From rgm at htt-consult.com Fri Jun 5 20:44:51 2015 Content-Type: multipart/mixed; boundary="===============4532430673339823073==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Curious symlink problem with Apache -- FC12 Date: Tue, 02 Nov 2010 21:39:38 -0400 Message-ID: <4CD0BD5A.6040106@htt-consult.com> --===============4532430673339823073== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I have a very simple setup. This is to create a simple repo. In /var/..../repo/html there are three files: # ls -ls total 8 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> = /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> = /var/hda/files/repo/fedora/FC12 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html index.html has in it: The link to FC12 works. The link ot Centos-5.5 gets a 403 failure: You don't have permission to access /Centos-5.5 on this server. The permissions look the same, so why the failure? And looking into = these two symlinks: # ls -ls FC12/ total 8 4 drwxr-xr-x 3 root root 4096 2009-11-21 19:35 os 4 drwxr-xr-x 3 root root 4096 2009-11-22 21:25 updates # ls -ls Centos-5.5/ total 4 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 os So what is wrong with the Centos-5.5 symlink? --===============4532430673339823073==-- From tomh0665 at gmail.com Fri Jun 5 20:44:52 2015 Content-Type: multipart/mixed; boundary="===============5160636457048632253==" MIME-Version: 1.0 From: Tom H To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Tue, 02 Nov 2010 22:13:28 -0400 Message-ID: In-Reply-To: 4CD0BD5A.6040106@htt-consult.com --===============5160636457048632253== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Tue, Nov 2, 2010 at 9:39 PM, Robert Moskowitz wr= ote: > I have a very simple setup. =C2=A0This is to create a simple repo. > > In /var/..../repo/html there are three files: > > # ls -ls > total 8 > 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> > /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 > 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> > /var/hda/files/repo/fedora/FC12 > 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html > > index.html has in it: > > > > > > The link to FC12 works. =C2=A0The link ot Centos-5.5 gets a 403 failure: > > You don't have permission to access /Centos-5.5 on this server. > > The permissions look the same, so why the failure? =C2=A0And looking into > these two symlinks: > > # ls -ls FC12/ > total 8 > 4 drwxr-xr-x 3 root root 4096 2009-11-21 19:35 os > 4 drwxr-xr-x 3 root root 4096 2009-11-22 21:25 updates > > # ls -ls Centos-5.5/ > total 4 > 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 os > > So what is wrong with the Centos-5.5 symlink? And "ls -lsd ..." for the two directories above? --===============5160636457048632253==-- From bruno at wolff.to Fri Jun 5 20:44:52 2015 Content-Type: multipart/mixed; boundary="===============2097777089703994698==" MIME-Version: 1.0 From: Bruno Wolff III To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Tue, 02 Nov 2010 21:07:41 -0500 Message-ID: <20101103020741.GA1249@wolff.to> In-Reply-To: 4CD0BD5A.6040106@htt-consult.com --===============2097777089703994698== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Tue, Nov 02, 2010 at 21:39:38 -0400, Robert Moskowitz wrote: > = > The link to FC12 works. The link ot Centos-5.5 gets a 403 failure: > = > You don't have permission to access /Centos-5.5 on this server. > = > The permissions look the same, so why the failure? And looking into = > these two symlinks: Are you running selinux in enforcing more? Apache has limited access to files and generally they need to be labeled something like: httpd_sys_content_t --===============2097777089703994698==-- From rgm at htt-consult.com Fri Jun 5 20:44:52 2015 Content-Type: multipart/mixed; boundary="===============6792790934305606403==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 00:11:56 -0400 Message-ID: <4CD0E10C.9090704@htt-consult.com> In-Reply-To: AANLkTineBcmYhMCfjPj6esPtVH3PdHqrVS=hBc8WCD9Q@mail.gmail.com --===============6792790934305606403== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/02/2010 10:13 PM, Tom H wrote: > On Tue, Nov 2, 2010 at 9:39 PM, Robert Moskowitz = wrote: > = >> I have a very simple setup. This is to create a simple repo. >> >> In /var/..../repo/html there are three files: >> >> # ls -ls >> total 8 >> 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> >> /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 >> 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> >> /var/hda/files/repo/fedora/FC12 >> 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html >> >> index.html has in it: >> >> >> >> >> >> The link to FC12 works. The link ot Centos-5.5 gets a 403 