You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by ex...@meson.dyndns.org on 2002/05/19 18:31:28 UTC

CGI's with nonstandard UserDir

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


  I recently reconfigured apache so I wouldn't have to keep user web files
under ~.  To this end, I changed the UserDir section of httpd.conf to read
like this:

<IfModule mod_userdir.c>
    UserDir /home/http
</IfModule>

and set up these rules:

<Directory /home/http/*>
    AllowOverride FileInfo AuthConfig Limit
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    <Limit GET POST OPTIONS PROPFIND>
        Order allow,deny
        Allow from all
    </Limit>
    <LimitExcept GET POST OPTIONS PROPFIND>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>

<Directory /home/http/*/cgi-bin>
    Options ExecCGI
    AddHandler cgi-script .cgi
    <Limit GET POST>
        Order allow,deny
        Allow from all
    </Limit>
    <LimitExcept GET POST>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>


- From what I understand from the docs, this should cause
http://myhost/~username/ requests to be looked up in the filesystem
beneath /home/http/username/, and this seems to be the case.  However,
when I attempt to access scripts in /home/http/username/cgi-bin, apache
returns a 500 and this shows up in the error_log:

[Sun May 19 11:11:25 2002] [error] (13)Permission denied: exec of /home/http/exarkun/cgi-bin/mojo.cgi failed
[Sun May 19 11:11:25 2002] [error] [client xx.xx.xx.xx] Premature end of script headers: /home/http/exarkun/cgi-bin/mojo.cgi

This is for the URL http://myhost/~exarkun/cgi-bin/mojo.cgi.  The
permissions of the relevant paths are:

root:/usr/local/httpd/logs# ls -ld /home /home/http /home/http/exarkun /home/http/exarkun/cgi-bin /home/http/exarkun/cgi-bin/mojo.cgi
drwxr-xr-x   16 root     root         4096 May 16 19:18 /home
drwxr-xr-x    4 root     root         4096 May 12 22:02 /home/http
drwxr-xr-x    5 exarkun  user         4096 May 13 21:30 /home/http/exarkun
drwxr-xr-x    3 exarkun  user         4096 May 19 11:04 /home/http/exarkun/cgi-bin
- -rwxr-xr-x    1 exarkun  user         1883 May 19 11:01 /home/http/exarkun/cgi-bin/mojo.cgi

I'm running suexec apache, so I believe these permissions are correct, if
not slightly liberal.  Nothing shows up in my suexec_log since I made the
config changes.  When I run the script from the command line, either as
the user nobody, exarkun, or root it executes (though quickly fails due to
missing POST data) and other, simpler scripts, that run from the command
line also generate the same error message when accessed via CGI.

Server version is Apache/1.3.22 (Unix).

I'm totally out of ideas on this.  Can anyone help?

Thanks

- --
 12:21pm up 15 days, 0:55, 2 users, load average: 0.20, 0.06, 0.06
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE859NkedcO2BJA+4YRAp2AAJ0SoI+g6eapodfrKX7E9D034bcenQCbBWGZ
NWTqeNYHbct/7/ybukuuHIA=
=sDOZ
-----END PGP SIGNATURE-----


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: CGI's with nonstandard UserDir

Posted by Joshua Slive <jo...@slive.ca>.
On Sun, 19 May 2002 exarkun@meson.dyndns.org wrote:
>
>   I recently reconfigured apache so I wouldn't have to keep user web files
> under ~.  To this end, I changed the UserDir section of httpd.conf to read
> like this:
>
> <IfModule mod_userdir.c>
>     UserDir /home/http
> </IfModule>

> [Sun May 19 11:11:25 2002] [error] (13)Permission denied: exec of /home/http/exarkun/cgi-bin/mojo.cgi failed
> [Sun May 19 11:11:25 2002] [error] [client xx.xx.xx.xx] Premature end of script headers: /home/http/exarkun/cgi-bin/mojo.cgi

> I'm running suexec apache, so I believe these permissions are correct

First thing to do is check the suexec log file.

You'll probably find a "not in docroot" complaint.  Suexec is VERY strict
about where files are located, and for user directories (~user), they
must be located under the user's home directory.  I believe you are going
to find that your current configuration is not compatible with suexec.

Joshua.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org