Apache won't follow symlinks (403 Forbidden)

Question

I'm having some trouble setting up Apache on Ubuntu. I've been following this guide.

# /usr/sbin/apache2 -v Server version: Apache/2.2.17 (Ubuntu) Server built:   Feb 22 2011 18:33:02 

My public directory, /var/www, can successfully serve up and execute PHP pages that are placed in it. However, I want to create a symlink in /var/www that points to a directory in my home folder and serve pages there.

[root /var/www]# ll total 36 drwxr-xr-x  3 root root 4096 2011-09-11 14:22 . drwxr-xr-x 14 root root 4096 2011-06-04 22:49 .. lrwxrwxrwx  1 root root   16 2011-09-11 13:21 about -> /root/site/about 

When I try to access /about on browser, I get

Forbidden  You don't have permission to access /about on this server. 

As far as I know, I gave sufficient privileges to the files I want to serve:

[root ~/site/about]# ll total 24 drwxr-xr-x 5 root root 4096 2011-09-11 13:20 . drwxr--r-- 3 root root 4096 2011-09-11 13:19 .. drwxr-xr-x 2 root root 4096 2011-09-11 13:21 contact -rwxr-xr-x 1 root root 1090 2011-09-11 13:19 index.php drwxr-xr-x 2 root root 4096 2011-09-11 13:20 me drwxr-xr-x 2 root root 4096 2011-09-11 13:21 resume 

I'm aware of the FollowSymLinks option, and I believe it's set in my /etc/apache2/sites-enabled/000-default file:

DocumentRoot /var/www <Directory />     Options FollowSymLinks     AllowOverride None </Directory> <Directory /var/www/>     Options FollowSymLinks Indexes MultiViews     AllowOverride None     Order allow,deny     allow from all </Directory> 

Any idea what I could be missing?

Answer 1

Check that Apache has execute rights for /root, /root/site and /root/site/about.

Run:

chmod o+x /root /root/site /root/site/about 

You can find a more secure way in Elijah's answer.

Answer 2

The 403 error may also be caused by an encrypted file system, e.g. a symlink to an encrypted home folder.

If your symlink points into the encrypted folder, the apache user (e.g. www-data) cannot access the contents, even if apache and file/folder permissions are set correctly. Access of the www-data user can be tested with such a call:

sudo -u www-data ls -l /var/www/html/<your symlink>/ 

There are workarounds/solutions to this, e.g. adding the www-data user to your private group (exposes the encrypted data to the web user) or by setting up an unencrypted rsynced folder (probably rather secure). I for myself will probably go for an rsync solution during development.

https://askubuntu.com/questions/633625/public-folder-in-an-encrypted-home-directory

A convenient tool for my purposes is lsyncd. This allows me to work directly in my encrypted home folder and being able to see changes almost instantly in the apache web page. The synchronization is triggered by changes in the file system, calling an rsync. As I'm only working on rather small web pages and scripts, the syncing is very fast. I decided to use a short delay of 1 second before the rsync is started, even though it is possible to set a delay of 0 seconds.

Installing lsyncd (in Ubuntu):

sudo apt-get install lsyncd 

Starting the background service:

lsyncd -delay 1 -rsync /home/<me>/<work folder>/ /var/www/html/<web folder>/