Permissions:htaccess pcfg_openfile: unable to check htaccess

[chrismcb]

Hi all,

I'm moving domains from one Plesk box to another and came across this issue in the logs after migrating (it also appears after creating a new domain from scratch):

Code: Select all

(13)Permission denied: /var/www/vhosts/[site.co.uk]/httpdocs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable

I checked the old box (CentOS 5.9, ASL latest) and the permissions for the httpdocs folder are 751 - as are the new box (Centos 6.4, ASL Latest).

Searching online, a "solution" is to CHMOD 755 the httpdocs folder - which does work, but why? What's changed?


SELinux is disabled (another culprit which is mentioned on various forums) and the

Code: Select all

selinux=0

parameter is set on boot.


Thanks

p.s. There is no .htaccess file in the httpdocs directory... the error is just being produced since it can't even check if it exists

[faris]

Check the ownership of the folder. We had a similar issue with cgi scripts.

It should be ftpuser.psaserv

On ours it was incorrectly set to ftpuser.psacln or something that was difficult to spot.

[chrismcb]

That's done it - however I surely don't won't have to go through each domain and do this when they migrate over?!

All of my previous domains have their httpd folder set with ftpuser:psaserv as their owner:group.

On my old box, my /etc/groups are as follows:

Code: Select all

saserv:x:2522:psaftp,psaadm,apache
psacln:x:2523:

With the new one missing Apache:

Code: Select all

psaserv:x:504:psaftp,psaadm
psacln:x:505:

I'm guessing adding it back in there will do the trick, but is it a security risk?

[faris]

Mine:

Code: Select all

psaserv:x:503:apache,psaftp,psaadm
psacln:x:504:

Note that cgi-bin and statistics are all ftpuser.psaserv and that all other instances of psa(anything) are psaserv and not psacln in /var/www/vhosts/domain.tld/

The files within /httpdocs are ftpuser.psacln however.

I'm reasonably certain there is a KB relating to this issue.
http://kb.parallels.com/en/800 (exact error you are getting)
http://kb.parallels.com/en/115454 (reset script for plesk 11)
http://kb.parallels.com/en/6572 (old KB for older plesk relating to permissions)

But what's going on here?
Is there a Plesk bug that caused apache not to be added to psaserv groups?
Is it a Migration Manager bug?
Is it something else? I don't understand why this is happening.

You said that when you create a new site you get the same wrong owner for httpdocs? Or something else?

[chrismcb]

Thanks Faris, apache missing from psaserv was the issue - as backed up by http://kb.parallels.com/en/800

Since it was missing a new domain OR migrated domain had the same fate.

I wonder if it is the image used by 1and1 on the new server which has a flaw and has been blindly replicated with the missing line.

[faris]

But are you saying that new and migrated domains get ftpusr.something-other-than-psaserv for /httpdocs as well?

[chrismcb]

Sorry, I got mixed up - I read your original post wrong:

It should be ftpuser.psaserv

I changed it to ftpuser.psacln and it worked - it already was ftpuser.psaerv.


If I hadn't have touched anything other than adding apache to the psaserv group, everything would have worked.

Still no idea why it wasn't in the group in the first place though.

[chrismcb]

I think I actually found the issue... Nagios deletes apache from psaserv:

The problem was that Nagios had deleted apache from the psaserv group so the solution was to run:
usermod -G psaserv apache

http://forum.parallels.com/showthread.p ... en-Errors)

[faris]

Hah! Thanks Nagios!