Internal Server Error

[Carl Parsons]

Hi

We have been trying to get mailman working on a fedora 10 installation
I can get it working on a internal server but my external server gives
the following error.
I use webmin which places virtual servers in /home so I had to recompile
suexec to work in a different root
I suspect this is the problem but do not understand suexec configuration
enough to fix the error

Internal Server Error

The server encountered an internal error or misconfiguration and was
unable to complete your request.

Please contact the server administrator, root@localhost and inform them
of the time the error occurred, and anything you might have done that
may have caused the error.

More information about this error may be available in the server error log.

Carl


--
PinGNU Systems Ltd
A company registered in England and Wales
Registered office: 6 Flackdale Road, Hilton, Cambs, PE28 9NY
Registered company number: 4176338

Mobile  [phone] Day time only
Home: 01480 831607 weekends
Skype: carlpingnu

------------------------------------------------------
Mailman-Users mailing list
Mailman-Users@...
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-users/lists%40nabble.com

Security Policy: http://wiki.list.org/x/QIA9

[Adam McGreggor-2]

On Sun, Oct 11, 2009 at 11:09:30AM +0100, Carl Parsons wrote:
> Hi
>
> We have been trying to get mailman working on a fedora 10 installation
> I can get it working on a internal server but my external server gives
> the following error.
> I use webmin which places virtual servers in /home so I had to recompile
> suexec to work in a different root

I'd not be using webmin, for a start.

> I suspect this is the problem but do not understand suexec configuration
> enough to fix the error
>
> Internal Server Error
>
> The server encountered an internal error or misconfiguration and was
> unable to complete your request.
>
> Please contact the server administrator, root@localhost and inform them
> of the time the error occurred, and anything you might have done that
> may have caused the error.
>
> More information about this error may be available in the server error log.

So, what's in the Apache Error Log?

--
``Every problem in the world can be fixed with either flowers,
  or duct tape, or both.'' (David Millington)
------------------------------------------------------
Mailman-Users mailing list Mailman-Users@...
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-users/lists%40nabble.com

[Carl Parsons]

hi

I rebuilt suexec so docroot is

-bash-3.2# suexec -V
 -D AP_DOC_ROOT="/home"
 -D AP_GID_MIN=100
 -D AP_HTTPD_USER="apache"
 -D AP_LOG_EXEC="/var/log/httpd/suexec.log"
 -D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
 -D AP_UID_MIN=500
 -D AP_USERDIR_SUFFIX="public_html"

created a directory /home/mailman to put the cgi-bin files copying from
/usr/lib/mailman/cgi-bin to
/home/mailman/cgi-bin

#
#  httpd configuration settings for use with mailman.
#

#ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/
ScriptAlias /mailman/ /home/mailman/cgi-bin/
<Directory /home/mailman/cgi-bin/>
    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all
</Directory>


Alias /pipermail/ /var/lib/mailman/archives/public/
<Directory /var/lib/mailman/archives/public>
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

# Uncomment the following line, replacing www.example.com with your server's
# name, to redirect queries to /mailman to the listinfo page (recommended).

RedirectMatch ^/mailman[/]*$ http://www.mysite.com/mailman/listinfo

error log
[Wed Oct 21 10:39:42 2009] [error] [client 81.178.1.21] suexec policy
violation: see suexec log for more details
[Wed Oct 21 10:39:42 2009] [error] [client 81.178.1.21] Premature end of
script headers: listinfo


suexec.log
[2009-10-21 10:32:43]: uid: (505/mysite.com) gid: (505/mysite) cmd: listinfo
[2009-10-21 10:32:43]: target uid/gid (505/505) mismatch with directory
(0/41) or program (0/41)

When http is at mysite.com it executes as user mysite.

Just realised I was looking at the wrong apache error file errors are in
per site file mysite_error.log

I have tried to put the suexec back to Fedora 10 version but it still fails

Carl


PS error


  Internal Server Error

The server encountered an internal error or misconfiguration and was
unable to complete your request.

Please contact the server administrator, root@localhost and inform them
of the time the error occurred, and anything you might have done that
may have caused the error.

More information about this error may be available in the server error log.



