Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just can't figure it out. I'm running apache2 on a Ubuntu 10.04 i386 server. Whenever I visit my server (has an IP address, and is connected to internet with static IP xxx.xxx.xxx.xxx) so that's not the problem) in browser, mysub.domain.edu (renamed here), I get the following:

Forbidden
You don't have permission to access /index.html on this server

The apache2 error log confirms this:

[Mon Apr 18 02:38:20 2011] [error] [client zzz.zzz.zzz.zzz] (13)Permission denied: access to / denied

I'll try to provide all necessary information below:

1) Contents of /etc/apache2/httpd.conf

DirectoryIndex index.html index.php

2) Contents of /etc/apache2/sites-available/default

<VirtualHost *:80>
ServerAdmin email@domain.com

DocumentRoot /home/myusername/htdocs
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
<Directory "/home/myusername/htdocs/">
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
order allow,deny
allow from all
DirectoryIndex index.html index.php
Satisfy any
</Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
ServerName mysub.domain.edu

</VirtualHost>

3) Contents of /etc/apache2/sites-enabled/000-default

<VirtualHost *:80>
ServerAdmin email@domain.com

DocumentRoot /home/myusername/htdocs
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
<Directory "/home/myusername/htdocs/">
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
order allow,deny
allow from all
DirectoryIndex index.html index.php
Satisfy any
</Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all 
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
ServerName mysub.domain.edu

</VirtualHost> 

4) Result of ls -l (when I'm using sudo -i to be root):

root@myserver:/home/myusername# ls -l
total 4
drwxr-xr-x 2 www-data root 4096 2011-04-18 03:04 htdocs

5) ps auxwww | grep -i apache

root@myserver:/home# ps auxwww | grep -i apache
root     15121  0.0  0.4   5408  2544 ?        Ss   16:55   0:00 /usr/sbin/apache2 -k start
www-data 15122  0.0  0.3   5180  1760 ?        S    16:55   0:00 /usr/sbin/apache2 -k start
www-data 15123  0.0  0.5 227020  2788 ?        Sl   16:55   0:00 /usr/sbin/apache2 -k start
www-data 15124  0.0  0.5 227020  2864 ?        Sl   16:55   0:00 /usr/sbin/apache2 -k start
root     29133  0.0  0.1   3320   680 pts/0    R+   16:58   0:00 grep --color=auto -i apache

6) ls -al /home/myusername/htdocs/

root@myserver:/# ls -al /home/myusername/htdocs/
total 20
drwxr-xr-x 2 www-data   root       4096 2011-04-18 03:04 .
drw-r--r-- 4 myusername myusername 4096 2011-04-18 02:13 ..
-rw-r--r-- 1 root       root         69 2011-04-18 02:14 index.html

I'm not currently using any .htaccess files in my web root (htdocs) folder in my user folder.

I don't know what is wrong, I've been trying to fix his for over 12 hours and I've gotten nowhere. If you have any suggestions, I'm all ears...

share|improve this question

migrated from stackoverflow.com Apr 18 '11 at 10:37

This question came from our site for professional and enthusiast programmers.

    
I assume you've tried reloading the apache conf? –  BlueEel Apr 18 '11 at 8:21
    
no, I haven't. do you mean just starting over from a blank /etc/apache2/apache2.conf? this is literally all I have in the file DirectoryIndex index.html index.php –  lollercoaster Apr 18 '11 at 18:46
    
Can you also post the output of ls -al /home/myusername/htdocs/? Also the output of ps auxwww | grep -i apache to confirm apache is running as www-data. Finally, are you sure www-data can cd into /home/myusername? It needs to do that in order to reach htdocs. Post ls -al /home if in doubt. –  Eduardo Ivanec Apr 18 '11 at 18:53
    
@eduardo i. done, it should be in the updated section also what is the -al flag? –  lollercoaster Apr 18 '11 at 21:04
    
nevermind, that's used to find out what user owns the folder. thanks a bunch though –  lollercoaster Apr 18 '11 at 22:06

4 Answers 4

up vote 1 down vote accepted

Make your /home/username and /home has the permissions 755

EDITL: I'll add onto here so its easier to read

You posted this:

drwxr-xr-x 2 www-data   root       4096 2011-04-18 03:04 .
drw-r--r-- 4 myusername myusername 4096 2011-04-18 02:13 ..

As you can see the /home/myusername folder has rw, r , r. You need to give "x" to that folder and the /home folder

chmod o+x /home
chmod o+x /home/myusername
share|improve this answer
    
root@myserver:/home/myusername# ls -l total 4 drwxr-xr-x 2 www-data root 4096 2011-04-18 03:04 htdocs –  lollercoaster Apr 18 '11 at 21:08
    
Your problem is right here: drwxr-xr-x 2 www-data root 4096 2011-04-18 03:04 . drw-r--r-- 4 myusername myusername 4096 2011-04-18 02:13 .. The folder above your htdocs folder (i.e your home directory) has the wrong permissions. You need the "x" permisson on both /home and /home/myusername because that is needed to traverse through the directory Run the command chmod o+x /home/myusername –  Pratik Amin Apr 18 '11 at 21:31
    
wow! that fixes it. I thought that www-data would only need +x on the htdocs folder...why does it need +x on home? –  lollercoaster Apr 18 '11 at 22:05
    
Its because the www-data user needs to go through both folders, without x on the upper folders it never gets to htdocs –  Pratik Amin Apr 18 '11 at 22:31

(this is more of a debugging suggestion, as I think that Pratik has answered the question with the +x)

The error you mention is a file system permission error, so unless your apache config file is redirecting/aliasing onto some restricted place in the file system, then your problem is with the permissions on the /home/myusername/htdocs directory, or the index.html file.

In order to see where your apache user is being denied, run the following command;

su -s /bin/bash apache

and then attempt to

cd /home/myusername/htdocs
share|improve this answer

I would always start with copying your configs into your home directory and 'apt-get purge apache2'.

Then re-install it and do a 'diff -y oldfile newfile' to see the changes. If bizarrely it's not configuration changes then it's permissions on your web root directory.

It'll only take a couple of minutes unless you have lots of vhosts.

share|improve this answer

BEWARE of bad advice about permissions. Generally you should NOT put 755 on your /home/username directory.

The correct permissions are documented in the httpd.conf file and I will paste the pertinent sections here:

# This usually means that ~userid  (/home/username for the lay person)
# must have permissions of 711

NOTE 711 on ~userid is recommended, please AVOID 755 for /home/username ( ~userid )!!!!!!!! ,

#~userid/public_html must have permissions"
# of 755"

~userid/public_html is ok to give 755, but if you give 755 to your ~userid folder EVERYONE on your system will be able to access your home folder and read your files and execute files in home, generally really BAD practice on a multi-user system. 711 avoids giving out read access to group and other

share|improve this answer
    
It might be worth explaining exactly what extra permission 755 gives a malicious user on your system compared to 711. The word access is rather vague and could be considered true for everything between 711 and 777. You could also explain what 711 still allows... for instance if you drop a world-readable privatekey.pem in your home directory, can the malicious user still read it if your home directory has mode 711? –  Ladadadada Oct 29 '13 at 12:47
    
711 on the home folder grants rwx on owner, folder navigation but no file access at all for group and other. It is the minimum access required for UserDir to work, allows apache to navigate without file access. It is recommended in this case –  Joseph Olstad Oct 30 '13 at 1:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.