CODEWITHSUNDEEP
nginxuwsgi
isaacselement
isaacselement

Reputation: 2689

Nginx serve static file and got 403 forbidden

Just want to help somebody out. yes ,you just want to serve static file using nginx, and you got everything right in nginx.conf:

location /static {
       autoindex on;
       #root /root/downloads/boxes/;
       alias /root/downloads/boxes/;
      }

But , in the end , you failed. You got "403 forbidden" from browser...

----------------------------------------The Answer Below:----------------------------------------

The Solution is very Simple:

Way 1 : Run nginx as the user as the '/root/downloads/boxes/' owner

In nginx.conf : 

＃user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;

YES, in the first line "＃user noboy;" , just delete "#" , and change "nobody" to your own username in Linux/OS X, i.e change to "root" for test. The restart nginx.

Attention , You'd better not run nginx as root! Here just for testing, it's dangerous for the Hacker.

For more reference , see nginx (engine X) – What a Pain in the BUM! [13: Permission denied]

Way 2 : Change '/root/downloads/boxes/' owner to 'www-data' or 'nobody'

In Terminal:

ps aux | grep nginx

Get the username of running nginx . It should be 'www-data' or 'nobody' determined by the version of nginx. Then hit in Terminal(use 'www-data' for example):

chown -R www-data:www-data /root/downloads/boxes/

------------------------------One More Important Thing Is:------------------------------

These parent directories "/", "/root", "/root/downloads" should give the execute(x) permission to 'www-data' or 'nobody'. i.e.

ls -al /root
chmod o+x /root
chmod o+x /root/downloads

For more reference , see Resolving "403 Forbidden" error and Nginx 403 forbidden for all files

Upvotes: 120

Views: 165554

Answers (15)

Илья Боярский
Илья Боярский

Reputation: 1

If your user has all necessary permissions for the nginx server and you filled in the nginx config file with correct data but still get 403 error, check the sites-enabled folder. If its empty, you need to create a link using the command:

sudo ln -s /etc/nginx/sites-available/your_site_conf.conf /etc/nginx/sites-enabled/

and then restart sudo systemctl restart nginx.service now nginx understand that your site is enabled. One day I got stack on this issue, cuz I just skipped step when i should have created this link.

Upvotes: 0

NewCoderfromthelowlands
NewCoderfromthelowlands

Reputation: 1

For those still running into this issue in 2024, this worked for me:

change the nginx default user to your own user.

go to /etc/nginx/nginx.conf

at the first line, change 'user www-data' to 'user your_user'. Make sure your static folder owner and group is set to your user.

Restart nginx with "sudo systemctl restart nginx" and you're good to go.

Upvotes: -1

Onyilimba
Onyilimba

Reputation: 1217

The best option to this is puting your static in /var/www/static/

and changing your /etc/nginx/sites-available/projectname to

 location /static/ {
        root /var/www;
    }

or

 location /static/ {
        alias /var/www/static;
    }

Upvotes: 0

Daniel Gašparík
Daniel Gašparík

Reputation: 23

To those that got locked out of ssh by following @sandes 's answer for Ubuntu. You need to somehow regain access as user with permissions and run this command

sudo gpasswd -d www-data your_user

This removes the www-data user from the group and allows you to log back in.

Upvotes: 2

gitaarik
gitaarik

Reputation: 46360

You should give nginx permissions to read the file. That means you should give the user that runs the nginx process permissions to read the file.

This user that runs the nginx process is configurable with the user directive in the nginx config, usually located somewhere on the top of nginx.conf:

user www-data

http://wiki.nginx.org/CoreModule#user

The second argument you give to user is the group, but if you don't specify it, it uses the same one as the user, so in my example the user and the group both are www-data.

Now the files you want to serve with nginx should have the correct permissions. Nginx should have permissions to read the files. You can give the group www-data read permissions to a file like this:

chown :www-data my-file.html

http://linux.die.net/man/1/chown

With chown you can change the user and group owner of a file. In this command I only change the group, if you would change the user too you would specify the username before the colon, like chown www-data:www-data my-file.html. But setting the group permissions correct should be enough for nginx to be able to read the file.

Upvotes: 98

Dhia Shalabi
Dhia Shalabi

Reputation: 1540

You can just do like what is did:

CentOS / Fedora

sudo usermod -a -G your_user_name nginx

chmod 710 /home/your_user_name

Ubuntu / Debian

sudo usermod -a -G your_user_name www-data

sudo chown -R :www-data /path/to/your/static_folder

And in your nginx file that serve your site make sure that your location for static is like this:

location /static/ {
        root /path/to/your/static_folder;
    }

Upvotes: 3

lingceng
lingceng

Reputation: 2425

My nginx is run as nginx user and nginx group, but add nginx group to public folder not work for me.

I check the permission as a nginx user.

su nginx -s /bin/bash

I found the I need to add the group for the full path. My path is start at /root, so I need to do following:

chown -R :nginx /root

Upvotes: 0

Jason
Jason

Reputation: 933

I ran into this issue with a Django project. Changing user permissions and groups didn't work. However, moving the entire static folder from my project to /var/www did.