failure: >> >> You don't have permission to access /Centos-5.5 on this server. >> >> The permissions look the same, so why the failure? And looking into >> these two symlinks: >> >> # ls -ls FC12/ >> total 8 >> 4 drwxr-xr-x 3 root root 4096 2009-11-21 19:35 os >> 4 drwxr-xr-x 3 root root 4096 2009-11-22 21:25 updates >> >> # ls -ls Centos-5.5/ >> total 4 >> 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 os >> >> So what is wrong with the Centos-5.5 symlink? >> = > And "ls -lsd ..." for the two directories above? > = # ls -ls total 8 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> = /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> = /var/hda/files/repo/fedora/FC12 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html # ls -lsd 4 drwxrwxr-x 2 apache users 4096 2010-11-02 13:43 . # ls -lsd FC12/ 4 drwxr-xr-x 4 root root 4096 2010-11-02 11:04 FC12/ # ls -lsd Centos-5.5/ 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 Centos-5.5/ --===============6792790934305606403==-- From rgm at htt-consult.com Fri Jun 5 20:44:52 2015 Content-Type: multipart/mixed; boundary="===============6936873099785292906==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 01:59:26 -0400 Message-ID: <4CD0FA3E.3060902@htt-consult.com> In-Reply-To: 20101103020741.GA1249@wolff.to --===============6936873099785292906== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/02/2010 10:07 PM, Bruno Wolff III wrote: > On Tue, Nov 02, 2010 at 21:39:38 -0400, > Robert Moskowitz wrote: > >> The link to FC12 works. The link ot Centos-5.5 gets a 403 failure: >> >> You don't have permission to access /Centos-5.5 on this server. >> >> The permissions look the same, so why the failure? And looking into >> these two symlinks: >> > Are you running selinux in enforcing more? # cat /etc/sysconfig/selinux # This file controls the state of SELinux on the system. # SELINUX=3D can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=3Ddisabled # SELINUXTYPE=3D can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=3Dtargeted > Apache has limited access to > files and generally they need to be labeled something like: > httpd_sys_content_t How do you set this? --===============6936873099785292906==-- From tomh0665 at gmail.com Fri Jun 5 20:44:52 2015 Content-Type: multipart/mixed; boundary="===============2837193786681149044==" MIME-Version: 1.0 From: Tom H To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 07:04:37 -0400 Message-ID: In-Reply-To: 4CD0E10C.9090704@htt-consult.com --===============2837193786681149044== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, Nov 3, 2010 at 12:11 AM, Robert Moskowitz w= rote: > On 11/02/2010 10:13 PM, Tom H wrote: >> On Tue, Nov 2, 2010 at 9:39 PM, Robert Moskowitz >> =C2=A0wrote: >>> >>> I have a very simple setup. =C2=A0This is to create a simple repo. >>> >>> In /var/..../repo/html there are three files: >>> >>> # ls -ls >>> total 8 >>> 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> >>> /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 >>> 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> >>> /var/hda/files/repo/fedora/FC12 >>> 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html >>> >>> index.html has in it: >>> >>> >>> >>> >>> >>> The link to FC12 works. =C2=A0The link ot Centos-5.5 gets a 403 failure: >>> >>> You don't have permission to access /Centos-5.5 on this server. >>> >>> The permissions look the same, so why the failure? =C2=A0And looking in= to >>> these two symlinks: >>> >>> # ls -ls FC12/ >>> total 8 >>> 4 drwxr-xr-x 3 root root 4096 2009-11-21 19:35 os >>> 4 drwxr-xr-x 3 root root 4096 2009-11-22 21:25 updates >>> >>> # ls -ls Centos-5.5/ >>> total 4 >>> 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 os >>> >>> So what is wrong with the Centos-5.5 symlink? >> >> And "ls -lsd ..." for the two directories above? > > # ls -ls > total 8 > 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> > /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 > 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> > /var/hda/files/repo/fedora/FC12 > 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html > > # ls -lsd > 4 drwxrwxr-x 2 apache users 4096 2010-11-02 13:43 . > > # ls -lsd FC12/ > 4 drwxr-xr-x 4 root root 4096 2010-11-02 11:04 FC12/ > > # ls -lsd Centos-5.5/ > 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 Centos-5.5/ I was hoping that it'd be a simple permissions problem but, as someone else has pointed out, it must be an selinux issue. You're going to have to compare the selinux contexts with the "-Z" ls option and then apply the correct context (most probably with "--type=3Dhttpd_sys_content_t") on the CentOS repository. --===============2837193786681149044==-- From rgm