403-forbidden - Nginx changing web root causes 403 Forbidden

Question

1. Background
Server environment: CentOS7/Nginx1.10.0

2. Problem
After changing the default web root directory of Nginx, a 403 Forbidden problem occurs when accessing the website.

Default directory:/usr/share/nginx/html

[root@AllenServer html]# pwd                                                                                                                             
/usr/share/nginx/html
[root@AllenServer html]# ls -al
总用量 16
drwxr-xr-x. 2 allen allen  71 5月  29 01:45 .
drwxr-xr-x. 5 allen allen  51 6月   1 14:47 ..
-rw-r--r--. 1 allen allen 537 4月  26 23:11 50x.html
-rw-r--r--. 1 allen allen  22 5月  29 01:45 index2.php
-rw-r--r--. 1 allen allen 617 5月  29 01:23 index.html
-rw-r--r--. 1 allen allen 167 5月  29 01:36 index.php

New directory:/home/nginx/default

[root@AllenServer default]# pwd                                                                                                                          
/home/nginx/default
[root@AllenServer default]# ls -al
总用量 16
drwxrwxrwx. 2 nginx nginx  71 6月   2 17:15 .
drwxrwxrwx. 3 nginx nginx  20 6月   1 16:10 ..
-rwxrwxrwx. 1 nginx nginx 537 6月   1 16:11 50x.html
-rwxrwxrwx. 1 nginx nginx  22 6月   1 16:11 index2.php
-rwxrwxrwx. 1 nginx nginx 618 6月   2 17:15 index.html
-rwxrwxrwx. 1 nginx nginx 167 6月   1 16:11 index.php

Nginx configuration file:

[root@AllenServer default]# more /etc/nginx/nginx.conf 
user  nginx;
#user  root;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

Website configuration file:

[root@AllenServer conf.d]# more default.conf 
server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/log/host.access.log  main;

    location / {
        #root   /usr/share/nginx/html;
        root   /home/nginx/default;
        #root   /test;
        index  index.html index.htm index.php;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        #root   /usr/share/nginx/html;
        root   /home/nginx/default;
        #root   /test;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        #root           /usr/share/nginx/html;
        root           /home/nginx/default;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}

3. Description
(1) It is normal to access the default directory before changing the configuration;
(2) Restart the Nginx service after changing the configuration;
(3) Access after changing the new Web root directory A 403 problem occurs.

Could you please tell me how to solve this problem?

Answer 1

Permission issues are generally checked like this:

• Switch to the user using the problematic software. For example su - nginx

• Try to enter the problematic directory one level at a time starting from /

• Try to read the file

When accessing a file, not only the permissions of the target file must be allowed, but also the permissions of all levels of directories above it.

Look at which step the error is reported and you will know where the problem is.

Also note that in addition to basic POSIX permissions, your permissions also include SELinux. Please check, if SELinux is enabled, SELinux must also allow nginx to access it. If the problem is caused by SELinux, SELinux has a special reporting program to view detailed information.