[gentoo-user] Apache 2.4 can not access server subdirectory

[gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

After installing apache 2.4 I can not access server subdirectory:
server/admin/index.html

Forbiden
You don't have permission to access /admin/index.html on this server

I can access index.html in a directory below /admin (server/index.html)
but not the server/admin/index.html

I even change the permission on the index file:
-rwxrwxrwx  1 apache apache   428 Oct 28 16:44 index.html

I removed .htaccess from server/admin (it doesn't help)

In apache.conf

<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>


-- 
Thelma

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Remco Rijnders]

On Wed, Oct 28, 2020 at 10:36:12PM -0600, thelma wrote in 
<7b3d3416-77b0-02eb-ad05-f717fdf0b6a4@sys-concept.com>:
>After installing apache 2.4 I can not access server subdirectory:
>server/admin/index.html
>
>Forbiden
>You don't have permission to access /admin/index.html on this server
>
>I can access index.html in a directory below /admin (server/index.html)
>but not the server/admin/index.html

That seems to suggest that either the permissions or ownership of
admin/index.html are different from admin/server/index.html, or that there is a
difference of that kind between the directories admin/ and admin/server. Are
they?

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

On 10/29/2020 06:21 AM, Remco Rijnders wrote:
> On Wed, Oct 28, 2020 at 10:36:12PM -0600, thelma wrote in
> <7b3d3416-77b0-02eb-ad05-f717fdf0b6a4@sys-concept.com>:
>> After installing apache 2.4 I can not access server subdirectory:
>> server/admin/index.html
>>
>> Forbiden
>> You don't have permission to access /admin/index.html on this server
>>
>> I can access index.html in a directory below /admin (server/index.html)
>> but not the server/admin/index.html
> 
> That seems to suggest that either the permissions or ownership of
> admin/index.html are different from admin/server/index.html, or that
> there is a
> difference of that kind between the directories admin/ and admin/server.
> Are
> they?

Here are the permissions:

index on server/
-rw-r--r--  1 root     root        19078 Jan 14  2011 index.php

index on server/admin/
drwxr-xr-x  6 root     root         4096 Oct 28 22:08 admin
-rwxrwxrwx  1 apache apache   428 Oct 28 16:44 index.html

It works on Apache 2.2 but not Apache 2.4

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Remco Rijnders]

On Thu, Oct 29, 2020 at 08:10:07AM -0600, thelma wrote in 
<474d741a-a72d-e3ff-f771-5c7ecd72c31b@sys-concept.com>:
>On 10/29/2020 06:21 AM, Remco Rijnders wrote:
>> On Wed, Oct 28, 2020 at 10:36:12PM -0600, thelma wrote in
>> <7b3d3416-77b0-02eb-ad05-f717fdf0b6a4@sys-concept.com>:
>>> After installing apache 2.4 I can not access server subdirectory:
>>> server/admin/index.html
>>>
>>> Forbiden
>>> You don't have permission to access /admin/index.html on this server
>>>
>>> I can access index.html in a directory below /admin (server/index.html)
>>> but not the server/admin/index.html
>>
>> That seems to suggest that either the permissions or ownership of
>> admin/index.html are different from admin/server/index.html, or that
>> there is a
>> difference of that kind between the directories admin/ and admin/server.
>> Are
>> they?
>
>Here are the permissions:
>
>index on server/
>-rw-r--r--  1 root     root        19078 Jan 14  2011 index.php
>
>index on server/admin/
>drwxr-xr-x  6 root     root         4096 Oct 28 22:08 admin
>-rwxrwxrwx  1 apache apache   428 Oct 28 16:44 index.html
>
>It works on Apache 2.2 but not Apache 2.4

Hi Thelma,

Please help us help you a little better. As I understand it, you have two
index.html files, but you show only one above. What role does index.php have in
all this? I am also unclear if your set up is server/admin or admin/server, as
you used both in your first message. So, all in all, I am a little confused as
to what your exact problem is and what the exact permissions on all the
directories and index.html files involved are.

Thanks!