at htt-consult.com Fri Jun 5 20:44:53 2015 Content-Type: multipart/mixed; boundary="===============8601506614672440813==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 08:58:29 -0400 Message-ID: <4CD15C75.1040108@htt-consult.com> In-Reply-To: AANLkTin5Q5_xTEamBNRogTwGdKF60Wf9t5aaaXBmUzV2@mail.gmail.com --===============8601506614672440813== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/03/2010 07:04 AM, Tom H wrote: > On Wed, Nov 3, 2010 at 12:11 AM, Robert Moskowitz = wrote: > = >> On 11/02/2010 10:13 PM, Tom H wrote: >> = >>> On Tue, Nov 2, 2010 at 9:39 PM, Robert Moskowitz >>> wrote: >>> = >>>> I have a very simple setup. This is to create a simple repo. >>>> >>>> In /var/..../repo/html there are three files: >>>> >>>> # ls -ls >>>> total 8 >>>> 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> >>>> /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 >>>> 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> >>>> /var/hda/files/repo/fedora/FC12 >>>> 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html >>>> >>>> index.html has in it: >>>> >>>> >>>> >>>> >>>> >>>> The link to FC12 works. The link ot Centos-5.5 gets a 403 failure: >>>> >>>> You don't have permission to access /Centos-5.5 on this server. >>>> >>>> The permissions look the same, so why the failure? And looking into >>>> these two symlinks: >>>> >>>> # ls -ls FC12/ >>>> total 8 >>>> 4 drwxr-xr-x 3 root root 4096 2009-11-21 19:35 os >>>> 4 drwxr-xr-x 3 root root 4096 2009-11-22 21:25 updates >>>> >>>> # ls -ls Centos-5.5/ >>>> total 4 >>>> 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 os >>>> >>>> So what is wrong with the Centos-5.5 symlink? >>>> = >>> And "ls -lsd ..." for the two directories above? >>> = >> # ls -ls >> total 8 >> 4 lrwxrwxrwx 1 root root 60 2010-11-02 13:42 Centos-5.5 -> >> /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 >> 0 lrwxrwxrwx 1 root root 31 2010-11-02 11:05 FC12 -> >> /var/hda/files/repo/fedora/FC12 >> 4 -rw-r--r-- 1 root root 99 2010-11-02 13:43 index.html >> >> # ls -lsd >> 4 drwxrwxr-x 2 apache users 4096 2010-11-02 13:43 . >> >> # ls -lsd FC12/ >> 4 drwxr-xr-x 4 root root 4096 2010-11-02 11:04 FC12/ >> >> # ls -lsd Centos-5.5/ >> 4 drwxr-xr-x 3 root root 4096 2010-11-02 14:04 Centos-5.5/ >> = > I was hoping that it'd be a simple permissions problem but, as someone > else has pointed out, it must be an selinux issue. > > You're going to have to compare the selinux contexts with the "-Z" ls > option and then apply the correct context (most probably with > "--type=3Dhttpd_sys_content_t") on the CentOS repository. > = # ls -lsZ total 8 lrwxrwxrwx root root ? Centos-5.5 -> = /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 lrwxrwxrwx root root ? FC12 -> = /var/hda/files/repo/fedora/FC12 -rw-r--r-- root root ? index.html selinux is disabled... --===============8601506614672440813==-- From ignored_mailbox at yahoo.com.au Fri Jun 5 20:44:53 2015 Content-Type: multipart/mixed; boundary="===============3557215660512578469==" MIME-Version: 1.0 From: Tim To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Thu, 04 Nov 2010 00:01:05 +1030 Message-ID: <1288791065.12962.43.camel@suspishus.lan.cameratim.com> In-Reply-To: 4CD0FA3E.3060902@htt-consult.com --===============3557215660512578469== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, 2010-11-03 at 01:59 -0400, Robert Moskowitz wrote: > # cat /etc/sysconfig/selinux > = > # This file controls the state of SELinux on the system. > # SELINUX=3D can take one of these three values: > # enforcing - SELinux security policy is enforced. > # permissive - SELinux prints warnings instead of enforcing. > # disabled - No SELinux policy is loaded. > SELINUX=3Ddisabled This (immediately above line) says that your SELinux is disabled, so SELinux shouldn't be the cause of your problems. That being said, it's usually a good idea to use SELinux when you have a publicly exposed webserver. Even one that's not advertised, as hackers find them by scanning ranges of IP addresses. To serve out anything via HTTP, the directory permissions from root right through to the directory in question, including all the ones in between, should be rwx r-x r-x (owner read, write, and execute; group permissions usually don't matter; other uses can read and execute). The file permissions need to be almost the same, the file in question should be rwx r-x r-x (owner read, write and execute; group permissions usually don't matter; other users can read the files). Apache treats the executable bit on files specially - it allows them to be parsed for server-side-includes. The "other" users, also known as "world," permissions are used for serving out to the world. (I spaced apart owner, group, and world permissions