1

I'm trying to use apache 2.2 to reverse proxy my tomcat server and serve the tomcat logs at the path /tomcat-logs. This is inside a Docker image based on ubuntu 12.04, but this shouldn't be an issue.

000-default.conf:

<VirtualHost *:80>
  Alias /tomcat-logs /var/log/tomcat7
  ProxyPreserveHost on
  ProxyPass /tomcat-logs !
  ProxyPass / http://localhost:8080/
  ProxyPassReverse / http://localhost:8080/
</VirtualHost>

httpd.conf:

<Directory />
  Order deny,allow
  Deny from all
</Directory>

<Directory /var/log/tomcat7>
  Order allow,deny
  Allow from all
  AllowOverride None
  Options +Indexes
</Directory>

The reverse proxy works as expected, but when I try to access tomcat-logs/catalina.out I get a 403 Forbidden. The error from the apache log is:

(13)Permission denied: access to /tomcat-logs/catalina.out denied

I've checked the file permissions of the log files and the directories leading to the log location and they are all 644 or 755.

The thing I find strange is that the access denied message says "/tomcat-logs/catalina.out" instead of "/var/log/tomcat7/catalina.out".

Does anyone have any ideas?

UPDATE

If I go to http://localhost/tomcat-logs/ in my web browser, I get the following error in my log:

(13)Permission denied: access to /tomcat-logs/index.html denied
... Others similar to index.html

So the Options +Indexes directive is not used. Therefore I think the Directory /var/log/tomcat7 is ignored. What could cause this?

UPDATE

If I drop the reverse proxy and use DocumentRoot instead of Alias I get the same error.

<VirtualHost *:80>
  DocumentRoot /var/log/tomcat7
</VirtualHost>

And the error is:

(13)Permission denied: access to /catalina.out denied

With debug logging the full log is:

[Fri Jan 09 14:26:40 2015] [notice] Apache/2.2.22 (Ubuntu) configured -- resuming normal operations
[Fri Jan 09 14:26:40 2015] [info] Server built: Jul 22 2014 14:35:32
[Fri Jan 09 14:26:40 2015] [debug] worker.c(1757): AcceptMutex: sysvsem (default: sysvsem)
[Fri Jan 09 14:26:40 2015] [debug] proxy_util.c(1818): proxy: grabbed scoreboard slot 0 in child 428 for worker proxy:reverse
[Fri Jan 09 14:26:40 2015] [debug] proxy_util.c(1914): proxy: initialized worker 0 in child 428 for (*) min=0 max=25 smax=25
[Fri Jan 09 14:26:40 2015] [debug] proxy_util.c(1818): proxy: grabbed scoreboard slot 0 in child 429 for worker proxy:reverse
[Fri Jan 09 14:26:40 2015] [debug] proxy_util.c(1837): proxy: worker proxy:reverse already initialized
[Fri Jan 09 14:26:40 2015] [debug] proxy_util.c(1914): proxy: initialized worker 0 in child 429 for (*) min=0 max=25 smax=25
[Fri Jan 09 14:27:07 2015] [error] [client 172.17.42.1] (13)Permission denied: access to /catalina.out denied
[Fri Jan 09 14:27:07 2015] [debug] mod_deflate.c(700): [client 172.17.42.1] Zlib: Compressed 289 to 219 : URL /catalina.out

Running sudo aa-status on the host gives:

apparmor module is loaded.
18 profiles are loaded.
18 profiles are in enforce mode.
  /sbin/dhclient
  /usr/lib/NetworkManager/nm-dhcp-client.action
  /usr/lib/connman/scripts/dhclient-script
  /usr/lib/cups/backend/cups-pdf
  /usr/lib/lightdm/lightdm-guest-session
  /usr/lib/lightdm/lightdm-guest-session//chromium
  /usr/lib/telepathy/mission-control-5
  /usr/lib/telepathy/telepathy-*
  /usr/lib/telepathy/telepathy-*//pxgsettings
  /usr/lib/telepathy/telepathy-*//sanitized_helper
  /usr/lib/telepathy/telepathy-ofono
  /usr/sbin/cups-browsed
  /usr/sbin/cupsd
  /usr/sbin/cupsd//third_party
  /usr/sbin/mysqld-akonadi
  /usr/sbin/mysqld-akonadi///usr/sbin/mysqld
  /usr/sbin/tcpdump
  docker-default
0 profiles are in complain mode.
10 processes have profiles defined.
10 processes are in enforce mode.
  /sbin/dhclient (9937) 
  /usr/lib/telepathy/mission-control-5 (3463) 
  /usr/sbin/cups-browsed (1405) 
  /usr/sbin/cupsd (3849) 
  /usr/sbin/mysqld-akonadi///usr/sbin/mysqld (3481) 
  docker-default (14568) 
  docker-default (15403) 
  docker-default (15406) 
  docker-default (15408) 
  docker-default (15409) 
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

After I run aa-complain /etc/apparmor.d/docker I still get the 403 error.

  • Could you try to copy the Directory inside the VirtualHost? – NuTTyX Jan 9 '15 at 13:04
  • Makes no difference – gerrit Jan 9 '15 at 13:21
  • Do you have SELinux enabled on the system? Type sestatus to check. – NuTTyX Jan 9 '15 at 13:51
  • sestatus is not installed – gerrit Jan 9 '15 at 13:52
  • Are directories from root to the /var/log/tomcat7 all set to 755? I read that you already checked that, but I was not sure if any of the directories could be 644. Just to check. Also they ship Ubuntu with apparmor instead of SELinux. Could you please check if there is any policy that could be blocking apache from reading those files? Also, check if there is a symlink on the path to the tomcat logs. If there is, check again the permissions and add Options +FollowSymLinks – NuTTyX Jan 9 '15 at 14:00
1

I've found a workaround by adding the www-data user to the adm group with usermod -a -G adm www-data. Can anybody shed some light why this works but giving read and execute permisions to others for /var/log/tomcat7 doesn't? Also changing the group of this directory to www-data didn't work.

  • I'm still trying to get the usermod work-around to work. Running Apache in a Docker container is painful. EVERYTHING is owned by root, but Apache runs under www-data and even if you give www-data sudoer permissions it still tosses 403 forbidden errors. You can change user and group in the envvars file but then you get advised to build Apache from source with specific switches for -DBIG_A$$_SECURITY_HOLE – RyanNerd Nov 20 '15 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.