Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been trawling the internet for a few days now and think I've tried almost everything to get some virtual hosts set up on my Ubuntu server but everything short of chmod 777 on the webroot fails.

I have my default Apache conf pointing at /home/server/public_html with the the settings show below

<VirtualHost *:80>
    ServerAdmin webmaster@localhost

    DocumentRoot /home/server/public_html/
    <Directory />
            Options FollowSymLinks
            AllowOverride All
    </Directory>
    <Directory /home/server/public_html/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
            Order allow,deny
            Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
    Allow from all
</Directory>

</VirtualHost>

I have then created a virtual host for a project I'm working on say for example project.name.co.uk.conf and inside there I have the following

<VirtualHost *:80>
    ServerName http://www.local.dirty-briefs.co.uk
    ServerAlias local.project-name.co.uk
    DocumentRoot /home/server/public_html/project-name/
    DirectoryIndex index.php index.html
</VirtualHost>

I then ran sudo a2ensite project.name.co.uk.conf. I'm working on a windows 7 machine using samba to access the files on the server. I added the project.name.co.uk to my windows hosts file however not matter what I do I get 403 permission errors.

edit

Thought id add the tail of the Apache error log in case it was useful

*==> /var/log/apache2/error.log <==
[Sat Jun 11 13:22:23 2011] [error] [client 192.168.0.3] PHP Warning:          require(/home/server/public_html/dirty-briefs/site/protected/config/main.php): failed to open stream: Permission denied in /home/server/public_html/dirty-briefs/framework/base/CApplication.php on line 120
[Sat Jun 11 13:22:23 2011] [error] [client 192.168.0.3] PHP Fatal error:  require(): Failed opening required '/home/server/public_html/dirty-briefs/site/protected/config/main.php' (include_path='.:/usr/share/php:/usr/share/pear') in /home/server/public_html/dirty-briefs/framework/base/CApplication.php on line 120*

It may also be worth mentioning I'm working with Yii the PHP framework I have a .htaccess file that lives in my site folder with the following inside

    # Disable directory browsing
    Options All -Indexes

    # File types
    AddType application/x-font-woff .eot .ttf       # Font-Face


    # URL Rewriting
    <IfModule mod_rewrite.c>
    RewriteEngine On

    # Site Maintenance
    # RewriteCond %{REMOTE_ADDR} !^10\.0\.2\.2
    # RewriteCond %{REQUEST_FILENAME} !-f
    # RewriteRule ^(.*)$ /maintenance.html [L]


    # LOCAL 
    RewriteCond %{SERVER_NAME} ^local.project-name.co.uk
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.*)$ /index-local.php/$1
    # -----

    # PRODUCTION
    RewriteCond %{HTTP_HOST} ^project-name.co.uk
    RewriteRule ^(.*)$ http://www.project-name.co.uk/$1 [R=301,L]

    RewriteCond %{SERVER_NAME} ^www.project-name.co.uk
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.*)$ /folder/index.php/$1
    # -----
    </IfModule>

I tailed the Apache error and access logs and found I was getting perm errors on importing files inside my PHP script due to permission errors.

I have read about checking what user and group Apache is running under, which are www-data www-data so I'm guessing Apache basically doesn't have perms to access the files under /home/server/public_html unless I give the folder 777 perms which I don't want so I'm just wondering if anyone can spot what I'm doing wrong or advise on anything I can try to get this working

share|improve this question
    
Please post ls -l /home and ls -l /home/server –  Michael Jun 11 '11 at 12:53

4 Answers 4

This folder layout is a litle confusing. Your default vhost directive specifes /home/server/public_html/ as the DocumentRoot, but then you specify a subfolder of it as the root of your application. This isn't an optimal configuration. Try moving the site out of public_html into its own folder (/home/server/project or somesuch) and setting the DocumentRoot accordingly.

Once it's moved, you don't need 777 permissions to make it accessible, though it does need to be readable by www-data. Try:

chmod -R 644 /home/server/project   
find /home/server/project -type d -exec chmod 755 {} \+

This will make everything world-readable and all the folders traversable (setting the execute bit on folders does this).

One other thing: ServerName doesn't use the http:// prefix. You should remove that from the configuration and leave just the domain name.

