Perplexing Index permissions issue

[ergophobe]

Hello all. I'm in need of a few ideas.

On my dev setup, I get a 403 every time I try to look at a directory. It serves up files and PHP scripts just fine, but I can't access directory listings.

[Fri Feb 05 08:49:59 2010] [error] [client 127.0.0.1] Directory index forbidden by Options directive: C:/Users/Tom/htdocs/

What's perplexing about this, is I have set

Options Indexes FollowSymlinks or Options All
Allow from All
Order allow, deny

everywhere I can.

Now here's where it gets really weird. I have

DirectoryIndex index.html index.htm index.php

And yet if I have all three of those files available, it serves up index.php. If I take away index.php, I get the 403 again.

Furthermore, I have this server setup pretty much mirrored between two machines (laptop and desktop). The only difference is that path to the actual htdocs folder is different, all other paths are the same (I've done a full directory/file compare on the two machines for the entire server setup). I've checked the httpd.conf over and over to make sure there isn't a path problem. On one machine it works as expected, on the other not.

I also commented out any Include directives in the httpd.conf to keep some included file from messing things up.

I've restarted Apache several times and done a full system reboot. No skill (as I'm sure luck has nothing to do with it).

This is, by the way, a Wampserver installation.

So what might I be missing? Why might it be working on one computer but not the other?

[jdMorgan]

Likely "AllowOverride None" is set in a config file. See the docs...

Jim

[ergophobe]

Thanks, but nope. I've been stymied by that mistake too many times to get stymied by it now (he says with fingers crossed while knocking on wood).

1. These settings (Options, etc) are all set in httpd.conf, so they aren't affected by the AllowOverride directive anyway

2. In any case, it's set to AllowOverride All in httpd.conf

I think the key clue that has to be that I can set the DirectoryIndex to index.php and it works, but I can't set it to index.html or index.htm. That's just beyond weird.

As I mentioned above, if I have

DirectoryIndex index.html, index.htm, index.php

in my httpd.conf file, and I have all three of those files in my directory, it's the index.php that gets served. Delete the index.php and I get a 403, same as if there's no index file.

Why in the world would it skip the first two choices and why in the world would it serve the index.php, but send a 403 for index.html and index.htm?

Some incorrect MIME type setting? It looks okay to me.

In httpd.conf

DefaultType text/plain

<IfModule mime_module>
TypesConfig conf/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddType application/x-httpd-php .php
</IfModule>

In mime.types:

text/html html htm

I've grepped for "html" to see if there's some strange setting somewhere else, but don't find anything. furthermore, both of these files are essentially identical on the two machines (again, just the DocumentRoot and the corresponding <Directory> directives are different).

I just know this is something where the solution is one level up from "computer is not plugged in", but I'm not finding it.

Oh well. Locking that machine up for the weekend. I'm hoping the Apache elves will stop by this weekend.

[jdMorgan]

> DirectoryIndex index.html, index.htm, index.php

You shouldn't have commas in your DirectoryIndex list, unless the filenames end with commas. It is a space-delimited list...

Jim

[ergophobe]

My bad. I typed that in fast rather than copying it from the actual httpd.conf.

The actual httpd.conf is space delimited (and, as I say, working perfectly on another machine).

Sorry for the false info.

[jdMorgan]

Is content-negotiation enabled? Is "AcceptPathInfo on" set?

Very strange...

Jim

[ergophobe]

hmm interesting thought. mod_negotiation is on (and on by default in Apache 2 anyway AFAIK).

But I don't have any Accept, Accept-Language, AcceptPathInfo directives set.

I think next week when I get back to that computer and fire it up, I'm going to wipe the server and reinstall.

It's just so strange that two installs, mirrors of each other, behave so differently. Tthe whole stack is mirrored - Apache, PHP, MySQL, all the docs and everything, having confirmed that a couple of times with a file/directory comparison tool, even doing binary compares (to verify they aren't files of the same size and timestamp but differnt content).

Thanks for your time. I'll do a reinstall midweek and let you know if that does it.

[jdMorgan]

AcceptPathInfo has nothing to do with HTTP Accept headers. It's an "automatic file finder" somewhat like MultiViews. If a URL does not resolve to an existing file, it 'strips back' the URL one path-part at a time and tries again. If it finds a shorter URL-path that resolves to an extant file, it exits after putting the remainder of the URL-path (the trailing path-part that caused the URL to fail to resolve) into the "Path_Info" variable for use by scripts.

At least, that's how I recall that it works; I don't tend to let servers do anything automatic with requests, since the side-effects can cause dupe-content issues.

Jim

[ergophobe]

I'm actually investigating now that this is related to a virus of some sort. I noticed that my Google SERPs are getting hijacked on that computer and I got a few Trojan alerts from my AV software a while back.

Today, right off, I got a hijacked from the SERPs and realized the system still isn't clean. So it's been in Safe Mode most of the day with a few hits for infections, one of which appears to match the hijacking behavior. So first that, then back to the server issues. Fun day!