Re: wsgi on RedHat 9
Tonu Mikk via Roundup-users <[email protected]> Tue, 6 Feb 2024 13:49:29 -0600
| Newsgroups | gmane.comp.bug-tracking.roundup.user |
|---|---|
| Message-ID | <CABDFm8gy3bPV+sk_kKtqfENncALrA9c-dY5X+OWW==mhQ5+xzA@mail.gmail.com> |
--===============2450610740626240007== Content-Type: multipart/alternative; boundary="00000000000082ede60610bbe2ac" --00000000000082ede60610bbe2ac Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Ralf and John! The file permissions need fixing. And there was indeed an error in the Apache Virtual config file. The line WSGIScriptAlias /piano /opt/trackers/classic_wsgi.py Should have been WSGIScriptAlias /piano /opt/trackers/classic/classic_wsgi.py Once I changed it and restarted Apache, I now get the following error: [Tue Feb 06 13:42:39.162045 2024] [wsgi:error] [pid 3131857:tid 3132046] [remote 10.20.27.232:52794] File "/opt/trackers/classic/classic_wsgi.py", line 1, in <module> [Tue Feb 06 13:42:39.162058 2024] [wsgi:error] [pid 3131857:tid 3132046] [remote 10.20.27.232:52794] from roundup.cgi.wsgi_handler import RequestDispatcher [Tue Feb 06 13:42:39.162089 2024] [wsgi:error] [pid 3131857:tid 3132046] [remote 10.20.27.232:52794] ModuleNotFoundError: No module named 'roundup' On Tue, Feb 6, 2024 at 1:32=E2=80=AFPM John P. Rouillard <[email protected]= > wrote: > Hi Tonu: > > In message > <CABDFm8j=3DAtOWt2EapqaNznqe=3Db25+G8gDHtK6m7sKqw3a1UDww@mail.gmail.com> = , > Tonu Mikk via Roundup-users writes: > >authz core:error client denied by server configuration: > >/opt/trackers/classic_wsgi.py . Seeking help in resolving this error. He= re > >are my configuration details. > > > >[...] > > - I created an Apache virtual config file with the following > directives: > > <VirtualHost *:80> > > ServerName music.drc.umn.edu > > <Directory /opt/trackers/classic> > > Require all granted > > </Directory> > > WSGIScriptAlias /test_wsgi /opt/trackers/classic/test_wsgi.py > > WSGIScriptAlias /piano /opt/trackers/classic_wsgi.py > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > Should this be /opt/trackers/classic/classic_wsgi.py so that the > Require applies? > > > WSGIDaemonProcess classic.apache user=3Dtmikk group=3Dmytrack= ergrp > > threads=3D25 > > WSGIProcessGroup classic.apache > > </VirtualHost> > > - I created a file (classic_wsgi.py) in the tracker's home directory > > with the following directives: > > Looks like you told apache it was one directory up. > > > - The permissions on the tracker directory > > drwxrwxrwx. 7 tmikk mytrackergrp 4096 Feb 6 08:21 classic > > - Permissions for the files in the tracker directory: > > drwxrwxrwx. 7 tmikk mytrackergrp 4096 Feb 6 08:21 . > > drwxrwxrwx. 3 root root 21 Jan 23 08:48 .. > > -rwxrwxrwx. 1 tmikk mytrackergrp 140 Jan 23 08:50 classic_wsgi.py > > -rwxrwxrwx. 1 tmikk mytrackergrp 39654 Feb 6 10:34 config.ini > > drwxrwsrwx. 2 tmikk mytrackergrp 16 Jan 23 08:48 db > > drwxrwxrwx. 3 tmikk mytrackergrp 137 Jan 23 08:48 detectors > > drwxrwxrwx. 2 tmikk mytrackergrp 24 Jan 23 08:48 extensions > > drwxrwxrwx. 2 tmikk mytrackergrp 4096 Jan 23 08:48 html > > -rwxrwxrwx. 1 tmikk mytrackergrp 1070 Jan 23 08:48 initial_data.py > > drwxrwxrwx. 2 tmikk mytrackergrp 70 Jan 23 08:48 __pycache__ > > -rwxrwxrwx. 1 tmikk mytrackergrp 7598 Jan 23 08:48 schema.py > > -rwxrwxrwx. 1 tmikk mytrackergrp 351 Jan 23 08:48 TEMPLATE-INFO.txt > > -rw-r-----. 1 tmikk mytrackergrp 295 Jan 25 08:30 test_wsgi.py > > > >I also created a test mod_wsgi file in the /opt/trackers/classic directo= ry > >called test_wsgi with the following content: > >> [...] > >When I access http://music.drc.umn.edu/test_wsgi/ using a browser I am > able > >to see that the wsgi is working. It presents a message "Hooray, mod_wsgi > is > >working". > > Yup the classic directory and therefore access to classic/test_wsgi > is allowed by Required. > > As Ralf noted, mode 777 is not what you want. My guess is mode 750 is > probably better for everything except for the db directory. The db > directory should be 770 with a setgid bit so the group is > inherited. > > Also the wsgi might need to set the os.umask to 002 (or 007 if you > want to secure the created files/directories from other users). That > way when Roundup creates new directories under db/{files,msgs} they > will be writable to mytrackergrp. If you have others in that group, > they can edit/remove files/messages if