1

I have OS CentOS Linux release 7.6.1810 (Core). I try just start almost pure httpd.service. I run command:

systemctl start httpd.service

I try run this from my user and from root - it is not different. In my error log I noticed string:

pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"

I thought that error was here. after my attempts to correct it, I tried replace in files /etc/pam.d/password-auth-ac and /etc/pam.d/system-auth Old string:

auth requisite pam_succeed_if.so uid >= 1000 quiet_success

With new string:

auth requisite pam_succeed_if.so quiet_success

this error string transform to

pam_succeed_if(sshd:auth): no condition detected; module succeeded

I tried reinstall httpd - it didn't work. Now full error log on image. I just want to start my httpd.

enter image description here

  • 1
    Can you disable the /etc/httpd/conf.d/vhost.conf file and see if httpd works? To disable it, just rename file to another extension, say vhost.conf.bak. – Haxiel Jan 2 at 9:17
  • @Haxiel Oh yearh. It started ok. It is very strange because .conf file example I take from linode.com/docs/web-servers/apache/… I only set my ServerAdmin, ServerName, ServerAlias. – Vladimir Goncharuk Jan 2 at 9:33
  • @Vladimir To check what's wrong with that specific configuration file, you can enable it (rename it back to vhost.conf) and then run apachectl configtest. That should give you a more accurate error message. – Haxiel Jan 2 at 9:39
  • @Haxial Ok. I have:AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf.d/vhost.conf:1 Syntax OK – Vladimir Goncharuk Jan 2 at 9:49
  • Okay, so you don't seem to have any configuration errors. Can you verify that the the directories specified in the virtual host configuration exist on the system? (/var/www/html/example.com/public_html/, /var/www/html/example.com/logs/). – Haxiel Jan 2 at 10:42
0

Problem was in SELinux. In order to check this is our case or not run from root:

setenforce 0

Then

sudo systemctl restart httpd.service

If the problem disappears then it is probably our case. For additional check: Add log debug level in main .conf httpd file. In my case /etc/httpd/conf/httpd.conf I added in this file:

LogLevel debug

Then set back setenforce to 1 and restart httpd. In error logs you may see some like this:

(13)Permission denied: AH00091: httpd: could not open error log file /var/www/example.com/logs/error.log If you see this - that it is exactly our case. Then we need:

  1. set setenforce to 0.
  2. Change type of out log files with this command

    chcon -t httpd_sys_rw_content_t error.log

  3. set setenforce to 1.

  4. restart httpd.service

After steps - all should be work fine.

P.S. Don't forget open your ports in firewall-cmd.

  • The reason SELinux is preventing you from saving your logs there is because the /var/www directory is defined in the policy as being for web content. Putting logs there is potentially dangerous. Logs go in /var/log/httpd/ (or a sub directory within). – jsbillings Jan 3 at 1:43
  • Also, if you absolutely have to put the logs in /var/www, you should amend the SELinux policy so it knows it. Using “chcon” sets the attributes on the files that exist, but new files will not be labeled properly. Look at using “semanage fcontext ...” to set up a local policy for the context. – jsbillings Jan 3 at 1:47
  • @jsbillings Putting logs in /var/www more comfortable and spread using, especially when using multiple virtual hosts. For example, see digitalocean.com/community/tutorials/… They put logs in /var/www. – Vladimir Goncharuk Jan 3 at 8:49
  • Well, their suggestions will break selinux. Digitalocean regularly suggests turning off security features, that’s why they have so many compromised servers. You could always keep the logs in /var/log/httpd/example.com/ and create a symlink in your /var/www directory if you find it hard to remember. – jsbillings Jan 3 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.