Apache 2.4 with mod_wsgi: 403 Forbidden, don’t have permission to access /calbase on this server

apache-2.4djangomod-wsgi

So I am trying to deploy my django project on a windows server, using apache 2.4 with mod_wsgi and pythong 3.4. Before I configure httpd.conf and just try start apache with mod-wsgi installed, it works and show me that "it works" page. then I did the following configuration in httpd.conf:

# Change Python path used by the server.
WSGIPythonPath “/EquipmentCalibration”

# Make calls to http://localhost/ refer to the Python/WSGI-script located at the specified location.
WSGIScriptAlias / /EquipmentCalibration/equipcal/wsgi.py

# Make calls to http://localhost/static refer to the specified folder.
Alias /static/ /EquipmentCalibration/static

Alias /media/ /EquipmentCalibration/media

<Directory /EquipmentCalibration/static>
Require all granted
</Directory>

<Directory /EquipmentCalibration/media>
Require all granted
</Directory>

<Directory /EquipmentCalibration/equipcale>
<Files wsgi.py>
Require all granted
</Files>
</Directory>

And then try to go to localhost:8080 (I changed the port from 80 to 8080), I got this error saying:

Forbidden

You don't have permission to access / on this server.

And below is the relevant error.log.

[Thu Sep 29 15:05:25.171920 2016] [mpm_winnt:notice] [pid 7756:tid 528] AH00456: Apache Lounge VC10 Server built: Jul  9 2016 11:59:00
[Thu Sep 29 15:05:25.171920 2016] [core:notice] [pid 7756:tid 528] AH00094: Command line: 'C:\\Apache24\\bin\\httpd.exe -d C:/Apache24'
[Thu Sep 29 15:05:25.171920 2016] [mpm_winnt:notice] [pid 7756:tid 528] AH00418: Parent: Created child process 7524
[Thu Sep 29 15:05:25.500078 2016] [wsgi:warn] [pid 7524:tid 456] mod_wsgi: Compiled for Python/3.4.2.
[Thu Sep 29 15:05:25.500078 2016] [wsgi:warn] [pid 7524:tid 456] mod_wsgi: Runtime using Python/3.4.3.
[Thu Sep 29 15:05:26.171978 2016] [mpm_winnt:notice] [pid 7524:tid 456] AH00354: Child: Starting 64 worker threads.
[Thu Sep 29 15:05:27.174429 2016] [mpm_winnt:notice] [pid 7636:tid 456] AH00364: Child: All worker threads have exited.
[Thu Sep 29 15:05:29.923754 2016] [authz_core:error] [pid 7524:tid 1108] [client ::1:55483] AH01630: client denied by server configuration: C:/EquipmentCalibration/equipcal/wsgi.py

Best Answer

You've got WSGIScriptAlias ... equipcal without e but then you've got <Directory /EquipmentCalibration/equipcale> which ends in e. Make them the same and restart httpd.

Related Solutions

Cannot run mod_wsgi on Apache 2.4 x64 Windows

In my case the problem was wyth Python - it's x86 while everithing else is x64 (thanks to https://stackoverflow.com/questions/10447094/installing-mod-wsgi-module-for-apache)

Also the module import should be (thanks to Can't locate API module structure `mod_wsgi')

LoadModule wsgi_module modules/mod_wsgi.so

not

LoadModule mod_wsgi modules/mod_wsgi.so

Linux – Random 403 Forbidden error (Apache 2.4)

I was having this exact problem, I am not sure if the below reason is what always causes this error(specifically in the described in the question way) but this was the case for me, so I just wanted to share my thoughts.

Debian 7 wheezy (7.7), apache 2.2.2

I was making a feature when the user should change the messages' status as read/unread, while clicking on a "link", when ajax was being sent to server, so, while testing - quickly clicking on that link to see if it works fine(so it wont be 2 concurrent ajax requests) I got this error

Forbidden

You don't have permission to access /messages on this server.

The strange part was that before that there were a few successful ajax requests with normal path including the domain name like http://example.com/messages/changeStatus/11. Which means the code was ok. But, on the other hand if I could just wait a few seconds and try again, it would work fine.

I had mod-security and mod-evasive installed, so after this error I found these last lines from /var/log/apache2/modsec_audit.log file.

--ba0f4035-E--
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /messages/changeStatus/24
on this server.</p>
</body></html>

--ba0f4035-H--
Apache-Error: [file "mod_evasive20.c"] [line 246] [level 3] client denied by server configuration: /home/user_name/www/example/messages, referer: http://example.com/messages
Stopwatch: 1421177262896100 4724 (- - -)
Stopwatch2: 1421177262896100 4724; combined=10, p1=0, p2=0, p3=2, p4=0, p5=7, sr=0, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/).
Server: Apache/2.2.22 (Debian) PHP/5.4.36-0+deb7u1 mod_ssl/2.2.27 OpenSSL/1.0.1h

--ba0f4035-Z--

Doing some more search, as I found out the log's error in this article. https://www.atomicorp.com/wiki/index.php/Mod_evasive

so, mod evasive is the reason, because the default params of it are too sensitive, mainly in /etc/apache2/mods-available/mod-evasive.conf file by default I had these options

<ifmodule mod_evasive20.c>
   DOSHashTableSize 3097
   DOSPageCount  2
   DOSSiteCount  50
   DOSPageInterval 1
   DOSSiteInterval  1
   DOSBlockingPeriod  10
   DOSLogDir   /var/log/mod_evasive
   DOSEmailNotify  EMAIL@DOMAIN.com
   DOSWhitelist   127.0.0.1
</ifmodule>

as we learn from the above link

MODEV_DOSPageCount - This is the threshhold for the number of requests for the same page (or URI) per page interval. Once the threshhold for that interval has been exceeded, the IP address of the client will be added to the blocking list.

and

MODEV_DOSPageInterval - The interval for the page count threshhold; defaults to 1 second intervals.

So, according to default options if I would do 2 requests for the same url during 1 second it would show 403 error, and it was smth that happened to me: ASA I increased the number to 20, I was unable already replicate the error message.

on other hand

MODEV_DOSBlockingPeriod The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list. During this time, all subsequent requests from the client will result in a 403 (Forbidden) and the timer being reset (e.g. another 10 seconds). Since the timer is reset for every subsequent request, it is not necessary to have a long blocking period; in the event of a DoS attack, this timer will keep getting reset

so, as we can see, after DOSBlockingPeriod time has passed the ip will be deleted from blacklist; as I am guessing this is the reason, that there are no banned IPs in logs, also that, when clicking F5 after a few seconds it works fine, as the blocked period has passed.

I also tested this with long blocking period and small page count values, mainly setting 1000 and 1 respectively. and After a 2-3 ajax requests it started showing 403 and did not go away after a few seconds.

Hope this will help someone.

Best Answer

Related Solutions

Cannot run mod_wsgi on Apache 2.4 x64 Windows

Linux – Random 403 Forbidden error (Apache 2.4)

Related Topic