Django folder permissions for installation - django

The official Django installation documentation seems to be lacking in exactly how to set up folder permissions post-installation so that a 403 Foridden error does not show up on a live apache installation.
I've spent 2 months going through thousands of forum posts, hundreds of guides, and countless Stackoverflow Q&As about setting up folder permissions. No single two of these posts, guides or Q&As are the same. All are riddled with users having to implement custom solutions here and there to get things working, there's no consistency anywhere as to exactly what folder permissions should be set up. I probably speak for silent untold thousands who gave up when trying to do folder permissions.
So my question is simple, how do I set the correct file and folder permissions on Ubuntu 16.04, configured with Python 2.11 in a virtual environment, with Django on an Apache mod_wsgi server?
My structure is as per the official documentation - /home/main/myproject/project
All of these folders (home, main, myproject and project) have 755 permissions owned by a non-root sudo user called 'main' which I use for everything.
I've done:
chmod 664 ~/myproject/db.sqlite3
chmod 775 ~/myproject
sudo chown :www-data ~/myproject/db.sqlite3
sudo chown :www-data ~/myproject
Apparently these are all the permissions I need. Yet I still get a 403 forbidden error. How on earth do I please get this Django thing live?
Edit: I've followed this tutorial exactly: https://www.digitalocean.com/community/tutorials/how-to-serve-django-applications-with-apache-and-mod_wsgi-on-debian-8 particularly the part with appending /etc/apache2/sites-available/000-default.conf
My 000-default.conf append looks like:
<VirtualHost *:80>
. . .
Alias /static /home/main/myproject/static
<Directory /home/main/myproject/static>
Require all granted
</Directory>
# Next, add the following directory block
<Directory /home/main/myproject/project>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
WSGIDaemonProcess project python-home=/home/main/myproject/projectenv python-path=/home/main/myproject
WSGIProcessGroup project
WSGIScriptAlias / /home/main/myproject/project/wsgi.py
My Apache error logs don't seem to show any issues after visiting the forbidden domain index:
[Wed Jun 27 07:03:46.807525 2018] [mpm_prefork:notice] [pid 21287] AH00171:
Graceful restart requested, doing restart
[Wed Jun 27 07:03:46.878042 2018] [wsgi:warn] [pid 21287] mod_wsgi: Compiled for Python/2.7.11.
[Wed Jun 27 07:03:46.878052 2018] [wsgi:warn] [pid 21287] mod_wsgi: Runtime using Python/2.7.12.
[Wed Jun 27 07:03:46.878142 2018] [mpm_prefork:notice] [pid 21287] AH00163: Apache/2.4.18 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.0.2g mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Wed Jun 27 07:03:46.878156 2018] [core:notice] [pid 21287] AH00094: Command line: '/usr/sbin/apache2'
[Wed Jun 27 07:03:50.444008 2018] [mpm_prefork:notice] [pid 21287] AH00171: Graceful restart requested, doing restart
[Wed Jun 27 07:03:50.517693 2018] [wsgi:warn] [pid 21287] mod_wsgi: Compiled for Python/2.7.11.
[Wed Jun 27 07:03:50.517704 2018] [wsgi:warn] [pid 21287] mod_wsgi: Runtime using Python/2.7.12.
[Wed Jun 27 07:03:50.517823 2018] [mpm_prefork:notice] [pid 21287] AH00163: Apache/2.4.18 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.0.2g mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Wed Jun 27 07:03:50.517837 2018] [core:notice] [pid 21287] AH00094: Command line: '/usr/sbin/apache2'

