Apache 2.4 error 403 Forbidden

Question

I have Ubuntu 18.04 system running apache2 and SSL from LetsEncrypt. Also I have connected a domain name to my server. I've tried changing permissions and folder owners, but no matter what I do, I still get the 403 Forbidden error when I try to access my domain(it is auto-redirecting to https btw). Here are the config files (I'm replacing my domain with sample-domain.eu below):

apache2.conf:

DefaultRuntimeDir ${APACHE_RUN_DIR}
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

Include ports.conf

<Directory />
        Options FollowSymLinks
        AllowOverride All
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride All
        Require all granted
</Directory>

AccessFileName .htaccess

<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

IncludeOptional conf-enabled/*.conf

IncludeOptional sites-enabled/*.conf

Envvars:

unset HOME

if [ "${APACHE_CONFDIR##/etc/apache2-}" != "${APACHE_CONFDIR}" ] ; then
        SUFFIX="-${APACHE_CONFDIR##/etc/apache2-}"
else
        SUFFIX=
fi

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

export APACHE_PID_FILE=/var/run/apache2$SUFFIX/apache2.pid
export APACHE_RUN_DIR=/var/run/apache2$SUFFIX
export APACHE_LOCK_DIR=/var/lock/apache2$SUFFIX

export APACHE_LOG_DIR=/var/log/apache2$SUFFIX

export LANG=C

export LANG

/sites-enabled/000-default.conf

<VirtualHost *:80>
        ServerAdmin webmaster@sample-domain.eu
        DocumentRoot /var/www/sample-domain.eu/public_html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

/sites-enabled/sample-domain.eu.conf

<VirtualHost *:80>
    ServerName sample-domain.eu
    ServerAlias www.sample-domain.eu
    ServerAdmin webmaster@sample-domain.eu
    DocumentRoot /var/www/sample-domain.eu/public_html

    <Directory /var/www/sample-domain.eu/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/sample-domain.eu-error.log
    CustomLog ${APACHE_LOG_DIR}/sample-domain.eu-access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =sample-domain.eu [OR]
RewriteCond %{SERVER_NAME} =www.sample-domain.eu
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

sites-enabled/sample-domain.eu-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName sample-domain.eu
    ServerAlias www.sample-domain.eu
    ServerAdmin webmaster@sample-domain.eu
    DocumentRoot /var/www/sample-domain.eu/public_html

    <Directory /var/www/sample-domain.eu/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/sample-domain.eu-error.log
    CustomLog ${APACHE_LOG_DIR}/sample-domain.eu-access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/sample-domain.eu/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/sample-domain.eu/privkey.pem
</VirtualHost>
</IfModule>

Also I have index.html file in /var/www/sample-domain.eu/public_html EDIT: forgot to mention that I have phpmyadmin and webmin installed and both are working with their urls: /phpmyadmin /:10000

Does it work when the redirection to https is disabled? The proper way to do such redirection is to use the Redirect directive: https://askubuntu.com/a/1031460/566421 Also, I think, you need to add something like: order allow,deny and allow from all for <Directory /var/www/sample-domain.eu/public_html>. — pa4080, Sep 16 '19 at 06:31
No, it does not work with https redirection disabled as well. — niki, Sep 16 '19 at 07:52
Even when I disable all sites with a2dissite, I still get 403 — niki, Sep 16 '19 at 09:44

score 2 · Answer 1 · answered Sep 16 '19 at 10:16

2

I have made it work, however I'm not sure if this is secure option to do.

In /etc/apache2/apache2.conf file, I have changed the "Require all denied" to "Require all granted" here:

<Directory />
        Options FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

I'm not sure why it was set to all denied, since I did not change it. However, the server is now working, and no longer throwing error 403.

answered Sep 16 '19 at 10:16

nikolay

121

1

This is protection against directory traversal attack. I wouldn't change it! You must write these rules for the DocumentRoot directory. When you changing the Apache's configuration you must reload it or restart the service and flush the browser's cache. – pa4080 Sep 16 '19 at 10:33

Apache 2.4 error 403 Forbidden

1 Answers1