130	2.766497	TCP	74	44970?80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1029178963 TSecr=0 WS=16
131	2.768022	TCP	60	80?44970 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
132	2.800200	TCP	74	27779?80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1029178972 TSecr=0 WS=16
133	2.801724	TCP	60	80?27779 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

[More Info ]

[/network/web/server] permanent link

[ More Info ]

[/network/web/server/apache] permanent link

Forbidden

You don't have permission to access / on this server.

I'd encountered the problem in the past when there was a problem with permissions on the user's home directory. I didn't see any log files for the site in the directory under the user account, either, where the ErrorLog and CustomLog directives in the VirtualHost section for the website should have placed them. I checked the access for the user's home directory and found that the only access to that directory was read, write, and execute access for the user's account.

# ls -ld /home/jim
drwx------ 5 jim jim 4096 Jan 22 21:44 /home/jim

When I added "search" access for the group and all users to the user's home directory from the root account, I was able to access the website from a browser.

# chmod ga+x /home/joe

I.e., the cause of the problem had been the same as the last time I encountered the error message.

[/network/web/server/apache] permanent link

With a telnet program you can send commands/headers to a web server to emulate those that a browser would send to a web server and observe the responses from the server. This can be useful in some troubleshooting efforts. E.g, see Testing acces to a website using PuTTY for how to configure PuTTY on a Microsoft Windows system to perform a basic connectivity test to port 80 and request a web page for a particular site from the server.

[/network/web/server] permanent link

# grep resuming /var/log/httpd/error_log
[Sun Nov 09 03:29:02.631763 2014] [mpm_prefork:notice] [pid 20663] AH00163: Apac
he/2.4.6 (CentOS) configured -- resuming normal operations

[/network/web/server/apache] permanent link

Forbidden

You don't have permission to access / on this server.

When I looked in the error log for the site, I saw the following:

Checking the public_html directory and the directories beneath it, I saw that owner, group, and world all had "execute" access, i.e., the capability to search through the directories.

$ ls -ld public_html
drwxrwxr-x. 14 jdoe jdoe 4096 Nov  5 21:04 public_html

But, checking the user's home directory I found there was no access to it except for the owner. When I changed that access to grant search access to other accounts in the same group and all accounts, then the website became visible.

$ chmod ga+x /home/jdoe
$ ls -ld /home/jdoe
drwx--x--x. 13 jdoe jdoe 4096 Nov  5 21:17 /home/jdoe

You can check the permissions on a directory and the directories above it up to the root directory with just one command using the namei -m command in the form namei -m /path_to_directory/dirname. E.g.:

$ namei -m /home/jdoe/public_html
f: /home/jdoe/public_html
 drwxr-xr-x /
 drwxr-xr-x home
 drwx--x--x jdoe
 drwxrwxr-x public_html

[/network/web/server/apache] permanent link

Redirect 301 /dir1/dir2/example.html /dir1/dir2/example.php

In the Apache error log for the website, I saw the following:

[Wed Mar 19 21:05:17 2014] [alert] [client 192.168.0.10] /home/jdoe/public_html/dir1/dir2/dir3/.htaccess: AuthUserFile not allowed here, referer: http://support.moonpoint.com/dir1/dir2/example.php

That error log entry was created when I clicked on a link I had in example.php to access a file in the directory dir3, which was below the one in which example.php was located.

To allow the redirect to work, I had inserted the following code in the VirtualHost section for the website within Apache's /etc/httpd/conf/httpd.conf file.

<Directory /home/jdoe/public_html/dir1/dir2>
    AllowOverride FileInfo
</Directory>


The .htaccess file for controlling access to the subdirectory dir1/dir2/dir3 had worked fine until I created another .htaccess file above it in dir2 for the redirect. The one for controlling access to dir3 with a username and password was similar to the following:

AuthUserFile /home/jdoe/public_html/.htpasswd-test
AuthGroupFile /dev/null
AuthName Testing
AuthType Basic
Require user test1


Because it contained AuthUserFile and AuthGroupFile, but I didn't specify AuthConfig within the <Directory> section for the virtual host in the httpd.conf file, but only FileInfo for AllowOverride, the authorization control no longer worked. When I changed the AllowOverride line to that shown below and restarted Apache with apachectl restart then both the redirect for the file in dir2 and the HTTP basic access authentication method for files in the subdirectory dir3 beneath dir2 both worked.

<Directory /home/jdoe/public_html/dir1/dir2>
    AllowOverride AuthConfig FileInfo
</Directory>

I had forgotten that by limiting AllowOverride to just FileInfo for dir2, I was effectively nullifying any other type of overrides in any subdirectores beneath it.

References:

1. Apache Core Feartures
   Apache HTTP Server Project

[/network/web/server/apache] permanent link

[ More Info ]

[/network/web/server/apache] permanent link

LoadModule authz_host_module modules/mod_authz_host.so

You can restrict access to a website that is set up as a virtual host by including information on what IP addresses should have access to documents on the website in a directory section Directory as shown below.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin webmaster@example.com
    DocumentRoot /home/www/example
    ErrorLog /home/www/example/logs/error.log
    CustomLog /home/www/example/logs/transfer.log common
    <Directory /home/www/example>
      Order Deny,Allow
      Deny from all
      Allow from 192.168 127.0.0.1
    </Directory>
</VirtualHost>

In the case above, access to the document root of the website, i.e., all documents on the website, is restricted to allow access only from IP addresses beginning with 192.168 and 127.0.0.1, which is the "localhost" address, meaning the address of the server itself. Anyone trying to access example.com from any other IP address would see the default webpage for the server, if any, not the example.com website.

References:

1. Access Control
   The Apache HTTP Server Project
2. Apache Module mod_authz_host
   The Apache HTTP Server Project
3. Learn how to configure Apache
   Date: September 29, 2003
   TechRepublic Articles

[/network/web/server/apache] permanent link

[ More Info ]

[/network/web/server/apache] permanent link