Good evening,
I have not able able to run the http://ip-addr/src/configtest.php script, nor access Squirrelmail. Looking for suggestions on what I might have missed. When I try either http://ip-... or https://ip-..., I get the following reply
Forbidden You don't have permission to access /webmail/src/configtest.php on this server.
I got squirrelmail installed in /usr/share/squirrelmail and 'configured' to work (using ./conf.pl). This setup below is about the same setup on my Centos 6 box. I'm thinking my issue is more Apache configuration related than Squirrelmail.
**Apache is running with no issues**
Below are some of my settings in /etc/httpd/conf/httpd.conf
Apache ServerRoot is /etc/httpd
Apache DocumentRoot is /www
Further parameters within httpd.conf include: # # Relax access to content within /var/www. # <Directory "/www"> AllowOverride None # Allow open access: Require all granted </Directory>
# Further relax access to the default document root: <Directory "/www"> Options Indexes FollowSymLinks AllowOverride None # # Controls who can get stuff from this server. # Require all granted </Directory>
In /etc/httpd/conf.modules.d I created a file called 16-squirrelmail.conf That file contains the following information:
# SquirrelMail is a webmail package written in PHP. #
Alias /webmail /usr/share/squirrelmail
<Directory "/usr/share/squirrelmail/plugins/squirrelspell/modules"> #<Directory "/usr/share/squirrelmail"> AllowOverride None Require all denied </Directory>
# this section makes squirrelmail use https connections only, for this you # need to have mod_ssl installed. If you want to use unsecure http # connections, just remove this section: #6-12-2020 commented out next five lines to test sqmail in http mode only <Directory /usr/share/squirrelmail> RewriteEngine on RewriteCond %{HTTPS} !=on RewriteRule (.*) https://%%7BHTTP_HOST%7D%%7BREQUEST_URI%7D </Directory>
Any suggestions????
Thanks,
Jay
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I have this in my squirrelmail notes for Centos 6, maybe this is a similar issue for you on Centos 8:
After configuring squirrelmail, do this to make selinux accept squirrelmail connections:
setsebool -P httpd_can_network_connect 1
(The -P makes it permanent across reboots. This command takes quite a while to run, so don't worry about the waiting)
Then this to allow apache to connect to sendmail:
setsebool -P httpd_can_sendmail 1
Also takes a long time to run.
Note that in SquirrelMail versions 1.5.0 and up, if you are accessing configtest.php from any place other than the machine where SquirrelMail is installed, you'll need to make sure $allow_remote_configtest is enabled in your configuration file to do so (or see "11. Tweaks" ==> "7. Allow remote configtest" in the configuration utility). If you do that, be sure to disable it again when you are finished.
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
I have this in my squirrelmail notes for Centos 6, maybe this is a similar issue for you on Centos 8:
After configuring squirrelmail, do this to make selinux accept squirrelmail connections:
setsebool -P httpd_can_network_connect 1
(The -P makes it permanent across reboots. This command takes quite a while to run, so don't worry about the waiting)
Then this to allow apache to connect to sendmail:
setsebool -P httpd_can_sendmail 1
Also takes a long time to run.
I am not using selinux on Centos 6, so those options are not set on C6. I have not tried either of those options above on C8. I wanted to check to see if those Directory options I listed in my OP were hosed, correct, etc.
Note that in SquirrelMail versions 1.5.0 and up, if you are accessing configtest.php from any place other than the machine where SquirrelMail is installed, you'll need to make sure $allow_remote_configtest is enabled in your configuration file to do so (or see "11. Tweaks" ==> "7. Allow remote configtest" in the configuration utility). If you do that, be sure to disable it again when you are finished.
I'm using v 1.4.23-svn.
-- Can we uninstall 2020 and install it again? This one has a virus. MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Jay
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
I have this in my squirrelmail notes for Centos 6, maybe this is a similar issue for you on Centos 8:
After configuring squirrelmail, do this to make selinux accept squirrelmail connections:
setsebool -P httpd_can_network_connect 1
(The -P makes it permanent across reboots. This command takes quite a while to run, so don't worry about the waiting)
Then this to allow apache to connect to sendmail:
setsebool -P httpd_can_sendmail 1
Also takes a long time to run.
Both of those are turned 'off' (0).
Also, my testing is from a remote machine.
I am not using selinux on Centos 6, so those options are not set on C6. I have not tried either of those options above on C8. I wanted to check to see if those Directory options I listed in my OP were hosed, correct, etc.
Note that in SquirrelMail versions 1.5.0 and up, if you are accessing configtest.php from any place other than the machine where SquirrelMail is installed, you'll need to make sure $allow_remote_configtest is enabled in your configuration file to do so (or see "11. Tweaks" ==> "7. Allow remote configtest" in the configuration utility). If you do that, be sure to disable it again when you are finished.
I'm using v 1.4.23-svn.
-- Can we uninstall 2020 and install it again? This one has a virus. MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Jay
CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Am 18.06.2020 um 22:37 schrieb Jay Hart:
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
Frank was hinting to SELinux preventing access. A valid guess, especially as you have installed the webapp in a very uncommon path where default SELinux does know nothing about. So check the audit.log for AVC or use ausearch.
