apache issue, symbolic links, pages denied

plisken · 03-22-2014, 04:18 AM

I'm having a head scratching moment, in my httpd.conf file I have the following standard config:

Code:

DocumentRoot "/srv/httpd/htdocs"
<Directory "/srv/httpd/htdocs">
SymLinksifOwnerMatch ExecCGI MultiViews
Options Indexes FollowSymLinks MultiViews
AllowOverride AuthConfig
		
Require all granted
</Directory>

(note removed comments)

So my document root is /srv/httpd/htdocs but since I have been using /var/www/htdocs for like years on other server, I want the same, so done symbolic links which are like so:

Code:

root@orion:/srv# dir -al
total 1
drwxr-xr-x  2 root root  96 Dec 15 17:37 .
drwxr-xr-x 23 root root 536 Mar 22 08:51 ..
lrwxrwxrwx  1 root root   8 Dec 15 17:37 httpd -> /var/www
lrwxrwxrwx  1 root root   8 Dec 15 17:37 www -> /var/www

All ok???
(my /var/www contains htdocs btw)

but when trying to access a file within this root I am denied and my apache error log shows:

Code:

[Sat Mar 22 09:08:26.687884 2014] [authz_core:error] [pid 14751:tid 140449432102656] [client 212.159.180.202:54076] AH01630: client denied by server configuration: /var/www/htdocs/

If however I change the document root line in httpd.conf to read /var/www/htdocs instead of /srv/httpd/htdocs but I DONT want to do this, surly the symbolic links should work, even mentions so in the apache comments.

Additionally, if I change the first/global config of the httpd.conf file from

Code:

<Directory />
    AllowOverride none
    Require all denied
</Directory>

TO

Code:

<Directory />
    AllowOverride none
    Require all granted
</Directory>

it works, so guessing its something to dow ith the symbolic links?

yo8rxp · 03-22-2014, 06:45 AM

if temporary change /var/www permission recursively to 777 , what happens then ?

bathory · 03-22-2014, 10:06 AM

Quote:

SymLinksifOwnerMatch ExecCGI MultiViews
Options Indexes FollowSymLinks Mul0tiViews

The above is wrong. I guess you're using:

Code:

Options Indexes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews

Remove "SymLinksifOwnerMatch" because you'll get a 403 if the link owner is not the same as for the target
Also since you're a using a directory outside DocumentRoot add:

Code:

<Directory "/var/www/htdocs">
 Require all granted
</Directory>

Regards

plisken · 03-22-2014, 10:25 AM

Quote:

Originally Posted by yo8rxp

if temporary change /var/www permission recursively to 777 , what happens then ?

same problem, no difference...

@bathory I already have

Code:

DocumentRoot "/srv/httpd/htdocs"
<Directory "/srv/httpd/htdocs">
SymLinksifOwnerMatch ExecCGI MultiViews
Options Indexes FollowSymLinks
AllowOverride AuthConfig
		
Require all granted
</Directory>

and have symbolic links to /var/www/htdocs which is where my problem is

bathory · 03-22-2014, 10:57 AM

Maybe I didn't make myself clear.
You should remove "SymLinksifOwnerMatch" from the DocumentRoot Directory definition and also grant access to /var/www/html:
DocumentRoot "/srv/httpd/htdocs"

Code:

<Directory "/srv/httpd/htdocs">
Options Indexes FollowSymLinks ExecCGI MultiViews
AllowOverride AuthConfig
Require all granted
</Directory>

<Directory "/var/www/htdocs">
 Require all granted
</Directory>

plisken · 03-22-2014, 11:32 AM

@bathory Sorry, my mistake!! (cut and paste errors)

My actual httpd.conf file looks like:

Code:

DocumentRoot "/srv/httpd/htdocs"
<Directory "/srv/httpd/htdocs">
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>

I know adding:

Code:

<Directory "/var/www/htdocs">
 Require all granted
</Directory>

works but thought that having symbolic links as earlier in the thread would have been all that was required? since /srv/httpd/htdocs points/links to /var/www/htdocs

from the httpd.conf file iteslf:

Code:

#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.

I hope I'm making sense

bathory · 03-22-2014, 12:26 PM

Quote:

My actual httpd.conf file looks like:
Code:

DocumentRoot "/srv/httpd/htdocs"
<Directory "/srv/httpd/htdocs">
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>

Then it should work.
Are you sure you don't have another "Options ..." directive (maybe in a .htaccess file) that overrides the above

plisken · 03-22-2014, 12:55 PM

all clean

this one's got me stumped, obviously as a temp "work around", I'll add a config to /var/www/htdocs but really thought the symbolic links would be enough.

bathory · 03-22-2014, 01:10 PM

D'oh...
Make sure that whole directory tree /var/www/html has the execute bit set:

Code:

chmod +x /var /var/www /var/www/html

plisken · 03-22-2014, 01:49 PM

755

must be something to do with the sym links?

bathory · 03-22-2014, 03:07 PM

Quote:

Originally Posted by plisken

755

must be something to do with the sym links?

Accoding to your 1st post they look correct. What gives:

Code:

ls -ld /srv /srv/httpd /srv/httpd/htdocs

yo8rxp · 03-22-2014, 03:13 PM

try this

Code:

DocumentRoot /srv/httpd/htdocs
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /srv/httpd/htdocs/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

look for .htaccess in htdocs folder and make sure it aint messing up things
is any virtual hosts enabled in apache2.conf ? if so check 000-default configuration , not to override httpd.conf

my raspberry PI works flawlessly upon symlinks , as I deleted /var/www/ folder and ln -s /home/gabriel/www www

plisken · 03-22-2014, 07:29 PM

Quote:

Originally Posted by bathory

Accoding to your 1st post they look correct. What gives:

Code:

ls -ld /srv /srv/httpd /srv/httpd/htdocs

Code:

ls -ld /srv /srv/httpd /srv/httpd/htdocs

gives

Code:

drwxr-xr-x 2 root root    72 Mar 22 18:55 /srv
lrwxrwxrwx 1 root root     8 Dec 15 17:37 /srv/httpd -> /var/www
drwxr-xr-x 6 root apache 296 Mar 22 19:49 /srv/httpd/htdocs

(note: the htdocs from above shows /var/www/htdocs)

ls /var/www -al gives:

Code:

 ls /var/www -al
total 11
drwxr-xr-x 13 root apache  464 Jan  3 13:03 .
drwxr-xr-x 20 root root    536 Dec 21 15:42 ..
drwxr-xr-x  8 root apache  480 Jan  3 13:02 cgi-bin
drwxr-xr-x  3 root apache  976 Aug  5  2013 error
drwxr-xr-x  6 root apache  296 Mar 22 19:49 htdocs
drwxr-xr-x  3 root apache 5216 Aug  5  2013 icons
-rwxr-xr-x  1 root apache   35 Jan  3 12:57 robots2.txt
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www.*[removed].co.uk_
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www.*[removed].com
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www.*[removed].co.uk
drwxr-xr-x  5 root apache  160 Jan  3 12:56 www.*[removed].co.uk
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www.*[removed].com
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www.*[removed].co.uk
drwxr-xr-x  5 root apache  128 Jan  3 12:56 www_template

I'm giving up on this for the time being and just changing the document root to /var/www/htdocs as such, works as expected, when I've more time, I'll dig deeper, probably something simple but for sure this one got me...