Not able to view error messages

[smolloy]

When I try to access a web page that does not exist on my server I get the following response,

The requested URL /blah_blah.html was not found on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

I checked apache's error logs and it says,

(13)Permission denied: access to /error/HTTP_NOT_FOUND.html.var denied

I've checked the permissions on the error directory and it's owned by the same user I use to run apache, so there shouldn't be a problem with that. Also, I haven't changed the errors.conf file, so I guess it's still correctly configured.

Can anyone tell me what I should change to allow access to the regular apache error messages?

Thanks.

[smolloy]

Anyone have any ideas?

I'd really appreciate any help at all.

[darkrose0510]

The problem is most likely in the errors.conf file, open and check for the lines that say;
Order deny,allow
Deny from all
and change them to;
Order allow,deny
Allow from all

Also check the errors directory permissions are set to 755

[smolloy]

Thanks for posting darkrose0510.

I confirmed that the lines in errors.conf in the directory section are correct, and I've just changed the errors directory permissions to 755, but it still doesn't work.

I tried it with the directory owned by root and the apache user, but no luck there either.

Have you any other suggestions?

[darkrose0510]

I take it the actual error files themselves have the right permissions - 644
and that the errors.conf file does actually point to the correct directory;
Alias /error/ "/usr/share/apache2/error/"
or similar.

[smolloy]

Thanks for keeping up with this thread, darkrose0510 -- I appreciate your help.

I take it the actual error files themselves have the right permissions - 644

Yes. I've just confirmed they're all 644.

and that the errors.conf file does actually point to the correct directory;
Alias /error/ "/usr/share/apache2/error/"
or similar.

The following is the relevant section from errors.conf

Alias /error/ "/usr/share/apache2/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
    <Directory "/usr/share/apache2/error/">
        AllowOverride None
        Options IncludesNoExec
        AddOutputFilter Includes html
        AddHandler type-map var
        Order allow,deny
        Allow from all
        LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
        ForceLanguagePriority Prefer Fallback
    </Directory>

It all looks right to me. What do you think?

Thanks again for your help.

[darkrose0510]

Hmm, have a look in httpd.conf and see if there is a section denying access to the filesystem, somwhere around line 150ish;

<Directory />
    Options None
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>

Edit the relavent lines to;

allow, deny
Allow from all

and try again...
if you still have no luck, try commenting out line 145 of httpd.conf just to see if apache is generating it's error messages correctly.
#Include /etc/apache2/errors.conf
Try to access a page that doesn't exist and you should get a basic error page like;
Not Found
The requested URL /blah.html was not found on this server.
Apache/2.2.3 (Linux/SUSE) example.com Port 80

If that is fine then atleast apache is generating errors correctly.
So let us know how you go....

[smolloy]

Thanks for all the comments darkrose -- you're a saint!

I changed httpd.conf to "allow,deny" and "Allow from all" with no success.

I then commented out the include line you suggested, and then it worked! So I left it commented out and reset httpd.conf to deny access to /, and it continues to work.

Not Found

The requested URL /nonexistingpage.html was not found on this server.

So what does this imply? I'm kinda confused since I thought that apache wouldn't generate anything with this line uncommented!

[darkrose0510]

With that line commented out Apache will use it's default error messages rather than the error pages Suse want you to use.

What you can try is moving the contents of /usr/share/apache2/error/ to somewhere like /srv/www/error/ then edit errors.conf to point to this directory

Alias /error/ "/srv/www/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
    <Directory "/srv/www/error/">
        AllowOverride None
        Options IncludesNoExec
        AddOutputFilter Includes html
        AddHandler type-map var
        Order allow,deny
        Allow from all
        LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
        ForceLanguagePriority Prefer Fallback
    </Directory>

Then uncomment the Include line in httpd.conf and you should be using the Suse error messages.

[smolloy]

Thanks again.

I tried your suggestion of moving the error files to a /srv/www/error/ and altering errors.conf and httpd.conf, with no success.

It seems as if there is a config command somewhere that is stopping apache seeing anything outside of its home directory, and therefore cannot see the messages in /srv/www/error. I checked this theory by putting the error folder in the root apache folder (/srv/www/htdocs) and it worked!

I then removed /srv/www/htdocs/error, and made a new </Directory> entry in httpd.conf.local with "order allow,deny" and "allow from all" for /srv/www/error, and this worked. It now allows me to see the error folder in the directory above the web root folder. The annoying thing is that it doesn't work in the original folder no matter what I try!

I'm a bit of a newbie when it comes to web servers, so I was wondering if there any security implications of having the errors folder one folder above the web root?

Thanks again for your help.