403 Forbidden

Bonjour tout le monde,

J’ai fais quelques recherches sur mon souci (google est mon ami) mais je n’ai pas trouvé de solution à mon problème qui est le suivant:

J’hébergeais des sites sous apache pour windows (ohh je sens déjà là que je vais me faire fouetter :079 :smiley: ) et puis depuis peu j’ai enfin eu le courage de me mettre à debian. La migration s’est bien passé et tout et tout mais un des sites que j’héberge me pose quelques souci.

En effet si tout le site s’affiche sans souci lorsque son utilisateur veux accéder à son administration (example.com/admin) cette dernière (qui est au passage protégé par un .htaccess qui est fonctionnel) refuse de s’afficher et me donne l’erreur suivante:

Forbidden

You don’t have permission to access /admin/index.php on this server.

Voici la ligne du log access qui va avec (du coté d’apache error il n’y à rien à signaler):

77.206.195.238 - celine [06/Jun/2012:18:20:56 +0200] “GET /admin/index.php HTTP/1.1” 403 520 “-” “Mozilla/5.0 (Windows NT 6.2; rv:12.0) Gecko/20100101 Firefox/12.0”

étant totalement débutant du coté de debian je ne vois pas qui/quoi pourrais bloquer le dossier (le dossier racine de ce site n’a pas de .htaccess qui pourrais influer sur le dossier admin)

Je vous donne en compléments quelques info supplémentaires sur mon système:

Operating system Debian Linux 6.0
Kernel and CPU Linux 2.6.32-5-amd64 on x86_64

ce derniers tourne avec virtualmin/webmin
le serveur Apache est en version 2.2.16
il tourne php5 ainsi que les modules suivants (désolé pour le cafouillis)
bcmath bz2 calendar cgi-fcgi Core ctype
date dba dom ereg exif fileinfo
filter ftp gd gettext hash iconv
json libxml mbstring mcrypt mhash mysql
mysqli openssl pcre PDO pdo_mysql pdo_sqlite
Phar posix Reflection session shmop SimpleXML
soap sockets SPL SQLite sqlite3 standard
suhosin Suhosin sysvmsg sysvsem sysvshm tokenizer
wddx xml xmlreader xmlwriter zip zlib

Voila voila si vous avez des pistes à me proposer voire plus je suis preneur :wink:

[quote=“bbysera”]En effet si tout le site s’affiche sans souci lorsque son utilisateur veux accéder à son administration (example.com/admin) cette dernière (qui est au passage protégé par un .htaccess qui est fonctionnel) refuse de s’afficher et me donne l’erreur suivante:

Forbidden

You don’t have permission to access /admin/index.php on this server.[/quote]
C’est avant ou après que tu ais entré ton login/password ?

Donne nous aussi le contenu du .htaccess et de la conf apache (pour le site en question).

Cela se passe après l’entrée du login/mdp (j’avais même fait le test sans la protection .htaccess)

Voici le htaccess tel que le site l’avais (j’ai juste eu à la modifier pour l’adapter aux chemin linux)

Options Indexes FollowSymLinks
AuthUserFile "/home/paradisemusic/public_html/admin/.htpasswd"
AuthType Basic
AuthName "Page protege"
require valid-user

voici les “directives” pour le site

SuexecUserGroup “#1013” "#1013"
ServerName paradisemusic-official.com
ServerAlias www.paradisemusic-official.com
ServerAlias webmail.paradisemusic-official.com
ServerAlias admin.paradisemusic-official.com
DocumentRoot /home/paradisemusic/public_html
ErrorLog /var/log/virtualmin/paradisemusic-official.com_error_log
CustomLog /var/log/virtualmin/paradisemusic-official.com_access_log combined
ScriptAlias /cgi-bin/ /home/paradisemusic/cgi-bin/
ScriptAlias /awstats/ /home/paradisemusic/cgi-bin/
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/paradisemusic/public_html>
Options -Indexes +IncludesNOEXEC +FollowSymLinks +ExecCGI
allow from all
AllowOverride All
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/paradisemusic/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/paradisemusic/fcgi-bin/php5.fcgi .php5

<Directory /home/paradisemusic/cgi-bin>
allow from all

RewriteEngine on
RewriteCond %{HTTP_HOST} =webmail.paradisemusic-official.com
RewriteRule ^(.) paradisemusic-official.com:20000/ [R]
RewriteCond %{HTTP_HOST} =admin.paradisemusic-official.com
RewriteRule ^(.
) paradisemusic-official.com:10000/ [R]
RemoveHandler .php
RemoveHandler .php5
IPCCommTimeout 31
FcgidMaxRequestLen 1073741824

AuthName "paradisemusic-official.com statistics"
AuthType Basic
AuthUserFile /home/paradisemusic/.awstats-htpasswd
require valid-user

et voici le fichier apache2.conf (il va être un peu gros je préviens ^^)

Based upon the NCSA server configuration files originally by Rob McCool.

