Fixing 403 Forbidden on alias directory with Apache

Question

I am trying to setup an alias to point to some directory on my filesystem not in DocumentRoot. Now I get a 403 Forbidden response. These are the steps taken: 1. edit http.conf, adding:

Alias /example "/Users/user/Documents/example"

then...

<Directory "/Users/user/Documents/example">
   Options Indexes FollowSymLinks MultiViews
   AllowOverride None
   Order allow,deny
   Allow from all</Directory>

2. setting permissions with chmod in terminal:

chmod 755 /Users/user/Documents/example

Now it should work? instead I get the access forbidden. This is the output from error_log:

[Sun Jul 24 06:57:57 2011] [error] [client xx.xx.xx.xx] (13)Permission denied: access to /example denied

Are there any other parts to your http.conf which could be overriding what you posted above? Do you have URLs on your server which do not throw 403? — patrickmdnet, Jul 24 '11 at 14:40
Anything under document root is loaded fine. I set the directory settings the same for the alias directory as the document root. — sjking, Jul 24 '11 at 15:12

score 28 · Accepted Answer · edited May 23 '17 at 12:09

28

I was having this issue on OS X too. It turned out gliptak was right, but I've some more detail to add.

We're both attempting to configure a virtual directory for a folder under a user's home folder; I think this is why we're having the problem. In my case, I had the following setup:

Home folder is /Users/calrion.
Virtual directory folder is /Users/calrion/Path/to/www.
There's a symlink /Users/calrion/Path pointing to /Volumes/Other/Users/calrion/Path.

The problem was the user and group _www (which Apache runs as on OS X) lacked execute access to /Users/calrion and /Volumes/Other/Users/calrion.

Running chmod o+x /Users/calrion and chmod o+x /Volumes/Other/Users/calrion resolved the issue (on OS X 10.7.4).

The rule here is that Apache requires execute access to all folders in the path in order to serve files. Without this, you'll get a HTTP 403 (forbidden).

edited May 23 '17 at 12:09

Community

1
1

answered Nov 13 '12 at 04:28

Calrion

3,202
1
28
30

1

@andi Are you sure you're having the same issue? When this issue occurs on OS X 10.9 I get an `error_log` message: "(13)Permission denied: access to /url/path/ denied (filesystem path '/Users/calrion/path/to/folder') because search permissions are missing on a component of the path". If not, perhaps ask a question where you can provide more details about what's going on. – Calrion Nov 03 '13 at 06:24
@Calrion it was caused by something else. Not properly configured httpd.conf. My fault. – andilabs Nov 03 '13 at 13:35
This worked perfectly for me. However, is there any way to fix this by adjusting the httpd config rather than changing the folder permissions? – Jun-Dai Bates-Kobashigawa Feb 24 '14 at 17:14
@Jun-DaiBates-Kobashigawa Try setting [AllowOverride](http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride) to `none`; that should prevent Apache looking for `.htaccess`files, which I believe is the only reason Apache needs access to all directories in the path. – Calrion Feb 25 '14 at 00:18
Had to also do this for OS X 10.9: http://wiki.apache.org/httpd/13PermissionDenied – SobiborTreblinka Mar 09 '14 at 19:11

score 15 · Answer 2 · edited Jan 11 '13 at 15:11

15

The last straw ;) Required local in the Directory Entry...

like

<Directory "/Users/user/Documents/example">
   Options Indexes FollowSymLinks MultiViews
   AllowOverride All
   Require local
   Order allow,deny
   Allow from all
</Directory>

if everything else doesn't work (correct Alias, Directory Entry in httpd.conf and correct mod/usr/grp).

keep in mind: if you put your site in user-space the apache user (running httpd) needs access to your home!

edited Jan 11 '13 at 15:11

Toto

89,455
62
89
125

answered Jan 11 '13 at 14:53

Mirco Ellmann

983
7
8

The home access was my issue. Where should we be putting the static folder? – varagrawal Mar 06 '16 at 01:27

score 10 · Answer 3 · answered Jul 03 '14 at 19:21

10

These are all very good answers. None of them worked for me.

I have an alias specified in OSX server pointing to a user directory. I spent a long while chmodding and messing with _www user, adding executable permissions recursively, uninstalling macports and all sorts of stuff trying to get this to work. I tried 777. Nope. No idea why it wasn't working.

Eventually, I just checked the "shared folder" checkbox in the Finder for that folder, and it worked, on the specified domain, with php active, the way I wanted it to. :/ ...so that was easy.

answered Jul 03 '14 at 19:21

greenland

289
3
6

checking the "shared folder" checkbox worked for me. I also had to remove Require local from my virtual host configuration. – Benjamin Sep 04 '14 at 08:30
I spent an hour to config apache, none of them worked. But this works perfectly. Thank you! – Lance Nov 12 '14 at 05:19

score 10 · Answer 4 · answered Jul 24 '11 at 18:17

10

Check permission on /Users/user/Documents/, /Users/user/ (higher level permissions are enforced first ...)

/bin/su into the user running Apache (like www, www-data) and cat a file in the /Users/user/Documents/example directory. That might point you to permission problems with your setup.

answered Jul 24 '11 at 18:17

gliptak

3,592
2
29
61

Here's the command that worked for me to login as _www: `sudo -s -u _www` (or I should say it didn't work, it immediately told me I didn't have permission on the parent directory if I tried it from the folder I wanted to share). From http://apple.stackexchange.com/questions/126302/how-to-login-as-a-different-bash-user-in-terminal – Marc Stober Jul 18 '14 at 12:07
But I am thinking this means it's probably not a good practice security-wise to share web files out of my Home directory. Have to think of a different way to test web files generated in a subdirectory of code I have in ~/Documents. – Marc Stober Jul 18 '14 at 12:08

score 6 · Answer 5 · answered Sep 27 '11 at 18:06

6

I was just having this exact same issue. What I found was SE_Linux was enabled, and the security context of the files in my Aliased directory was incorrect, missing httpd_sys_content_t.

