2

Bear with me I am still new to Linux. I have a web server that is trying to access a public folder under a users account.

Problem

I am running an nginx server that is trying to access the maintenance page within an applications shared public folder and receives permission denied errors.

Basics

  • Application user: quotr and primary group: app
  • Webserver user: ubuntu and primary group: www-data
  • Application home: /home/quotr/app
  • Application shared public folder: /home/quotr/app/shared
  • Absolute path of maintenance file: /home/quotr/app/shared/public/system/maintenance.html

Groups:

I initially only added the www-data group to the app group hoping to fix the issue. When that didn't work, I also added the group going the other way.

www-data:x:33:apache,quotr
ubuntu:x:1000:
app:x:1001:quotr,ubuntu,www-data

Ownership

The ownership for the whole application tree belong to quotr:app. When I started receiving the permission problems, I changed the ownership along public/system/maintenance.html portion of the path to the maintenance page (/home/quotr/app/shared/public/system/maintenance.html) to quotr:www-data.

Permissions

Starting at /var/www/quotr-public and working our way down:

# ls -la
drwxr-xr-x 4 quotr www-data 4096 Mar  3 21:49 .
drwxr-xr-x 5 quotr www-data 4096 Mar  3 21:49 ..
drwxr-xr-x 5 quotr www-data 4096 Mar  4 16:00 assets
drwxr-xr-x 3 quotr www-data 4096 Mar  4 19:03 system

# cd to system ls -la
drwxr-xr-x 3 quotr www-data 4096 Mar  4 19:03 .
drwxr-xr-x 4 quotr www-data 4096 Mar  3 21:49 ..
-rwxr-x--- 1 quotr www-data 3004 Mar  4 19:03 maintenance.html
drwxr-xr-x 3 quotr www-data 4096 Mar  3 21:51 pictures

Testing

I am testing the permissions using the following command:

sudo -u www-data stat /home/quotr/app/shared/public/

which results in permission denied.

Last Ditch

As a last ditch attempt, I created the following symlink:

quotr-public -> /home/quotr/app/shared/public/

Which I am able to run the following successfully but no deeper:

sudo -u www-data stat /var/www/quotr-public

I am at a complete loss of what the problem is at this point. Any guidance would be greatly appreciated.

Edit 1

I have continued farting around with permissions so these might be a little difference, but please find below the output requested. Output of 'namei -lx /home/quotr/app/shared/public/system/maintenance.html'

Drwxr-xr-x root  root     /
drwxr-xr-x root  root     home
drwx------ quotr app      quotr
drwxr-xr-x quotr app      app
drwxr-xr-x quotr www-data shared
drwxr-xr-x quotr www-data public
drwxr-xr-x quotr www-data system
-rw-r--r-- quotr app      maintenance.html

Output of 'namei -lx /var/www/quotr-public/system/maintenance.html '

Drwxr-xr-x root   root     /
drwxr-xr-x root   root     var
drwxrwsr-x root   www-data www
lrwxrwxrwx ubuntu www-data quotr-public -> /home/quotr/app/shared/public/
Drwxr-xr-x root   root       /
drwxr-xr-x root   root       home
drwx------ quotr  app        quotr
drwxr-xr-x quotr  app        app
drwxr-xr-x quotr  www-data   shared
drwxr-xr-x quotr  www-data   public
drwxr-xr-x quotr  www-data system
-rw-r--r-- quotr  app      maintenance.html

Thanks.

  • Add the output of namei -lx /home/quotr/app/shared/public/system/maintenance.html please. – muru Mar 6 '17 at 3:34
  • There's your problem. /home/quotr has no execute permissions for others. – muru Mar 6 '17 at 7:02
  • even though www-data belongs to the app group? – gwnp Mar 6 '17 at 7:09
  • Unfortunately I added the permission via chmod o+x /home/quotr but it still cannot access it – gwnp Mar 6 '17 at 7:16
  • Is FollowSymlinks enabled in Apache's options? – muru Mar 6 '17 at 7:20
0

I think you almost had it there with help from muru. All folders in the tree do need to be executable by www-data. Since the quotr folder is owned by the app group and www-data is in the app group, it'd be better to give exec to the group instead of others:

chmod g+x quotr

As a side suggestion... I have built several websites with nginx as www-data. What has worked well for me is to let www-data own everything as user and group. Then I add my user & whoever else needs access to the www-data group.

  • 1
    o+x gives permission to "others" ie to everyone. If everyone has permission then granting group permission will not help ;) – Zanna Mar 10 '17 at 22:41
  • Indeed... others are not really "others" at all; they are actually "everyone". Hmmm.. never though of it that way. Ok then! I updated with your input Zanna, thks. – Paul Brackin Mar 11 '17 at 23:12
  • But this does not answer the question :( – Zanna Mar 12 '17 at 5:45
  • Thank you, this actually ended up being the problem. Unfortunately I forgot to check this post first and found it out myself. – gwnp Aug 27 '17 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.