This is the main Apache server configuration file. It contains the

configuration directives that give the server its instructions.

See httpd.apache.org/docs/2.2/ for detailed information about

the directives.

Do NOT simply read the instructions in here without understanding

what they do. They’re here only as hints or reminders. If you are unsure

consult the online docs. You have been warned.

The configuration directives are grouped into three basic sections:

1. Directives that control the operation of the Apache server process as a

whole (the ‘global environment’).

2. Directives that define the parameters of the ‘main’ or ‘default’ server,

which responds to requests that aren’t handled by a virtual host.

These directives also provide default values for the settings

of all virtual hosts.

3. Settings for virtual hosts, which allow Web requests to be sent to

different IP addresses or hostnames and have them handled by the

same Apache server process.

Configuration and logfile names: If the filenames you specify for many

of the server’s control files begin with “/” (or “drive:/” for Win32), the

server will use that explicit path. If the filenames do not begin

with “/”, the value of ServerRoot is prepended – so “foo.log”

with ServerRoot set to “/etc/apache2” will be interpreted by the

server as “/etc/apache2/foo.log”.

Section 1: Global Environment

The directives in this section affect the overall operation of Apache,

such as the number of concurrent requests it can handle or where it

can find its configuration files.

ServerRoot: The top of the directory tree under which the server’s

configuration, error, and log files are kept.

NOTE! If you intend to place this on an NFS (or otherwise network)

mounted filesystem then please read the LockFile documentation (available

at URL:http://httpd.apache.org/docs/2.2/mod/mpm_common.html#lockfile);

you will save yourself a lot of trouble.

Do NOT add a slash at the end of the directory path.

#ServerRoot “/etc/apache2”

The accept serialization lock file MUST BE STORED ON A LOCAL DISK.

LockFile ${APACHE_LOCK_DIR}/accept.lock

PidFile: The file in which the server should record its process

identification number when it starts.

This needs to be set in /etc/apache2/envvars

PidFile ${APACHE_PID_FILE}

Timeout: The number of seconds before receives and sends time out.

Timeout 300

KeepAlive: Whether or not to allow persistent connections (more than

one request per connection). Set to “Off” to deactivate.

KeepAlive On

MaxKeepAliveRequests: The maximum number of requests to allow

during a persistent connection. Set to 0 to allow an unlimited amount.

We recommend you leave this number high, for maximum performance.

MaxKeepAliveRequests 100

KeepAliveTimeout: Number of seconds to wait for the next request from the

same client on the same connection.

KeepAliveTimeout 15

Server-Pool Size Regulation (MPM specific)

prefork MPM

StartServers: number of server processes to start

MinSpareServers: minimum number of server processes which are kept spare

MaxSpareServers: maximum number of server processes which are kept spare

MaxClients: maximum number of server processes allowed to start

MaxRequestsPerChild: maximum number of requests a server process serves

StartServers 5 MinSpareServers 5 MaxSpareServers 10 MaxClients 150 MaxRequestsPerChild 0

worker MPM

StartServers: initial number of server processes to start

MaxClients: maximum number of simultaneous client connections

MinSpareThreads: minimum number of worker threads which are kept spare

MaxSpareThreads: maximum number of worker threads which are kept spare

ThreadLimit: ThreadsPerChild can be changed to this maximum value during a

graceful restart. ThreadLimit can only be changed by stopping

and starting Apache.

ThreadsPerChild: constant number of worker threads in each server process

MaxRequestsPerChild: maximum number of requests a server process serves

StartServers 2 MinSpareThreads 25 MaxSpareThreads 75 ThreadLimit 64 ThreadsPerChild 25 MaxClients 150 MaxRequestsPerChild 0

event MPM

StartServers: initial number of server processes to start

MaxClients: maximum number of simultaneous client connections

MinSpareThreads: minimum number of worker threads which are kept spare

MaxSpareThreads: maximum number of worker threads which are kept spare

ThreadsPerChild: constant number of worker threads in each server process

MaxRequestsPerChild: maximum number of requests a server process serves

StartServers 2 MaxClients 150 MinSpareThreads 25 MaxSpareThreads 75 ThreadLimit 64 ThreadsPerChild 25 MaxRequestsPerChild 0

These need to be set in /etc/apache2/envvars

User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

AccessFileName: The name of the file to look for in each directory

for additional configuration directives. See also the AllowOverride

directive.