Related

apache wsgi_mod fails to run on python 3.10

I am developing a django app using django 4 and python 3.10.
I had a server using apache and mod_wsgi, that used to run an old app using python3.8.
I've created a virtual env from 3.10. Command line manage.py is working well.
I've changed apache's conf:
WSGIDaemonProcess my_app310 python-path=/home/ubuntu/my_app310:/home/ubuntu/venv/my_app310/lib/python3.10/site-packages
WSGIProcessGroup my_app310
WSGIScriptAlias / /home/ubuntu/my_app310/my_app310/wsgi.py
But I keep getting:
[mpm_event:notice] AH00489: Apache/2.4.41 (Ubuntu) mod_wsgi/4.6.8 Python/3.8 configured -- resuming normal operations
[core:notice] AH00094: Command line: '/usr/sbin/apache2'
[wsgi:error] mod_wsgi (pid=1724834): Failed to exec Python script file '/home/ubuntu/my_app310/my_app310/wsgi.py'.
[wsgi:error] mod_wsgi (pid=1724834): Exception occurred processing WSGI script '/home/ubuntu/my_app310/my_app310/wsgi.py'.
[wsgi:error] Traceback (most recent call last):
[wsgi:error] File "/home/ubuntu/venv/my_app310/lib/python3.10/site-packages/django/utils/timezone.py", line 10, in <module>
[wsgi:error] import zoneinfo
[wsgi:error] ModuleNotFoundError: No module named 'zoneinfo'
Which suggest that something is running using python3.8 and not python3.10 (mod_wsgi?). What am I missing?
to configure apache2 with a certain Python Version just do the following:
go into your virtual_env that you have created with Python3.10
$ pip install mod_wsgi
$ mod_wsgi-express module-config
you get an output like
LoadModule wsgi_module "..../lib/python3.10/site-packages/mod_wsgi/server/mod_wsgi-py310.cpython-310-x86_64-linux-gnu.so"
SSGIPythonHome "..."
copy the 2 lines into /etc/apache2/apache2.conf
restart apache2
you should see something like
[mpm_event:notice] AH00489: Apache/2.4.41 (Ubuntu) mod_wsgi/4.6.8 Python/3.10 config .....
WSGI Clearly says that File "/home/ubuntu/venv/my_app310/lib/python3.10/site-packages/django/utils/timezone.py", given this path has no module named zoneinfo try importing module into your python virtual environment.
Example:
pip install (module)

Deploying Ghost One-Click droplet on Digital Ocean: Exit code 1 when verifying domain

