1

Installation

OS: CentOS 7.4

Server: Nginx 1.12.2


Question: My nginx installation serves files without problem from the default directory, /usr/share/nginx/html. Unfortunately I get a 403 error when I use a new folder that I created, /www/html. What should I look for?

My permissions are identical for both folders although the owner is different.

Original default folder

drwxr-xr-x. 13 root root 155 Jan 8 09:25 usr

New default folder

drwxr-xr-x. 3 first first 18 Jan 15 10:45 www

I am using the stripped down nginx.conf file below and it works correctly.

events {}

http {

    server {
        listen       80;
        server_name  mydomain.com;
        root         /usr/share/nginx/html;
    }

}

However when I change nginx.conf to use this directory /www/html I get a 403 error.

Thanks for any help in advance! I'm a noob and not even sure where to look beyond file permissions.


UPDATE

SELinux is enabled in enforcing mode.

[first@centos-2gb-sfo1-01 log]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

2nd UPDATE I updated nginx.conf to include an error log.

events {}

http {

    server {
        listen       80;
        server_name  projournal.com;
        root         /www/html;
        error_log    /var/log/nginx.error.log;
    }

}

nginx.error.log was created in the correct directory but after several 403 errors it was still blank.

  • It's probably permissions - the user running as Nginx probably doesn't have permission to read from the new folder. Please edit your question to include the Nginx configuration that works and the one that doesn't, and an Nginx error log that shows the error. – Tim Jan 15 '18 at 18:53
  • Do you have SElinux set to enforcing ? – user9517 supports GoFundMonica Jan 15 '18 at 19:39
  • Does the default directory contain an index file while your new folder does not? – FrankZ Jan 15 '18 at 20:09
  • 1
    SELinux is additional security for linux. Maybe you can share the result of command 'ls -Z /path/to/your/folder'? To check if it's because selinux disable it first by using 'setenforce 0' then access the web again. And please add error_log in the configuration as @mjb2km suggest. – Ilham Sulaksono Jan 16 '18 at 2:02
  • 1
    Use /srv/www instead, to avoid SELinux issues like this. – Michael Hampton Jan 16 '18 at 4:49
3

With SELinux enforcing, httpd will be denied access to /www/html as files will not have the correct context.

matchpathcon /www/html
/www/html       system_u:object_r:default_t:s0

If you really want to use /www/html then you can add an appropriate path context to the database

semanage fcontext -a -t "httpd_sys_content_t" /www/html(/.*)?

There are though a number of default locations that can be used that already have the correct context already defined e.g. /var/www/html, /srv/www etc.

As you created /srv/www, you need to initially set it's SELinux context after which (normally) any new files and directories will have the correct context.

restorecon -v /srv/www

Will 'fix' /srv/www. You have though already populated /srv/www so you will need to set the file contexts for the whole tree

restorecon -Rv /srv/www

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.