You can view the security context with ls -Z. If your files/folders don't have httpd_sys_content_t then apache won't server them up! You can add the proper context with something like chcon -R --type=httpd_sys_content_t /new_html_directory. This will change the context of the files currently in the directory, but not any files that are added afterwards (for that you'll need to work with semanage). Your other option is to just leave the files under /var/www.

answered Sep 27 '11 at 18:06

sudol

207
3
10

2

there is no -Z option for ls, I'm in BSD Mac OS. I've just been using the /Library/WebServer/Documents directory, I assume is the same as /var/www under linux. When I have time I am going to start with a fresh install, probably build apache from source. – sjking Sep 29 '11 at 11:25
I see. Sorry I don't have much experience running Apache on OS X, but if you don't have to deal with SELinux, then it must just be permissions. Apache on OSX runs as _www on my machine. Did you already give _www access to your /Users/user/Documents/example? – sudol Oct 20 '11 at 01:28

score 4 · Answer 6 · answered Dec 29 '14 at 17:48

4

Here's what fixed it for me:

in /etc/apache2/httpd.conf

<Directory />
    Options FollowSymLinks
    AllowOverride None

    # REMOVE THESE LINES
    #Order deny,allow
    #Deny from all

    # ADD THIS LINE
    Require all denied
</Directory>

This change implements changes made in the apache update from 2.2 to 2.4. The OSX Yosemite update brought the apache update with it (PSA: if you're planning on upgrading to Yosemite, budget yourself a week to fix everything it breaks).

The weird thing is that I already got apache 2.4 working, and suddenly it breaks again....

PSA: if you're planning on upgrading to Yosemite, budget yourself a week to fix everything it breaks

answered Dec 29 '14 at 17:48

edan

1,119
1
14
13

Sounds crazy, but your code fixed it! -> Have changed to Yosemite and 1. "Options FollowSymLinks" was missing and 2. there were old apache 2.2 code. just added "Require all granted" / "denied" and everything works. – Fer To Mar 03 '15 at 12:06
Usually the OS X updates rename the `http.conf` to `http.con~previous` which can be recovered easily. Even though @edan is right, some fixing still needs to be done according to the updated apache. – Julian F. Weinert Jun 19 '15 at 21:32
This Require all granted/denied is the one missing from standard httpd.conf on most tutorial. Once I re-add it, it works again. Thanks. – Firanto Aug 20 '18 at 07:33

score 3 · Answer 7 · answered Aug 20 '13 at 22:32

After lots of time waste i fixed the issue and i wanted to share to save your time.

All the gentelmen above and on other posts has some correct parts in their answers but below is the sum

In your "/etc/apache2/httpd.conf" file:

1- change your document root

Original: DocumentRoot "/Library/WebServer/Documents"
Change to: DocumentRoot "/Users/yourname/www"

2- change

Original:

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>

Change to:

<Directory /Users/yourname/www>
    Options FollowSymLinks Includes ExecCGI
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>

3- Change:

Original:

<Directory "/Library/WebServer/Documents">

Change to:

<Directory "/Users/yourname/www">

4- Finally, you might not need this step if you are the supper user, this is to set the right permition on your new root folder

chmod 755 /Users/yourname/www

Hope this will help

Finally! Thank you so much for the 2nd step! Working fine on OS X 10.10.2. — Diéssica, Jul 09 '15 at 13:24

score 0 · Answer 8 · edited Apr 13 '17 at 12:45

0

I had to revert my apache config file and then set up the server again. found this useful: https://apple.stackexchange.com/questions/41143/how-to-revert-default-mac-apache-install-to-original

edited Apr 13 '17 at 12:45

Community

1
1

answered Mar 15 '16 at 18:46

TacoEater

2,115
20
22

score 0 · Answer 9 · edited Aug 04 '17 at 21:25

0

Quick Solution:

Use these commands as root on Linux:

find /var/www -type d -exec chmod 755 {} \;
find /var/www -type f -exec chmod 644 {} \;

edited Aug 04 '17 at 21:25

Remy Lebeau

555,201
31
458
770

answered Aug 04 '17 at 13:52

Israelmikan

1
1

score 0 · Answer 10 · answered Jul 24 '11 at 14:47

0

It certainly does look right, do a sanity check.

you restarted apache
check group and user ownership
I think the quotes can be removed
there is something in /Users/user/Documents/example ?
try 777

-sean

answered Jul 24 '11 at 14:47

Sean Kimball

4,506
9
42
73

I restarted apache. I changed user group too httpd user, www. and user owner to www. I rebooted. I removed the quotes, no difference. I put a test.php file in /Users/user/Documents/example... In document root, which is accessed by apache without any problems, ownership is set 755, and works. – sjking Jul 24 '11 at 14:54
have you got a case issue? /Users/user/Documents/example > /Users/User/Documents/Example – Sean Kimball Jul 24 '11 at 19:06

score 0 · Answer 11 · answered Jan 23 '12 at 21:38

0

SELinux was the culprit for me. If you're having this issue on a linux box and your alias and file permissions are correct than try doing a "setenforce 0" to put SELinux into permissive mode. That did the trick for me.

answered Jan 23 '12 at 21:38

ktbiz

586
4
13

Fixing 403 Forbidden on alias directory with Apache

11 Answers11

Linked