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Michael]

[-- Attachment #1: Type: text/plain, Size: 1658 bytes --]

On Thursday, 29 October 2020 14:10:07 GMT thelma@sys-concept.com wrote:
> On 10/29/2020 06:21 AM, Remco Rijnders wrote:
> > On Wed, Oct 28, 2020 at 10:36:12PM -0600, thelma wrote in
> > 
> > <7b3d3416-77b0-02eb-ad05-f717fdf0b6a4@sys-concept.com>:
> >> After installing apache 2.4 I can not access server subdirectory:
> >> server/admin/index.html
> >> 
> >> Forbiden
> >> You don't have permission to access /admin/index.html on this server
> >> 
> >> I can access index.html in a directory below /admin (server/index.html)
> >> but not the server/admin/index.html
> > 
> > That seems to suggest that either the permissions or ownership of
> > admin/index.html are different from admin/server/index.html, or that
> > there is a
> > difference of that kind between the directories admin/ and admin/server.
> > Are
> > they?
> 
> Here are the permissions:
> 
> index on server/
> -rw-r--r--  1 root     root        19078 Jan 14  2011 index.php

The above is a .php file.


> index on server/admin/
> drwxr-xr-x  6 root     root         4096 Oct 28 22:08 admin
> -rwxrwxrwx  1 apache apache   428 Oct 28 16:44 index.html

You shouldn't need apache:apache or 0777 ownership of this file which is very 
insecure, unless apache is meant to be editing it live.  Normally root:root 
and 0755 is what is used.

Is 'server/' a subdirectory of '/var/www/'?

.htaccess won't work if you have disabled it with 'AllowOverride None'. 

> It works on Apache 2.2 but not Apache 2.4

Directives changed on version 2.4.  It would be worth familiarising yourself 
with the latest:

https://httpd.apache.org/docs/2.4/upgrading.html

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

On 10/29/2020 10:53 AM, Michael wrote:
> On Thursday, 29 October 2020 14:10:07 GMT thelma@sys-concept.com wrote:
>> On 10/29/2020 06:21 AM, Remco Rijnders wrote:
>>> On Wed, Oct 28, 2020 at 10:36:12PM -0600, thelma wrote in
>>>
>>> <7b3d3416-77b0-02eb-ad05-f717fdf0b6a4@sys-concept.com>:
>>>> After installing apache 2.4 I can not access server subdirectory:
>>>> server/admin/index.html
>>>>
>>>> Forbiden
>>>> You don't have permission to access /admin/index.html on this server
>>>>
>>>> I can access index.html in a directory below /admin (server/index.html)
>>>> but not the server/admin/index.html
>>>
>>> That seems to suggest that either the permissions or ownership of
>>> admin/index.html are different from admin/server/index.html, or that
>>> there is a
>>> difference of that kind between the directories admin/ and admin/server.
>>> Are
>>> they?
>>
>> Here are the permissions:
>>
>> index on server/
>> -rw-r--r--  1 root     root        19078 Jan 14  2011 index.php
> 
> The above is a .php file.

Yes, it is and I can read that file.  The files that I can not access
are in:
server/admin/index.html

> 
> 
>> index on server/admin/
>> drwxr-xr-x  6 root     root         4096 Oct 28 22:08 admin
>> -rwxrwxrwx  1 apache apache   428 Oct 28 16:44 index.html
> 
> You shouldn't need apache:apache or 0777 ownership of this file which is very 
> insecure, unless apache is meant to be editing it live.  Normally root:root 
> and 0755 is what is used.

Yes, I'll change that.  I just use it temporarily as I run out of ideas
to try :-/

> 
> Is 'server/' a subdirectory of '/var/www/'?

Yes

> .htaccess won't work if you have disabled it with 'AllowOverride None'. 

Thank you for the pointer.  I just change this directive in apache.conf
for /var/www/  and restarted apache but there is no difference.  I still
can not access /server/admin/ directory from apache.  server =
/var/www/html/catalog/

This is from apache.conf

<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

I just search all server .htaccess files for "AllowOverride" but none is
active in these files.
grep -Rnw '/var/www/html/catalog/' -e 'AllowOverride'

> 
>> It works on Apache 2.2 but not Apache 2.4
> 
> Directives changed on version 2.4.  It would be worth familiarising yourself 
> with the latest:
> 
> https://httpd.apache.org/docs/2.4/upgrading.html
> 

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Michael]

[-- Attachment #1: Type: text/plain, Size: 3032 bytes --]

On Thursday, 29 October 2020 19:59:45 GMT thelma@sys-concept.com wrote:
> On 10/29/2020 10:53 AM, Michael wrote:
> > On Thursday, 29 October 2020 14:10:07 GMT thelma@sys-concept.com wrote:

> >> Here are the permissions:
> >> 
> >> index on server/
> >> -rw-r--r--  1 root     root        19078 Jan 14  2011 index.php
> > 
> > The above is a .php file.
> 
> Yes, it is and I can read that file.  The files that I can not access
> are in:
> server/admin/index.html

> > Is 'server/' a subdirectory of '/var/www/'?
> 
> Yes

I assume you have a directive for DocumentRoot?

e.g. I think the default is:

DocumentRoot "/var/www/localhost/htdocs"

and probably in your use case it would be:

DocumentRoot "/var/www/html/catalog"  ?

