4

I have been trawling the internet for a few days now and think I've tried almost everything to get some virtual hosts set up on my Ubuntu server but everything short of chmod 777 on the webroot fails.

I have my default Apache conf pointing at /home/server/public_html with the the settings show below

<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /home/server/public_html/ <Directory /> Options FollowSymLinks AllowOverride All </Directory> <Directory /home/server/public_html/> Options Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all </Directory> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ <Directory "/usr/lib/cgi-bin"> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all </Directory> ErrorLog ${APACHE_LOG_DIR}/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog ${APACHE_LOG_DIR}/access.log combined Alias /doc/ "/usr/share/doc/" <Directory "/usr/share/doc/"> Options Indexes MultiViews FollowSymLinks AllowOverride None Order deny,allow Deny from all Allow from all </Directory> </VirtualHost>

I have then created a virtual host for a project I'm working on say for example project.name.co.uk.conf and inside there I have the following

<VirtualHost *:80> ServerName http://www.local.dirty-briefs.co.uk ServerAlias local.project-name.co.uk DocumentRoot /home/server/public_html/project-name/ DirectoryIndex index.php index.html </VirtualHost>

I then ran sudo a2ensite project.name.co.uk.conf. I'm working on a windows 7 machine using samba to access the files on the server. I added the project.name.co.uk to my windows hosts file however not matter what I do I get 403 permission errors.

edit

Thought id add the tail of the Apache error log in case it was useful

*==> /var/log/apache2/error.log <== [Sat Jun 11 13:22:23 2011] [error] [client 192.168.0.3] PHP Warning: require(/home/server/public_html/dirty-briefs/site/protected/config/main.php): failed to open stream: Permission denied in /home/server/public_html/dirty-briefs/framework/base/CApplication.php on line 120 [Sat Jun 11 13:22:23 2011] [error] [client 192.168.0.3] PHP Fatal error: require(): Failed opening required '/home/server/public_html/dirty-briefs/site/protected/config/main.php' (include_path='.:/usr/share/php:/usr/share/pear') in /home/server/public_html/dirty-briefs/framework/base/CApplication.php on line 120*

It may also be worth mentioning I'm working with Yii the PHP framework I have a .htaccess file that lives in my site folder with the following inside

 # Disable directory browsing Options All -Indexes # File types AddType application/x-font-woff .eot .ttf # Font-Face # URL Rewriting <IfModule mod_rewrite.c> RewriteEngine On # Site Maintenance # RewriteCond %{REMOTE_ADDR} !^10\.0\.2\.2 # RewriteCond %{REQUEST_FILENAME} !-f # RewriteRule ^(.*)$ /maintenance.html [L] # LOCAL RewriteCond %{SERVER_NAME} ^local.project-name.co.uk RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ /index-local.php/$1 # ----- # PRODUCTION RewriteCond %{HTTP_HOST} ^project-name.co.uk RewriteRule ^(.*)$ http://www.project-name.co.uk/$1 [R=301,L] RewriteCond %{SERVER_NAME} ^www.project-name.co.uk RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ /folder/index.php/$1 # ----- </IfModule>

I tailed the Apache error and access logs and found I was getting perm errors on importing files inside my PHP script due to permission errors.

I have read about checking what user and group Apache is running under, which are www-data www-data so I'm guessing Apache basically doesn't have perms to access the files under /home/server/public_html unless I give the folder 777 perms which I don't want so I'm just wondering if anyone can spot what I'm doing wrong or advise on anything I can try to get this working

Improve this question
1
  • Please post ls -l /home and ls -l /home/server Commented Jun 11, 2011 at 12:53

4 Answers 4

Reset to default
2

This folder layout is a litle confusing. Your default vhost directive specifes /home/server/public_html/ as the DocumentRoot, but then you specify a subfolder of it as the root of your application. This isn't an optimal configuration. Try moving the site out of public_html into its own folder (/home/server/project or somesuch) and setting the DocumentRoot accordingly.

Once it's moved, you don't need 777 permissions to make it accessible, though it does need to be readable by www-data. Try:

chmod -R 644 /home/server/project find /home/server/project -type d -exec chmod 755 {} \+

This will make everything world-readable and all the folders traversable (setting the execute bit on folders does this).

