0

I've been trying by hook or by crook to get /admin/static/ served up in an Apache SSL VirtualHost, preferably by Apache (which is forwarding SSL traffic to a Django Gunicorn instance), or barring Apache, at least Gunicorn serving up static content while I work on a better solution.

I'm getting an Apache-served 403, and all the permissions I've checked suggest that the /usr/lib/python2.7/dist-packages/django/contrib/admin/static/ directory (and parents as needed) are readable and executable by the user running the server.

Can you see anything wrong in the VirtualHost below which would explain why Apache isn't serving up the directory in question as an Aliased directory?

<VirtualHost *:443>
    ServerName ccachicago.pragmatometer.com

    Alias /media/ "/home/jonathan/ccachicago/media/"
    <Directory "/home/jonathan/ccachicago/media/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

    Alias /admin/static/ "/usr/lib/python2.7/dist-packages/django/contrib/admin/static/"
    <Directory "/usr/lib/python2.7/dist-packages/django/contrib/admin/static/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

    ProxyPass /media/ !
    ProxyPass /admin/static/ !
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

     SSLEngine On
     SSLCertificateFile /etc/apache2/ssl/ssl.crt
     SSLCertificateKeyFile /etc/apache2/ssl/ssl.key
    ServerAdmin CJSHayward@PObox.com
</VirtualHost>

--UPDATE--

I get the same 403 error page if I comment out the deny/allow lines. The logfile has:

[Mon Jan 27 21:52:34.297099 2014] [authz_core:error] [pid 4818] [client 205.197.161.146:44895] AH01630: client denied by server configuration: /usr/lib/python2.7/dist-packages/django/contrib/admin/static/css

So something in my configuration is apparently not working; I now have:

<VirtualHost *:443>
    ServerName ccachicago.pragmatometer.com

    Alias /media/ "/home/jonathan/ccachicago/media/"
    ErrorLog /var/log/apache2/error.log
    <Directory "/home/jonathan/ccachicago/media/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

    Alias /admin/static/ "/usr/lib/python2.7/dist-packages/django/contrib/admin/static/"
    <Directory "/usr/lib/python2.7/dist-packages/django/contrib/admin/static/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        #Order deny,allow
        #Deny from all
        #Allow from 127.0.0.0/255.0.0.0 ::1/128
        #Allow from 0.0.0.0 ::1/128
        #Allow from all
    </Directory>

    ProxyPass /media/ !
    ProxyPass /admin/static/ !
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

     SSLEngine On
     SSLCertificateFile /etc/apache2/ssl/ssl.crt
     SSLCertificateKeyFile /etc/apache2/ssl/ssl.key
    ServerAdmin CJSHayward@PObox.com
</VirtualHost>
Christos Hayward
  • 1,162
  • 3
  • 16
  • 35
  • Your Log snippet shows that you're not accessing the server from 127.0.0.1 or ::1 so the access restrictions you have in place will deny access when they are in force. After making the changes to your config you did remember to restart apache didn't you ? – user9517 Jan 27 '14 at 22:00
  • I remembered to restart Apache. – Christos Hayward Jan 27 '14 at 22:45

1 Answers1

1

You're only allowing access from 127.0.0.0 and ::1. Are you sure that you are accessing the site via these addresses? I would first disable the access restrictions and see what happens from there.

Your Log snippet shows that you're not accessing the server from 127.0.0.1 or ::1 so the access restrictions you have in place will deny access when they are in force.

user9517
  • 115,471
  • 20
  • 215
  • 297