Then if you point your browser to:

http://<IP_address>

it should display any index.html, or index.php, under catalog/, i.e.:

/var/www/html/catalog/index.html

it should *also* be able to display any other index.html under any 
subdirectory, unless this has been explicitly blocked in some other specific 
Directory, or Location directives, e.g.:

http://<IP_address>/admin

should display this index.html:

/var/www/html/catalog/admin/index.html


> > .htaccess won't work if you have disabled it with 'AllowOverride None'.
> 
> Thank you for the pointer.  I just change this directive in apache.conf
> for /var/www/  and restarted apache but there is no difference.  I still
> can not access /server/admin/ directory from apache.  server =
> /var/www/html/catalog/
> 
> This is from apache.conf
> 
> <Directory />
>         Options FollowSymLinks
>         AllowOverride None
>         Require all denied
> </Directory>
> 
> <Directory /usr/share>
>         AllowOverride None
>         Require all granted
> </Directory>
> 
> <Directory /var/www/>
>         Options FollowSymLinks
>         AllowOverride All
>         Require all granted
> </Directory>
> 
> I just search all server .htaccess files for "AllowOverride" but none is
> active in these files.
> grep -Rnw '/var/www/html/catalog/' -e 'AllowOverride'

You wouldn't find "AllowOverride" within an .htaccess file.  This is a 
directive placed in the main /etc/apache2 configuration files to determine if 
directives contained in local filesystem .htaccess files will be processed or 
not.  An 'AllowOverride None' will ignore .htaccess directives and make the 
server speedier in responding to requests.  TBH .htaccess are typically used 
locally, when you are not allowed to make changes to the main apache 
configuration files.  Note, if you changed the name of ".htaccess" with the 
'AccessFileName' directive, you may end up missing it.

Another thing to check is any changes to the default 'DirectoryIndex' types, 
for the particular subdirectory.  If you have removed index.html or 
index.html.var in this directive then apache won't serve index files when a 
directory like admin/ is requested.

Finally, you could increase the log verbosity to debug level and see if more 
information is revealed as to the cause of this problem.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

On 10/30/2020 04:31 AM, Michael wrote:
[snip]
>>
>> This is from apache.conf
>>
>> <Directory />
>>         Options FollowSymLinks
>>         AllowOverride None
>>         Require all denied
>> </Directory>
>>
>> <Directory /usr/share>
>>         AllowOverride None
>>         Require all granted
>> </Directory>
>>
>> <Directory /var/www/>
>>         Options FollowSymLinks
>>         AllowOverride All
>>         Require all granted
>> </Directory>
>>
>> I just search all server .htaccess files for "AllowOverride" but none is
>> active in these files.
>> grep -Rnw '/var/www/html/catalog/' -e 'AllowOverride'
> 
> You wouldn't find "AllowOverride" within an .htaccess file.  This is a 
> directive placed in the main /etc/apache2 configuration files to determine if 
> directives contained in local filesystem .htaccess files will be processed or 
> not.  An 'AllowOverride None' will ignore .htaccess directives and make the 
> server speedier in responding to requests.  TBH .htaccess are typically used 
> locally, when you are not allowed to make changes to the main apache 
> configuration files.  Note, if you changed the name of ".htaccess" with the 
> 'AccessFileName' directive, you may end up missing it.
> 
> Another thing to check is any changes to the default 'DirectoryIndex' types, 
> for the particular subdirectory.  If you have removed index.html or 
> index.html.var in this directive then apache won't serve index files when a 
> directory like admin/ is requested.
> 
> Finally, you could increase the log verbosity to debug level and see if more 
> information is revealed as to the cause of this problem.

I have a bigger problem.
The apache 2.4 doesn't read configuration files.
In apache2.conf I have:

# Include the virtual host configurations:
IncludeOptional sites-enabled/*.conf

So it should read read every *config file in sites-enabled/
In that directory I have:

ll sites-enabled/
lrwxrwxrwx 1 root root   35 Oct 27 21:15 000-default.conf ->
../sites-available/000-default.conf
-rw-r--r-- 1 root root 3420 Oct 29 18:03 vhosts.conf

vhosts.conf - define my web-site, but I commented everything out in that
file (it is empty) and restarted apache:
/etc/init.d/apache2 restart

And I can still display my web page.
How is it possible???

