38

in Apache on Ubuntu I've set up a vhost, but in the browser I keep getting a "403 Access forbidden" error; the log says "Client denied by server configuration: /home/remix/".

Looking for the solution online I found many posts about the directory access (Allow from all, etc), but as far as I know I already did that. In httpd-vhosts.conf there is the following code:

NameVirtualHost *:80

<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot "/opt/lampp/htdocs/"
    ServerName localhost
    ServerAlias localhost
    ErrorLog "logs/dummy-host.example.com-error_log"
    CustomLog "logs/dummy-host.example.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot "/home/remix/"
    ServerName testproject
    ServerAlias testproject
    <Directory "/home/remix/">
        Options Indexes FollowSymLinks Includes ExecCGI
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

I've also added

127.0.0.1    testproject

to the /etc/hosts file.

Also, the /home/remix/ folder contains an index.html file and vhosts are enabled in httpd.conf.

Is there anything I'm not seeing?

Edit: This is the Apache error_log entry:

[Sat Aug 18 09:15:32.666938 2012] [authz_core:error] [pid 6587] 
[client 127.0.0.1:38873] AH01630: client denied by server configuration: /home/remix/
  • What's in Apache's error log? – Shane Madden Aug 17 '12 at 6:16
  • Ah, I thought I forgot something... I've added it to the original post. – RemiX Aug 18 '12 at 7:17
  • What version of Apache are you using? – Shane Madden Aug 18 '12 at 7:29
  • Apache/2.4.2 (Unix) – RemiX Aug 20 '12 at 7:09
64

Change your authorization configuration:

<Directory /home/remix/>
    #...
    Order allow,deny
    Allow from all
</Directory>

...to the Apache 2.4 version of the same.

<Directory /home/remix/>
    #...
    Require all granted
</Directory>

Review the upgrading overview document for information on other changes you might need to make - and be aware that most of the config examples and assistance that you find out there on Google (as well as on this site) is referring to 2.2.

  • 2
    If I had time, I'd log a bug about this because httpd -t says there's no problem using the older syntax, and neither does httpd -S. In my mind, the whole point of a configuration checker is that it should be pointing out problems! ...If you have a directory you're referencing w/o this, it won't work - simple as that. ...Thumbs up on the answer. – Richard T Apr 12 '15 at 23:36
4

Check the permissions on the directory. I would bet that it's set to deny access to anyone but yourself, for instance:

$ ls -ld /home/remix
drwx------ 92 remix remix 4096 Aug 17 22:59 /home/remix

If you see drwx------ exactly, then this is the case. Fix it by running:

chmod a+x /home/remix
  • I see: drwxrwxr-x 2 remix remix 4096 Aug 16 09:36 /home/remix. I tried the command anyway, without effect. – RemiX Aug 18 '12 at 7:26
  • Ahh, can't win 'em all. – Michael Hampton Aug 18 '12 at 7:28
3

Make sure that the user who is running httpd service has access to this directories.

  • I'm not sure who the user for httpd is or how to check, but everyone can read (user/group/other). – RemiX Aug 18 '12 at 7:24
  • Check httpd.conf for User param. – cpt.Buggy Aug 18 '12 at 12:08
  • 1
    Ok it says 'User nobody', and 'Group nogroup'. I tried changing it to 'User remix' (which is the owner of the folder), but even that won't help. – RemiX Aug 20 '12 at 7:06
1

"client denied by server configuration" means that the Linux server itself forbids the access to the file, not Apache.

If providing access through changing permissions / ownership / group membership does not solve the problem, the route cause may be SELinux forbidding the access to any folder which has not the appropriate SE Linux context as explained in 'Relocating an Apache DocumentRoot under Selinux'.

  • If temporarily disabling SELinux by doing setenforce 0 makes the file accessible
  • Whereas re-enabling SELinux by doing setenforce 0 makes again the file not accessible

Then for sure the access is forbidden by SELinux whatever the file permissions are.

0

Another simple (but tricksy gotcha) that might cause this problem for people is when user directories are not in /home/* But somewhere else e.g. /nethome/*

The supplied userdir.conf contains something like this: (but with Userdir: disabled)

$ cat /etc/httpd/conf.d/userdir.conf 
<IfModule mod_userdir.c>
    UserDir enabled
    UserDir public_html
</IfModule>

<Directory "/home/*/public_html">
    AllowOverride FileInfo AuthConfig Limit Indexes
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    Require method GET POST OPTIONS
</Directory>

The Directory specification assumes ~user == /home/user. Just change or add Directory specification for where the user home directories actually are.

Pretty of obvious but took me a while to figure out!! :-P DUH!

e.g. ~user == /nethome/user

<Directory "/nethome/*/public_html">
    AllowOverride All
    Options MultiViews Indexes Includes FollowSymLinks
    Require all granted
</Directory>

See also more open authorisation on that Directory generally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.