Apache access to mounted shares.

Question

Level 1

0 points

Apache access to mounted shares.

I keep trying to encourage my company to use our X Server for all the wonderful web stuff it does. So somebody has to help me please?

I've got Apache, MySql, PHP all up and running, and the application developed mostly. BUT... I need to serve some images that are on a Windows server with a custom application. That server doesn't run any Web server, and I don't even want to go there....

Here is what I tried so far:
1) Connect to the Server with Finder. This "works". I can see the server and browse the files in Finder. Unfortunately, only the user that connects to the windows server has any permissions to the file. I checked with Terminal and LS -l and the permissions are DRWX------. Since Apache on the Server runs as WWW, it doesn't have access to the file. I tried to do a CHMOD 744 on the diretory, but it is basically ignored (no error message, no change).

2) Use mount_smbfs. This lets me mount the Windows server within the Documents directory, and lets me set the permissions so that they are RWXR--R--. But Apache still can't serve the jpg file. The Apache error log says "failed because search permissions are missing on a component of the path".

Any suggestions on what I am doing wrong? XSERVE 10.4.6

Thanks...

G5 Server, Mac OS X (10.4.6)

Posted on Nov 29, 2006 6:24 AM

Reply

Answer 1

Jun T.

Level 4

2,191 points

Nov 29, 2006 6:58 AM in response to GrandpaNi

Please try mounting with rwxr-xr-x.

x for a directory is the "search permission".

HTH

Reply

Answer 2

Dec 2, 2006 5:22 PM in response to GrandpaNi

Instead of setting the perms on the directory 0744, they need to be 0755.

Roger

Reply

Answer 3

GrandpaNi Author

Level 1

0 points

Dec 4, 2006 6:58 AM in response to GrandpaNi

Sorry, thought I mentioned. I tried to change the permissions on the directory.

Even with a sudo, the permissions are not changed. I don't get an error message back from chmod. It just ignores the command and the permissions are not changed (doesn't make any difference if I do 744 or 755, they still remain 700).

Interestingly, when I go to /Volumes/ in Finder and check the permissions, it says the owner is SYSTEM, group is WHEEL, and even they have "No Access".

This is different than what I get when I do an LS in Terminal. Which says the owner is ADMINISTRATOR and group is ADMIN (which is the userid I am signed on with). And permissions are DRWX------

Reply

Answer 4

Jun T.

Level 4

2,191 points

Dec 5, 2006 12:02 AM in response to GrandpaNi

Hi GrandpaNi,

Yes, it seems very difficult to mount a Windows volume with public read access. I'm not familiar with SMB, but the following may enable you to mount a Windows volume in a way readable by the user www (actually it will be readable only by www).

It seems the owner of the mount point is very important. So you can explicitly chown the mount point:

$ mkdir /Volumes/win
$ sudo chown www /Volumes/win
$ sudo mount_smbfs //user@server/share /Volumes/win

If you run 'sudo mount_smbfs' just after you run 'sudo chown', then you will be prompted for only one password; enter the password for user@server here. If 5 minutes or so has passed after the previous sudo command, then you will be asked for two passwords; first one is from sudo, so you must enter admin password of your Mac, and the second one is for user@server. If this is confusing, then you can try

$ sudo bash

and in the new (root) bash,

# mount_smbfs //user@server/share /Volumes/win

and enter the password for user@server.

Anyway, if the owner of the mount point is www, then I guess only www can read/write the mounted volume.

PowerMac G4 Mac OS X (10.4.8)

Reply

Answer 5

Dec 5, 2006 7:03 AM in response to GrandpaNi

Ive had the smae problem and its been driving me NUTS. In my case however all our project directories are stored on a windows server, however we dont run an actual webserver on that machine (nor would it be adequate as we develop soley for *nix webservers) we only use it for shared storage so that we dont polute the local HD's and so anyone in our groups can have access to anything at any time even when we designers and developers arent in, or what have you. But weve recently been using Symfony for dynamic site dev and as opposed to using a "local directory" and then transfering files after preview to the testing/staging/production Symfony works by havng you develop directly frm the web root of your site on your dev. server and then when the app is done you rsync up to production or wherever... Thatd be great if we had a spare box to through a nix on... but we dont so up iuntil this little tip ive we jsut been copying the folders over every night for "backup" instead of storing them where they need to be.

Anyhow THANX.. i hope this works.. ill report back.

Reply

Answer 6

Dec 5, 2006 11:13 AM in response to Jun T.

Hi Jun,

As my post below says similar I have a similar situation. Your directions work, but my issue is i need rwx access to the mount. Also i need to be able to have this acces through a symlink this is what im doing for example:

i mount a share calls "Clients" in /Library/WebServer.
i now need to symlink /Library/WebServer/Clients/ClientName/Projects/ProjectName/DevDir to /Library/WebServer/Documents/ProjectName So that i can serve the appropriate directories locally as well as modify files in them.

