![AH00035:访问/被拒绝 403 禁止 Django mod-wsgi](https://linux22.com/image/761309/AH00035%EF%BC%9A%E8%AE%BF%E9%97%AE%2F%E8%A2%AB%E6%8B%92%E7%BB%9D%20403%20%E7%A6%81%E6%AD%A2%20Django%20mod-wsgi.png)
我正在尝试使用 mod-wsgi 配置 apache 和 Django。但我收到以下错误
AH00035: access to / denied (filesystem path '/home/ec2-user/ezvoice') because search permissions are missing on a component of the path
URL 显示403 forbidden
这是 conf 文件
LoadModule wsgi_module "/home/ec2-user/venv/lib/python3.7/site-packages/mod_wsgi/server/mod_wsgi-py37.cpython-37m-x86_64-linux-gnu.so"
<VirtualHost *:80>
DocumentRoot /home/ec2-user/
Alias /static /home/ec2-user/ezvoice/sub_app/static
<Directory /home/ec2-user/ezvoice/sub_app/static>
Options FollowSymLinks
Order allow,deny
Require all granted
</Directory>
WSGIDaemonProcess ezvoice python-path=/home/ec2-user/ezvoice:/home/ec2-user/venv/lib/python3.7/site-packages
WSGIProcessGroup ezvoice
WSGIScriptAlias / /home/ec2-user/ezvoice/main_app/wsgi.py
ErrorLog /home/ec2-user/ezvoice/log-error.log
CustomLog /home/ec2-user/ezvoice/custom-error.log combined
<Directory /home/ec2-user/ezvoice/main_app>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
</VirtualHost>
目录结构如下
home
-ec2-user
--ezvoice
---main_app
----asgi.py
----settings.py
---sub_app
----views.py
--venv
---bin
---include
---lib
我尝试设置权限如下
sudo chown ec2-user ezvoice
sudo chown -R ec2-user /usr/local/lib/python3.7
sudo chown ec2-user /usr/local/bin
sudo chown ec2-user /usr/local/lib
答案1
“缺少搜索权限”意味着 Apache 用户(可能是 apache 或 www-data)没有权限遍历目录树直至 /home/ec2-user/ezvoice。您可以使用 来调试此问题namei -l
,它将向您显示从 / 开始到文件或目录的所有目录路径的长列表。例如:
$ namei -l /home/testuser
f: /home/testuser
dr-xr-xr-x root root /
drwxr-xr-x root root home
drwx------ testuser users testuser
当您对 /home/ec2-user/ezvoice 执行此操作时,您可能会看到路径上的某个目录 - 可能是 /,根据错误消息判断 - 缺少x
组或其他的权限,该权限允许用户通过该目录遍历目录树。
一个简单的解决方案是授予所有用户对所有这些目录的遍历权限:
chmod go+x / /home /home/ec2-user /home/ec2-user/ezvoice
然后再次比较输出namei -l
以查看发生了什么变化。如果您不想授予如此广泛的权限,您可以更谨慎地仅为 Apache 用户执行此操作,并使用文件 ACL:
setfacl -m u:apache:x / /home /home/ec2-user /home/ec2-user/ezvoice
请注意,更改 Python 的所有权并不是一个好主意。您应该能够修复 Python 和 Apache 读取的文件的权限,而不是程序本身的权限。