Forbidden request for a page.

Hi, my dilemma is that when trying to access content on a system, a
customer is getting a "GET / HTTP/1.1" 403 210 0 - Forbidden error,
however I can access the content without a problem i.e. "GET
/content/index.html HTTP/1.1" 200 27263 1 from my browser.

I have tomcat and cocoon installed as well as a number of vhosts
configured. Accessing the URL http://www.gedtestsite.com serves the
content successfully for me i.e
http://www.gedtestsite.com/content/index.html. However, the customer
is met with a forbidden error.

I am almost at my wits end trying to figure this out. The above is
from the access.log, the error log shows the following:

[error] [client xx.xxx.xxx.xx] Directory index forbidden by rule:
/usr/local/apache/htdocs/shared.gedtestsite.com/

I've read so much about the "directory index forbidden....." stuff but
I cannot see how I can access the content whereas the customer cannot.

Any help would be much appreciated.
Regards

"weeged" <weeged@gmail.com> schreef in bericht
news:1118917803.418225.224710@g14g2000cwa.googlegr oups.com...
> Hi, my dilemma is that when trying to access content on a system, a
> customer is getting a "GET / HTTP/1.1" 403 210 0 - Forbidden error,
> however I can access the content without a problem i.e. "GET
> /content/index.html HTTP/1.1" 200 27263 1 from my browser.
These two lines from access_log do not represent the same URL. The first
line shows an -failing- attempt to retrieve a default document from the root
of the site, the second line shows succesful access to a file in folder.

> I've read so much about the "directory index forbidden....." stuff but
> I cannot see how I can access the content whereas the customer cannot.
With unidentical request, the result should not match either ...

What type of url-s were given to the browsers for these requests: eg
http://name.domain.org/ or http://1.2.3.4/ ?

Is name.domain.org registered with som dynamic DNS provider and using
port-redirect to bypass your provider's block on port 80?

Tell us more about the config, parts of greater interest are vhost-sections
and (their) documentroot.

HansH

Hans many thanks for your reply. I have replied below.

HansH wrote:
> "weeged" <weeged@gmail.com> schreef in bericht
> news:1118917803.418225.224710@g14g2000cwa.googlegr oups.com...
> > Hi, my dilemma is that when trying to access content on a system, a
> > customer is getting a "GET / HTTP/1.1" 403 210 0 - Forbidden error,
> > however I can access the content without a problem i.e. "GET
> > /content/index.html HTTP/1.1" 200 27263 1 from my browser.
> These two lines from access_log do not represent the same URL. The first
> line shows an -failing- attempt to retrieve a default document from the root
> of the site, the second line shows succesful access to a file in folder.
>
> > I've read so much about the "directory index forbidden....." stuff but
> > I cannot see how I can access the content whereas the customer cannot.
> With unidentical request, the result should not match either ...
>
> What type of url-s were given to the browsers for these requests: eg
> http://name.domain.org/ or http://1.2.3.4/ ?

URLs given were http://name.domain.org.

>
> Is name.domain.org registered with som dynamic DNS provider and using
> port-redirect to bypass your provider's block on port 80?

No

> Tell us more about the config, parts of greater interest are vhost-sections
> and (their) documentroot.
>

Apart from Apache, tomcat is installed with cocoon. There are around
14 or so vhosts set up and these are fine, it is only this one. Working
normally, hitting the url http://www.gedtestsite.com would display
http://www.gedtestsite.com/content/index.html. The machine is hosted
within a corporate intranet and as just mentioned there are a number of
other vhosts configured, but these can be accessed internally and
externally. It is only this vhost that gives a forbidden error when
attempting to access externally. You will notice below that I've tried
to add some Directory directives, to no avail.

