43

I have changed the configuration of Apache to point towards a folder in my home directory:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost

    DocumentRoot /home/dbugger/html

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /home/dbugger/html/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

I have even given my /home/dbugger/html permission 777. But I still keep getting the same error message at http://localhost: "403 Forbidden"

What is it that I am missing?

4
  • What about /home/dbugger permission? Jul 28, 2013 at 3:30
  • You mean I should make 777 my whole home folder? That seems overdoing it. Even making 777 the html is not a safe solution. Im just doing it to try to identify the root of the problem. Jul 28, 2013 at 3:31
  • 2
    apache runs as user www-data. If that user doesn't have executing permission on your home, apache will not be able to read any file. Jul 28, 2013 at 3:34
  • Isn't there a way to add a subfolder of my home directory to the www-data wihtout having it to give complete access to the home folder? Following that logic seems like I would have to give access to ALL THE HOME folders as well, as I would have to give it access to /home. That seems too much Jul 28, 2013 at 3:37

5 Answers 5

32

This worked for me

<Directory />
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All
    Require all granted
    Allow from all
</Directory>

The important bit was to change

Order allow, deny

to

Require all granted 
8
  • you save my time ,I don't have to change permission May 12, 2014 at 14:32
  • Hi I'm glad that it helped you
    – szydan
    May 12, 2014 at 15:33
  • 3
    I took the liberty of looking up what "require all granted" was and found that it is the "new equivalent" of Allow from all from apache 2.4 onwards - serverfault.com/questions/549517/… May 15, 2014 at 13:13
  • 10
    nope, granting access to the whole root is never a good idea!
    – bjunix
    Sep 24, 2014 at 15:13
  • 12
    Setting AllowOverride to All on your root directory is reckless at best! See httpd.apache.org/docs/2.4/mod/core.html#allowoverride for details.
    – Bombe
    Jul 24, 2015 at 11:47
24

Enable userdir module:

sudo a2enmod userdir 

Enable PHP execution in user directory:

sudo nano /etc/apache2/mods-available/php5.conf  

(Or if using php7.0, for example)

sudo nano /etc/apache2/mods-available/php7.0.conf

Comment this part (put # at the start of each line):

#<IfModule mod_userdir.c>
#    <Directory /home/*/public_html>
#        php_admin_flag engine Off
#    </Directory>
#</IfModule>

Press Ctrl+X to save

Enable directory listing:

sudo nano /etc/apache2/apache2.conf

Add this:

<Directory /home/*/public_html/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Press Ctrl+X to save


Restart apache (sudo required here also):

sudo service apache2 restart

Now put your php files in /home/yourname/public_html directory and go to
http://localhost/~yourname from your web browser.

17

Apache runs as user www-data. If it doesn't have execution permission on your home, apache will not be able to read any file.

Change you home's group to www-data:

chgrp www-data /home/dbugger

And give it permission only to traverse your home directory:

chmod g+x /home/dbugger

You can also restrict permisions of /home/dbugger/html:

chgrp www-data /home/dbugger/html
chmod 750 /home/dbugger/html
5
  • Can I do that, but instead of /home/dbugger using /home/dbugger/html? Jul 28, 2013 at 3:42
  • You can also apply that permission to /home/dbugger/html instead of 777, but you have to keep in mind that if user www-data cannot cd to your home, it won't be able to access any file or subfolder. So, if your home permission is rwx------ dbugger:dbugger apache will not be able to access any file inside your home. If you wan't to restrict access a little bit you could try giving only execute permission (chmod g+x /home/dbugger), I'm not sure, but I think it works. Jul 28, 2013 at 3:52
  • Sorry but neither of this solutions did work :( Jul 28, 2013 at 10:41
  • chgrp www-data /home/dbugger in combination with @DavidGreene method got it working for me
    – laurent
    Jan 19, 2018 at 11:43
  • It's also possible to add your user group to the apache user (www-data) sudo usermod -a -G dbugger www-data, after that you need to restart apache.
    – TIIUNDER
    Jul 2, 2018 at 21:18
2

You don't need change the permissions if you want to use your home directory to host the development environment, at least that you need write permissions for some applications. You need apache mod_userdir module and you can access to /home/user_name/public_html/* like this http://domain.local/~user_name/dir_name/* for use a virtual hosts, to use the mod_userdir module you need create a sym link like this:

$ sudo ln -s /etc/apache2/mods-available/userdir.conf /etc/apache2/mods-enabled/
$ sudo ln -s /etc/apache2/mods-available/userdir.load /etc/apache2/mods-enabled/
$ sudo service apache2 restart
1
  • 7
    You can also use a2enmod userdir
    – Joril
    Feb 10, 2014 at 16:29
0

according to their page: https://httpd.apache.org/docs/2.4/howto/public_html.html

you can set userdir to something better: /var/www and create a directory in there by a "username", which you could make owned by a simple user, but world readable (i.e. 755), the user is required to copy files there, but it's a lot safer than making / or ~ world readable, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .