New GCSE IT Controlled Assessment - Display MySQL Data in Web Page [Dreamweaver]?

[mavhc]

So you get a 403 even if the file isn't there? Sounds like the web server user can't read the directory.

 

cd to the user's homedir, then: chmod 755 public_html

[JRA]

Thanks again both! Gosh lots of people helping with Apache for a Friday afternoon... Cheers all.

 

Okay, tinkering with the permissions didn't seem to do it; tkid3/ and all below is 777 now. I also changed the folder in userdir.conf to specifically look for /public_html (and then made the folder public_html) as it was just set to look for /compsci/tkid3/sites/file.html, still no joy. That should work though I'd have thought.

 

Checking apache's error.log though I get a lot of the following:

 

[Fri Oct 20 15:47:04.774653 2017] [core:error] [pid 1058] (13)Permission denied: [client 10.108.5.162:59251] AH00035: access to /~tkid3/file.html denied (filesystem path '/compscihomes/tkid3') because search permissions are missing on a component of the path

 

Anything to go on?

[mavhc]

Do the folders above tkid3 have the right permissions? Directories need the +x bit to be able to be queried

 

So /home and /home/compsci I guess

[JRA]

Thanks yet again - gave that a stab. Just to clarify, the little home areas are eg /compscihomes/tkid3/ they're not eg /home/compscihomes/tkid3/

Currently, I've chmod-ed everything wide open (as in chmod -R 777 /compscihomes) and userdir.conf looks like:

 

UserDir /compscihomes/*/public_html
UserDir disabled root


 AllowOverride FileInfo AuthConfig Limit Indexes
 Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
 
  Require all granted
 
 
  Require all denied
 



# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

 

The file I'm after is in /compscihomes/tkid3/public_html/file.html

 

Just in case I've got anyone tangled up back there. But yes, still not got it.

[PyROm]

hi, url should be http://compsci/~tkid3/public_html/file.html if it still doesnt work get rid of the limit sections

[JRA]

Cheers for that - ok, deleted those two sections but still getting the same.

[PyROm]

Edit: Sorry meant everything in the directory section of your mod_userdir.conf

 

working backwards, replace evenrything in your userdir.conf with

Options Indexes FollowSymLinks
   AllowOverride None
   Require all granted

 

And try again, also you have indexes on so if you just out the directory into your browser it should list contents.

Edited October 23, 2017 by PyROm

[PyROm]

As a daft question, you have symlinked mods-available/mod_userdir.load as well as mod_userdir.conf to your mods-enabled folder?

[PyROm]

Also if your flavour of linux has selinux enabled you need to run

setsebool -P httpd_enable_homedirs true

[JRA]

Thanks HUGELY for sticking with me! Okay, done all that and get Forbidden 403 still. The userdir.conf now looks like:

 

   UserDir /compscihomes/*/public_html
   UserDir disabled root

   
 AllowOverride None
 Options Indexes FollowSymLinks
 Require all granted
 Allow from all
#  
#   Require all granted
#    
   


# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

 

Everything from /compscihomes down (including that folder itself) is 777, with www-data as owning group on everything.

 

Added the following section into apache2.conf for good measure:

 

       Options Indexes FollowSymLinks
       AllowOverride None
       Require all granted

 

Though that doesn't seem to do anything either. Tailing the apache error log gets me these though:

 

[Mon Oct 23 10:51:25.330781 2017] [core:error] [pid 2718] (13)Permission denied: [client 10.108.5.162:51219] AH00035: access to /~tkid3/public_html/file.html denied (filesystem path '/compscihomes/tkid3/public_html') because search permissions are missing on a component of the path

 

But they're all 777. At least with the Unix ACLs, could this be Samba doing something? Home directories (/compscihomes/%username%) all got the "drwxrwxrwx+" as ACLs.

 

Uuurgh! Pesty rotten smegging thing.

 

Also yes I had added those symlinks in.

Edited October 23, 2017 by JRA

[PyROm]

Have you restarted the whole server since running the setsebool command?

 

I doubt its samba interfering with permission at this point. You could try and chod 644 the file itself to check having execute on it is nt causing a problem, but that wouldnt match your error log.

[JRA]

Ah, now on running that setsebool command, I got "The program 'setsebool' is currently not installed. You can install it by typing: apt install policycoreutils" but I figured I wouldn't need to as I'm on Ubuntu server. Do I need to install those utils then run that jobber?

 

Thanks again! You're becoming my hero.

