Solved DocumentRoot on apache

balanga said:
now make sure that files/directories involved are owned by www:www.
Click to expand...
Ehm, no. Suppose your web application gets hacked. Then they'll have access with the www user, if this user has write access to the document root (or other directories) they'll have all the access needed to completely wreck your website, insert malware, deface it.

Leave permissions as root:wheel, and give 'other' read access (and execute on directories). That's enough for the web server to be able to serve the content. The www user rarely needs write permissions, although some web applications might have a cache or temp directory. Set write permissions on those directories and nowhere else.
 
SirDice It's been a while, and my memory is foggy on this, but a while back, we had a proliferation of small sites we managed and we moved them all to /www from /usr/local/www to get them out of the way. I really don't remember the details but I expressed concern about having them starting from root. Afterwards I found other companies did such a thing--having a /www directory. Thoughts on this?
 
drhowarddrfine said:
having a /www directory. Thoughts on this?
Click to expand...
Not my preference, but I see no problems with it as long as the permissions/ownership are all sound. It's not going to make much difference if the webserver got hacked where the exact path on the filesystem is. Lots of people seem to think www is some sort of super limited user account, it's not. It's a user account like any other. It can do anything any regular user could do on the system, including starting processes and opening listening ports (above 1024).
 
SirDice said:
Ehm, no. Suppose your web application gets hacked. Then they'll have access with the www user, if this user has write access to the document root (or other directories) they'll have all the access needed to completely wreck your website, insert malware, deface it.

Leave permissions as root:wheel, and give 'other' read access (and execute on directories). That's enough for the web server to be able to serve the content. The www user rarely needs write permissions, although some web applications might have a cache or temp directory. Set write permissions on those directories and nowhere else.
Click to expand...
I changed DocumentRoot and thought I had setup the correct permissions but still get permission denied and can't tell where the problem lies.

Could I set the root partition with www:www ownership to make some progress? I'm running this in a jail so it shouldn't affect anything else.
 
drhowarddrfine said:
Afterwards I found other companies did such a thing--having a /www directory. Thoughts on this?
Click to expand...
As a mounted file system should not be tragic, but I would not do it as a sub-directory of root.
Usually the root file system is small, putting there directories that grow unlimited is not a good idea.
 
drhowarddrfine said:
but I'd still be concerned about other apps and programs expecting it under /usr/local/www/ and I'd have to fiddle with that.
Click to expand...
I think, that should be easy solvable with some configuration. But on the mean time I like to take things as they are,
packages as they are, and spend my time in more important things. But my case may be different: my work is not
about computers. My "important things" are not the ones of a computer professional.
 
I think I'll try it on /zroot/iocage/jails/TESTJAIL/usr/local

Can't do any harm. I can always recreate the jail and use the original DocumentRoot which worked.

I need to make some progress with this.

Am I correct in thinking that I won't be able to get PERMISSION DENIED with such a permission when all the subdirectoies are set to www:www ownership?
 
Look in httpd-error.log for the reason. I'm pretty sure filesystem permissions have nothing to do with it. Ownership doesn't matter if the 'other' group has read permissions.

And post your Apache config, not httpd.conf but the Virtualhost configuration file(s) you have in /usr/local/etc/apache24/Includes/.
 
httpd-error.log

Code: 
[Thu Aug 06 18:40:16.531208 2026] [autoindex:error] [pid 10242] [client 192.168.1.21:65495] AH01276: Cannot serve directory /usr/local/www/: No matching DirectoryIndex (index.php,index.html,index.html) found, and server-generated directory index forbidden by Option
s directive

I have an Includes/documentroot.conf

Code: 
DocumentRoot "/usr/local/www"
<Directory "/usr/local/www">
    AllowOverride All
    Require all granted
</Directory>

I'm not familiar with what should go in Includes and not used them before.
 
It cannot find a index.php or index.html file in that directory. And directory browsing is turned off by default. So you're not allowed to browse the directory, that's what the error is telling you. This has nothing to do with filesystem permissions.

Change that file to:
Code: 
<VirtualHost _default_:80>
  ServerName mysite.example.com
  DocumentRoot "/usr/local/www/apache24/data"

  <Directory "/usr/local/www/apache24/data">
    AllowOverride All
    Require all granted
  </Directory>
</VirtualHost>
(I usually name this file with a _default_ virtualhost config as 000_default.conf, so it's clear what it is and what it's for)

That should show the default "It works" page. If you get that, we'll go with the next step.

mkdir -p /usr/local/www/mysite
/usr/local/www/mysite/index.html:
Code: 
<html>
<head>
<title>My first website</title>
</head>
<body>
<h1>Hello World!</h1>
</body>
</html>

Now change the Directory and DocumentRoot to /usr/local/www/mysite and reload Apache.
 
You must log in or register to reply here.
Back
Top