0

I am trying to spin up a webserver using CentOS 6 and Apache. The files for the websites are hosted in a Windows file share. Here is the line from the fstab file to mount the web files: \\192.168.1.10\apache /var/www/html cifs credentials=/root/secret.txt,uid=apache,gid=apache 0 0. This seems to be working fine.

Here is the vhost.conf file:

Listen 80
<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName sub.domain.com
    DocumentRoot "/var/www/html/domain.com/sub/public_html"
    #ErrorLog /var/www/html/domain.com/sub/logs/error.log
    #CustomLog /var/www/html/domain.com/sub/logs/access.log combined
</VirtualHost>

I ran the command ls -l /var/www/html/domain.com/sub/public_html and here is the output:

total 1
-rwxr-xr-x. 0 apache apache  0 Jan 26 20:43 index2.txt
-rwxr-xr-x. 0 apache apache 45 Jan 26 19:33 index.html

Command ls -l /var/www/html/domain.com/sub output is:

total 0
drwxr-xr-x. 0 apache apache 0 Jan 26 20:00 logs
drwxr-xr-x. 0 apache apache 0 Jan 26 20:43 public_html

When I go to http://sub.domain.com, I get the generic Apache screen. On a whim, I went to the URL http://sub.domain.com/index.html; and the browser said I don't have permission to access the page--same thing for http://sub.domain.com/index2.txt. For the URL http://sub.domain.com/index2.html, the browser said the file does not exist. That tells me my 'fingers' are all pointing in the right directions. Any idea what my problem might be?

The log lines in the vhost.conf file are commented out because httpd would not restart with those. I think it is the same problem.

Improve this question
10
  • 1
    Checking the server log files should always be the first step in trouble-shooting. I’d suggest that you edit the question to include corresponding lines from Apache’s error.log. The output of apachectl -S can also be useful for ensuring virtual sites are configured correctly.
    – Anthony Geoghegan
    Jan 27, 2017 at 14:07
  • I suggest you add the logs back again, only with new files outside the shared folder.
    – yunzen
    Jan 27, 2017 at 14:17
  • 3
    Do you have SELinux in use?
    – yunzen
    Jan 27, 2017 at 14:22
  • 2
    I think you should check the permissions set with SELinux.
    – yunzen
    Jan 27, 2017 at 15:18
  • 1
    As @AnthonyGeoghegan say check the server error log, and permissions.. unix permissions does not consist only on the destination permissions, the whole path should need at least search permissions if this is a problem in which Apache complains about not having permissions to read. SELInux could very well be the cause of your issues too.
    – Daniel Ferradal
    Jan 27, 2017 at 15:42

3 Answers 3

Reset to default
3

Since there are no obvious problems with the Apache settings themselves, it must be a problem with the permissions set by the OS.

Apache requires that the apache user has access to the parent directories as well.

Since CentOS comes with SELinux, this could be the problem as well. Maybe you did not make an active setting of permissions with SELinux, but Linux itself has default SELinux settings for remote mounts.

You can check with ls -Z.

Here is an interesting OP in askubuntu: https://askubuntu.com/questions/451922/apache-access-denied-because-search-permissions-are-missing

Improve this answer
1

We can see in your question that you are running SELinux and have attempted to have Apache read web content from a CIFS share. By default this is not permitted by SELinux, but you can enable it by setting the appropriate boolean.

setsebool -P httpd_use_cifs 1
Improve this answer
4
  • This may work, but it was not necessary. I added a context parameter to the fstab command.
    – Andrew
    Jan 30, 2017 at 13:23
  • @Andrew That's another way to do it, though I'm confused why you haven't posted an answer with this information, and why you accepted an answer completely unrelated to the solution.
    – Michael Hampton
    Jan 30, 2017 at 13:25
  • In the comments of my question yunzen's comments pointed me in the direction of SELinux which got my research in the direction I needed. I said I would give him credit if he wrote an answer. But you are correct, his response does not really answer the question. I will write an answer summarizing what I did.
    – Andrew
    Jan 30, 2017 at 13:31
  • @Andrew Aha. Comments are temporary, and some people don't see them anyway. So as a rule, everything relevant to understanding the question should be edited into the question.
    – Michael Hampton
    Jan 30, 2017 at 13:33
1

The problem was with SELinux. The way I mounted the share, the SELinux security context would not allow Apache to access the files in the share. The example at SELinux How Tos just happened to be for Apache.

I used the command ls -Z, not just ls -l, and I saw the SELinux security context of the mounted files were wrong. I changed the line in the fstab file to

\\192.168.1.100\apache /var/www/html cifs credentials=/root/apache.pass,uid=apache,gid=apache,context=‌​system_u:object_r:ht‌​tpd_sys_content_t:s0 0 0

This added context parameter I needed for SELinux to allow Apache to access the files.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .