New GCSE IT Controlled Assessment - Display MySQL Data in Web Page [Dreamweaver]?

[JRA]

Cheers yet again! Done both but still forbidden.

[JRA]

Oh now THIS is interesting...

 

Tailing error.log still, comes up with the following:

 

[Mon Oct 23 13:24:45.054456 2017] [authz_core:error] [pid 2359] [client 10.108.5.162:63212] AH01630: client denied by server configuration: /home/year10/tkid3/public_html

 

Now that's not where I want that, should be (as I'm sure we're all painfully aware by now) in /compscihomes/%kidname%/public_html

 

What pesty old bit of Linux is steering that I wonder?

[PyROm]

Are the folders under /compscihomes/ symlinks? or actual folders?

[JRA]

They're proper folders.

[pcstru]

Oh now THIS is interesting...

 

Tailing error.log still, comes up with the following:

 

[Mon Oct 23 13:24:45.054456 2017] [authz_core:error] [pid 2359] [client 10.108.5.162:63212] AH01630: client denied by server configuration: /home/year10/tkid3/public_html

 

Now that's not where I want that, should be (as I'm sure we're all painfully aware by now) in /compscihomes/%kidname%/public_html

 

What pesty old bit of Linux is steering that I wonder?

 

What is the users home set to (if you log in as them, what is the value of $HOME)? (will also show if you cat /etc/passwd )?

[pcstru]

Also if you create a file :

 

/home/year10/tkid3/public_html/index.html

 

Does that work?

[JRA]

Hi - that's promising looking:

 

root@compsci:/etc/apache2# getent passwd tkid3
tkid3:*:53350:11666:Test Kid3:/home/year10/tkid3:/bin/bash

[PyROm]

possibly quick cheating way

ln -s /compscihomes /home/year10

 

This will symlink the home folder back to your comsci folder, you will need to do it with each year. You may also need to allow foolow symlinks for /home (or just / if your not too bothered)

[PyROm]

Are you using samba to create users from ad? if so there is option for user home folder in smb.conf which will alter where it creates them.

[pcstru]

Hi - that's promising looking:

 

root@compsci:/etc/apache2# getent passwd tkid3
tkid3:*:53350:11666:Test Kid3:/home/year10/tkid3:/bin/bash

 

usermod -d

 

can be used to change the home. Should be something like :

 

sudo usermod -d /compscihomes/tkid3 tkid3

[PyROm]

I think I understand now, change the "userdir public_html" to "userdir /compscihomes/*/public_html" this should overide going to the users actual home folder.

[JRA]

I think I understand now, change the "userdir public_html" to "userdir /compscihomes/*/public_html" this should overide going to the users actual home folder.

Ta! Okay, tried that but still forbidden visiting http://compsci/~tkid3/file.html

usermod -d

 

can be used to change the home. Should be something like :

 

sudo usermod -d /compscihomes/tkid3 tkid3

 

Thanks! Had a bash but get "usermod: user 'tkid3' does not exist in /etc/passwd" even though getent passwd does spit them out (domain account.)

 

 

I've been getting the following similar thing in error.log:

 

[Mon Oct 23 14:49:29.363574 2017] [core:error] [pid 2119] (13)Permission denied: [client 10.108.5.162:64272] AH00035: access to /~tkid3/file.html denied (filesystem path '/compscihomes/tkid3/public_html') because search permissions are missing on a component of the path

Which is daft because permissions are wide open.

[PyROm]

what happens if you miss the file off and just try for the folder? eg http://compsci/~tkid3/

[JRA]

Same forbidden message:

 

[h=1]Forbidden[/h]You don't have permission to access /~tkid3/ on this server.

---

Apache/2.4.18 (Ubuntu) Server at compsci Port 80

[PyROm]

Have you created any .htaccess file in the folder any folders above?

If you do an ls-l does the file.html have a + on the end of the permissions?

When you ran the comand to disable apparmor did you try it again straight away or reboot? (turning apparmor off that way only stops it until next reboot, so rebooting would reset it again).

[JRA]

Not got an .htaccess file anywhere from root downwards.

 

Yes that file does have the "+" (indicates NTFS ACLs, that right?)

 

Tried again with apparmor disabled and still the same.

 

Cheers loads, yet yet again.

[PyROm]

I think the problem is that the ACL will be blocking it somewhere, acl`s are seperate to the normal 777 file permissions.... not used acl on linux before, but looks the below shpould work, after doing it run getfacl /compscihomes/tkid3/public_html/file.html to check it looks right.

setfacl -dm "g:www-data:rwx" /compscihomes

[JRA]

Okay had a bash with that, modified it slightly thus:

 

root@compsci:/compscihomes/tkid3# setfacl -Rdm g:www-data:rwx /compscihomes/
root@compsci:/compscihomes/tkid3# getfacl /compscihomes/tkid3/public_html/
getfacl: Removing leading '/' from absolute path names
# file: compscihomes/tkid3/public_html/
# owner: james
# group: www-data
user::rwx
user:root:rwx
user:domain\040admins:rwx
user:james:rwx
user:tkid3:rwx
group::---
group:domain\040admins:rwx
group:staff:---
group:tkid3:rwx
mask::rwx
other::rwx
default:user::rwx
default:user:root:rwx
default:user:domain\040admins:rwx
default:user:james:rwx
default:user:tkid3:rwx
default:group::---
default:group:www-data:rwx
default:group:domain\040admins:rwx
default:group:staff:---
default:group:tkid3:rwx
default:mask::rwx
default:other::r--

 

Still get forbidden.

[PyROm]

I cant see anything wrong with that, but im not used to linux acl`s. Im afraid im stuck here.

 

You could disable acl`s on the filesystem but that might break other things.

 

Alternatively you could reinstall, my preference is debian, ubuntu is based off it but a debian (so the commands and configs are mostly the same)minimal install is very small and doesnt have acls or apparmor on as default.

[JRA]

Yeah that'd break Windows access to the share. Gawd I wish they'd stop dreaming up these stupid bleedin' controlled assessments. I'm baffled as to how anyone could get this working...

 

Thanks much for the help though, really do appreciate it.

[PyROm]

Are you sure it would break access, it never used to (switched away from using samba as main fiel server 3 years ago)?

 

as a thought, try the setfacl command again, but dont put a trailing / in, it might not have set the acl`s on the /compscihome folder. so

setfacl -Rdm g:www-data:rwx /compscihomes

[JRA]

Yeah I'm fairly sure it'd undo that - I also need the teacher to be able to view /compscihomes itself (with sub-folders) so that's also shared in Samba. I'm alright with making up the folders manually for each student, but sorting access so the kids can't fiddle with just Unix ACLs is well beyond me.

 

I tried that out, still forbidden. :/

[PyROm]

Coming from another angle, what if rather then having a second storage area for them, you mounted the windows homes share on your windows server onto the linux server, I believe you can set the effective/fake permissions on the mount option, then served the webpages from there?

[JRA]

Lol, I know, like, some of the words you wrote there but I'm not sure I could do that!

 

Would it be ok to spell it out a bit for me?

 

The 'proper' home areas btw are on another Samba server.

[PyROm]

If it's any help, if I change the "denied" to "granted" in apache2.conf for the root dir I get "not found" rather than "denied" - as in, this bit:

 

       Options FollowSymLinks
       AllowOverride None
       Require all denied

 

 

Missed this bit, looks like they changed wildcard handling in apache 2.4, in theory what you have should still work but maybe its a bit buggy, try changing the direcory block to point to just /compscihomes in your userdir.conf, so it reads

 

       UserDir public_html
       UserDir disabled root

       
               AllowOverride FileInfo AuthConfig Limit Indexes
               Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec +ExecCgi
               AddHandler cgi-script cgi pl
               
                       Order allow,deny
                       Allow from all
               
               
                       Order deny,allow
                       Deny from all
               
       

 

also if you still have this section in your apache2.conf remove it, as it might be overiding your userdir.conf settings or vice versa

       Options Indexes FollowSymLinks MultiViews
       AllowOverride None
       Require all granted

 

I think the way you are setting up this server is probably the best way to do it from a security point of view. My sugestion of mounting the homedrives would allow you to serve files straight from their normal homedrive but could potentially open up security holes to let users get at each others normal home drives, especially if you are allowing scripting on the server. For linux to linux mount I would actually use nfs, when you mount anything on linux you can pass options on mount (or in fstab) to fake the owner and file permissions.