Apache2 virtual host cgi 403 Forbidden /

mossy · 04-13-2004, 10:17 PM

got this issue...

Apache2 virtual host cgi 403 Forbidden /

domain.com, www.domain.com, and mail.domain.com all work with dns.
I added a virtual host listing in Vhost file:
mail.domain.com should go to: http://domain.com/cgi-bin/openwebmail/openwebmail.pl

==
ERROR:
Forbidden
You don't have permission to access / on this server.
--------------------------------------------------------------------------------

Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6mdk) Server at mail.xdomainx.com Port 80
==

Prolly cos of the Userdir directives but not sure how to modify it, or should I try the Docroot as starting from /cgi-bin/openwebmail/openwebmail.pl ??
It is currently set as /var/www/cgi-bin... ...et cetera

[edit]
exact entry in vhost.conf:
NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.domain.com
ServerAlias domain.com
DocumentRoot /var/www/html/
</VirtualHost>

<VirtualHost *:80>
ServerName mail.domain.com
DocumentRoot /cgi-bin/openwebmail/openwebmail.pl
</VirtualHost>

======
tried these;
DocumentRoot /cgi-bin/openwebmail/openwebmail.pl
DocumentRoot /var/www/cgi-bin/openwebmail/openwebmail.pl
DocumentRoot /cgi-bin/openwebmail/

error: 403 Forbidden.

do I need to change anything to /etc/hosts:
127.0.0.1 localhost
192.168.0.75 mail.domain.com mail
==

NS: http://domain.com/cgi-bin/openwebmail/openwebmail.pl works fine by iitself.

david_ross · 04-14-2004, 02:18 PM

DocumentRoot must be a directory and use a full system path.

You can set the default file that is accessed by modifying DirectoryIndex.

You will most likely need to create a Directory entry for the mail folder and add ExecCGI to the Options directive to allow the scripts to be run.

mossy · 04-14-2004, 02:29 PM

yes - I did something similiar already but still having the same problem - I will post the changes I made last night when I get home from work [my company cut off my remote ssh access and threatens zero tolerance for getting caught, the bolloxes]. I will post the entries when I get home tonight. Thanks for the help.

mossy · 04-14-2004, 05:09 PM

thanks for the help...

NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.domain.com
ServerAlias domain.com
DocumentRoot /var/www/html/
</VirtualHost>

#<VirtualHost *:80>

#ServerName mail.domain.com
#DocumentRoot /var/www/cgi-bin/openwebmail/
#ServerAlias mail.domain.com
#</VirtualHost>
#
#took that out
#
#tried several variations of this below
#
<VirtualHost *:80>
#ServerAdmin mossy@domain.com
#DocumentRoot /cgi-bin/openwebmail/openwebmail.pl
ServerName mail.domain.com
#ServerAlias mail.domain.com
ScriptAlias localhost.localdomain "/cgi-bin/openwebmail/openwebmail.pl"
#ScriptAlias mail.domain.com "/cgi-bin/openwebmail/openwebmail.pl"
AddHandler cgi-script .cgi .pl
Alias /data "/var/www/data"
<Directory "/cgi-bin/openwebmail/openwebmail.pl">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>
</VirtualHost>

mossy · 04-14-2004, 07:13 PM

I will add something like this too when I get the chance:
DirectoryIndex -Index
and or
DirectoryIndex .cgi .pl
AddHandler cgi-script cgi pl
Options ExecCGI

david_ross · 04-15-2004, 12:51 PM

Try this:

Code:

<VirtualHost *:80>
   ServerAdmin mossy@domain.com
   DocumentRoot /var/www/cgi-bin/openwebmail/
   ServerName mail.domain.com

   <Directory "/var/www/cgi-bin/openwebmail/">
      AllowOverride None
      Options ExecCGI
      DirectoryIndex openwebmail.pl
      Order allow,deny
      Allow from all
   </Directory>
</VirtualHost>

mossy · 04-15-2004, 06:00 PM

thanks david_ross ~

Now it tries to download the cgi-script:

Message:
You have chosen to open from http://mail.domain.com/
which is a: application/x-perl
and then it asks if I want to open with an application or download it.

current Vhost.conf

Code:

NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.domain.com
ServerAlias domain.com
DocumentRoot /var/www/html/
</VirtualHost>
#
#
#
<VirtualHost *:80>
   ServerAdmin mossy@domain.com
   DocumentRoot /var/www/cgi-bin/openwebmail/
   ServerName mail.domain.com
   <Directory "/var/www/cgi-bin/openwebmail/">
      AllowOverride None
      Options ExecCGI
      DirectoryIndex openwebmail.pl
      Order allow,deny
      Allow from all
   </Directory>
</VirtualHost>
#

wondering if it is anything to do with the " *:80" ?

