Apache 13 权限在用户的主目录中被拒绝

Apache 13 permission denied in user's home directory

提问by Dave

My friend's website was working fine until he moved the document root from /var/www/xxxto /home/user/xxx.

我的朋友的网站工作正常，直到他从移动文档根/var/www/xxx来/home/user/xxx。

Apache gives 13 permission denied error messages when we try to access the site via a web browser.

当我们尝试通过 Web 浏览器访问该站点时，Apache 会给出 13 条权限被拒绝的错误消息。

The site is configured as a virtual directory. All the Apache configurations were unchanged (except for the directory change).

该站点被配置为虚拟目录。所有 Apache 配置均未更改（目录更改除外）。

We tried to chmod 777 /home/user/xxx, chown apache /home/user/xxx. But they didn't work.

我们试图chmod 777 /home/user/xxx，chown apache /home/user/xxx。但他们没有工作。

Is there some kind of security feature set on the user's home directories? The server OS is CentOS (Godaddy VPS).

用户的主目录是否设置了某种安全功能？服务器操作系统为 CentOS（Godaddy VPS）。

Any help is appreciated!

任何帮助表示赞赏！

Thanks!

谢谢！

回答by Dave

Turns out... we had to also chmod 755 the parent directory, user, in addition to xxx.

结果……除了xxx之外，我们还必须chmod 755父目录，用户。

回答by kek

im using CentOS 5.5 and for me it was SElinuxmessing with it, i forgot to check that out. you can temporary disable it by doing as root

我使用的是 CentOS 5.5，对我来说是SElinux搞砸了，我忘了检查。您可以通过以 root 身份暂时禁用它

echo 0 > /selinux/enforce

hope it help someone

希望它可以帮助某人

回答by selvakumar

selinux is cause for that problem.....

selinux 是导致该问题的原因.....

TException: Error: TSocket: Could not connect to localhost:9160 (Permission denied [13]) To resolve it, you need to change an SELinux boolean value (which will automatically persist across reboots). You may also want to restart httpd to reset the proxy worker, although this isn't strictly required.

TException：错误：TSocket：无法连接到 localhost:9160（权限被拒绝 [13]）要解决它，您需要更改 SELinux 布尔值（它将在重新启动后自动保持）。您可能还想重新启动 httpd 以重置代理工作器，尽管这不是严格要求的。

setsebool -P httpd_can_network_connect 1

setebool -P httpd_can_network_connect 1

or

或者

(13) Permission Denied

(13) 权限被拒绝

Error 13 indicates a filesystem permissions problem. That is, Apache was denied access to a file or directory due to incorrect permissions. It does not, in general, imply a problem in the Apache configuration files.

错误 13 表示文件系统权限问题。也就是说，由于权限不正确，Apache 被拒绝访问文件或目录。通常，这并不意味着 Apache 配置文件中存在问题。

In order to serve files, Apache must have the proper permission granted by the operating system to access those files. In particular, the User or Group specified in httpd.conf must be able to read all files that will be served and search the directory containing those files, along with all parent directories up to the root of the filesystem.

为了提供文件，Apache 必须具有操作系统授予的适当权限才能访问这些文件。特别是，httpd.conf 中指定的用户或组必须能够读取将提供的所有文件并搜索包含这些文件的目录，以及文件系统根目录下的所有父目录。

Typical permissions on a unix-like system for resources not owned by the User or Group specified in httpd.conf would be 644 -rw-r--r-- for ordinary files and 755 drwxr-x-r-x for directories or CGI scripts. You may also need to check extended permissions (such as SELinux permissions) on operating systems that support them.

对于不属于 httpd.conf 中指定的用户或组的资源，在类 Unix 系统上的典型权限对于普通文件为 644 -rw-r--r--，对于目录或 CGI 脚本为 755 drwxr-xrx。您可能还需要在支持它们的操作系统上检查扩展权限（例如 SELinux 权限）。

An Example

一个例子

Lets say that you received the Permission Denied error when accessing the file /usr/local/apache2/htdocs/foo/bar.html on a unix-like system.

假设您在类 Unix 系统上访问文件 /usr/local/apache2/htdocs/foo/bar.html 时收到 Permission Denied 错误。

First check the existing permissions on the file:

首先检查文件的现有权限：

cd /usr/local/apache2/htdocs/foo ls -l bar.htm

cd /usr/local/apache2/htdocs/foo ls -l bar.htm

Fix them if necessary:

如有必要，请修复它们：

chmod 644 bar.html

chmod 644 bar.html

Then do the same for the directory and each parent directory (/usr/local/apache2/htdocs/foo, /usr/local/apache2/htdocs, /usr/local/apache2, /usr/local, /usr):

然后对目录和每个父目录（/usr/local/apache2/htdocs/foo、/usr/local/apache2/htdocs、/usr/local/apache2、/usr/local、/usr）执行相同的操作：

ls -la chmod +x . cd ..

ls -la chmod +x 。光盘..

repeat up to the root

重复到根

On some systems, the utility namei can be used to help find permissions problems by listing the permissions along each component of the path:

在某些系统上，实用程序 namei 可用于通过列出路径的每个组件的权限来帮助查找权限问题：

namei -m /usr/local/apache2/htdocs/foo/bar.html

namei -m /usr/local/apache2/htdocs/foo/bar.html

If all the standard permissions are correct and you still get a Permission Denied error, you should check for extended-permissions. For example you can use the command setenforce 0 to turn off SELinux and check to see if the problem goes away. If so, ls -alZ can be used to view SELinux permission and chcon to fix them.