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Michael]

[-- Attachment #1: Type: text/plain, Size: 1302 bytes --]

On Friday, 30 October 2020 16:27:05 GMT thelma@sys-concept.com wrote:

> I have a bigger problem.
> The apache 2.4 doesn't read configuration files.
> In apache2.conf I have:
> 
> # Include the virtual host configurations:
> IncludeOptional sites-enabled/*.conf
> 
> So it should read read every *config file in sites-enabled/
> In that directory I have:
> 
> ll sites-enabled/
> lrwxrwxrwx 1 root root   35 Oct 27 21:15 000-default.conf ->
> ../sites-available/000-default.conf
> -rw-r--r-- 1 root root 3420 Oct 29 18:03 vhosts.conf

I have different configuration files, one for each website.  This makes it 
easier to know where to look and what to edit when I want to make changes.


> vhosts.conf - define my web-site, but I commented everything out in that
> file (it is empty) and restarted apache:
> /etc/init.d/apache2 restart
> 
> And I can still display my web page.
> How is it possible???

I would assume it is possible to still display your website because the main 
apache2.conf and/or ./sites-available/000-default.conf contain some default 
settings which specify the DocumentRoot where your website filesystem resides.

Your approach to start from first principles by commenting out individual 
configurations is sound, because you can check in this way what works and what 
does not.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

On 10/30/2020 11:55 AM, Michael wrote:
> On Friday, 30 October 2020 16:27:05 GMT thelma@sys-concept.com wrote:
> 
>> I have a bigger problem.
>> The apache 2.4 doesn't read configuration files.
>> In apache2.conf I have:
>>
>> # Include the virtual host configurations:
>> IncludeOptional sites-enabled/*.conf
>>
>> So it should read read every *config file in sites-enabled/
>> In that directory I have:
>>
>> ll sites-enabled/
>> lrwxrwxrwx 1 root root   35 Oct 27 21:15 000-default.conf ->
>> ../sites-available/000-default.conf
>> -rw-r--r-- 1 root root 3420 Oct 29 18:03 vhosts.conf
> 
> I have different configuration files, one for each website.  This makes it 
> easier to know where to look and what to edit when I want to make changes.
> 
> 
>> vhosts.conf - define my web-site, but I commented everything out in that
>> file (it is empty) and restarted apache:
>> /etc/init.d/apache2 restart
>>
>> And I can still display my web page.
>> How is it possible???
> 
> I would assume it is possible to still display your website because the main 
> apache2.conf and/or ./sites-available/000-default.conf contain some default 
> settings which specify the DocumentRoot where your website filesystem resides.
> 
> Your approach to start from first principles by commenting out individual 
> configurations is sound, because you can check in this way what works and what 
> does not.

I check all configuration files for "DocumentRoot" and all the files
have DocumentRoot commented out (so nothing is active)
grep -Rnw '/etc/apache2/' -e 'DocumentRoot'

Restarted apache 2.4 and the web-page is still loading :-/

Re: [gentoo-user] Apache 2.4 can not access server subdirectory

[Michael]

[-- Attachment #1: Type: text/plain, Size: 1874 bytes --]

On Friday, 30 October 2020 18:29:18 GMT thelma@sys-concept.com wrote:
> On 10/30/2020 11:55 AM, Michael wrote:
> > On Friday, 30 October 2020 16:27:05 GMT thelma@sys-concept.com wrote:
> >> I have a bigger problem.
> >> The apache 2.4 doesn't read configuration files.
> >> In apache2.conf I have:
> >> 
> >> # Include the virtual host configurations:
> >> IncludeOptional sites-enabled/*.conf
> >> 
> >> So it should read read every *config file in sites-enabled/
> >> In that directory I have:
> >> 
> >> ll sites-enabled/
> >> lrwxrwxrwx 1 root root   35 Oct 27 21:15 000-default.conf ->
> >> ../sites-available/000-default.conf
> >> -rw-r--r-- 1 root root 3420 Oct 29 18:03 vhosts.conf
> > 
> > I have different configuration files, one for each website.  This makes it
> > easier to know where to look and what to edit when I want to make changes.
> > 
> >> vhosts.conf - define my web-site, but I commented everything out in that
> >> file (it is empty) and restarted apache:
> >> /etc/init.d/apache2 restart
> >> 
> >> And I can still display my web page.
> >> How is it possible???
> > 
> > I would assume it is possible to still display your website because the
> > main apache2.conf and/or ./sites-available/000-default.conf contain some
> > default settings which specify the DocumentRoot where your website
> > filesystem resides.
> > 
> > Your approach to start from first principles by commenting out individual
> > configurations is sound, because you can check in this way what works and
> > what does not.
> 
> I check all configuration files for "DocumentRoot" and all the files
> have DocumentRoot commented out (so nothing is active)
> grep -Rnw '/etc/apache2/' -e 'DocumentRoot'
> 
> Restarted apache 2.4 and the web-page is still loading :-/

ServerRoot specified somewhere?  Increase log verbosity and see what it 
reports, otherwise I'm out of ideas!