needed. If you are the only > person who will be doing maintenance, then the default umask of 022 > will work fine. > > Also as Ralf noted, he allowed access to just the wsgi script from > apache, not the tracker home. This should prevent apache from > accessing any of the tracker home. I haven't worked with apache in > years, so I'm not sure if your current config could allow a web user > to somehow request config.ini and see passwords etc. located in that > file. > > The install guide is light on a manual apache mod_wsgi setup. > > Also I am intrigued by your choice of path. What are you tracking on > pianos? Tuning requests? > > Hope this helps. > -- > -- rouilj > John Rouillard > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D > My employers don't acknowledge my existence much less my opinions. > --=20 Tonu Mikk Developer | Disability Resource Center | disability.umn.edu University of Minnesota | umn.edu [email protected] Pronouns: He/Him --00000000000082ede60610bbe2ac Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks Ralf and John! The file permissions need fixing.=C2= =A0 And there was indeed an error in the Apache Virtual config file. The li= ne<div><br></div><div>=C2=A0WSGIScriptAlias /piano /opt/trackers/classic_ws= gi.py</div><div><br></div><div>Should=C2=A0have been=C2=A0</div><div>=C2=A0= WSGIScriptAlias /piano /opt/trackers/classic/classic_wsgi.py</div><div><br>= </div><div>Once I changed it and restarted Apache, I now get the following = error:<br><div><br></div><div>[Tue Feb 06 13:42:39.162045 2024] [wsgi:error= ] [pid 3131857:tid 3132046] [remote <a href=3D"http://10.20.27.232:52794">1= 0.20.27.232:52794</a>] =C2=A0 File "/opt/trackers/classic/classic_wsgi= .py", line 1, in <module><br>[Tue Feb 06 13:42:39.162058 2024] [= wsgi:error] [pid 3131857:tid 3132046] [remote <a href=3D"http://10.20.27.23= 2:52794">10.20.27.232:52794</a>] =C2=A0 =C2=A0 from roundup.cgi.wsgi_handle= r import RequestDispatcher<br>[Tue Feb 06 13:42:39.162089 2024] [wsgi:error= ] [pid 3131857:tid 3132046] [remote <a href=3D"http://10.20.27.232:52794">1= 0.20.27.232:52794</a>] ModuleNotFoundError: No module named 'roundup= 9;<br></div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cla= ss=3D"gmail_attr">On Tue, Feb 6, 2024 at 1:32=E2=80=AFPM John P. Rouillard = <<a href=3D"mailto:[email protected]">[email protected]</a>> wrote:<b= r></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex= ;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Tonu:<br> <br> In message<br> <CABDFm8j=3DAtOWt2EapqaNznqe=3D<a href=3D"mailto:b25%2BG8gDHtK6m7sKqw3a1= [email protected]" target=3D"_blank">[email protected]= .com</a>> ,<br> Tonu Mikk via Roundup-users writes:<br> >authz core:error client denied by server configuration:<br> >/opt/trackers/classic_wsgi.py . Seeking help in resolving this error. H= ere<br> >are my configuration details.<br> ><br> >[...]<br> >=C2=A0 =C2=A0- I created an Apache virtual config file with the followi= ng directives:<br> >=C2=A0 =C2=A0<VirtualHost *:80><br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ServerName <a href=3D"http://m= usic.drc.umn.edu" rel=3D"noreferrer" target=3D"_blank">music.drc.umn.edu</a= ><br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<Directory /opt/trackers/cl= assic><br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Re= quire all granted<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0</Directory><br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0WSGIScriptAlias /test_wsgi /op= t/trackers/classic/test_wsgi.py<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0WSGIScriptAlias /piano /opt/tr= ackers/classic_wsgi.py<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0^^^^^^^^^^^^^^^^^^^^^^^= ^^^^^^<br> <br> Should this be /opt/trackers/classic/classic_wsgi.py so that the<br> Require applies?<br> <br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0WSGIDaemonProcess classic.apac= he user=3Dtmikk group=3Dmytrackergrp<br> >=C2=A0 =C2=A0threads=3D25<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0WSGIProcessGroup classic.apach= e<br> >=C2=A0 =C2=A0</VirtualHost><br> >=C2=A0 =C2=A0- I created a file (classic_wsgi.py) in the tracker's = home directory<br> >=C2=A0 =C2=A0with the following directives:<br> <br> Looks like you told apache it was one directory up.<br> <br> >=C2=A0 =C2=A0- The permissions on the tracker directory<br> >=C2=A0 =C2=A0drwxrwxrwx. 