Ive tried ever combonation of perms and owner:group (me:wheel, me:www, www:me, www:admin, etc..) that might apply. The only things that does seem to work is leaving it wide open (777) everything else result in either the webserver not being able to read the file or me not being able to work in the directory.

Any thoughts on how i might accomplish this?

Reply

Answer 7

Jun T.

Level 4

2,191 points

Dec 5, 2006 11:37 PM in response to Anthony Cunningham

Hi Anthony,

The only thing I can think of is to create two mount points (one for you and the other for www) and mount the Windows volume twice.

This may work, but I guess there should be a better way. We need a help from those who are more experienced in Windows network.

Reply

Answer 8

GrandpaNi Author

Level 1

0 points

Dec 12, 2006 7:44 AM in response to GrandpaNi

Well, I have a very uggly work around that I will document, but not recommend. It is pretty resource intensive, and not particularly secure, but it works for our limited environment.

The application was simple enough that if I could copy the files I needed to a local drive, then things would work.

PHP can execute a system command, and that command runs as WWW (the Apache id), so what I ended up doing was checking to see if the file I needed was already on the local system (in a directory that WWW can access). If the file was not already there, then I would exec('smb_client....). Since you can include a command on the smb_client command line, I just included a command to copy the file I was looking for.

This is NOT a recommended solution... it is simply something that works for me..
1) PHP does not encourage running system commands under Apache. If the command hangs, you can hang Apache.

2) Running the client like this uses all the resource to establish the smb connection for each file I needed to copy, then tear it down.

As you can see, if you do this a lot, it could slow things down.

While I was writing this up, it occured to me that another option would be to have PHP see if the share was mounted, and if not, then it could issue the smb_mount command as WWW. I will have to try this next time I get some time on the server for testing.

Reply

Answer 9

GrandpaNi Author

Level 1

0 points

Dec 12, 2006 7:56 AM in response to Jun T.

Hi Jun,

I do not think that this is a Windows access problem. What files you can access on the Windows system is determined by the WINDOWS user ID you connect to the system with. Even if you are running as root on the Mac system, if you connect as JOHN to the windows system, you will only be able to access the files that JOHN has access to.

What I think we need is somebody who understands how OS/X determines the permissions and owner when you mount an SMB share. And then how to change it.

It would also be helpful to know how to tell Finder that the SMB share is mounted. If I mount a share with SBM_MOUNT, Finder doesn't always notice it, and doesn't notice if I unmount it. So currently on my system, Finder says the share is mounted, but it really isn't, and I cannot eject it from Finder.

Reply

Answer 10

GrandpaNi Author

Level 1

0 points

Dec 13, 2006 6:18 AM in response to Jun T.

Hi Jun san,

I tried this and encountered some strange results.

I created the directory /Volumes/RWD and checked that it was owned by root, group admin, with permissions of RWDR-WR-W.

I then did the sudo mount_smbfs. It asked for both passwords (root and the windows password). And looked like it worked.

I could do a cd /Volumes/RWD/, but when I tried to do an ls -l, I got a permissions denied message.

So I tried doing sudo ls -l and that gave me a directory listing as expected. So the mount worked. And it showed everything as being owned by root, with group of admin. The user id I was running under was a member of the admin group, so it should have had permissions.

I tried sudo ls -el and did not see any ACLs attached (which I did not expect to see because we did not have ACLs set for the boot volume.

Nick

Reply

Answer 11

Jun T.

Level 4

2,191 points

Dec 13, 2006 6:42 AM in response to GrandpaNi

Did you try mounting the Windows volume twice?

$ mkdir /Volumes/foryou
$ mount_smbfs //user@server/share /Volumes/foryou
$ mkdir /Volumes/forwww
$ sudo chown www /Volumes/forwww
$ sudo mount_smbfs //user@server/share /Volumes/forwww

Then you can access the volume through /Volumes/foryou, and Apache through /Volumes/forwww.

PowerMac G4 Mac OS X (10.4.8)

Reply

Answer 12

Dec 13, 2006 9:25 AM in response to GrandpaNi

I created the directory /Volumes/RWD and checked that
it was owned by root, group admin, with permissions
of RWDR-WR-W.
...
I could do a cd /Volumes/RWD/, but when I tried to do
an ls -l, I got a permissions denied message.

RWDR-WR-W is not a real permissions string, and I can't tell what you mean by it. This is important, because the reported behavior of 'ls -l' is consistent with a missing 'x' permission. Remember that 'x' on a directory is the ability to list (or search) the directory...

If you want every user to be able to read and list the directory, then it should have permissions "drwxr-xr-x".

Reply