Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #165872 > unrolled thread

Error with Apache MPM itk

Started byOlivier Desport <olivier.desport@ac-versailles.fr>
First post2016-03-23 15:00 +0100
Last post2016-03-24 10:40 +0100
Articles 9 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  Error with Apache MPM itk Olivier Desport <olivier.desport@ac-versailles.fr> - 2016-03-23 15:00 +0100
    Re: Error with Apache MPM itk <tomas@tuxteam.de> - 2016-03-23 15:40 +0100
      Re: Error with Apache MPM itk Olivier Desport <olivier.desport@ac-versailles.fr> - 2016-03-23 15:50 +0100
        Re: Error with Apache MPM itk <tomas@tuxteam.de> - 2016-03-23 16:30 +0100
          Re: Error with Apache MPM itk Olivier Desport <olivier.desport@ac-versailles.fr> - 2016-03-23 16:50 +0100
            Re: Error with Apache MPM itk <tomas@tuxteam.de> - 2016-03-23 21:50 +0100
              Re: Error with Apache MPM itk Olivier Desport <olivier.desport@ac-versailles.fr> - 2016-03-24 10:10 +0100
                Re: Error with Apache MPM itk <tomas@tuxteam.de> - 2016-03-24 10:30 +0100
                  Re: Error with Apache MPM itk Olivier Desport <olivier.desport@ac-versailles.fr> - 2016-03-24 10:40 +0100

#165872 — Error with Apache MPM itk

FromOlivier Desport <olivier.desport@ac-versailles.fr>
Date2016-03-23 15:00 +0100
SubjectError with Apache MPM itk
Message-ID<rfRui-4aA-7@gated-at.bofh.it>
Hi,

I'm using mpm_itk module (on Apache 2.4.10 - Debian Jessie) but the web 
server returns 403 errors :

[Wed Mar 23 12:03:35.303631 2016] [core:error] [pid 18224] 
(13)Permission denied: [client 172.31.130.36:54815] AH00035: access to 
/favicon.ico denied (filesystem path '/var/www/portail/favicon.ico') 
because search permissions are missing on a component of the path, 
referer: http://edu-portail.ac-versailles.fr/portail.php

- My VH


DocumentRoot /var/www/portail

<IfModule mpm_itk_module>
AssignUserId portail portail
</IfModule>

<Directory /var/www/portail>
Options -Indexes +FollowSymLinks +MultiViews
Require all granted
</Directory>

- Rights :

ls -la /var/www/
drwxr-x--- 1 portail portail 2260 mars 2 13:20 portail

ls -la /var/www/portail/
rwxr-x--- 1 portail portail 2102 déc. 2 13:09 index.php
-rwxr-x--- 1 portail portail 6545 janv. 12 17:04 portail.php
[...]


It worked well on Wheezy and Apache 2.2. So, what can I do ?

Thanks.

[toc] | [next] | [standalone]

#165873

From<tomas@tuxteam.de>
Date2016-03-23 15:40 +0100
Message-ID<rfS70-4Jv-25@gated-at.bofh.it>
In reply to#165872
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 23, 2016 at 02:41:14PM +0100, Olivier Desport wrote:
> Hi,
> 
> I'm using mpm_itk module (on Apache 2.4.10 - Debian Jessie) but the
> web server returns 403 errors :
> 
> [Wed Mar 23 12:03:35.303631 2016] [core:error] [pid 18224]
> (13)Permission denied: [client 172.31.130.36:54815] AH00035: access
> to /favicon.ico denied (filesystem path
> '/var/www/portail/favicon.ico') because search permissions are
> missing on a component of the path, referer:
> http://edu-portail.ac-versailles.fr/portail.php

There's a clue in the error message: "search permissions" means the
+x in the directory.

To be able to access /var/www/portail/favicon.ico, the web server
wants to have read and "execute" (which for directories means actually
search) access to all of its parent directories, i.e. /, /var, /var/www
and so on.

So check that it is the case.

Just ask again if that wasn't clear :-)

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbyof8ACgkQBcgs9XrR2kZHTwCfTZOtmRG4KzwNboQE/UQqJlg9
gaAAnRCqNjfDmj2M11ctcy5to1/PlWCu
=Hp+f
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165874

FromOlivier Desport <olivier.desport@ac-versailles.fr>
Date2016-03-23 15:50 +0100
Message-ID<rfSgH-4NE-29@gated-at.bofh.it>
In reply to#165873

[Multipart message — attachments visible in raw view] — view raw

Hi Thomas,

I don't want to set 755 permissions to this folder for security reasons. 
It worked well like this (750) with Wheezy/Apache 2.2 and I want to keep 
my settings.