[PyROm]

Type

sestatus

to see if selinux is enabled, if it isnt, or you get an error about sestatus not installed then you dont need to run the setsebool as selinux isnt installed/enabled.

 

If it is enabled you could temporerily (until next reboot) turn it off with

echo 0 > /selinux/enforce

to see if that fixes it.

[pcstru]

My userdir.conf.

 

       UserDir public_html
       UserDir disabled root

       
               AllowOverride FileInfo AuthConfig Limit Indexes
               Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec +ExecCgi
               AddHandler cgi-script cgi pl
               
                       Order allow,deny
                       Allow from all
               
               
                       Order deny,allow
                       Deny from all
               
       

 

Access is then via : http:///~

 

which would pick up /home//public_html/index.html

[JRA]

Ta, ran that and it's not installed.

[PyROm]

Have you restarted apache after making the config changes? eg.

/etc/init.d/apache2 restart

[JRA]

My userdir.conf.

 

       UserDir public_html
       UserDir disabled root

       
               AllowOverride FileInfo AuthConfig Limit Indexes
               Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec +ExecCgi
               AddHandler cgi-script cgi pl
               
                       Order allow,deny
                       Allow from all
               
               
                       Order deny,allow
                       Deny from all
               
       

 

Access is then via : http:///~

 

which would pick up /home//public_html/index.html

Thanks! Ooh now that has done something. Making that example my own userdir.conf (and changing only the directory line to say ) then Apache seems to not restart nicely (# service apache2 restart) with: Job for apache2.service failed because the control process exited with error code. See "systemctl status apache2.service" and "journalctl -xe" for details. The web server then doesn't work; not this test kid's page not the phpmyadmin page of the MySQL part of it (which I generally keep open alongside to sanity check it still actually servers web pages.)

 

Is that a clue to anything?

 

- - - Updated - - -

 

Have you restarted apache after making the config changes? eg.

/etc/init.d/apache2 restart

Ah yes, usually do with # service apache2 restart after any change but more often than not restart the whole server.

[PyROm]

run

systemctl status apache2.service

to see why the service wont start. Or look in /var/log/apache2/error.log if the first isnt useful.

[pcstru]

Probably remove the line : AddHandler cgi-script cgi pl.

 

I have it for perl.

[JRA]

Thanks folks. Apache didn't start as it didn't like the "+" option in userdir.conf now; says they all needed to start with a "+" or "-" or none of them. Removed the "+" and back to the same, forbidden still on http://compsci/~tkid3/ but the phpmyadmin page works.

 

Again, cheers very very much fro sticking with me!

[PyROm]

Just double checking some basic stuff now because im a bit stuck, is the whole path on the server actually lowercase? eg. the username is all lowercase so /compscihomes/tkid3/public_html not /compscihomes/TKid3/public_html ?

 

The other thing to double check permissions is

namei -l /compscihomes/tkid3/public_html

To make sure nothing has changed permissions since ou chmodded them. This will list all folders back down to root with permissions.

[JRA]

Hi there - yes it's a proper head-scratcher! I do appreciate the help though hugely from both of you.

Output is:

root@compsci:/etc/apache2/mods-available# namei -l /compscihomes/tkid3/public_html
f: /compscihomes/tkid3/public_html
drwxr-xr-x root  root     /
drwxrwxrwx root  www-data compscihomes
drwxrwxrwx james www-data tkid3
drwxrwxrwx root  www-data public_html

[PyROm]

as a wild guess....

chown -R james:www-data /compscihomes/tkid3/public_html

Just wondering if it doesnt like root owndership of the public_html as you have told it deny the root user in the userdir option.

[PyROm]

Also worth a try, ubuntu uses apparmor rather then selinux, try

service apparmor stop

 

Apparmor is a security system (like selinux) that restricts what folders applications can access.

[JRA]

If it's any help, if I change the "denied" to "granted" in apache2.conf for the root dir I get "not found" rather than "denied" - as in, this bit:

 

       Options FollowSymLinks
       AllowOverride None
       Require all denied

 

In fact, that whole section looks like:

 

       Options FollowSymLinks
       AllowOverride None
       Require all denied



       AllowOverride None
       Require all granted



       Options Indexes FollowSymLinks
       AllowOverride None
       Require all granted


#
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#


       Options Indexes FollowSymLinks MultiViews
       AllowOverride None
       Require all granted

 

Any clues? Also, any merit in commenting out the "AccessFileName .htaccess" section or no?