Adam McGreggor wrote:

> On Sun, Oct 11, 2009 at 11:09:30AM +0100, Carl Parsons wrote:
>  
>> Hi
>>
>> We have been trying to get mailman working on a fedora 10 installation
>> I can get it working on a internal server but my external server gives
>> the following error.
>> I use webmin which places virtual servers in /home so I had to recompile
>> suexec to work in a different root
>>    
>
> I'd not be using webmin, for a start.
>
>  
>> I suspect this is the problem but do not understand suexec configuration
>> enough to fix the error
>>
>> Internal Server Error
>>
>> The server encountered an internal error or misconfiguration and was
>> unable to complete your request.
>>
>> Please contact the server administrator, root@localhost and inform them
>> of the time the error occurred, and anything you might have done that
>> may have caused the error.
>>
>> More information about this error may be available in the server error log.
>>    
>
> So, what's in the Apache Error Log?
>
>  

--
Carl Parsons

Director
PinGNU Systems Ltd
A company registered in England and Wales
Registered office: 6 Flackdale Road, Hilton, Cambs, PE28 9NY
Registered company number: 4176338
Landline: 01480 831607
Mobile  [phone]
Email: carl.parsons@...
_______

 <http://www.pingnu.co.uk/> Home Office IT Support

------------------------------------------------------
Mailman-Users mailing list Mailman-Users@...
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-users/lists%40nabble.com

[Mark Sapiro-3]

Carl Parsons wrote:
>
>We have been trying to get mailman working on a fedora 10 installation
>I can get it working on a internal server but my external server gives
>the following error.
>I use webmin which places virtual servers in /home so I had to recompile
>suexec to work in a different root
>I suspect this is the problem but do not understand suexec configuration
>enough to fix the error


First a big caveat. Mailman's security model is not compatible with
suexec. You can make it work if you only host a single domain, but
beyond that, it's a pain or impossible. Maybe your recompilation will
help. I don't know.

>Internal Server Error
>
>The server encountered an internal error or misconfiguration and was
>unable to complete your request.
>
>Please contact the server administrator, root@localhost and inform them
>of the time the error occurred, and anything you might have done that
>may have caused the error.
>
>More information about this error may be available in the server error log.

Suexec errors are not logged in apache's error_log. They are logged in
a special suexec_log (or whatever name was configured in suexec).

Find the error.

Read the documentation at
<http://httpd.apache.org/docs/2.2/suexec.html> (or whatever is
appropriate for your version) and good luck!

--
Mark Sapiro <mark@...>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

------------------------------------------------------
Mailman-Users mailing list Mailman-Users@...
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-users/lists%40nabble.com

[Mark Sapiro-3]

Carl Parsons wrote:

>
>I rebuilt suexec so docroot is
>
>-bash-3.2# suexec -V
> -D AP_DOC_ROOT="/home"
> -D AP_GID_MIN=100
> -D AP_HTTPD_USER="apache"
> -D AP_LOG_EXEC="/var/log/httpd/suexec.log"
> -D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
> -D AP_UID_MIN=500
> -D AP_USERDIR_SUFFIX="public_html"
>
>created a directory /home/mailman to put the cgi-bin files copying from
>/usr/lib/mailman/cgi-bin to
>/home/mailman/cgi-bin

You didn't have to do that.

See my reply at
<http://mail.python.org/pipermail/mailman-users/2009-October/067490.html>.
The important part of that reply is


>First a big caveat. Mailman's security model is not compatible with
>suexec. You can make it work if you only host a single domain, but
>beyond that, it's a pain or impossible. Maybe your recompilation will
>help. I don't know.

[...]
>suexec.log
>[2009-10-21 10:32:43]: uid: (505/mysite.com) gid: (505/mysite) cmd: listinfo
>[2009-10-21 10:32:43]: target uid/gid (505/505) mismatch with directory
>(0/41) or program (0/41)
>
>When http is at mysite.com it executes as user mysite.


Apache is trying to run the wrapper as suExec uid and gid
uid: (505/mysite.com) gid: (505/mysite)

Your wrappers and the directory containing them are owned by root and
group 41 whatever that is. This is a violation of items 14 and 16 at
<http://httpd.apache.org/docs/2.2/suexec.html>.

Note that the wrapper also can't be SETGID (to any group), so
everything will run as user/group 505/505 which in turn means that all
mailman code must be readable by that user/group and all existing an
future mutable data must be writable by that user/group.

For practical purposes this means that Mailman must be
configured/installed with GID 505.

--
Mark Sapiro <mark@...>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

------------------------------------------------------
Mailman-Users mailing list Mailman-Users@...
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-users/lists%40nabble.com