0

I am trying to spin up a webserver using CentOS 6 and Apache. The files for the websites are hosted in a Windows file share. Here is the line from the fstab file to mount the web files: \\192.168.1.10\apache /var/www/html cifs credentials=/root/secret.txt,uid=apache,gid=apache 0 0. This seems to be working fine.

Here is the vhost.conf file:

Listen 80
<VirtualHost *:80>
    ServerAdmin webmaster@domain.com
    ServerName sub.domain.com
    DocumentRoot "/var/www/html/domain.com/sub/public_html"
    #ErrorLog /var/www/html/domain.com/sub/logs/error.log
    #CustomLog /var/www/html/domain.com/sub/logs/access.log combined
</VirtualHost>

I ran the command ls -l /var/www/html/domain.com/sub/public_html and here is the output:

total 1
-rwxr-xr-x. 0 apache apache  0 Jan 26 20:43 index2.txt
-rwxr-xr-x. 0 apache apache 45 Jan 26 19:33 index.html

Command ls -l /var/www/html/domain.com/sub output is:

total 0
drwxr-xr-x. 0 apache apache 0 Jan 26 20:00 logs
drwxr-xr-x. 0 apache apache 0 Jan 26 20:43 public_html

When I go to http://sub.domain.com, I get the generic Apache screen. On a whim, I went to the URL http://sub.domain.com/index.html; and the browser said I don't have permission to access the page--same thing for http://sub.domain.com/index2.txt. For the URL http://sub.domain.com/index2.html, the browser said the file does not exist. That tells me my 'fingers' are all pointing in the right directions. Any idea what my problem might be?

The log lines in the vhost.conf file are commented out because httpd would not restart with those. I think it is the same problem.

10
  • 1
    Checking the server log files should always be the first step in trouble-shooting. I’d suggest that you edit the question to include corresponding lines from Apache’s error.log. The output of apachectl -S can also be useful for ensuring virtual sites are configured correctly. – Anthony Geoghegan Jan 27 '17 at 14:07
  • I suggest you add the logs back again, only with new files outside the shared folder. – yunzen Jan 27 '17 at 14:17
  • 3
    Do you have SELinux in use? – yunzen Jan 27 '17 at 14:22
  • 2
    I think you should check the permissions set with SELinux. – yunzen Jan 27 '17 at 15:18
  • 1
    As @AnthonyGeoghegan say check the server error log, and permissions.. unix permissions does not consist only on the destination permissions, the whole path should need at least search permissions if this is a problem in which Apache complains about not having permissions to read. SELInux could very well be the cause of your issues too. – ezra-s Jan 27 '17 at 15:42
3

Since there are no obvious problems with the Apache settings themselves, it must be a problem with the permissions set by the OS.

Apache requires that the apache user has access to the parent directories as well.

Since CentOS comes with SELinux, this could be the problem as well. Maybe you did not make an active setting of permissions with SELinux, but Linux itself has default SELinux settings for remote mounts.

You can check with ls -Z.

Here is an interesting OP in askubuntu: https://askubuntu.com/questions/451922/apache-access-denied-because-search-permissions-are-missing

1

We can see in your question that you are running SELinux and have attempted to have Apache read web content from a CIFS share. By default this is not permitted by SELinux, but you can enable it by setting the appropriate boolean.

setsebool -P httpd_use_cifs 1
4
  • This may work, but it was not necessary. I added a context parameter to the fstab command. – Andrew Jan 30 '17 at 13:23
  • @Andrew That's another way to do it, though I'm confused why you haven't posted an answer with this information, and why you accepted an answer completely unrelated to the solution. – Michael Hampton Jan 30 '17 at 13:25
  • In the comments of my question yunzen's comments pointed me in the direction of SELinux which got my research in the direction I needed. I said I would give him credit if he wrote an answer. But you are correct, his response does not really answer the question. I will write an answer summarizing what I did. – Andrew Jan 30 '17 at 13:31
  • @Andrew Aha. Comments are temporary, and some people don't see them anyway. So as a rule, everything relevant to understanding the question should be edited into the question. – Michael Hampton Jan 30 '17 at 13:33
1

The problem was with SELinux. The way I mounted the share, the SELinux security context would not allow Apache to access the files in the share. The example at SELinux How Tos just happened to be for Apache.

I used the command ls -Z, not just ls -l, and I saw the SELinux security context of the mounted files were wrong. I changed the line in the fstab file to

\\192.168.1.100\apache /var/www/html cifs credentials=/root/apache.pass,uid=apache,gid=apache,context=‌​system_u:object_r:ht‌​tpd_sys_content_t:s0 0 0

This added context parameter I needed for SELinux to allow Apache to access the files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.