7 tmikk mytrackergrp 4096 Feb=C2=A0 6 08:21 cl= assic<br> >=C2=A0 =C2=A0- Permissions for the files in the tracker directory:<br> >=C2=A0 =C2=A0drwxrwxrwx. 7 tmikk mytrackergrp=C2=A0 4096 Feb=C2=A0 6 08= :21 .<br> >=C2=A0 =C2=A0drwxrwxrwx. 3 root=C2=A0 root=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 21 Jan 23 08:48 ..<br> >=C2=A0 =C2=A0-rwxrwxrwx. 1 tmikk mytrackergrp=C2=A0 =C2=A0140 Jan 23 08= :50 classic_wsgi.py<br> >=C2=A0 =C2=A0-rwxrwxrwx. 1 tmikk mytrackergrp 39654 Feb=C2=A0 6 10:34 c= onfig.ini<br> >=C2=A0 =C2=A0drwxrwsrwx. 2 tmikk mytrackergrp=C2=A0 =C2=A0 16 Jan 23 08= :48 db<br> >=C2=A0 =C2=A0drwxrwxrwx. 3 tmikk mytrackergrp=C2=A0 =C2=A0137 Jan 23 08= :48 detectors<br> >=C2=A0 =C2=A0drwxrwxrwx. 2 tmikk mytrackergrp=C2=A0 =C2=A0 24 Jan 23 08= :48 extensions<br> >=C2=A0 =C2=A0drwxrwxrwx. 2 tmikk mytrackergrp=C2=A0 4096 Jan 23 08:48 h= tml<br> >=C2=A0 =C2=A0-rwxrwxrwx. 1 tmikk mytrackergrp=C2=A0 1070 Jan 23 08:48 i= nitial_data.py<br> >=C2=A0 =C2=A0drwxrwxrwx. 2 tmikk mytrackergrp=C2=A0 =C2=A0 70 Jan 23 08= :48 __pycache__<br> >=C2=A0 =C2=A0-rwxrwxrwx. 1 tmikk mytrackergrp=C2=A0 7598 Jan 23 08:48 s= chema.py<br> >=C2=A0 =C2=A0-rwxrwxrwx. 1 tmikk mytrackergrp=C2=A0 =C2=A0351 Jan 23 08= :48 TEMPLATE-INFO.txt<br> >=C2=A0 =C2=A0-rw-r-----. 1 tmikk mytrackergrp=C2=A0 =C2=A0295 Jan 25 08= :30 test_wsgi.py<br> ><br> >I also created a test mod_wsgi file in the /opt/trackers/classic direct= ory<br> >called test_wsgi with the following content:<br> >> [...]<br> >When I access <a href=3D"http://music.drc.umn.edu/test_wsgi/" rel=3D"no= referrer" target=3D"_blank">http://music.drc.umn.edu/test_wsgi/</a> using a= browser I am able<br> >to see that the wsgi is working. It presents a message "Hooray, mo= d_wsgi is<br> >working".<br> <br> Yup the classic directory and therefore access to classic/test_wsgi<br> is allowed by Required.<br> <br> As Ralf noted, mode 777 is not what you want. My guess is mode 750 is<br> probably better for everything except for the db directory. The db<br> directory should be 770 with a setgid bit so the group is<br> inherited.<br> <br> Also the wsgi might need to set the os.umask to 002 (or 007 if you<br> want to secure the created files/directories from other users). That<br> way when Roundup creates new directories under db/{files,msgs} they<br> will be writable to mytrackergrp. If you have others in that group,<br> they can edit/remove files/messages if needed. If you are the only<br> person who will be doing maintenance, then the default umask of 022<br> will work fine.<br> <br> Also as Ralf noted, he allowed access to just the wsgi script from<br> apache, not the tracker home. This should prevent apache from<br> accessing any of the tracker home. I haven't worked with apache in<br> years, so I'm not sure if your current config could allow a web user<br= > to somehow request config.ini and see passwords etc. located in that<br> file.<br> <br> The install guide is light on a manual apache mod_wsgi setup.<br> <br> Also I am intrigued by your choice of path. What are you tracking on<br> pianos? Tuning requests?<br> <br> Hope this helps.<br> --<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- rouilj<br> John Rouillard<br> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= <br> My employers don't acknowledge my existence much less my opinions.<br> </blockquote></div><br clear=3D"all"><div><br></div><span class=3D"gmail_si= gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d= iv dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><span sty= le=3D"border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"= ><font color=3D"#666666"><div>Tonu Mikk</div><div>Developer | Disability Re= source Center | <a href=3D"https://disability.umn.edu" target=3D"_blank">di= sability.umn.edu</a></div><div>University of Minnesota | <a href=3D"http://= umn.edu" target=3D"_blank">umn.edu</a>=C2=A0</div><div><a href=3D"mailto:tm= [email protected]" target=3D"_blank">[email protected]</a>=C2=A0</div><div>Pronouns: = He/Him</div></font></span></div></div></div></div></div> --00000000000082ede60610bbe2ac-- --===============2450610740626240007== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2450610740626240007== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Roundup-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/roundup-users --===============2450610740626240007==--