I'm trying to follow along with DigitalOceans intructions on creating a one-click droplet in order to set up a ghost cms for my website.
I set up my website on Netlify, and had Netlify manage the dns. When Netlify manages the dns it looks like it automatically sets up ssl on Netlify.
The domain registrar is Namecheap.
When I ssh to my droplet I get the output below and visiting https://example.com/ghost/ gives a 404 error, but I can still visit https://example.com
~ % ssh root#111.111.1.11
The authenticity of host '111.111.1.11 (111.111.1.11)' can't be established.
ECDSA key fingerprint is SHA111:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '111.111.1.11' (ECDSA) to the list of known hosts.
root#111.111.1.11's password:
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
-------------------------------------------------------------------------------
Configuring DigitalOcean 1-Click Ghost installation.
Please wait a minute while your 1-Click is configured.
Once complete, you are encouraged to run mysql_secure_installation to ready
your server for production. Passwords have been saved to:
root/.digitalocean_password
-------------------------------------------------------------------------------
Ensuring Ghost-CLI is up-to-date...
+ sudo npm i -g ghost-cli#latest
/usr/bin/ghost -> /usr/lib/node_modules/ghost-cli/bin/ghost
+ ghost-cli#1.13.1
added 59 packages from 29 contributors, removed 11 packages and updated 48 packages in 16.313s
Ghost will prompt you for two details:
1. Your domain
- Add an A Record -> 111.111.1.11 & ensure the DNS has fully propagated
- Or alternatively enter http://111.111.1.11
2. Your email address (only used for SSL)
Press enter when you're ready to get started!
+ sudo chown -R ghost-mgr:ghost-mgr /home/ghost-mgr/.config
✔ Checking system Node.js version
✔ Checking logged in user
✔ Checking current folder permissions
✔ Checking operating system compatibility
✔ Checking for a MySQL installation
✔ Checking memory availability
✔ Checking for latest Ghost version
✔ Setting up install directory
✔ Downloading and installing Ghost v3.13.4
✔ Finishing install process
? Enter your blog URL: https://example.com
✔ Configuring Ghost
✔ Setting up instance
+ sudo useradd --system --user-group ghost
+ sudo chown -R ghost:ghost /var/www/ghost/content
✔ Setting up "ghost" system user
ℹ Setting up "ghost" mysql user [skipped]
✔ Creating nginx config file at /var/www/ghost/system/files/example.com.conf
+ sudo ln -sf /var/www/ghost/system/files/example.com.conf /etc/nginx/sites-available/example.com.conf
+ sudo ln -sf /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/example.com.conf
+ sudo nginx -s reload
✔ Setting up Nginx
? Enter your email (For SSL Certificate) myemail#outlook.com
+ sudo mkdir -p /etc/letsencrypt
+ sudo ./acme.sh --install --home /etc/letsencrypt
+ sudo /etc/letsencrypt/acme.sh --issue --home /etc/letsencrypt --domain example.com --webroot /var/www/ghost/system/nginx-root --reloadcmd "nginx -s reload" --accountemail myemail#outlook.com
✖ Setting up SSL
✔ Creating systemd service file at /var/www/ghost/system/files/ghost_example-com.service
+ sudo ln -sf /var/www/ghost/system/files/ghost_example-com.service /lib/systemd/system/ghost_example-com.service
+ sudo systemctl daemon-reload
✔ Setting up Systemd
+ sudo systemctl is-active ghost_example-com
+ sudo systemctl start ghost_example-com
+ sudo systemctl is-enabled ghost_example-com
+ sudo systemctl enable ghost_example-com --quiet
✔ Starting Ghost
One or more errors occurred.
1) ProcessError
Message: Command failed: /bin/sh -c sudo -S -p '#node-sudo-passwd#' /etc/letsencrypt/acme.sh --issue --home /etc/letsencrypt --domain example.com --webroot /var/www/ghost/system/nginx-root --reloadcmd "nginx -s reload" --accountemail myemail#outlook.com
[Tue Apr 21 18:30:16 UTC 2020] example.com:Verify error:Invalid response from https://example.com/.well-known/acme-challenge/vsRL-FT-yUeK0ntPgkXjl2-4vcYw8FV213estE4b1as [206.189.73.52]:
[Tue Apr 21 18:30:16 UTC 2020] Please add '--debug' or '--log' to check more details.
[Tue Apr 21 18:30:16 UTC 2020] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
[Tue Apr 21 18:30:11 UTC 2020] Create account key ok.
[Tue Apr 21 18:30:11 UTC 2020] Registering account
[Tue Apr 21 18:30:12 UTC 2020] Registered
[Tue Apr 21 18:30:12 UTC 2020] ACCOUNT_THUMBPRINT='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
[Tue Apr 21 18:30:12 UTC 2020] Creating domain key
[Tue Apr 21 18:30:12 UTC 2020] The domain key is here: /etc/letsencrypt/example.com/example.com.key
[Tue Apr 21 18:30:12 UTC 2020] Single domain='example.com'
[Tue Apr 21 18:30:12 UTC 2020] Getting domain auth token for each domain
[Tue Apr 21 18:30:13 UTC 2020] Getting webroot for domain='example.com'
[Tue Apr 21 18:30:13 UTC 2020] Verifying: example.com
Exit code: 1
Debug Information:
OS: Ubuntu, v18.04.3 LTS
Node Version: v10.16.3
Ghost Version: 3.13.4
Ghost-CLI Version: 1.13.1
Environment: production
Command: 'ghost install --auto --db=mysql --dbhost=localhost --dbname=ghost_production --dbuser=ghost --dbpass=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb --dir=/var/www/ghost --start'
Additional log info available in: /home/ghost-mgr/.ghost/logs/ghost-cli-debug-2020-04-21T18_30_42_032Z.log
Try running ghost doctor to check your system for known issues.
You can always refer to https://ghost.org/docs/api/ghost-cli/ for troubleshooting.
------------------------------------------------------------------------------
For any further commands, please switch to the ghost-mgr user to manage Ghost.
sudo -i -u ghost-mgr
------------------------------------------------------------------------------
I did a bit of searching and it appears from this thread that you need to set up an SSL at the other end rather than using the one from Netlify:
https://community.netlify.com/t/how-to-do-dns-ssl-for-sub-domain-that-doesnt-run-on-netlify/5498/11