Le 23/03/2016 15:02, tomas@tuxteam.de a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wed, Mar 23, 2016 at 02:41:14PM +0100, Olivier Desport wrote:
>> Hi,
>>
>> I'm using mpm_itk module (on Apache 2.4.10 - Debian Jessie) but the
>> web server returns 403 errors :
>>
>> [Wed Mar 23 12:03:35.303631 2016] [core:error] [pid 18224]
>> (13)Permission denied: [client 172.31.130.36:54815] AH00035: access
>> to /favicon.ico denied (filesystem path
>> '/var/www/portail/favicon.ico') because search permissions are
>> missing on a component of the path, referer:
>> http://edu-portail.ac-versailles.fr/portail.php
> There's a clue in the error message: "search permissions" means the
> +x in the directory.
>
> To be able to access /var/www/portail/favicon.ico, the web server
> wants to have read and "execute" (which for directories means actually
> search) access to all of its parent directories, i.e. /, /var, /var/www
> and so on.
>
> So check that it is the case.
>
> Just ask again if that wasn't clear :-)
>
> regards
> - -- t
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iEYEARECAAYFAlbyof8ACgkQBcgs9XrR2kZHTwCfTZOtmRG4KzwNboQE/UQqJlg9
> gaAAnRCqNjfDmj2M11ctcy5to1/PlWCu
> =Hp+f
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [next] | [standalone]

#165876

From<tomas@tuxteam.de>
Date2016-03-23 16:30 +0100
Message-ID<rfSTo-5lq-19@gated-at.bofh.it>
In reply to#165874
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 23, 2016 at 03:48:41PM +0100, Olivier Desport wrote:
> Hi Thomas,
> 
> I don't want to set 755 permissions to this folder for security
> reasons. It worked well like this (750) with Wheezy/Apache 2.2 and I
> want to keep my settings.

Whatever "this folder" is ;-)

Anyway, if Apache hasn't read *and* execute access then it won't play
with you.

I don't know what "this" folder is, but if we are talking about
one of the last directories in the path (i.e. /var/www or even
/var/www/portail), then you might consider to set their "group"
to the group Apache is running under, so that permissions 0750
can actually do the trick.

Typically, Apache is running under group apache, but I'd double-
check.

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbyrcAACgkQBcgs9XrR2kaSbACeNxlTetCZVIWDN1at9cGzBr/T
jpEAnRRUHaYSzMRaRnGsn3r5pohXYXbW
=qnCM
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165879

FromOlivier Desport <olivier.desport@ac-versailles.fr>
Date2016-03-23 16:50 +0100
Message-ID<rfTcJ-5vE-13@gated-at.bofh.it>
In reply to#165876

[Multipart message — attachments visible in raw view] — view raw

It's true that Apache is running under www-data group on Jessie :

root     11718  0.0  3.4 446260 35680 ?        Ss   15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11722  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11723  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11724  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11725  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11726  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11736  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11740  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11741  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11742  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start
www-data 11743  0.0  1.3 446292 13424 ?        S    15:03   0:00 
/usr/sbin/apache2 -k start

But on Wheezy, Apache is running under root, so I don't have to give 
execute access to the folder :

root      2178  0.2  0.4 363472 44104 ?        S    15:33   0:10 
/usr/sbin/apache2 -k start
root      2292  0.2  0.4 363472 44104 ?        S    15:15   0:13 
/usr/sbin/apache2 -k start
root     15009  0.1  0.4 363472 44104 ?        S    14:22   0:13 
/usr/sbin/apache2 -k start
root     16979  0.0  0.1 337332 17664 ?        S    févr.17   0:02 
/usr/sbin/apache2 -k start
root     23261  0.2  0.4 363472 44104 ?        S    16:04   0:05 
/usr/sbin/apache2 -k start
root     24872  0.1  0.4 363472 44104 ?        S    14:09   0:15 
/usr/sbin/apache2 -k start
root     27992  0.2  0.4 363472 44104 ?        S    13:50   0:23 
/usr/sbin/apache2 -k start
root     28543  0.1  0.4 363472 44104 ?        S    15:11   0:09 
/usr/sbin/apache2 -k start
root     29159  0.0  0.4 363472 44104 ?        S    16:06   0:00 
/usr/sbin/apache2 -k start
root     29309  0.0  0.4 363472 44104 ?        S    16:07   0:01 
/usr/sbin/apache2 -k start
root     29857  0.2  0.4 363472 44104 ?        S    16:07   0:04 
/usr/sbin/apache2 -k start
root     30088  0.2  0.4 363472 44104 ?        S    16:07   0:04 
/usr/sbin/apache2 -k start
root     31218  0.2  0.4 363472 44104 ?        S    16:08   0:04 
/usr/sbin/apache2 -k start
root     32046  0.2  0.4 363472 44108 ?        S    16:08   0:04 
/usr/sbin/apache2 -k start



