This is my first time using Amazon EC2. I'm running a server with Apache 2.4.6 and I can't seem to get it working when I access the Public DNS or Elastic IP. The error message I get is:

Forbidden You don't have permission to access /index.html on this server.

I have checked the permissions of this file (755). I have a VirtualHost block in my httpd.conf file as follows:

Listen 80
NameVirtualHost *:80

<VirtualHost *:80>
    DocumentRoot "/var/www/html"
    ServerName my-ec2-public-dns-url
</VirtualHost>

My Security Group settings in AWS are set to Anywhere for both HTTP/HTTPS.

When I check the error log, it says: AH00132: file permissions deny server access: /var/www/html/index.html

Not sure what I am doing wrong. Thanks for your help.

  • FYI, this has nothing to do with EC2, so I removed that tag. – EEAA Dec 9 '14 at 22:40
  • @EEAA Okay, no problem. I thought it may be related due to the Security Group settings. Any idea how I can fix this issue? Thanks. – kaoscify Dec 9 '14 at 22:44
  • 3
    Security groups are a network level function, whereas the error you're getting is at the application level. – EEAA Dec 9 '14 at 22:45
  • What is the file's security context? – Michael Hampton Dec 9 '14 at 23:05
  • 2
    serverfault.com/a/487239/126632 When working on an SELinux-enabled system, you should always copy instead of moving files (and delete the original if necessary). – Michael Hampton Dec 9 '14 at 23:35
up vote 14 down vote accepted

Try check the existing permissions on the file:

ls -l index.html

Fix them if necessary:

chmod 644 index.html

If all the standard permissions are correct and you still get a Permission Denied error, you should check for extended-permissions. For example you can use the command setenforce 0 to turn off SELinux and check to see if the problem goes away. If so, ls -alZ can be used to view SELinux permission and chcon to fix them.

Eg:

sudo chcon -R -v -t httpd_sys_rw_content_t index.html
  • 2
    Thank you so much for your help. This was it. I just used the chcon command without turning off SELinux. Could elaborate more as to why this was needed? SELinux just added another layer of protection to the files? – kaoscify Dec 9 '14 at 23:29
  • 1
    SELinux is a set of kernel modifications and user-space tools. SELinux has a labeling system where every process and every object (files, directories, etc.) gets a label. Then a large rules database, called policy, is loaded into the kernel. The kernel, based on the policy, controls what each process can do based on its label, and the label of the object it is trying to access. For example SELinux allows a process with the Apache label (httpd_t) to share data labeled as "read/only Apache content" (httpd_sys_content_thttpd_sys_content_rw_t).See selinuxproject.org/page/Main_Page – Federico Sierra Dec 9 '14 at 23:37
  • 1
    There are numerous questions about 403 errors with Apache, and none of them mentioned SELinux as the cause of it. After an intense search I finally found this answer. Well done, Federico. – Gendarme Aug 14 '16 at 17:48
  • 1
    @mapr I found this source helpful to understand the basics of SELinux security context – the accountant Jul 13 at 0:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.