in the above examples, for ease of reading.) Servable files should not be owned by root or the apache user, they should be owned by the author. The same goes for directories *inside* the webserver's root path. This allows changes, and disallows tampering by remote uses over the web. e.g. drwxr-xr-x root root /var/www/html/ drwxr-xr-x tim tim /var/www/html/mywebsite/ drw-r--r-- tim tim /var/www/html/mywebsite/homepage.html drw-r--r-- tim tim /var/www/html/mywebsite/picture.png If you are asking the server to follow symlinks, then you need to set the Apache configuration option to allow that. I can't remember what the default was. If you installed the manual, see: http://localhost/manual/mod/core.html#options Also, if you serve files from outside the usual filepaths, you might want to check the options in the Apache configuration. If you installed the manual, see: http://localhost/manual/mod/core.html#directory If you have SELinux enabled, then you need to set proper contexts for the files and directories. This will be done automatically, when you create them in the standard file paths. i.e. inside "/var/www/html" and inside "~/public_html/" But not if you move files into those paths, or serve files in other locations. Then, you'll need to manually set the contexts, and reset them if you ever scan the whole drive resetting contexts to defaults (unless you make up custom rules to match your custom locations). See http://fedoraproject.org/wiki/SELinux/apache for example contexts. But I have this for webserving directories, and the files inside them: system_u:object_r:httpd_sys_script_exec_t:s0 /var/www/cgi-bin/ unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/ system_u:object_r:httpd_user_content_t:s0 ~/public_html/ -- = [tim(a)localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686 Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists. --===============3557215660512578469==-- From rgm at htt-consult.com Fri Jun 5 20:44:54 2015 Content-Type: multipart/mixed; boundary="===============8185052365689805603==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 11:27:39 -0400 Message-ID: <4CD17F6B.5090705@htt-consult.com> In-Reply-To: 1288791065.12962.43.camel@suspishus.lan.cameratim.com --===============8185052365689805603== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable There is a lot here to go through, but just a quick note below. On 11/03/2010 09:31 AM, Tim wrote: > On Wed, 2010-11-03 at 01:59 -0400, Robert Moskowitz wrote: > = >> # cat /etc/sysconfig/selinux >> >> # This file controls the state of SELinux on the system. >> # SELINUX=3D can take one of these three values: >> # enforcing - SELinux security policy is enforced. >> # permissive - SELinux prints warnings instead of enforcing. >> # disabled - No SELinux policy is loaded. >> SELINUX=3Ddisabled >> = > This (immediately above line) says that your SELinux is disabled, so > SELinux shouldn't be the cause of your problems. That being said, it's > usually a good idea to use SELinux when you have a publicly exposed > webserver. Even one that's not advertised, as hackers find them by > scanning ranges of IP addresses. > = This is NOT a publicly facing server. It is behind my firewall (A = Juniper SSG5) on a subnet that has very limited outside access. Other = subnets here have limited access to this subnet. This server is running = the Amahi.org setup and serves as a PDC to clients on its subnet, and = some Amahi apps for all local subnets. I am adding the repo services for = the local devices (on its subnet) and so I can rebuild my main repo = server. So though I am a bit concerned about SELinux being disabled, I = am not too worried. > To serve out anything via HTTP, the directory permissions from root > right through to the directory in question, including all the ones in > between, should be rwx r-x r-x (owner read, write, and execute; group > permissions usually don't matter; other uses can read and execute). > > The file permissions need to be almost the same, the file in question > should be rwx r-x r-x (owner read, write and execute; group permissions > usually don't matter; other users can read the files). Apache treats > the executable bit on files specially - it allows them to be parsed for > server-side-includes. > > The "other" users, also known as "world," permissions are used for > serving out to the world. > > (I spaced apart owner, group, and world permissions in the above > examples, for ease of reading.) > > Servable files should not be owned by root or the apache user, they > should be owned by the author. The same goes for directories *inside* > the webserver's root path. This allows changes, and disallows tampering > by remote uses over the