Copy your project static files to /var/www/static

# cp -r /project/static /var/www/static

Point nginx to proper directory

# sudo nano /etc/nginx/sites-available/default

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        server_name _;

        location /static/ {
                root /var/www;
        }

        location / {
                include proxy_params;
                proxy_pass http://unix:/run/gunicorn.sock;
        }

}

Test nginx config and reload

# sudo nginx -t
# sudo systemctl reload nginx

Upvotes: 19

sandes
sandes

Reputation: 2277

Since Nginx is handling the static files directly, it needs access to the appropriate directories. We need to give it executable permissions for our home directory.

The safest way to do this is to add the Nginx user to our own user group. We can then add the executable permission to the group owners of our home directory, giving just enough access for Nginx to serve the files:

CentOS / Fedora

  sudo usermod -a -G your_user nginx

  chmod 710 /home/your_user

Set SELinux to globally permissive mode, run:

sudo setenforce 0

for more info, please visit https://www.nginx.com/blog/using-nginx-plus-with-selinux/

Ubuntu / Debian

  sudo usermod -a -G your_user www-data

  sudo chown -R :www-data /path/to/your/static/folder

Upvotes: 67

EPS
EPS

Reputation: 1

I bang my head on this 403 problem for quite some time. I'm using CentOS from DigitalOcean.

I thought to fix the problem was just to set SELINUX=disabled in /etc/selinux/config but I was wrong. Somehow, I screwed my droplet.

This works for me! sudo chown nginx:nginx /var/www/mydir

Upvotes: 0

Jeremy
Jeremy

Reputation: 863

Try the accepted answer by @gitaarik, and if it still gives 403 Forbidden or 404 Not Found and your location target is / read on.

I also experienced this issue, but none of the permission changes mentioned above solved my problem. It was solved by adding the root directive because I was defining the root location (/) and accidentally used the alias directive when I should have used the root directive.

The configuration is accepted, but gives 403 Forbidden, or 404 Not Found if auto-indexing is enabled for /:

location / {
  alias /my/path/;
  index index.html;
}

Correct definition:

location / {
  root /my/path/;
  index index.html;
}

Upvotes: 4

Joe
Joe

Reputation: 492

For me is was SElinux, I had to run the following: (RHEL/Centos on AWS)

sudo setsebool -P httpd_can_network_connect on 
chcon -Rt httpd_sys_content_t /var/www/

Upvotes: 13

roj4s
roj4s

Reputation: 281

Setting user root in nginx can be really dangerous. Having to set permissions to all file hierarchy can be cumbersome (imagine the folder's full path is under more than 10 subfolders).

What I'd do is to mirror the folder you want to share, under /usr/share/nginx/any_folder_name with permissions for nginx's configured user (usually www-data). That you can do with bindfs.

In your case I would do:

sudo bindfs -u www-data -g www-data /root/downloads/boxes/ /usr/share/nginx/root_boxes

It will mount /root/downloads/boxes into /usr/share/nginx/root_boxes with all permissions for user www-data. Now you set that path in your location block config

location /static {
   autoindex on;
   alias /usr/share/nginx/root_boxes/;
  }

Upvotes: 5

Alexis Pokrovski
Alexis Pokrovski

Reputation: 141

After digging into very useful answers decided to collect everything related to permissions as a recipe. Specifically, the simplest solution with maximal security (=minimal permissions).

  1. Suppose we deploy the site as user admin, that is, she owns site dir and everything within. We do not want to run nginx as this user (too many permissions). It's OK for testing, not for prod.
  2. By default Nginx runs workers as a user nginx, that is, config contains line user nginx
  3. By default user nginx is in the group with the same name: nginx.
  4. We want to give minimal permissions to user nginx without changing file ownership. This seems to be the most secure of naive options.

  5. In order to serve static files, the minimal required permissions in the folders hierarchy (see the group permissions) should be like this (use the command namei -l /home/admin/WebProject/site/static/hmenu.css):

    dr-xr-xr-x root root /
    drwxr-xr-x root root home
    drwxr-x--- admin nginx admin
    drwx--x--- admin nginx WebProject
    drwx--x--- admin nginx site
    drwx--x--- admin nginx static
    -rwxr----- admin nginx hmenu.css

  6. Next, how to get this beautiful picture? To change group ownership for dirs, we first apply sudo chown :nginx /home/admin/WebProject/site/static and then repeat the command stripping dirs from the right one-by-one.

  7. To change permissions for dirs, we apply sudo chmod g+x /home/admin/WebProject/site/static and again strip dirs.

  8. Change group for the files in the /static dir: sudo chown -R :nginx /home/admin/WebProject/site/static

  9. Finally, change permissions for the files in the /static dir: sudo chmod g+r /home/admin/WebProject/site/static/*

(Of course one can create a dedicated group and change the user name, but this would obscure the narration with unimportant details.)

Upvotes: 10

masternone
masternone

Reputation: 499

for accepted answer

sudo chown -R :www-data static_folder

for changing group owner of all files in that folder

Upvotes: 21

Related Questions