Forum: NGINX 403 after changing root, but permissions look correct

99f6b76dbca18e0ef1be09e7b54b3629?d=identicon&s=25 Adam Pearlman (Guest)
on 2014-03-23 16:49
(Received via mailing list)
I've been struggling with this for a few hours.

I installed nginx 1.4.6 on Fedora 20. The test page displayed fine. I
changed the root, leaving all other configuration the same, and I get a
403
Forbidden error.

If I look at the permissions for the original test page and the new
page,
they appear identical.

Working test page:
namei -om /usr/share/nginx/html/index.html
f: /usr/share/nginx/html/index.html
dr-xr-xr-x root root /
drwxr-xr-x root root usr
drwxr-xr-x root root share
drwxr-xr-x root root nginx
drwxr-xr-x root root html
-rw-r--r-- root root index.html

Not working:
namei -om /var/www/html/index.html
f: /var/www/html/index.html
dr-xr-xr-x root root /
drwxr-xr-x root root var
drwxr-xr-x root root www
drwxr-xr-x root root html
-rw-r--r-- root root index.html

The error log seems to be what I would expect as well:
2014/03/23 12:45:08 [error] 5490#0: *13 open()
"/var/www/html/index.html"
failed (13: Permission denied), client: XXX.XX.XXX.XXX, server:
localhost,
request: "GET /index.html HTTP/1.1", host: "
ec2-XXX-XX-XXX-XXX.compute-1.amazonaws.com"

The Nginx config has "user nginx" - I tried using root and it made no
difference. I also made user ngnix the owner & group of the files, but
that
didn't work. If I move the index file from /var/www/html to
/usr/share/nginx/html (the test file location) it works fine making me
suspect the path, but as I said, permissions appear correct.

Any help would be very much appreciated. Thanks!

- Adam

I've included the config file below just in case:

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log;
#error_log  /var/log/nginx/error.log  notice;
#error_log  /var/log/nginx/error.log  info;

pid        /run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local]
"$request"
'
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    # Load modular configuration files from the /etc/nginx/conf.d
directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    index   index.html index.htm;

    server {
        listen       80;
        server_name  localhost;
        root         /usr/share/nginx/html; ################THIS WORKS
        #root         /var/www/html; #####################THIS DOESN'T

        #charset koi8-r;

        #access_log  /var/log/nginx/host.access.log  main;

        location / {
        }

        # redirect server error pages to the static page /40x.html
        #
        error_page  404              /404.html;
        location = /40x.html {
        }

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on
127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME
/scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }

    # another virtual host using mix of IP-, name-, and port-based
configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;
    #    root         html;

    #    location / {
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443;
    #    server_name  localhost;
    #    root         html;

    #    ssl                  on;
    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;
    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers   on;

    #    location / {
    #    }
    #}

}
671d9faabfe3d3382be736b93fbfa1d5?d=identicon&s=25 Steve Holdoway (Guest)
on 2014-03-23 22:36
(Received via mailing list)
Having just had a similar problem with migrating a MySQL database, I
suggest that you check whether SELinux/Apparmor is running.

Why prople think it's ok to use a program that can be switched off in an
instant to improve their 'security' is and always will be a mystery to
me!

Cheers,

Steve

On Sun, 2014-03-23 at 11:48 -0400, Adam Pearlman wrote:
> namei -om /usr/share/nginx/html/index.html
> f: /var/www/html/index.html
> HTTP/1.1", host: "ec2-XXX-XX-XXX-XXX.compute-1.amazonaws.com"
>
>
>     worker_connections  1024;
>
>     # Load modular configuration files from the /etc/nginx/conf.d
>         root         /usr/share/nginx/html; ################THIS WORKS
>         #
>         # proxy the PHP scripts to Apache listening on 127.0.0.1:80
>         #    fastcgi_pass   127.0.0.1:9000;
>         #    deny  all;
>     #    root         html;
>     #    server_name  localhost;
>     #    ssl_prefer_server_ciphers   on;
>
>     #    location / {
>     #    }
>     #}
>
> }
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

--
Steve Holdoway BSc(Hons) MIITP
http://www.greengecko.co.nz
Linkedin: http://www.linkedin.com/in/steveholdoway
Skype: sholdowa
99f6b76dbca18e0ef1be09e7b54b3629?d=identicon&s=25 Adam Pearlman (Guest)
on 2014-03-24 15:32
(Received via mailing list)
Turns out this was my fault. I was using "sudo service nginx start"
instead
of just "sudo nginx."
Please log in before posting. Registration is free and takes only a minute.
Existing account

NEW: Do you have a Google/GoogleMail, Yahoo or Facebook account? No registration required!
Log in with Google account | Log in with Yahoo account | Log in with Facebook account
No account? Register here.