And of course check the webserver's logfile. Always the logs! They have the neccessary information your need to debug your situation.
Alexander
Am 18.06.2020 um 22:37 schrieb Jay Hart:
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
Frank was hinting to SELinux preventing access. A valid guess, especially as you have installed the webapp in a very uncommon path where default SELinux does know nothing about. So check the audit.log for AVC or use ausearch.
And of course check the webserver's logfile. Always the logs! They have the neccessary information your need to debug your situation.
Alexander
I enabled both those options. tried to access again, same issue.
Log file: [Thu Jun 18 17:08:31.160897 2020] [authz_core:error] [pid 10427:tid 140567258310400] [client 10.20.30.61:34096] AH01630: client denied by server configuration: /usr/share/squirrelmail/src/login.php
After changing those options, do I need to restart service[s], or reboot?
CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Am 18.06.2020 um 23:18 schrieb Jay Hart:
Am 18.06.2020 um 22:37 schrieb Jay Hart:
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
Frank was hinting to SELinux preventing access. A valid guess, especially as you have installed the webapp in a very uncommon path where default SELinux does know nothing about. So check the audit.log for AVC or use ausearch.
And of course check the webserver's logfile. Always the logs! They have the neccessary information your need to debug your situation.
Alexander
I enabled both those options. tried to access again, same issue.
Sorry, which 2 options did you enable?
Log file: [Thu Jun 18 17:08:31.160897 2020] [authz_core:error] [pid 10427:tid 140567258310400] [client 10.20.30.61:34096] AH01630: client denied by server configuration: /usr/share/squirrelmail/src/login.php
So here you get the information about what needs to be corrected. Please look closely at your apache configuration as you are forbidding access by your active settings.
After changing those options, do I need to restart service[s], or reboot?
As much as you have setup your webmail in a config file like 16-squirrelmail.conf you will of course have to restart or reload the service. A reboot is never needed for such kind of change.
Alexander
Am 18.06.2020 um 23:18 schrieb Jay Hart:
Am 18.06.2020 um 22:37 schrieb Jay Hart:
On Thu, 18 Jun 2020 16:11:01 -0400 Jay Hart wrote:
Any suggestions????
selinux issue?
I turned the firewall off and tried to access /webmail and the configtest file, Turning off the firewall resulted in same issue.
Frank was hinting to SELinux preventing access. A valid guess, especially as you have installed the webapp in a very uncommon path where default SELinux does know nothing about. So check the audit.log for AVC or use ausearch.
And of course check the webserver's logfile. Always the logs! They have the neccessary information your need to debug your situation.
Alexander
I enabled both those options. tried to access again, same issue.
Sorry, which 2 options did you enable?
I turned on
httpd_can_network_connect --> on httpd_can_sendmail --> on
I restarted httpd.
Log file: [Thu Jun 18 17:08:31.160897 2020] [authz_core:error] [pid 10427:tid 140567258310400] [client 10.20.30.61:34096] AH01630: client denied by server configuration: /usr/share/squirrelmail/src/login.php
So here you get the information about what needs to be corrected. Please look closely at your apache configuration as you are forbidding access by your active settings.
After changing those options, do I need to restart service[s], or reboot?
As much as you have setup your webmail in a config file like 16-squirrelmail.conf you will of course have to restart or reload the service. A reboot is never needed for such kind of change.
Alexander
CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Am 18.06.2020 um 23:44 schrieb Jay Hart:
I turned on
httpd_can_network_connect --> on httpd_can_sendmail --> on
I restarted httpd.
Log file: [Thu Jun 18 17:08:31.160897 2020] [authz_core:error] [pid 10427:tid 140567258310400] [client 10.20.30.61:34096] AH01630: client denied by server configuration: /usr/share/squirrelmail/src/login.php
Jay,
the SELinux booleans are not the reason for your issue. See the error message, it should give you a clue: the authz_core element is spitting that out, that's a part of apache itself.
https://cwiki.apache.org/confluence/display/HTTPD/ClientDeniedByServerConfig...
If you google search for "AH01630: client denied by server configuration:" you will get a confirmation what that error means and for what to look at in your apache configuration.
Alexander
Jay Hart writes:
Good evening,
I have not able able to run the http://ip-addr/src/configtest.php script, nor access Squirrelmail. Looking for suggestions on what I might have missed. When I try either http://ip-... or https://ip-..., I get the following reply
Forbidden You don't have permission to access /webmail/src/configtest.php on this server.
mod_security?
Jay Hart writes:
Good evening,
I have not able able to run the http://ip-addr/src/configtest.php script, nor access Squirrelmail. Looking for suggestions on what I might have missed. When I try either http://ip-... or https://ip-..., I get the following reply
Forbidden You don't have permission to access /webmail/src/configtest.php on this server.
mod_security?
Mod_security is not installed.
Jay
CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
Le 18/06/2020 à 22:11, Jay Hart a écrit :
I got squirrelmail installed
The SquirrelMail project has been dead for years now. Don't use it.
Suggestion : Roundcube.
Cheers,
Niki
-
Alexander Dalloz -
Frank Cox -
isdtor -
Jay Hart -
Nicolas Kovacs