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re:[SOLVED] [gentoo-user] Apache 2.4 can not access server subdirectory

[thelma]

On 10/30/2020 12:34 PM, Michael wrote:
[snip]
>>>> vhosts.conf - define my web-site, but I commented everything out in that
>>>> file (it is empty) and restarted apache:
>>>> /etc/init.d/apache2 restart
>>>>
>>>> And I can still display my web page.
>>>> How is it possible???
>>>
>>> I would assume it is possible to still display your website because the
>>> main apache2.conf and/or ./sites-available/000-default.conf contain some
>>> default settings which specify the DocumentRoot where your website
>>> filesystem resides.
>>>
>>> Your approach to start from first principles by commenting out individual
>>> configurations is sound, because you can check in this way what works and
>>> what does not.
>>
>> I check all configuration files for "DocumentRoot" and all the files
>> have DocumentRoot commented out (so nothing is active)
>> grep -Rnw '/etc/apache2/' -e 'DocumentRoot'
>>
>> Restarted apache 2.4 and the web-page is still loading :-/
> 
> ServerRoot specified somewhere?  Increase log verbosity and see what it 
> reports, otherwise I'm out of ideas!

Solved.
For some reason or another in my /etc/hosts file I had:
10.0.0.112      server.ca

And apache was accessing my production box1

box1 - production
box2 - work in progress

I changed in hosts to:
10.0.0.112      www.server.ca

And apache was resolving accessing box2 only.
Strange.

Re: [SOLVED] [gentoo-user] Apache 2.4 can not access server subdirectory

[Michael]

[-- Attachment #1: Type: text/plain, Size: 2570 bytes --]

On Sunday, 1 November 2020 05:01:48 GMT thelma@sys-concept.com wrote:
> On 10/30/2020 12:34 PM, Michael wrote:
> [snip]
> 
> >>>> vhosts.conf - define my web-site, but I commented everything out in
> >>>> that
> >>>> file (it is empty) and restarted apache:
> >>>> /etc/init.d/apache2 restart
> >>>> 
> >>>> And I can still display my web page.
> >>>> How is it possible???
> >>> 
> >>> I would assume it is possible to still display your website because the
> >>> main apache2.conf and/or ./sites-available/000-default.conf contain some
> >>> default settings which specify the DocumentRoot where your website
> >>> filesystem resides.
> >>> 
> >>> Your approach to start from first principles by commenting out
> >>> individual
> >>> configurations is sound, because you can check in this way what works
> >>> and
> >>> what does not.
> >> 
> >> I check all configuration files for "DocumentRoot" and all the files
> >> have DocumentRoot commented out (so nothing is active)
> >> grep -Rnw '/etc/apache2/' -e 'DocumentRoot'
> >> 
> >> Restarted apache 2.4 and the web-page is still loading :-/
> > 
> > ServerRoot specified somewhere?  Increase log verbosity and see what it
> > reports, otherwise I'm out of ideas!
> 
> Solved.
> For some reason or another in my /etc/hosts file I had:
> 10.0.0.112      server.ca
> 
> And apache was accessing my production box1
> 
> box1 - production
> box2 - work in progress
> 
> I changed in hosts to:
> 10.0.0.112      www.server.ca
> 
> And apache was resolving accessing box2 only.
> Strange.

server.ca != www.server.ca

The first is a FQDN, the second is a subdomain of it.

You can set up aliases in /etc/hosts of a PC:

10.0.0.112    server.ca  www.server.ca prod.server server 

All of the above will allow the PC to resolve the FQDN and any aliases to host 
10.0.0.112 and look for a listening webserver on appropriate ports.

The web server should be listening on an appropriate port, or port and IP 
address, here 10.0.0.112.  Typically the server is listening on all IPs on 
port :80 in the apache configuration files:

Listen *:80

This can be different for each Vhost served by this webserver, but make sure 
there are no overlapping Listen directives on the same port, or the server 
will error out.

https://cwiki.apache.org/confluence/display/HTTPD/CouldNotBindToAddress

Then on each VirtualHost  section you can specify whatever ServerName and 
ServerAlias you need  to make sure your are accessing the correct Vhost and 
its corresponding filesystem:

https://httpd.apache.org/docs/2.4/vhosts/name-based.html

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]