Forbidden with VirtualHost folder other than /var/www/html

[netweblogic]

I've got a bit of a pickle here:

I've got Fedora 9 on Windows VM, logged in as root. I'm just playing with it until we get our new server.

My apache setup seems to be working fine to a certain extent. I have set up test.lan on my windows machine to redirect to the VM IP (192.168.0.11) and can access it within my lan when accessing the default /var/www/html folder.
I have an index.php page showing phpinfo()

However, I set up a virtualhost and point test.lan to folder /var/www/vhosts/test.lan/httpdocs with the identical index.php page and I get a 403:

Forbidden

You don't have permission to access / on this server.
Apache/2.2.9 (Fedora) Server at test.lan Port 80

I then changed my virtualhost DocumentRoot to /var/www/html and it works fine. What could the problem be? I'll inform you of some of the steps I've already taken:

-Disabled SELinux
-tried setenforce 0
-tried setting the user and type contexts for selinux to duplicate the html folder in the httpdocs folder, test.lan and vhosts
-moved /var/www/html to /var/www/vhosts/test.lan/html to see if this folder still worked in a different location, but no luck
-change the document root to /var/www/vhosts/test.lan/httpdocs but no luck, and the html folder still works if defined in the virtualhost directive

None of these have had any effect, the only time it works is when the html folder is in it's original place, /var/www/html. It seems to me that from my experiments it's an issue with permissions in the filesystem so I give you a list of the html and httpdocs folders:

[root@localhost html]# ls -laZ
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 ..
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php

[root@localhost html]# ls -laZ ../vhosts/test.lan/httpdocs
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 ..
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php


Help!

[AlexDudko]

Put your vhosts directories into /var/www/html directory. Let them be /var/www/html/site1, /var/www/html/site2 and it should work.

[netweblogic]

No Luck. How strange, one would think that should work? I put here a list of the directories starting from /var/www/ drilling down to /var/www/vhosts/test.lan/httpdocs:

[root@localhost www]# ls -laZ
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root system_u:object_r:var_t:s0 ..
drwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 error
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 html
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 icons
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 manual
drwxr-xr-x webalizer root system_u:object_r:httpd_sys_content_t:s0 usage
drw-r--r-- root root system_u:object_r:httpd_sys_content_t:s0 vhosts
[root@localhost www]# cd html
[root@localhost html]# ls -laZ
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 ..
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php
drw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 vhosts
[root@localhost html]# cd vhosts
[root@localhost vhosts]# ls -laZ
drw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 ..
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 test.lan
[root@localhost vhosts]# cd test.lan
[root@localhost test.lan]# ls -laZ
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 .
drw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 ..
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 httpdocs
[root@localhost test.lan]# cd httpdocs
[root@localhost httpdocs]# ls -laZ
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 ..
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php
[root@localhost httpdocs]#

This has to be some permission problem somewhere?

[marcrblevins]

You have to list it twice in the httpd.conf file.

#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
#DocumentRoot "/var/www/html"
DocumentRoot "/home/marc/public_html"

#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#

#
# This should be changed to whatever you set DocumentRoot to.
#
#<Directory "/var/www/html">
<Directory "/home/marc/public_html">

[markkuk]

Originally Posted by netweblogic

[root@localhost www]# ls -laZ
(...)
drw-r--r-- root root system_u:object_r:httpd_sys_content_t:s0 vhosts

This has to be some permission problem somewhere?

Yes, you must set the "execute" permission for the vhosts directory.

[netweblogic]

Originally Posted by markkuk

Yes, you must set the "execute" permission for the vhosts directory.

Yup, that might have been it... thanks for spotting that markuk! I thought read was enough.

Thanks again!

[greg.harvey]

Edit: forget it, resolved ... simple, but no one else mentions it except in this one post:
http://forums.fedoraforum.org/showpo...64&postcount=3

I had chmod -R 755 /home/USER/workspace ... you must *also* chmod 755 /home/USER !!!


====================================
Ok, I've got projects checked out at :

/home/USER/workspace

There are several users on a system with different workspaces and I do not want to just put them under /var/www/html - I want them to live in home directories.

SELinux is Disabled, to rule it out. The UserDir module is also disabled to take it out of the equation. Typical vhost entry looks like this:

<VirtualHost *:80>
ServerName mcdc
DocumentRoot /home/USER/workspace/mcdc/trunk/www
ServerAdmin "webadmin@drupaler.co.uk"
<Directory /home/USER/workspace/mcdc/trunk/www>
        Options Includes FollowSymLinks
        Order allow,deny
        AllowOverride All
        Allow from all
</Directory>
</VirtualHost>

Always worked in the past, Windows, Ubuntu, Debian. Remember, SELinux is *OFF*, UserDir is *OFF*, I have set permissions (recursively) on /home/USER/workspace to 777 (for testing).

STILL A 403!! WTF?

This is madness. I'll have no hair if this carries on. I had *similar* issues on another workstation, which I solved and posted the resolution here:
http://drupaler.co.uk/blog/apache2-f...ng-rid-403/418

But the same steps have failed me totally this time.

I'm at a total loss. What could possibly be denying access to the user's home directory if SELinux is disabled and the UserDir module is commented out??

Hope someone can help. Thanks!

[netweblogic]

If you've set permissions recursively and it still doesn't work then I'm not sure what to say.... maybe you have a typo in in your httpd.conf or vhosts.conf file (maybe even a stray slash somewhere or something silly like that)?

[greg.harvey]

Hi - read the edit - the trick is the actual home director /home/USER must *also* have 755 permissions! That's what people don't seem to know. You must do this:

chmod 755 /home/USER
chmod -R 755 /home/USER/workspace

You *must* do *both* commands. =)

[netweblogic]

Yeah, that's the snag I ran into previously . Working down the directory tree each directory must be readable down the line.