<VirtualHost *:80>
ServerAdmin webmaster@gedtestsite.com
DocumentRoot "/usr/local/apache/htdocs/www.gedtestsite.com"
ServerName www.gedtestsite.com
ServerAlias uk.gedtestsite.com
ServerAlias stag.gedtestsite.com
ErrorLog logs/www.gedtestsite.com-error_log
CustomLog "|/usr/local/apache/bin/rotatelogs
/usr/local/apache/logs/www.gedtestsite.com-access_log_%d-%m-%Y 86400 "
common
JkMount /content/* worker1
DirectoryIndex index.html
<Directory />
DirectoryIndex index.html
Order allow,deny
Allow from all
</Directory>
<Directory /usr/local/apache/htdocs/sharedcontent.gedtestsite.com>
DirectoryIndex index.html
Order allow,deny
Allow from all
</Directory>
RewriteEngine on
RewriteCond /usr/local/apache/%{REQUEST_FILENAME} !-f
RewriteCond
/usr/local/apache/htdocs/www.gedtestsite.com/%{REQUEST_FILENAME} !-f
RewriteRule ^(.+)
/usr/local/apache/htdocs/sharedcontent.gedtestsite.com/$1
#RewriteRule ^/
/usr/local/apache/htdocs/shared.gedtestsite.com/index.html
</VirtualHost>

> HansH

"weeged" <weeged@gmail.com> schreef in bericht
news:1118999054.942348.305150@z14g2000cwz.googlegr oups.com...
> HansH wrote:
> > "weeged" <weeged@gmail.com> schreef in bericht
> > news:1118917803.418225.224710@g14g2000cwa.googlegr oups.com...
> > What type of url-s were given to the browsers for these requests: eg
> > http://name.domain.org/ or http://1.2.3.4/ ?
> URLs given were http://name.domain.org.
> > Is name.domain.org registered with som dynamic DNS provider and using
> > port-redirect to bypass your provider's block on port 80?
> No
> > Tell us more about the config, parts of greater interest are
vhost-sections
> > and (their) documentroot.
> Apart from Apache, tomcat is installed with cocoon. There are around
> 14 or so vhosts set up and these are fine, it is only this one. Working
> normally, hitting the url http://www.gedtestsite.com would display
> http://www.gedtestsite.com/content/index.html.
There must be some config line responsible for this tric:
Is there a serverwide rewrite?
What's the paramter on the directoryindex ?
Do other vhost have their own directoryindex?

> The machine is hosted
> within a corporate intranet and as just mentioned there are a number of
> other vhosts configured, but these can be accessed internally and
> externally. It is only this vhost that gives a forbidden error when
> attempting to access externally.
Which rules _out_ the unanswered questions above ...
.... but I still wanna know

Attempts were made from multiple PCs, IPs, browsers?

BTW Is this the first vhost defined?

> You will notice below that I've tried
> to add some Directory directives, to no avail.
>
> <VirtualHost *:80>
> ServerAdmin webmaster@gedtestsite.com
> DocumentRoot "/usr/local/apache/htdocs/www.gedtestsite.com"
> ServerName www.gedtestsite.com
> ServerAlias uk.gedtestsite.com
> ServerAlias stag.gedtestsite.com
> ErrorLog logs/www.gedtestsite.com-error_log
> CustomLog "|/usr/local/apache/bin/rotatelogs
> /usr/local/apache/logs/www.gedtestsite.com-access_log_%d-%m-%Y 86400 "
> common
> JkMount /content/* worker1
> DirectoryIndex index.html
> <Directory />
> DirectoryIndex index.html
> Order allow,deny
> Allow from all
> </Directory>
> <Directory /usr/local/apache/htdocs/sharedcontent.gedtestsite.com>
> DirectoryIndex index.html
> Order allow,deny
> Allow from all
> </Directory>
> RewriteEngine on
> RewriteCond /usr/local/apache/%{REQUEST_FILENAME} !-f
> RewriteCond
> /usr/local/apache/htdocs/www.gedtestsite.com/%{REQUEST_FILENAME} !-f
> RewriteRule ^(.+)
> /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/$1
> #RewriteRule ^/
> /usr/local/apache/htdocs/shared.gedtestsite.com/index.html
> </VirtualHost>

The rules and conditions make me wonder ...
.... looks like you have shared 'master' pages to fill in for missing pages
of a site.
I think this would be more correct:
RewriteCond
/usr/local/apache/htdocs/sharedcontent.gedtestsite.com/%{REQUEST_FILENAME} -
f
RewriteCond
/usr/local/apache/htdocs/www.gedtestsite.com/%{REQUEST_FILENAME} !-f
RewriteRule ^(.+) /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/$1

However this -again- holds no clue to the problem observed...

Diverting course... is there a .htaccess file hanging around in
- /usr/local/apache/htdocs/www.gedtestsite.com/
- /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/content/
or has the config a directory or location block for any of these??


