Re: wsgi on RedHat 9

Hi Tonu:

In message
<CABDFm8j=AtOWt2EapqaNznqe=b25+G8gDHtK6m7sKqw3a1UDww@mail.gmail.com> ,
Tonu Mikk via Roundup-users writes:
>authz core:error client denied by server configuration:
>/opt/trackers/classic_wsgi.py . Seeking help in resolving this error. Here
>are my configuration details.
>
>[...]
>   - I created an Apache virtual config file with the following directives:
>   <VirtualHost *:80>
>           ServerName music.drc.umn.edu
>           <Directory /opt/trackers/classic>
>                   Require all granted
>           </Directory>
>           WSGIScriptAlias /test_wsgi /opt/trackers/classic/test_wsgi.py
>           WSGIScriptAlias /piano /opt/trackers/classic_wsgi.py
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Should this be /opt/trackers/classic/classic_wsgi.py so that the
Require applies?

>           WSGIDaemonProcess classic.apache user=tmikk group=mytrackergrp
>   threads=25
>           WSGIProcessGroup classic.apache
>   </VirtualHost>
>   - I created a file (classic_wsgi.py) in the tracker's home directory
>   with the following directives:

Looks like you told apache it was one directory up.

>   - The permissions on the tracker directory
>   drwxrwxrwx. 7 tmikk mytrackergrp 4096 Feb  6 08:21 classic
>   - Permissions for the files in the tracker directory:
>   drwxrwxrwx. 7 tmikk mytrackergrp  4096 Feb  6 08:21 .
>   drwxrwxrwx. 3 root  root            21 Jan 23 08:48 ..
>   -rwxrwxrwx. 1 tmikk mytrackergrp   140 Jan 23 08:50 classic_wsgi.py
>   -rwxrwxrwx. 1 tmikk mytrackergrp 39654 Feb  6 10:34 config.ini
>   drwxrwsrwx. 2 tmikk mytrackergrp    16 Jan 23 08:48 db
>   drwxrwxrwx. 3 tmikk mytrackergrp   137 Jan 23 08:48 detectors
>   drwxrwxrwx. 2 tmikk mytrackergrp    24 Jan 23 08:48 extensions
>   drwxrwxrwx. 2 tmikk mytrackergrp  4096 Jan 23 08:48 html
>   -rwxrwxrwx. 1 tmikk mytrackergrp  1070 Jan 23 08:48 initial_data.py
>   drwxrwxrwx. 2 tmikk mytrackergrp    70 Jan 23 08:48 __pycache__
>   -rwxrwxrwx. 1 tmikk mytrackergrp  7598 Jan 23 08:48 schema.py
>   -rwxrwxrwx. 1 tmikk mytrackergrp   351 Jan 23 08:48 TEMPLATE-INFO.txt
>   -rw-r-----. 1 tmikk mytrackergrp   295 Jan 25 08:30 test_wsgi.py
>
>I also created a test mod_wsgi file in the /opt/trackers/classic directory
>called test_wsgi with the following content:
>> [...]
>When I access http://music.drc.umn.edu/test_wsgi/ using a browser I am able
>to see that the wsgi is working. It presents a message "Hooray, mod_wsgi is
>working".

Yup the classic directory and therefore access to classic/test_wsgi
is allowed by Required.

As Ralf noted, mode 777 is not what you want. My guess is mode 750 is
probably better for everything except for the db directory. The db
directory should be 770 with a setgid bit so the group is
inherited.

Also the wsgi might need to set the os.umask to 002 (or 007 if you
want to secure the created files/directories from other users). That
way when Roundup creates new directories under db/{files,msgs} they
will be writable to mytrackergrp. If you have others in that group,
they can edit/remove files/messages if needed. If you are the only
person who will be doing maintenance, then the default umask of 022
will work fine.

Also as Ralf noted, he allowed access to just the wsgi script from
apache, not the tracker home. This should prevent apache from
accessing any of the tracker home. I haven't worked with apache in
years, so I'm not sure if your current config could allow a web user
to somehow request config.ini and see passwords etc. located in that
file.

The install guide is light on a manual apache mod_wsgi setup.

Also I am intrigued by your choice of path. What are you tracking on
pianos? Tuning requests?

Hope this helps.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.