Restart your apache after this changes and you should be able to reach the site with your given host name.

share|improve this answer
    
Hey thanks for your amazing answer!! The reason i had the projects under public_html was just so everything was organised, maybe public_html was a bad name but would you still suggest i moved them out into the root under /home/server then point the DocumentRoot of my virtualHost at /home/server/project-name/ in turn should i then point the default at /home/server ? –  Mike Waites Jun 11 '11 at 13:07
    
Certainly, keeping all of your sites in one location is no bad thing, but the default DcoumentRoot doesn't need to be (and shouldn't be) a parent of the other vhost roots. Remember: any requests for domains that don't match the ServerName or ServerAlias of your vhosts will be served by the default one. With your original setup, it might be possible for people to subvert security measures in the sub-vhost by accessing the same files though the parent one. –  SmallClanger Jun 11 '11 at 13:16
    
Ah ok thanks for clearing that up for me, so perhaps what ill do is revert the default back to /var/www/ then create virtual hosts to point to /home/server/sites/project-name Ill have a go at that now and let you know the outcome, Thanks again! –  Mike Waites Jun 11 '11 at 13:23
    
chmod -R 644 /home/server/project when running that is it weird that i need sudo i mean i dont think it is but as i step through this i just wanna make sure im not missing something causing the problem you know –  Mike Waites Jun 11 '11 at 13:43
    
YOU LEGEND!! That worked a treat –  Mike Waites Jun 11 '11 at 13:51

You can give Apache the right to access the files without setting them to world-can-do-everything (rwxrwxrwx or 777), you would only need to give it permission to read the files so that the PHP executable can read them. You may need to give execution rights too if PHP checks for that. The better way would be to change ownership with chown www-data:www-data <file> then you can give Apache full rights and no rights to anyone else (except root) with chmod 700 (or chmod u+rwx <file>; chmod go-rwx <file> if you prefer to use mnemonic codes rather than the bit-pattern based ones).

If you have other sites running from the same Apache install (and so also running as www-data) and you want to keep them separated s one site is to some extent protected by the others, then look into using suPHP (as provided by this package in Ubuntu). It is less efficient than the bog-standard mod_php (though not by much unless you are on severely constrained hardware) but gives you that extra layer of protection between users/sites by making it harder for them (accidentally or otherwise) to affect each other or read each other's stuff. Each script gets run by a process acting as the user that owns it, so a php file owned by user1 gets run as user1 and no other user (even www-data or what-ever scripts usually run as) needs to have any access to it. You may encounter other permissions errors from suphp until you have things set right, as it defaults to insisting certain security checks pass (like directories and scripts not being world writeable) before running any script.

ps. re: require(/home/server/public_html/dirty-briefs/site/protected/config/main.php): failed - coffee stained meeting briefing notes, or something else?!

share|improve this answer

You probably need execute access on /home/server so the Apache user can traverse inside it to read the public_html folder (which should be other-readable).

# If not already drwx--x--x...
chmod o+x /home/server
share|improve this answer
    
Hey Thanks for the reply i had the relevant perms set for those folders –  Mike Waites Jun 11 '11 at 13:08

It is probably a seLinux problem.

EDIT:

To be sure you can set seLinux to permissive mode and try again. If you were working on RedHat I would recommend using system-config-selinux but I dont know a tool for that in Ubuntu

share|improve this answer
    
And would you elaborate on how to fix the problem, rather than just blaming something? –  Ben Pilbrow Jun 11 '11 at 12:53
    
I cannot without access to the server. I guess knowing the problem will help. –  Cem Kalyoncu Jun 11 '11 at 12:56
    
Before down voting make sure that some one else is talking about same issue with better answer. –  Cem Kalyoncu Jun 11 '11 at 12:58
    
the downvote was probably not because who-ever voted didn't think it was an selinux issue (though it most likely isn't IMO), it is because answers of the form of your pre-edit answer ("It is probably an X problem.") are rarely useful to the question asker. Some more detail on how to verify that X is/isn't the issue and what might need to be done to address the problem if it is that, would make the response far more helpful. –  David Spillett Jun 11 '11 at 13:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.