10

I am trying to set up an apache server on my Kubuntu 13.04 laptop. I have installed the apache2 package and sudo a2enmod userdir; sudo service apache2 restart, but still when I visit http://localhost/~user, it says something like this:

Forbidden

You don't have permission to access /~user on this server.

Apache/2.2.22 (Ubuntu) Server at localhost Port 80

Result of tail /var/log/apache2/access.log

127.0.0.1 - - [02/Aug/2013:16:22:01 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:16:22:02 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:17:35:30 +0200] "GET /~kaiyin HTTP/1.1" 403 501 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:17:35:30 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:17:35:30 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:17:36:26 +0200] "GET /favicon.ico HTTP/1.1" 404 499 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:17:36:26 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:21:05:17 +0200] "GET /~kaiyin HTTP/1.1" 403 501 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:21:05:17 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"
127.0.0.1 - - [02/Aug/2013:21:05:17 +0200] "GET /favicon.ico HTTP/1.1" 404 498 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.71 Safari/537.36"

Result of tail /var/log/apache2/error.log

[Fri Aug 02 21:05:17 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:05:17 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:06:54 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:06:54 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:06:59 2013] [error] [client 127.0.0.1] (13)Permission denied: access to /~kaiyin denied
[Fri Aug 02 21:06:59 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:06:59 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:07:17 2013] [error] [client 127.0.0.1] (13)Permission denied: access to /~kaiyin denied
[Fri Aug 02 21:07:17 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Fri Aug 02 21:07:17 2013] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
2
  • Do you have a public_html directory for the user? Does the user running apache have permission to read it?
    – jordanm
    Commented Aug 2, 2013 at 14:38
  • @jordanm Yes, I have set it to 755, also tried 777.
    – qed
    Commented Aug 2, 2013 at 19:10

4 Answers 4

11

The public_html directories need to have their permissions like this so that the user that Apache is running as can access it:

$ chmod -R 755 ~/public_html

still not work?

If you look in your Apache error logs you might see a line like this:

[Fri Aug 02 21:06:59 2013] [error] [client 127.0.0.1] (13)Permission denied: access to /~kaiyin denied

This is telling you that Apache doesn't have permissions to navigate to your user's directory (~kaiyin) in this example.

How to fix this?

You need to make sure that read + execute bits are set for either a group that Apache is a member of or the others read + execute bits are set on the user's directory as well so that Apache can access the public_html folder down below.

Example

/home
|-- [drwxr-x---]  /home/sam

/home/sam
|-- [drwxr-xr-x]  /home/sam/public_html

References

14
  • I have already done that, but I still got a 403 forbidden.
    – qed
    Commented Aug 2, 2013 at 15:36
  • @CravingSpirit - tail the apache logs (/var/log/httpd/access.log) and (/var/log/httpd/error.log) to see if there are any additional messages.
    – slm
    Commented Aug 2, 2013 at 15:39
  • I have added the log to the post.
    – qed
    Commented Aug 2, 2013 at 19:11
  • @CravingSpirit - notice the access denied on the ~kaiyin`? Apache's user doesn't have access to the top level directories of the users. You need read + execute rights so that it can access them.
    – slm
    Commented Aug 2, 2013 at 19:16
  • 2
    Actually, you almost certainly don't need 755; 711 or even 710 group www-data should do on the parents of public_html; it will do on public_html too if you don't need file listings, otherwise Apache will need read too (so 755/750 rather than 711/710).
    – user
    Commented Aug 2, 2013 at 21:23
1
<IfModule mod_userdir.c>
UserDir public_html
UserDir disabled root

  <Directory /home/*/public_html>
    AllowOverride All
    Options MultiViews Indexes SymLinksIfOwnerMatch
    <Limit GET POST OPTIONS>
      # Apache <= 2.2:
      #Order allow,deny
      #Allow from all

      # Apache >= 2.4:
      Require all granted
    </Limit>
    <LimitExcept GET POST OPTIONS>
      # Apache <= 2.2:
      #Order deny,allow
      #Deny from all

      # Apache >= 2.4:
      Require all denied
    </LimitExcept>
  </Directory>
</IfModule>

Make sure you have the correct settings in /etc/apache2/mods-enabled/userdir.conf. I was getting permission denied after chmodding my public_html and then decided to check the userdir.conf. I noticed there was settings for earlier apache versions, as well as newer. I knew I was running the latest so enabled the newer settings and now all is working fine

1
  • Thank you for including the the Apache <=2.2 info, that's why it wasn't working for me and is what I needed! Commented May 9, 2020 at 11:01
0

Also you can use /etc/hosts file to eliminate the need of temporary URL. If there is reference for the complete URL in theme or plugin (if you have any) the site won't show up the contents in proper format.

0

It is most likely a folder does not have search(x) permissions or a file does don't have read(r) permissions

namei -ml /home/joe/public_html/index.html

f: /home/joe/public_html/index.html
drwxr-xr-x root  root  /
drwxr-xr-x root  root  home
drwxr-x--- joe joe joe
drwxrwxr-x joe joe public_html
-rwxr-xr-x joe joe index.html

Apache needs to search and read all folders from the root (/) till index.html (ie must have r & x permissions). If you notice from the above, /home/joe does NOT allow other users to read (r) or search (x).

Solution 1:

Add the apache2 user (in my case www-data), to the logged in user group. This way www-data has access to everything user /home/joe.

In my case apache2 run under the user named www-data. So we need to add www-data user into the group joe

adduser www-data joe

Also all files under public_html must have rx permissions for the group.

chmod -R g+rw /home/joe/public_html

This is less secure as any file under /home/joe can be accessed by the apache server. If apache2 admin accidentally changes the configuration to access some_private_folder instead of public_html, others can easily access these.

Solution 2:

Allow any other to search(x) /home/joe

chmod o+x /home/joe

Also all files under public_html must be accessible by others for rx permissions.

chmod -R o+rw /home/joe/public_html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .