Apache "Client denied by server configuration", despite allowing access to directory (vhost configuration)

Question

in Apache on Ubuntu I've set up a vhost, but in the browser I keep getting a "403 Access forbidden" error; the log says "Client denied by server configuration: /home/remix/".

Looking for the solution online I found many posts about the directory access (Allow from all, etc), but as far as I know I already did that. In httpd-vhosts.conf there is the following code:

NameVirtualHost *:80

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/opt/lampp/htdocs/"
    ServerName localhost
    ServerAlias localhost
    ErrorLog "logs/dummy-host.example.com-error_log"
    CustomLog "logs/dummy-host.example.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot "/home/remix/"
    ServerName testproject
    ServerAlias testproject
    <Directory "/home/remix/">
        Options Indexes FollowSymLinks Includes ExecCGI
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

I've also added

127.0.0.1    testproject

to the /etc/hosts file.

Also, the /home/remix/ folder contains an index.html file and vhosts are enabled in httpd.conf.

Is there anything I'm not seeing?

Edit: This is the Apache error_log entry:

[Sat Aug 18 09:15:32.666938 2012] [authz_core:error] [pid 6587] 
[client 127.0.0.1:38873] AH01630: client denied by server configuration: /home/remix/

Solution 1

Change your authorization configuration:

<Directory /home/remix/>
    #...
    Order allow,deny
    Allow from all
</Directory>

...to the Apache 2.4 version of the same.

<Directory /home/remix/>
    #...
    Require all granted
</Directory>

Review the upgrading overview document for information on other changes you might need to make - and be aware that most of the config examples and assistance that you find out there on Google (as well as on this site) is referring to 2.2.

Solution 2

Check the permissions on the directory. I would bet that it's set to deny access to anyone but yourself, for instance:

$ ls -ld /home/remix
drwx------ 92 remix remix 4096 Aug 17 22:59 /home/remix

If you see drwx------ exactly, then this is the case. Fix it by running:

chmod a+x /home/remix

Solution 3

Make sure that the user who is running httpd service has access to this directories.

Solution 4

"client denied by server configuration" means that the Linux server itself forbids the access to the file, not Apache.

If providing access through changing permissions / ownership / group membership does not solve the problem, the route cause may be SELinux forbidding the access to any folder which has not the appropriate SE Linux context as explained in 'Relocating an Apache DocumentRoot under Selinux'.

• If temporarily disabling SELinux by doing setenforce 0 makes the file accessible
• Whereas re-enabling SELinux by doing setenforce 0 makes again the file not accessible

Then for sure the access is forbidden by SELinux whatever the file permissions are.

View more solutions

Comments

[Admin]

What's in Apache's error log?

[Admin]

Ah, I thought I forgot something... I've added it to the original post.

[Admin]

What version of Apache are you using?

[Admin]

Apache/2.4.2 (Unix)

[RemiX]

I'm not sure who the user for httpd is or how to check, but everyone can read (user/group/other).

[RemiX]

I see: drwxrwxr-x 2 remix remix 4096 Aug 16 09:36 /home/remix. I tried the command anyway, without effect.

[Michael Hampton]

Ahh, can't win 'em all.

[cpt.Buggy]

Check httpd.conf for User param.

[RemiX]

Ok it says 'User nobody', and 'Group nogroup'. I tried changing it to 'User remix' (which is the owner of the folder), but even that won't help.

[Phib3r Optix]

If I had time, I'd log a bug about this because httpd -t says there's no problem using the older syntax, and neither does httpd -S. In my mind, the whole point of a configuration checker is that it should be pointing out problems! ...If you have a directory you're referencing w/o this, it won't work - simple as that. ...Thumbs up on the answer.