also I will try adding:

AddHandler cgi-script cgi pl

and play with it alittle when I get time.

mossy · 04-16-2004, 01:59 AM

Code:

NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.domain.com
ServerAlias domain.com
DocumentRoot /var/www/html/
</VirtualHost>
                                                                                                                                                            #
#
<VirtualHost *:80>
   ServerAdmin mossy@domain.com
   DocumentRoot /var/www/cgi-bin/openwebmail/
   ServerName mail.domain.com
   <Directory "/var/www/cgi-bin/openwebmail/">
      AllowOverride None
      Options ExecCGI
      AddHandler cgi-script cgi pl
      DirectoryIndex openwebmail.pl
      Order allow,deny
      Allow from all
   </Directory>
</VirtualHost>

It will now open the script. Thank you very much. I am going to affero you.

On another note my end result is not achieved. I should have realized this beforehand. Argh!

I guess basically what I am trying to do is make:

mail.domain.com = http://domain.com/cgi-bin/openwebmail/openwebmail.pl

The reason for this is that postfix and openwebmail both work off the $domain.
Currently I access webmail at http://domain.com/cgi-bin/openwebmail/openwebmail.pl and it sends/recieves fine.

If I access it as mail.domain.com with the vhost it goes to http://mail.domain.com/cgi-bin/openw...openwebmail.pl

This means that the sender/from field is then mossy@mail.domain.com which does not work when people reply to it.
It will send tho. Another wierd thing is that alot of the icons don't follow thru. The webmail layout, email and listings are all beginning with "search".
That never happened when I used to access it straight with mail.domain.com/cgi-bin/cgi-bin/openwebmail/openwebmail.pl until the Vhost addition.
[I guess to make that work I would have to specify the icon dirs etc etc but anyway].

So end result - I am not sure how to proceed.
Will a redirect work? Forwarder? Alias?
Do you have any ideas?

http://mail.domain.com should go to http://domain.com/cgi-bin/openwebmail/openwebmail.pl

that way users will only have to type mail.domain.com and it will forward to the openwebmail.

Thanks again.

david_ross · 04-16-2004, 01:39 PM

I think for what you are trying to achieve a redirect would be better - even if it is just a meta tag in an html page. I haven't really used openwebmail so I'm not sure about the domain problem in the e-mail so a redirect will probably be easier.

mossy · 04-16-2004, 01:53 PM

ok no problem david_ross - I now know how to make various vhosts and that was important. I'll post a brand new question to get some ideas on which is the best way to do this.

david_ross · 04-16-2004, 01:58 PM

For redirecting you can just create a basic html page with a redirect as described here:
http://www.seologic.com/faq/meta-refresh-tag.php

mossy · 04-16-2004, 02:37 PM

yeah sounds good. I was initially wondering about the time involved in a redirect but I can adjust that apparently. kewl. I will give that a shot and test it.

Hey I was also wondering about security and locking down the cgi properly.

are the permissions we set on the cgi secure?

Code:

Order allow,deny
      Allow from all

Do you happen to know what the "allow,deny" bit means exactly?

On the Apache site they have a very low opinion of cgi regarding security.
If your up on that can you tell me the main weaknesses - Is it the scripts themselves or the fact of opening up another directory with the permissions above?

PS: How's the weather over there in the fine land of Scotland?

Thanks for all you help.
Cheers.

david_ross · 04-16-2004, 03:02 PM

The allow and deny options allow you to restrict access to specific IP addresses - the apache docs can explain much better than me:
http://httpd.apache.org/docs-2.0/mod...ess.html#order

Any sort of application that is run on a machine is liable to increase the chance of a security hole. On a website you are generally letting any user run these programs at their will so they are much more exposed that shell applications. If a malicous user finds a security hole in a web based script they can exploit it on any system that is running it.

We've actually had pretty good weather the last few days. I just hope it keeps up so I can get a few rounds of golf this weekend

mossy · 04-16-2004, 04:32 PM

thanks.

mossy · 04-16-2004, 05:58 PM

man, set it up in less than 3 mins, works great set to 1 sec.
I was way over complicating things. I really should have stuck to my first instinct in the beginning to just a redirect.
Then I read up on vhost and thought bingo! Well actually It did need the vhost too.
I will consider setting the timer to 0 as google is not an issue with the webmail. Jees all this time I was wreck'in me head on that cgi vhost.

I just created a simple index.html with the 1 liner redirect and a simple vhost - boom - she's up. Thanks for all you help.