2

In /etc/apache2/apache2.conf, I have the following configuration for Apache with regard to the /var/www directory:

<Directory /var/www/>
    Options -Indexes -Includes -ExecCGI
    AllowOverride All
    Require all granted
</Directory>

In /etc/apache2/sites-enabled/example.com.conf then, this is how I've set up my virtual host for example.com:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin info@example.com
    DocumentRoot /var/www/example.com/public

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Everything is working fine so far.

But as soon as I edit the <Directory /var/www/> part (see above) from

Options -Indexes -Includes -ExecCGI

to

Options -Indexes -FollowSymLinks -Includes -ExecCGI

the website stops working and responds with a 403 error instead.

Why is this happening? Nowhere did I use any symbolic links, at least not consciously. So is Apache using them internally when working with virtual hosts?

I don't see any reason why that option should break the setup. The website is actually stored in /var/www/example.com/public, that's not a symbolic link, either.

  • 1
    You can use sudo find /var/www -type l to be sure. And look at your error log. – fkraiem Dec 2 '16 at 3:21
  • @fkraiem Thanks, that helped! Should have looked that up right away, of course. Sorry! – caw Dec 2 '16 at 7:19
1

The Apache error logs explain the reason for this problem:

[rewrite:error] [pid ...] [client ...] AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off, so the RewriteRule directive is also forbidden due to its similar ability to circumvent directory restrictions

Using mod_rewrite with RewriteRule (as is common) while disabling FollowSymLinks (as shown in the question) is only possible if SymLinksIfOwnerMatch is enabled in return.

Thus

-FollowSymLinks

must become

-FollowSymLinks +SymLinksIfOwnerMatch

or mod_rewrite with RewriteRule cannot be used anymore.

Thanks for the hint, @fkraiem!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.