[users@httpd] FollowSymLinks - anything which could globally block this?

[Brent Harsh <db...@nc.rr.com>]

I'm configuring Apache (2.0.52 as it came with RedHat EL distribution 
and am always seeing 403 denied when trying to download a file via a 
symlink.

I have the FollowSymLink directive present in the httpd.conf <Directory> 
  section for my docroot directory, as well as in the <Directory /> 
section.  I know that at least some changes to the config file are 
working: I've toggled the Indexes option on and off and see the expected 
behavior.  I've also tried enabling this via .htaccess files by allowing 
Options overrides and building .htaccess files in the directory.  Again, 
similar behavior:  changing the Indexes setting in the local file 
results in file listings displayed or denied, but changing 
FollowSymLinks has absolutely no effect.

Is there a global "security" setting that I'm missing somewhere? One 
clue which makes me ask this is that an identical Apache configuration 
seems to work fine on 2.0.54 under FC4.  Google shows lots of basic 
references to the Option in the httpd.conf, but I have pretty much 
convinced myself I have it set up correctly.  I also searched the mail 
archives and haven't seen "sym" discussed in the titles of any of the 
archives over the past year (BTW, is all of March 2007 missing?), so 
clearly I'm the only one confused out here.  Hate to ask, but I'm not 
finding anything in my searches.

Thanks in advance for any pointers or tips,

Brent

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] FollowSymLinks - anything which could globally block this?

[Joshua Slive <jo...@slive.ca>]

On 4/30/07, Brent Harsh <db...@nc.rr.com> wrote:
> I'm configuring Apache (2.0.52 as it came with RedHat EL distribution
> and am always seeing 403 denied when trying to download a file via a
> symlink.
>
> I have the FollowSymLink directive present in the httpd.conf <Directory>
>   section for my docroot directory, as well as in the <Directory />
> section.  I know that at least some changes to the config file are
> working: I've toggled the Indexes option on and off and see the expected
> behavior.  I've also tried enabling this via .htaccess files by allowing
> Options overrides and building .htaccess files in the directory.  Again,
> similar behavior:  changing the Indexes setting in the local file
> results in file listings displayed or denied, but changing
> FollowSymLinks has absolutely no effect.
>
> Is there a global "security" setting that I'm missing somewhere? One
> clue which makes me ask this is that an identical Apache configuration
> seems to work fine on 2.0.54 under FC4.  Google shows lots of basic
> references to the Option in the httpd.conf, but I have pretty much
> convinced myself I have it set up correctly.  I also searched the mail
> archives and haven't seen "sym" discussed in the titles of any of the
> archives over the past year (BTW, is all of March 2007 missing?), so
> clearly I'm the only one confused out here.  Hate to ask, but I'm not
> finding anything in my searches.

The first thing to do is to verify that Options FollowSymLinks is
really the problem. You do this by checking the error log for the
exact error message reported for the failed request.

If it is the Options FollowSymLinks that is at fault, then you should
go through ALL your config files (including any Include'd files and
any .htaccess files) and verify that every single Options directive
includes FollowSymLinks. If you can then get it to work, you can
remove FollowSymLinks from the ones that shouldn't matter until you
figure out which Options directive is causing the problems.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org