403 Forbidden in Ubuntu Saucy [#2155445]

As of Ubuntu Saucy, Apache denies access to any directory other than /var/www/ by default using the Directory directive. This means that after you install Aegir and try to visit the frontend, you get a 403 forbidden page, and a corresponding error in the Apache error log:

AH01630: client denied by server configuration

I think Aegir needs to include a Directory block like the following in apache.conf:

<Directory /var/aegir/>
	Options Indexes FollowSymLinks
	AllowOverride None
	Require all granted
</Directory>

Comments

Comment #1

helmo CreditAttribution: helmo commented 12 December 2013 at 21:56

Parent issue:

» #2155705: [meta] Support Apache 2.4 (Ubuntu Saucy, Debian Jessie)

Comment #2

anarcat CreditAttribution: anarcat commented 31 December 2013 at 16:40

Status:

Active

» Postponed (maintainer needs more info)

HUm... this should be part of the platform configuration in platform.d, isn't there such a file with a block for all your platforms?

Comment #3

Dane Powell CreditAttribution: Dane Powell commented 31 December 2013 at 19:50

The files in platform.d have Directory blocks for each platform's subdirectory, but there's no directory block for the entire /var/aegir/ directory - I assume that's necessary, because when I manually add it to apache2.conf, I'm able to reach the Aegir frontend.

Comment #4

anarcat CreditAttribution: anarcat commented 4 March 2014 at 18:23

Status:

Postponed (maintainer needs more info)

» Active

I confirm this problem occurs, at least in Debian Jessie + apache 2.4 + php 5.5.

Comment #5

anarcat CreditAttribution: anarcat commented 4 March 2014 at 18:45

Status:

Active

» Fixed

I found that adding this to the platform configuration is sufficient:

Require all granted

I committed a fix to the 1.x and 2.x branches.

Comment #6

18 March 2014 at 18:51

Status:

Fixed

» Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Comment #7

helmo CreditAttribution: helmo commented 28 April 2014 at 08:50

For the record, this issue added two lines:

    Satisfy any
    Require all granted

As as side effect the http_basic_auth module included in provision_tasks_extra also needs an extra line. I've create #2252063: basic auth: match hostmaster 2.1 apache update to address that.