如果所有标准权限都正确，但您仍然收到 Permission Denied 错误，您应该检查扩展权限。例如，您可以使用命令 setenforce 0 关闭 SELinux 并检查问题是否消失。如果是这样，可以使用 ls -alZ 查看 SELinux 权限和 chcon 来修复它们。

In rare cases, this can be caused by other issues, such as a file permissions problem elsewhere in your apache2.conf file. For example, a WSGIScriptAlias directive not mapping to an actual file. The error message may not be accurate about which file was unreadable.

在极少数情况下，这可能是由其他问题引起的，例如 apache2.conf 文件中其他地方的文件权限问题。例如，WSGIScriptAlias 指令未映射到实际文件。关于哪个文件不可读的错误消息可能不准确。

DO NOT set files or directories to mode 777, even "just to test", even if "it's just a test server". The purpose of a test server is to get things right in a safe environment, not to get away with doing it wrong. All it will tell you is if the problem is with files that actually exist.

不要将文件或目录设置为模式 777，即使“只是为了测试”，即使“它只是一个测试服务器”。测试服务器的目的是在安全的环境中把事情做好，而不是做错事。它只会告诉您问题是否出在实际存在的文件上。

回答by Greg

Not sure if you've fixed it but in your httpd.conf

不确定您是否已修复它，但在您的 httpd.conf 中

Check to see your User/Group settings. Usually it will be set to

检查以查看您的用户/组设置。通常它会被设置为

User www Group www

用户 www 组 www

If so change it to your name/group

如果是这样，请将其更改为您的姓名/组

User Greg group staff

用户 Greg 组工作人员

回答by Josh

Apache's errorlog will explain why you get a permission denied. Also, serverfault.comis a better forum for a question like this.

Apache 的错误日志将解释为什么您的权限被拒绝。此外，serverfault.com是解决此类问题的更好论坛。

If the error log simply says "permission denied", su to the user that the webserver is running as and try to read from the file in question. So for example:

如果错误日志只是说“权限被拒绝”，则向用户表明网络服务器正在运行，并尝试从相关文件中读取。例如：

sudo -s
su - nobody
cd /
cd /home
cd user
cd xxx
cat index.html

See if one of those gives you the "permission denied" error.

看看其中一个是否会给您“权限被拒绝”错误。

回答by Josh

Can't you set the Loglevel in httpd.conf to debug? (I'm using FreeBSD)

不能在httpd.conf 中设置Loglevel 来调试吗？（我使用的是 FreeBSD）

ee usr/local/etc/apache22/httpd.conf

ee usr/local/etc/apache22/httpd.conf

change loglevel :

更改日志级别：

'LogLevel: Control the number of messages logged to the error_log. Possible values include: debug, info, notice, warn, error, crit, alert, emerg.'

'LogLevel：控制记录到 error_log 的消息数量。可能的值包括：debug、info、notice、warn、error、crit、alert、emerg。

Try changing to debug and re-checking the error log after that.

尝试更改为调试并在此之后重新检查错误日志。

回答by nobody

Could be SELinux. Check the appropriate log file (/var/log/messages? - been a while since I've used a RedHat derivative) to see if that's blocking the access.

可能是 SELinux。检查适当的日志文件（/var/log/messages？ - 自从我使用 RedHat 衍生产品以来已经有一段时间了），看看它是否阻止了访问。

回答by Carlos Omar Brise?o Gutierrez

Error:

错误：

[error] [client 127.0.0.1] (13)Permission denied: Could not open password file: /home/XXX/svn/svn_password

Info:

信息：

##SELinux Security Context File Labels
#httpd_sys_content_t  The type used by regular static web pages with .html and .htm extensions.
#httpd_sys_script_ro_t  Required for CGI scripts to read files and directories.
#httpd_sys_script_ra_t  Same as the httpd_sys_script_ro_t type but also allows appending data to files by the CGI script.
#httpd_sys_script_rw_t  Files with this type may be changed by a CGI script in any way, including deletion.
#httpd_sys_script_exec_t  The type required for the execution of CGI scripts 

Solution:

解决方案：

[root@localhost]# perror 13
OS error code  13:  Permission denied
[root@localhost]# chown apache.apache /home/XXX/svn/ -R
[root@localhost]# semanage fcontext -a -t httpd_sys_script_rw_t  "/home/XXX/svn(/.*)?"
[root@localhost]# restorecon -R -v /home/XXX/svn/
[root@localhost]# restorecon reset /home/XXX/svn/ context
[root@localhost]# ls -dZ /home/XXX/svn/
drwxr-xr-x. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 /home/XXX/svn/
[root@localhost]# ls -dZ /home/XXX/svn/svn_password 
-rwxr-xr-x. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 /home/XXX/svn/svn_password
[root@localhost]# 

回答by Carlos Omar Brise?o Gutierrez

Have you changed the permissions on the individual files as well as just the directory?

您是否更改了单个文件以及目录的权限？

chmod -R 777 /home/user/xxx