web. > > e.g. > > drwxr-xr-x root root /var/www/html/ > drwxr-xr-x tim tim /var/www/html/mywebsite/ > drw-r--r-- tim tim /var/www/html/mywebsite/homepage.html > drw-r--r-- tim tim /var/www/html/mywebsite/picture.png > > If you are asking the server to follow symlinks, then you need to set > the Apache configuration option to allow that. I can't remember what > the default was. > > If you installed the manual, see: > http://localhost/manual/mod/core.html#options > > Also, if you serve files from outside the usual filepaths, you might > want to check the options in the Apache configuration. > > If you installed the manual, see: > http://localhost/manual/mod/core.html#directory > > If you have SELinux enabled, then you need to set proper contexts for > the files and directories. This will be done automatically, when you > create them in the standard file paths. > > i.e. inside "/var/www/html" and inside "~/public_html/" > > But not if you move files into those paths, or serve files in other > locations. Then, you'll need to manually set the contexts, and reset > them if you ever scan the whole drive resetting contexts to defaults > (unless you make up custom rules to match your custom locations). > > See http://fedoraproject.org/wiki/SELinux/apache for example contexts. > > But I have this for webserving directories, and the files inside them: > > system_u:object_r:httpd_sys_script_exec_t:s0 /var/www/cgi-bin/ > unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/ > > system_u:object_r:httpd_user_content_t:s0 ~/public_html/ > > =20 --===============8185052365689805603==-- From ignored_mailbox at yahoo.com.au Fri Jun 5 20:44:54 2015 Content-Type: multipart/mixed; boundary="===============6967652795247227584==" MIME-Version: 1.0 From: Tim To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Thu, 04 Nov 2010 02:15:25 +1030 Message-ID: <1288799125.25268.0.camel@suspishus.lan.cameratim.com> In-Reply-To: 1288791065.12962.43.camel@suspishus.lan.cameratim.com --===============6967652795247227584== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Thu, 2010-11-04 at 00:01 +1030, Tim wrote: > The file permissions need to be almost the same, the file in question > should be rwx r-x r-x (owner read, write and execute; group > permissions usually don't matter; other users can read the files). > Apache treats the executable bit on files specially - it allows them > to be parsed for server-side-includes. Typing correction, the triple of permissions should have been: rwx & r-- & r-- No eXecutables set. -- = [tim(a)localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686 Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists. --===============6967652795247227584==-- From ignored_mailbox at yahoo.com.au Fri Jun 5 20:44:54 2015 Content-Type: multipart/mixed; boundary="===============6451871327610917249==" MIME-Version: 1.0 From: Tim To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Thu, 04 Nov 2010 02:26:21 +1030 Message-ID: <1288799781.25268.12.camel@suspishus.lan.cameratim.com> In-Reply-To: 4CD17F6B.5090705@htt-consult.com --===============6451871327610917249== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, 2010-11-03 at 11:27 -0400, Robert Moskowitz wrote: > This is NOT a publicly facing server. It is behind my firewall (A = > Juniper SSG5) on a subnet that has very limited outside access. Other = > subnets here have limited access to this subnet. This server is > running the Amahi.org setup and serves as a PDC to clients on its > subnet, and some Amahi apps for all local subnets. I am adding the > repo services for the local devices (on its subnet) and so I can > rebuild my main repo server. So though I am a bit concerned about > SELinux being disabled, I am not too worried. Just to remove any ambiguity: If the only outside access to a computer is via the webserver software on port 80, then the computer is still *potentially* vulnerable. A computer can be hacked through flaws in the webserver. Merely blocking off other ports (e.g. SSH) is only being partially protective. Having said that, it would depend on what the webserver could do, as to whether anybody else could wreak havoc. If it only served flat HTML files, they'd have to find a security hole in Apache to cause you problems. The typical Achilles heel is flawed scripts (other programs) being running through the server (CGI, PHP, et al). -- = [tim(a)localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686 Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists. --===============6451871327610917249==-- From ignored_mailbox at yahoo.com.au Fri Jun 5 20:44:55 2015 Content-Type: multipart/mixed; boundary="===============1154951973465332841==" MIME-Version: 1.0 From: Tim To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Thu, 04 Nov 2010 02:40:26 +1030 Message-ID: <1288800626.25268.22.camel@suspishus.lan.cameratim.com> In-Reply-To: 1288799125.25268.0.camel@suspishus.lan.cameratim.com --===============1154951973465332841== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Thu, 2010-11-04 at 02:15 +1030, Tim wrote: > Typing correction, the triple of permissions should have been: > = > rwx & r-- & r-- > = > No eXecutables set. Grr, sodding typos. I'll try that again, third time's the charm... For most files served out through Apache, there will be no executable bit set for any of the permissions (owner, group, or other). Typically, user bits: rw- (can read and write) group bits: --- (usually unimportant) other bits: r-- (can only read files) [tim(a)computer personal]$ ls -l /var/www/html/homepage.html -rw-r--r-- 1 tim tim 3379 2008-07-27 22:17 /var/www/html/homepage.html If you were playing with Apache's XbitHack option, then the group permissions are paid attention to. See: http://localhost/manual/mod/mod_include.html#xbithack -- = [tim(a)localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686 Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists. --===============1154951973465332841==-- From rgm at htt-consult.com Fri Jun 5 20:44:55 2015 Content-Type: multipart/mixed; boundary="===============7901148041295312878==" MIME-Version: 1.0 From: Robert Moskowitz To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 12:30:21 -0400 Message-ID: <4CD18E1D.2000702@htt-consult.com> In-Reply-To: 1288799781.25268.12.camel@suspishus.lan.cameratim.com --===============7901148041295312878== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/03/2010 11:56 AM, Tim wrote: > On Wed, 2010-11-03 at 11:27 -0400, Robert Moskowitz wrote: > = >> This is NOT a publicly facing server. It is behind my firewall (A >> Juniper SSG5) on a subnet that has very limited outside access. Other >> subnets here have limited access to this subnet. This server is >> running the Amahi.org setup and serves as a PDC to clients on its >> subnet, and some Amahi apps for all local subnets. I am adding the >> repo services for the local devices (on its subnet) and so I can >> rebuild my main repo server. So though I am a bit concerned about >> SELinux being disabled, I am not too worried. >> = > Just to remove any ambiguity: If the only outside access to a computer > is via the webserver software on port 80, then the computer is still > *potentially* vulnerable. A computer can be hacked through flaws in the > webserver. Merely blocking off other ports (e.g. SSH) is only being > partially protective. > = Yeah. I am aware of that. It would take an island hopping attack. One of = my outward facing servers would have to go and it in turn go after this = server. I am just a little guy. I am behind on some updates but working = to get current. Plus move to DNSEC for my domain... I do have one Amahi server partially open, it runs my mail service and = SquirrelMail. So 25, 587, 110 and 443 are open. So I do run SELinux on = this one. > Having said that, it would depend on what the webserver could do, as to > whether anybody else could wreak havoc. If it only served flat HTML > files, they'd have to find a security hole in Apache to cause you > problems. The typical Achilles heel is flawed scripts (other programs) > being running through the server (CGI, PHP, et al). > > =20 --===============7901148041295312878==-- From tomh0665 at gmail.com Fri Jun 5 20:44:58 2015 Content-Type: multipart/mixed; boundary="===============2116460636135694781==" MIME-Version: 1.0 From: Tom H To: users at lists.fedoraproject.org Subject: Re: Curious symlink problem with Apache -- FC12 Date: Wed, 03 Nov 2010 17:50:01 -0400 Message-ID: In-Reply-To: 4CD15C75.1040108@htt-consult.com --===============2116460636135694781== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, Nov 3, 2010 at 8:58 AM, Robert Moskowitz wr= ote: > On 11/03/2010 07:04 AM, Tom H wrote: >> >> You're going to have to compare the selinux contexts with the "-Z" ls >> option and then apply the correct context (most probably with >> "--type=3Dhttpd_sys_content_t") on the CentOS repository. > > # ls -lsZ > total 8 > lrwxrwxrwx root root ? =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Centos-5.5 -> > /media/d4ae05a3-c60f-489d-8159-e16c9a271f0b/repos/centos/5.5 > lrwxrwxrwx root root ? =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0FC12 -> > /var/hda/files/repo/fedora/FC12 > -rw-r--r-- root root ? =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0index.html > > selinux is disabled... Then there's no point in using "-Z" and your problem's sue to "regular" owner and perms issues... --===============2116460636135694781==--