RE: Forbidden web pages (Apache Users)

Hi Steve.

What you said I realized this morning. There are no symbolic links in either directory, so I don’t know why it’s confused. In the /var/www/mrtg, I have all the mrtg info page. The data I want is in the /var/www/html/mrtg page, which is within the document root.

From: Steve Swift [mailto:steve.j.swift@xxxxxxxxx]
Sent: Friday, January 19, 2007 11:45 AM
To: users@xxxxxxxxxxxxxxxx
Subject: Re: Forbidden web pages

I don't have an answer. I'll add what I found and maybe someone else can see what's going on.

>From your httpd.conf you have set DocumentRool to /var/www/html
So fetching a url such as http://servername/mrtg would try to fetch the file "mrtg" from directory /var/www/html - so it's looking for /var/www/html/mrtg

>From your error_log, the forbidden is being generated from a reference to /var/www/mrtg - this is outside the document root, so something has directed the URL reference of "/mrtg" to directory/file /var/www/mrtg

Do you have a symbolic link at /var/www/html/mrtg which points to /var/www/mrtg ? It's about the only thing I can think of.
Do you have anything at /var/www/mrtg on your susyem? If so, is it a file, or a directory?

On 19/01/07, Lowe, Grant <glowe@xxxxxxxx> wrote:

Hi Steve.

Thanks for such a quick reply. As you asked, here's the last few lines of the access_log:

[root@chenmr9 logs]# tail access_log

132.239.157.144 - - [19/Jan/2007:09:58:44 -0800] "POST / HTTP/1.1" 200 10343 "http://132.239.73.52/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

132.239.157.144 - - [19/Jan/2007:09:58:45 -0800] "GET /NoAuth/webrt.css HTTP/1.1" 200 12658 "http://132.239.73.52/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

132.239.157.144 - - [19/Jan/2007:09:58:45 -0800] "GET /NoAuth/printrt.css HTTP/1.1" 200 696 "http://132.239.73.52/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

132.239.157.144 - - [19/Jan/2007:09:58:49 -0800] "GET /Admin/ HTTP/1.1" 200 4851 "http://132.239.73.52/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

132.239.157.144 - - [19/Jan/2007:09:58:49 -0800] "GET /NoAuth/webrt.css HTTP/1.1" 200 12658 "http://132.239.73.52/Admin/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

132.239.157.144 - - [19/Jan/2007:09:58:49 -0800] "GET /NoAuth/printrt.css HTTP/1.1" 200 696 "http://132.239.73.52/Admin/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.8.1 (KHTML, like Gecko) Safari/312.6"

127.0.0.1 - - [19/Jan/2007:10:56:31 -0800] "GET /mrtg/imgdot-1x1-transp-ffffff.gif HTTP/1.1" 404 306 "http://localhost/mrtg/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.9) Gecko/20061222 CentOS/1.5.0.9-0.1.el4.centos4 Firefox/1.5.0.9"

132.239.157.153 - - [19/Jan/2007:11:19:35 -0800] "GET /mrtg HTTP/1.1" 403 285 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"

132.239.157.153 - - [19/Jan/2007:11:19:36 -0800] "GET /mrtg HTTP/1.1" 403 285 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"

132.239.73.52 - - [19/Jan/2007:11:19:53 -0800] "GET /mrtg HTTP/1.1" 403 285 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.9) Gecko/20061222 CentOS/1.5.0.9-0.1.el4.centos4 Firefox/1.5.0.9"

Here's the last lines of the error_log:

[Fri Jan 19 07:47:28 2007] [error] [client 132.239.73.52] client denied by server configuration: /var/www/mrtg/

[Fri Jan 19 09:00:22 2007] [error] [client 132.239.73.52] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 09:09:46 2007] [error] [client 132.239.73.52] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 09:28:34 2007] [error] [client 132.239.73.52] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 09:29:03 2007] [error] [client 132.239.157.153] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 09:41:58 2007] [error] [client 127.0.0.1] File does not exist: /var/www/mrtg/imgdot-1x1-transp-ffffff.gif, referer: http://localhost/mrtg/

[Fri Jan 19 10:56:31 2007] [error] [client 127.0.0.1] File does not exist: /var/www/mrtg/imgdot-1x1-transp-ffffff.gif, referer: http://localhost/mrtg/

[Fri Jan 19 11:19:35 2007] [error] [client 132.239.157.153] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 11:19:36 2007] [error] [client 132.239.157.153] client denied by server configuration: /var/www/mrtg

[Fri Jan 19 11:19:53 2007] [error] [client 132.239.73.52] client denied by server configuration: /var/www/mrtg

From: Steve Swift [mailto:steve.j.swift@xxxxxxxxx]
Sent: Friday, January 19, 2007 11:10 AM
To: users@xxxxxxxxxxxxxxxx
Subject: Re: Forbidden web pages

Also the entries from the error log would be useful. There are (at least) two distinct ways to get "Forbidden" - the httpd.conf doesn't say that apache can server pages from a particular {directory;URL;etc} or, the httpd.conf says that it *is* OK, but when apache gets to the file it wants to serve, the operating system says "you can't read that file".

On 19/01/07, Rob Sterenborg < rob@xxxxxxxxxxxxxxx> wrote:

Lowe, Grant <mailto:glowe@xxxxxxxx> wrote:
> Hi All.
>
> I'm getting the error:
>
> Forbidden
>
> You don't have permission to access /mrtg on this server.
>
> I have searched through Google and looked at various web pages and
> numerous USENET news groups.  I have checked the permissions
> on the mrtg and apache directories and files in question.  I have
> tried different browsers.  I have also looked through the FAQ,
> specifically, under Configuration, question 15 (Why do I get
> "Forbidden/You don't have permission to access / on this server"
> message whenever I try to access my server).  I have tried
> connecting from different computers.  Still the same result.  I'm
> running Apache 2.0.52 on a CentOS server.  Any ideas?

We don't know how you configured the webserver or virtual-host.
And since we don't, my advice would be to start looking at these places:
http://httpd.apache.org/docs/2.0/mod/mod_access.html#allow
(And: http://httpd.apache.org/docs/2.0/mod/mod_access.html#deny)
http://httpd.apache.org/docs/2.0/mod/mod_access.html#order

Check in your config files if you used these directives at multiple
places for the same VH.
Or post your config so someone can look at it.

Grts,
Rob

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

--
Steve Swift
http://www.swiftys.org.uk