One other thing: ServerName doesn't use the http:// prefix. You should remove that from the configuration and leave just the domain name.

Restart your apache after this changes and you should be able to reach the site with your given host name.

Improve this answer
10
  • Hey thanks for your amazing answer!! The reason i had the projects under public_html was just so everything was organised, maybe public_html was a bad name but would you still suggest i moved them out into the root under /home/server then point the DocumentRoot of my virtualHost at /home/server/project-name/ in turn should i then point the default at /home/server ? Commented Jun 11, 2011 at 13:07
  • Certainly, keeping all of your sites in one location is no bad thing, but the default DcoumentRoot doesn't need to be (and shouldn't be) a parent of the other vhost roots. Remember: any requests for domains that don't match the ServerName or ServerAlias of your vhosts will be served by the default one. With your original setup, it might be possible for people to subvert security measures in the sub-vhost by accessing the same files though the parent one. Commented Jun 11, 2011 at 13:16
  • Ah ok thanks for clearing that up for me, so perhaps what ill do is revert the default back to /var/www/ then create virtual hosts to point to /home/server/sites/project-name Ill have a go at that now and let you know the outcome, Thanks again! Commented Jun 11, 2011 at 13:23
  • chmod -R 644 /home/server/project when running that is it weird that i need sudo i mean i dont think it is but as i step through this i just wanna make sure im not missing something causing the problem you know Commented Jun 11, 2011 at 13:43
  • YOU LEGEND!! That worked a treat Commented Jun 11, 2011 at 13:51
1

You can give Apache the right to access the files without setting them to world-can-do-everything (rwxrwxrwx or 777), you would only need to give it permission to read the files so that the PHP executable can read them. You may need to give execution rights too if PHP checks for that. The better way would be to change ownership with chown www-data:www-data <file> then you can give Apache full rights and no rights to anyone else (except root) with chmod 700 (or chmod u+rwx <file>; chmod go-rwx <file> if you prefer to use mnemonic codes rather than the bit-pattern based ones).

If you have other sites running from the same Apache install (and so also running as www-data) and you want to keep them separated s one site is to some extent protected by the others, then look into using suPHP (as provided by this package in Ubuntu). It is less efficient than the bog-standard mod_php (though not by much unless you are on severely constrained hardware) but gives you that extra layer of protection between users/sites by making it harder for them (accidentally or otherwise) to affect each other or read each other's stuff. Each script gets run by a process acting as the user that owns it, so a php file owned by user1 gets run as user1 and no other user (even www-data or what-ever scripts usually run as) needs to have any access to it. You may encounter other permissions errors from suphp until you have things set right, as it defaults to insisting certain security checks pass (like directories and scripts not being world writeable) before running any script.

ps. re: require(/home/server/public_html/dirty-briefs/site/protected/config/main.php): failed - coffee stained meeting briefing notes, or something else?!

Improve this answer
0

You probably need execute access on /home/server so the Apache user can traverse inside it to read the public_html folder (which should be other-readable).

# If not already drwx--x--x... chmod o+x /home/server
Improve this answer
1
  • Hey Thanks for the reply i had the relevant perms set for those folders Commented Jun 11, 2011 at 13:08
-1

It is probably a seLinux problem.

EDIT:

To be sure you can set seLinux to permissive mode and try again. If you were working on RedHat I would recommend using system-config-selinux but I dont know a tool for that in Ubuntu

Improve this answer
4
  • And would you elaborate on how to fix the problem, rather than just blaming something? Commented Jun 11, 2011 at 12:53
  • I cannot without access to the server. I guess knowing the problem will help. Commented Jun 11, 2011 at 12:56
  • Before down voting make sure that some one else is talking about same issue with better answer. Commented Jun 11, 2011 at 12:58
  • the downvote was probably not because who-ever voted didn't think it was an selinux issue (though it most likely isn't IMO), it is because answers of the form of your pre-edit answer ("It is probably an X problem.") are rarely useful to the question asker. Some more detail on how to verify that X is/isn't the issue and what might need to be done to address the problem if it is that, would make the response far more helpful. Commented Jun 11, 2011 at 13:12

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.