AccessFileName .htaccess

The following lines prevent .htaccess and .htpasswd files from being

viewed by Web clients.

<Files ~ “^.ht”>
Order allow,deny
Deny from all
Satisfy all

DefaultType is the default MIME type the server will use for a document

if it cannot otherwise determine one, such as from filename extensions.

If your server contains mostly text or HTML documents, “text/plain” is

a good value. If most of your content is binary, such as applications

or images, you may want to use “application/octet-stream” instead to

keep browsers from trying to display binary files as though they are

text.

DefaultType text/plain

HostnameLookups: Log the names of clients or just their IP addresses

e.g., www.apache.org (on) or 204.62.129.132 (off).

The default is off because it’d be overall better for the net if people

had to knowingly turn this feature on, since enabling it means that

each client request will result in AT LEAST one lookup request to the

nameserver.

HostnameLookups Off

ErrorLog: The location of the error log file.

If you do not specify an ErrorLog directive within a

container, error messages relating to that virtual host will be

logged here. If you do define an error logfile for a

container, that host’s errors will be logged there and not here.

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel: Control the number of messages logged to the error_log.

Possible values include: debug, info, notice, warn, error, crit,

alert, emerg.

LogLevel warn

Include module configuration:

Include mods-enabled/.load
Include mods-enabled/
.conf

Include all the user configurations:

Include httpd.conf

Include ports listing

Include ports.conf

The following directives define some format nicknames for use with

a CustomLog directive (see below).

If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i

LogFormat “%v:%p %h %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” vhost_combined
LogFormat “%h %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” combined
LogFormat “%h %l %u %t “%r” %>s %O” common
LogFormat “%{Referer}i -> %U” referer
LogFormat “%{User-agent}i” agent

Include of directories ignores editors’ and dpkg’s backup files,

see README.Debian for details.

Include generic snippets of statements

Include conf.d/

Include the virtual host configurations:

Include sites-enabled/
NameVirtualHost 87.98.137.122:80
NameVirtualHost 87.98.137.122:443

Salut,

C’est porte ouverte chez toi … :033

Starting Nmap 5.00 ( http://nmap.org ) at 2012-06-06 19:56 CEST Interesting ports on x.x.x.x.kimsufi.com (x.x.x.x): Not shown: 65512 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp ProFTPD 1.3.3a 22/tcp open ssh OpenSSH 5.5p1 Debian 6+squeeze2 (protocol 2.0) 25/tcp filtered smtp 53/tcp open domain ISC BIND 9.7.3 80/tcp open http Apache httpd 2.2.16 ((Debian)) 110/tcp open pop3 Dovecot pop3d 111/tcp open rpcbind 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 143/tcp open imap Dovecot imapd 443/tcp open ssl/http Apache httpd 2.2.16 ((Debian)) 445/tcp filtered microsoft-ds 587/tcp open smtp Postfix smtpd 901/tcp open http Samba SWAT administration server 993/tcp open ssl/imap Dovecot imapd 995/tcp open ssl/pop3 Dovecot pop3d 2049/tcp open rpcbind 3306/tcp open mysql MySQL 5.1.49-3 10000/tcp open ssl/snet-sensor-mgmt? 20000/tcp open http Webmin httpd 25565/tcp open unknown 46898/tcp open rpcbind 51221/tcp open rpcbind 53014/tcp open rpcbind

oui je sais le parefeu n’est pas activé encore (chaque chose en son temps nan? :slightly_smiling: )

Tu as le même problème quand tu supprimes le .htaccess ?
Vérifie qu’apache a le droit de lecture sur les fichiers.

Tu as le même problème quand tu supprimes le .htaccess ?
Vérifie qu’apache a le droit de lecture sur les fichiers.[/quote]

Oui même sans le htaccess :confused:

Sinon pardon d’avoir oublié de préciser mes droits sur les fichier: le dossier est en 755

Je reste perplexe quant au problème. J’ai bien entendu parlé d’un mod_security où de je ne sais quelle autre pare-feu applicatif mais bon je n’en ai pas (sauf si cela est livré par défaut???) enfin à ce que j’ai pu trouver :confused:

j’ai un peu de nouveau: vu que j’ai d’autre nom de domaine (dont un qui ne me sert pas encore) j’ai fait le test rapide de faire une arborecense comme suite:

public_html: un dossier admin et un fichier index.html
admin: un fichier index.php

et là j’arrive à aller lire ces deux fichier O.o

Il y a donc un truc qui merdouille du coté de l’autre site…un truc qui refuse l’accès au pannel admin mais quoi donc…

Je me permet un petit up si quelqu’un à une idée.

Ce soir je retente l’expérience mais avec des .htaccess (voir un duplicata du site concerné)