0

I have set up an Apache server for the purpose of hosting gitolite. I've followed this guide, but when accessing the server I get a 403, and the apache error log contains this line:

[error] [client 192.168.0.97] client denied by server configuration: /var/www/bin/gitolite-suexec-wrapper.sh

As far as my understanding goes, this means the apache user can't open the wrapper script? Most pages detailing the "client denied by server configuration" message write about directories needing an Allow from all, but since the /var/www/bin/ directory isn't even supposed to be browsed, that shouldn't be the issue, I'd think?

The suexec part of the vhost config looks like this:

    SuexecUserGroup git git
    ScriptAlias /git/ /var/www/bin/gitolite-suexec-wrapper.sh/
    ScriptAlias /gitmob/ /var/www/bin/gitolite-suexec-wrapper.sh/

I'm running gitolite 3.5.2 and apache 2.2.25 on a gentoo 3.10.7 server. Apache is running under the user apache, and gitolite under git. These are the access rights for the suexec directories:

# ls -la /var/www/bin/ /var/www/git/
/var/www/bin/:
total 12
drwxr-xr-x 2 git    git  4096 Dec  9 21:26 .
drwxr-xr-x 5 apache root 4096 Dec  9 21:25 ..
-rwx------ 1 git    git   249 Dec  9 21:27 gitolite-suexec-wrapper.sh

/var/www/git/:
total 8
drwxr-xr-x 2 apache apache 4096 Dec  9 21:25 .
drwxr-xr-x 5 apache root   4096 Dec  9 21:25 ..

What more should I check?

0

I "fixed" it, though it feels like a hack to me. I added this

    <Directory /var/www/bin>
            Order allow,deny
            Allow from all
    </Directory>

... to the vhost config. I would have guessed that it should not really be necessary, since it is not an actual client request that opens this directory?

I also had to remap my git user and group, since suexec was compiled to force uid/gid > 1000, but the gentoo installer made them system accounts, which yielded a low id.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.