HansH

HansH wrote:
> "weeged" <weeged@gmail.com> schreef in bericht
> news:1118999054.942348.305150@z14g2000cwz.googlegr oups.com...
> > HansH wrote:
> > > "weeged" <weeged@gmail.com> schreef in bericht
> > > news:1118917803.418225.224710@g14g2000cwa.googlegr oups.com...
> > > What type of url-s were given to the browsers for these requests: eg
> > > http://name.domain.org/ or http://1.2.3.4/ ?
> > URLs given were http://name.domain.org.
> > > Is name.domain.org registered with som dynamic DNS provider and using
> > > port-redirect to bypass your provider's block on port 80?
> > No
> > > Tell us more about the config, parts of greater interest are
> vhost-sections
> > > and (their) documentroot.
> > Apart from Apache, tomcat is installed with cocoon. There are around
> > 14 or so vhosts set up and these are fine, it is only this one. Working
> > normally, hitting the url http://www.gedtestsite.com would display
> > http://www.gedtestsite.com/content/index.html.
> There must be some config line responsible for this tric:
> Is there a serverwide rewrite?
> What's the paramter on the directoryindex ?
> Do other vhost have their own directoryindex?

The other vhosts do not have their own DirectoryIndex.
In httpd.conf the only reference to DirectoryIndex is:
<IfModule mod_dir.c>
DirectoryIndex index.html index.htm
</IfModule>

>
> > The machine is hosted
> > within a corporate intranet and as just mentioned there are a number of
> > other vhosts configured, but these can be accessed internally and
> > externally. It is only this vhost that gives a forbidden error when
> > attempting to access externally.
> Which rules _out_ the unanswered questions above ...
> ... but I still wanna know
>
> Attempts were made from multiple PCs, IPs, browsers?

Attempts have been made from multiple pc's and browsers.

>
> BTW Is this the first vhost defined?

No this is not the first vhost.

>
> > You will notice below that I've tried
> > to add some Directory directives, to no avail.
> >
> > <VirtualHost *:80>
> > ServerAdmin webmaster@gedtestsite.com
> > DocumentRoot "/usr/local/apache/htdocs/www.gedtestsite.com"
> > ServerName www.gedtestsite.com
> > ServerAlias uk.gedtestsite.com
> > ServerAlias stag.gedtestsite.com
> > ErrorLog logs/www.gedtestsite.com-error_log
> > CustomLog "|/usr/local/apache/bin/rotatelogs
> > /usr/local/apache/logs/www.gedtestsite.com-access_log_%d-%m-%Y 86400 "
> > common
> > JkMount /content/* worker1
> > DirectoryIndex index.html
> > <Directory />
> > DirectoryIndex index.html
> > Order allow,deny
> > Allow from all
> > </Directory>
> > <Directory /usr/local/apache/htdocs/sharedcontent.gedtestsite.com>
> > DirectoryIndex index.html
> > Order allow,deny
> > Allow from all
> > </Directory>
> > RewriteEngine on
> > RewriteCond /usr/local/apache/%{REQUEST_FILENAME} !-f
> > RewriteCond
> > /usr/local/apache/htdocs/www.gedtestsite.com/%{REQUEST_FILENAME} !-f
> > RewriteRule ^(.+)
> > /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/$1
> > #RewriteRule ^/
> > /usr/local/apache/htdocs/shared.gedtestsite.com/index.html
> > </VirtualHost>
>
> The rules and conditions make me wonder ...
> ... looks like you have shared 'master' pages to fill in for missing pages
> of a site.
> I think this would be more correct:
> RewriteCond
> /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/%{REQUEST_FILENAME} -
> f
> RewriteCond
> /usr/local/apache/htdocs/www.gedtestsite.com/%{REQUEST_FILENAME} !-f
> RewriteRule ^(.+) /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/$1
>
I'll give this a try

> However this -again- holds no clue to the problem observed...
>
> Diverting course... is there a .htaccess file hanging around in
> - /usr/local/apache/htdocs/www.gedtestsite.com/
> - /usr/local/apache/htdocs/sharedcontent.gedtestsite.com/content/
> or has the config a directory or location block for any of these??
>

There are no .htaccess files and no directory or location restrictions
in place.
>

> HansH