Bug 14317 - Apache 2.4 Directory config needs Require all granted
Summary: Apache 2.4 Directory config needs Require all granted
Status: CLOSED WORKSFORME
Alias: None
Product: Koha
Classification: Unclassified
Component: Installation and upgrade (command-line installer) (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-02 16:46 UTC by Larry Baerveldt
Modified: 2016-06-21 21:36 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Larry Baerveldt 2015-06-02 16:46:24 UTC
I recently installed Koha on Ubuntu 14.04, with Apache 2.4.7. The new default security settings in Apache 2.4 were causing the Koha directories to be blocked. The error message in the logs is: "AH01630: client denied by server configuration".

More specifically, the Directory settings in apache2.conf specifically block access to all directories other than /var/www and /srv. The koha-create and Makefile.PL scripts should be modified to add the following Directory definition to the apache conf file (either instance.conf for package or koha-httpd.conf for git installs):

<Directory "/path/to/doc/root">
  Require all granted
</Directory>

Regards,
Larry
Comment 1 Larry Baerveldt 2015-06-02 16:56:28 UTC
FYI, changes to Apache access control structures in 2.4:
http://httpd.apache.org/docs/2.4/upgrading.html#access
Comment 2 Robin Sheat 2015-06-03 00:09:24 UTC
I just did a package install on an Ubuntu 14.04 VM:

$ apt-cache policy apache2
apache2:
  Installed: 2.4.7-1ubuntu4.4

and there are no permission issues. Note that the access_compat module seems to be enabled by default, however it seems to work without that.
Comment 3 Larry Baerveldt 2015-06-03 15:41:42 UTC
Ah I see what happened. My installation had to use git, instead of package, because this particular site requires some extensive customizations. 

On a package site, the root Koha directories are in /usr/share/koha, and by default Apache 2.4 allows access to /usr/share, but not /home/koha/kohaclone (or wherever else your kohaclone may be).

So this will only be an issue if you're attempting to use a git install, and is a non-factor for normal package installations.

We may still want to consider patching the make files for git installs, so they will work for the rare occassions when someone might need that type of install. Otherwise this is probably a non-issue.

- Larry
Comment 4 Tomás Cohen Arazi 2015-09-28 21:41:31 UTC
I'm closing this for now. If we encounter this problem again, a new bug should be fixed, with reproducible steps.