New webserver / permissions issue

[worthydealer]

Hello,

Our hosting company suddenly changed us over to a new webserver last week, and since then we have had a few problems doing updates and refreshes. I think this is a permissions problem, but would just like to check this theory out with people more knowledgable than I ...

Our website is at www.worthydeal.co.uk, and currently seems to be working OK, all scripts running fine. However, if I try to do a refresh or update, the refresh or update will fail at the last merge stage, after which no scripts will run on the website - attempts to put an item into the shopping cart, or do a serach, simply result in an 'internal server error'.

When this happened yesterday, I contacted the Support people at my hosting company, and they came back with the answer: "This has been fixed. You can not set CHMOD permissions > 755 under Apache 2 running SuExec as it is deemed a security risk."

Sure enough, when I checked the website, everything seemed to be back to normal - the Support guys at my hosting company had indeed fixed my problem. When I looked at the permissions they had set on the cgi-bin folder, the acatalog folder, and individual files in those folders - in fact, everything - was set to permissions of 644.

This is my theory: when I run the network test, or do a Refresh or an Update, at some point during the running of these processes, Actinic sends out a 'site chmod 0777' (or something higher than a 755 anyway) on some file or folder; this then gets interpreted by the webserver as a security risk, which in turns means that something on the webserver clicks in that prevents any and all scripts on my domain from running (because they are deemed to be a security risk).

Can anybody verify this theory and has anybody encountered this particular problem? Is there a workaround, or do I have to conclude that the webserver I am currently on is no longer suitable for the running of Actinic software?

I thought permissions on the cgi-bin and its files had to be 755, and 777 for the acatalog folder and its files, for Actinic to run properly, but I seem to be running OK with everything set to 644 (as mentioned above).

What are the implications of not having a Refresh or Update complete fully (I'm not sure what the last 'merge' stage of a Refresh/Update actually does)? Can I let it fail at this stage, cancel out of Actinic, then FTP manually to the website and set all the permissions to 644 to lets the scripts run and still expect everything to be working fine?

[worthydealer]

Since posting the above, my hosting company have sent me further information:-

Hi Peter,

With Apache2 one of it's inbuilt security features is that if a directory is CHMOD'd 777, no scripts within that directory will be allowed to run. This is most likely what caused the problems here.

Any host running Apache 2 will have the same problem, and really the Actinic oftware should support it as Apache 2 has been out for many years now.

Thanks,
- Will Kruss

Can anybody confirm my Actinic 5 will definitely NOT run properly on any hosting company running Apache 2? Can anybody recommend a hosting company where my v5 WILL run properly??

[Bruce]

Have you tried the setup with the acatalog set at '755' and the cgi-bin too at '755'. You can later further reduce the settings to the least with which Actinic can complete an update or refresh.

Kind regards,

[mahatma]

I did and still nothing

[Bruce]

Irek,

Do you have a firewall on? I would try turning off the firewalls to check, if it works then you need to Allow Actinic on the firewall as well as make sure that the firewall settings are not too high. This issue has been noticed if you have Zone Alarm.

Kind regards,

[simon_y]

I'm running Apache2 on my local server for testing and using Actinic v7

Can only get Actinic to work with permissions on the cgi-bin set to 755 & the acatalog folder to 777, as worthydealer suggested earlier. Anything less doesn't work (for me anyway!). So, it seems clear that Apache2 will run scripts in directories that have been chmod to 777.

Has there been a resolution to this one yet?

Simon

BTW I'm running Zone Alarm as well

[Bruce]

Hi Simon,

'777' permissions are read, write and execute for all, this is however the 'acatalog' folder and does not contain the Actinic scripts, the cgi-bin at 755 contains them and these are desired permissions. What is the problem you are facing?

Kind regards,

[simon_y]

Hi Bruce,

At the time of posting I was just lettin worthydealer know that setting permissions to 777 did not break anything for me in Apache2, which I am running on a local server for testing (this was the first Actinic site I had tried). His web host appears to have told him otherwise.

However, since you ask, I am currently tearing my remaining hair out whilst trying to upload another test site locally. When running the test in network configurations I keep getting the message:

The server is not properly configured to allow Actinic to run CGI scripts from the cgi-bin.

Permissions on everything are set to 777 at the moment, there is an htaccess file to enable scripts in the cgi-bin I want to use for this site, Apache is configured to let the htaccess file overide default settings.

If I ignore the warnings and upload the site all files go to the correct places. Can browst to the index page fine, but any link involving scripts returns an access forbidden error.

My Actinic settings are:

HTTPPROXYMODE 0
HTTPPROXYADDRESS
HTTPPROXYPORT 80
HTTPPROXYUSER
HTTPPROXYPASSWORD
FTPPROXYMODE 0
FTPPROXYADDRESS
FTPPROXYPORT 21
FTPPROXYUSER
FTPPROXYPASSWORD
SCRIPTID 1
SCRIPTEXT .pl
SMTPHOST smtp.localhost
WEBSITEURL http://quantockshop.local
IGNOREPASSIVEERRORS true
USERELATIVECGIURLS false
PATHTOPERL /usr/bin/perl
USEENHANCEFTP false
FTPCLIENTTIMEOUT 15000
FTPRETRYDELAY 3000
FTPSILENT false
FTPMAXRETRIES 3
FTPCONNECTTIMEOUT 25000
SMTPAUTHREQUIRED false
SMTPUSERNAME
SMTPPASSWORD
CATALOGURL http://quantockshop.local/q_shop01_local/acatalog/
CGIBINURL http://quantockshop.local/cgi-bin/q_shop01cgi_local/
PATHFROMCGITOCATALOG ../../htdocs/q_shop01_local/acatalog/
CODEBASE ./
FTPHOST quantockshop.local
FTPUSERNAME ********
FTPPASSWORD **********
PATHTOCGIBIN /cgi-bin/q_shop01cgi_local/
USEPASSIVEFTP false
FTPPATHFROMCGITOCATALOG

Any help gratefully received!
Thanks
Simon

[wjcampbe]

If you already have one working site and that is using script ID 1, then change the second site to script ID 2 - they cannot both have the same number.

[Bruce]

Hi,

Why dont you create the cgi-bin to be in the same directory as the 'acatalog'. Then change
PATHFROMCGITOCATALOG to ../acatalog/
PATHTOCGIBIN to /htdocs/q_shop01_local/cgi-bin/

You will have to change the cgi-bin url too.

Kind regards,

[simon_y]

Wow! Those were fast replies.

Bill, it appears that the first site is broken now I have changed a few settings in Apache, which is a new game for me, so it looks as if the problem could be there!

Bruce, I'll give your suggestion a shot - although I was under the impression that having a cgi-bin under htdocs presented a potential security issue.

Will report back
Simon

[wjcampbe]

If the first site was running script ID 1 and you added a second site also running script ID 1, then BOTH sites would be broken. You would have expected an error message, but that depends on whether its a common cgi-bin.

[simon_y]

Sorry, Bill
I didn't read your first post carefully.
Where are these script ID's located?

Thanks for your patience!
Simon

[wjcampbe]

Advanced | Network setup - lower left side CGI script ID number.

[simon_y]

Thanks, Bill.

I'll give it a go.

Simon

- Right in front of my eyes! It's been a long day.