Ubuntu – What else do I need to do to satisfy Apache working as a plain old media server

amazon ec2apache-2.4permissionsUbuntu

I am trying to set up an Apache VirtualHost on an Ubuntu 13.10 EC2 instance that will serve up media documents from a directory old-school-style. There is an existing VirtualHost which is handling a ProxyPass well enough, and the following:

<VirtualHost *:80>
    ServerName media.ccachicago.org
    ServerAlias media.ccachicago.pragmatometer.com
    DocumentRoot /home/ubuntu/ccachicago/media
    <Directory "/home/ubuntu/ccachicago/media">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        #Order deny,allow
        #Deny from all
        #Allow from 127.0.0.0/255.0.0.0 ::1/128
        Order deny,allow
        Deny from all
        Allow from 0.0.0.0/0.0.0.0 ::1/128
    </Directory>
    ServerAdmin CJSHayward@PObox.com
</VirtualHost>

media.ccachicago.pragmatometer.com/css/style.css is getting the following 403 error:

Forbidden

You don't have permission to access / on this server.

Apache/2.4.6 (Ubuntu) Server at media.ccachicago.pragmatometer.com Port 80

I've checked file permissions several ways, and as nobody I can cat /home/ubuntu/ccachicago/media/css/style.css, but I've only gotten a 403 on trying to access this VirtualHost. I've also checked that the <Directory> permissions above will allow media access to any client.

What else could I be doing that would stop the VirtualHost to serve up static media content as desired? The machine is a new Ubuntu 13.10 Amazon EC2 instance, and only has VirtualHosts, contents, etc. from the new project.

Best Answer

I needed to replace:

Order deny, allow
Deny from all
Allow from 0.0.0.0/0.0.0.0 ::1/128

with:

Require all granted

from https://stackoverflow.com/questions/11992466/apache-permission-denied

Related Solutions

Security – WebServer Permission problem, Ubuntu & Lighttpd

If you are using the Ubuntu package and didn't change things too much, the running process name should be lighttpd and the default user and group names are both www-data. Check the server.username and server.groupname entries in your config file (/etc/lighttpd/lighttpd.conf) to be certain.

Running ps -fC lighttpd should tell you if it is running and the user id that is is running as. On my system the output looks like

rik@mary:/home/rik$ ps -fC lighttpd
UID PID PPID C STIME TTY TIME CMD
www-data 667 1 0 03:50 ? 00:00:00 /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf

Everything you want displayed under your document-root should be readable by the www-data user and the directories need to be executable by www-data as well. To test this you may want to try using find as the user www-data. The sudo command can help with this. sudo -u www-data find /var/www/sites/mysite.com/http/media/css/ should succeed. If not try again one step up with sudo -u www-data find /var/www/sites/mysite.com/http/media/ and so on until find can return file and directory names. Once there the run the chown and chmod commands against that directory without the -R (recursive) flag. Then test again.

If you are comfortable with all of the files and directories under /var/www/sites/mysite.com/http/media being readable by anyone, you may want to chmod all the files as 644 and the dirs as 755. If you have files that need to have the execute bit set this can be a bit more of a problem unless the all have distinctive extensions. This is done using the -type, -exec, and -name flags like:

chown -R id:www-data /var/www/sites/mysite.com/http/media
find /var/www/sites/mysite.com/http/media -type d -exec chmod 755 {} \;
find /var/www/sites/mysite.com/http/media -type f -exec chmod 644 {} \;
find /var/www/sites/mysite.com/http/media -type f -name '*.php' -exec chmod 755 {} \;

If you don't want lighty to access other files an/or dirs in the tree, you will need to handle things differently. It is always easier if you keep files you want readable in a different directory from those you want kept out of the public eye.

Ssh – CopSSH SFTP — limit users access to their home directory only

create group 'SSH Users' in computer management
Add group to gpedit -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Allow log on locally (see Can't login to Cygwin sshd server with a non-administrator user account)
run gpupdate
Add ftpuser to group SSH Users
Append details in /etc/sshd_config:
```
Subsystem sftp internal-sftp

Match User ftpuser
    ChrootDirectory /home/ftpuser
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
```
(the keywords on the lines following the Match directive apply only to the user ftpuserand override those set in the global section of the config file, until either another Match line or the end of the file.)
Activate ftpuser user through copSSH wizard
Delete all .ssh .bashprofile files/folders under ftpuser folder
Set SvcCOPSSH user to root id 0
```
SvcCOPSSH:unused_by_nt/2000/xp:**0**:545:U...
```
(see http://www.itefix.no/i2/node/11956)
Might need to do the following as well in copSSH 'UNIX BASH Shell'
```
cd /
chown SvcCOPSSH /
chmod 0755 /
```
restart openssh service

Best Answer

Related Solutions

Security – WebServer Permission problem, Ubuntu & Lighttpd

Ssh – CopSSH SFTP — limit users access to their home directory only

Related Topic