Le 23/03/2016 15:52, tomas@tuxteam.de a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wed, Mar 23, 2016 at 03:48:41PM +0100, Olivier Desport wrote:
>> Hi Thomas,
>>
>> I don't want to set 755 permissions to this folder for security
>> reasons. It worked well like this (750) with Wheezy/Apache 2.2 and I
>> want to keep my settings.
> Whatever "this folder" is ;-)
>
> Anyway, if Apache hasn't read *and* execute access then it won't play
> with you.
>
> I don't know what "this" folder is, but if we are talking about
> one of the last directories in the path (i.e. /var/www or even
> /var/www/portail), then you might consider to set their "group"
> to the group Apache is running under, so that permissions 0750
> can actually do the trick.
>
> Typically, Apache is running under group apache, but I'd double-
> check.
>
> regards
> - -- t
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iEYEARECAAYFAlbyrcAACgkQBcgs9XrR2kaSbACeNxlTetCZVIWDN1at9cGzBr/T
> jpEAnRRUHaYSzMRaRnGsn3r5pohXYXbW
> =qnCM
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [next] | [standalone]

#165883

From<tomas@tuxteam.de>
Date2016-03-23 21:50 +0100
Message-ID<rfXT3-qz-11@gated-at.bofh.it>
In reply to#165879
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Mar 23, 2016 at 04:40:57PM +0100, Olivier Desport wrote:
> It's true that Apache is running under www-data group on Jessie :

[...]

> But on Wheezy, Apache is running under root, so I don't have to give
> execute access to the folder :

[...]

But that's what I am saying: just chgrp the folder to www-data; I asume
that the perms are 0750 -- voilà. The group *has* the necessary w+x
access. You don't have to give that to *all*.

By the way -- running Apache under root seems a bad idea. The least security
issue gives a potential attacker root! I can't imagine that this was the
default in Wheezy (actually I'm pretty sure it wasn't).

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlby9xwACgkQBcgs9XrR2kbZNACdGol+oXiyWReIeHlafhG8tA4+
pIkAnAxZHR5zU8lM0ZcAR6NGdh5QgGcc
=OVq7
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165899

FromOlivier Desport <olivier.desport@ac-versailles.fr>
Date2016-03-24 10:10 +0100
Message-ID<rg9rc-lu-11@gated-at.bofh.it>
In reply to#165883

[Multipart message — attachments visible in raw view] — view raw



Le 23/03/2016 21:05, tomas@tuxteam.de a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wed, Mar 23, 2016 at 04:40:57PM +0100, Olivier Desport wrote:
>> It's true that Apache is running under www-data group on Jessie :
> [...]
>
>> But on Wheezy, Apache is running under root, so I don't have to give
>> execute access to the folder :
> [...]
>
> But that's what I am saying: just chgrp the folder to www-data; I asume
> that the perms are 0750 -- voilà. The group *has* the necessary w+x
> access. You don't have to give that to *all*.
OK. I've changed the folders groups owner to www-data with r-x 
permissions. Only the owner have rwx permissions and it works well when 
I upload a file from a web site.
> By the way -- running Apache under root seems a bad idea. The least security
> issue gives a potential attacker root! I can't imagine that this was the
> default in Wheezy (actually I'm pretty sure it wasn't).
You're right.
>
> regards
> - -- t
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iEYEARECAAYFAlby9xwACgkQBcgs9XrR2kbZNACdGol+oXiyWReIeHlafhG8tA4+
> pIkAnAxZHR5zU8lM0ZcAR6NGdh5QgGcc
> =OVq7
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [next] | [standalone]

#165900

From<tomas@tuxteam.de>
Date2016-03-24 10:30 +0100
Message-ID<rg9Ky-u0-19@gated-at.bofh.it>
In reply to#165899
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Mar 24, 2016 at 10:05:29AM +0100, Olivier Desport wrote:

[...]

> OK. I've changed the folders groups owner to www-data with r-x
> permissions. Only the owner have rwx permissions and it works well
> when I upload a file from a web site.

Glad you could solve your problem :-)

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbzqqAACgkQBcgs9XrR2kYW1ACZAaXru8Md7mZQvWkrA8aDR0jz
+EcAnjxXXaL0ZVfJr45P/CVtYA+rnwtd
=scsb
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#165901

FromOlivier Desport <olivier.desport@ac-versailles.fr>
Date2016-03-24 10:40 +0100
Message-ID<rg9Ue-xV-31@gated-at.bofh.it>
In reply to#165900

[Multipart message — attachments visible in raw view] — view raw

Thanks for your help.



Le 24/03/2016 09:51, tomas@tuxteam.de a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, Mar 24, 2016 at 10:05:29AM +0100, Olivier Desport wrote:
>
> [...]
>
>> OK. I've changed the folders groups owner to www-data with r-x
>> permissions. Only the owner have rwx permissions and it works well
>> when I upload a file from a web site.
> Glad you could solve your problem :-)
>
> regards
> - -- t
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iEYEARECAAYFAlbzqqAACgkQBcgs9XrR2kYW1ACZAaXru8Md7mZQvWkrA8aDR0jz
> +EcAnjxXXaL0ZVfJr45P/CVtYA+rnwtd
> =scsb
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web