Why does Nginx return a 403 even though all permissions are set properly?

Question

I have Nginx setup and displaying the test page properly. If I try to change the root path, I get a 403 Forbidden error, even though all permissions are identical. Additiona

Answer 1

First of all you have to run following command to allow nginx to access filesystem

sudo setsebool -P httpd_read_user_content 1

You can check if the files or directory with following command:

ls -Z

If it is still not accessible, you can try changing the SELinux property of the files and folder with following command:

chcon -Rt httpd_sys_content_t /path/to/www

However, above command cannot apply to files under FUSE or NFS system.

To enable serving files from FUSE mounts, you can use:

setsebool httpd_use_fusefs 1

To enable serving files from NFS mounts, you can use:

setsebool httpd_use_nfs 1

Answer 2

I have met this problem when I added a new user with a folder /home/new_user as a new virtual host. Make sure these folders (/home, /home/new_user, /home/new_user/xxx...) are 755 so that it resolved my problem. At last, I found my problem were correctly according to the /var/log/nginx/error.log file.

Answer 3

Another possible reason (NOT IN THIS CASE) is a symlink for index.html file pointing to another directory.

ls -lrt /usr/share/nginx/html/

rsync files to that particular directory will easily solve the problem.

or disable symlinks in nginx.conf

http {
    disable_symlinks off;
}

Answer 4

I experienced the same problem and it was due to SELinux.

To check if SELinux is running:

# getenforce

To disable SELinux until next reboot:

# setenforce Permissive

Restart Nginx and see if the problem persists. If you would like to permanently alter the settings you can edit /etc/sysconfig/selinux

If SELinux is your problem you can run the following to allow nginx to serve your www directory (make sure you turn SELinux back on before testing this. i.e, # setenforce Enforcing)

# chcon -Rt httpd_sys_content_t /path/to/www

If you're still having issues take a look at the boolean flags in getsebool -a, in particular you may need to turn on httpd_can_network_connect for network access

# setsebool -P httpd_can_network_connect on

For me it was enough to allow http to serve my www directory.

Answer 5

I ran into the same problem. If you're using Fedora/RedHat/CentOS, this might help you:

• According to SELinux: setsebool -P httpd_read_user_content 1

Hope this helps.

Answer 6

This is an addition to Prowlas answer but I dont have enough reputation to commment: If the /path/to/www is a home directory of a user. You should try:

setsebool -P httpd_enable_homedirs=1

This solved my problem

Source: http://forums.fedoraforum.org/archive/index.php/t-250779.html