'No module named 'encodings'' error when deploying django app on apache with mod_wsgi

Versions list:
Centos 7---django 2.1.7---Apache 2.4.6---Python 3.6
Check EDIT 5 for most recent error log
followed this tutorial here: https://www.digitalocean.com/community/tutorials/how-to-serve-django-applications-with-apache-and-mod_wsgi-on-centos-7
I am able to run sudo systemctl start httpd and when i go to the url i get a Internal sever error (logs at the bottom)
My file structure
home
└── user
└── projects
└── myapp
├── app
│ ├── <All Code for Webapp including static dir> 
├── env (virtualenv)
├── manage.py
├── new
│   ├── settings.py
│   ├── urls.py
│   └── wsgi.py
└── requirements.txt
And i hoping someone can see a mistake in my django.conf located in my further down in my httpd folder. And hoping these are the endpoints i'm looking for
EDIT: This file is located here: /etc/httpd/conf.d/django.conf
django.conf
Alias /static /home/user/projects/myapp/app/static
<Directory /home/user/projects/myapp/app/static>
Require all granted
</Directory>
<Directory /home/user/projects/myapp/new>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
WSGIApplicationGroup %{GLOBAL}
WSGIDaemonProcess myapp python-path=/home/user/projects/myapp python-home=/home/user/projects/myapp/env
WSGIProcessGroup myapp
WSGIScriptAlias / /home/user/projects/myapp/new/wsgi.py
I'm not sure if these are pointing to all the right places and was hoping someone could give me a second look.
And i havent touched wsgi.py and was wondering if i am missing any logic there.
my wsgi.py
import os
from django.core.wsgi import get_wsgi_application
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'new.settings')
application = get_wsgi_application()
EDIT2: i am able to run the server but get a 500 internal server error and when i check the error_logs i get this
Updated Logs
[Mon Mar 11 10:40:39.865611 2019] [core:notice] [pid 9371] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon Mar 11 10:40:39.868149 2019] [suexec:notice] [pid 9371] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Mar 11 10:40:39.918015 2019] [auth_digest:notice] [pid 9371] AH01757: generating secret for digest authentication ...
[Mon Mar 11 10:40:39.919681 2019] [lbmethod_heartbeat:notice] [pid 9371] AH02282: No slotmem from mod_heartmonitor
[Mon Mar 11 10:40:39.948303 2019] [mpm_prefork:notice] [pid 9371] AH00163: Apache/2.4.6 (CentOS) mod_wsgi/3.4 Python/2.7.5 configured -- resuming normal operations
[Mon Mar 11 10:40:39.948370 2019] [core:notice] [pid 9371] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
[Mon Mar 11 10:40:42.878806 2019] [mime_magic:error] [pid 9376] [client ip] AH01512: mod_mime_magic: can't read `/home/user/projects/myapp/new/wsgi.py'
[Mon Mar 11 10:40:42.879459 2019] [mime_magic:error] [pid 9376] [client ip] AH01512: mod_mime_magic: can't read `/home/user/projects/myapp/new/wsgi.py'
[Mon Mar 11 10:40:42.905048 2019] [:error] [pid 9372] (13)Permission denied: [remote ip] mod_wsgi (pid=9372, process='myapp', application='<url>|'): Call to fopen() failed for '/home/user/projects/myapp/new/wsgi.py'
EDIT3
In this log file it says this Apache/2.4.6 (CentOS) mod_wsgi/3.4 Python/2.7.5 configured when i am running python3.6 not 2.7.5, Maybe changing this would help?
EDIT 4
So i changed my WSGIDaemonProcess to
WSGIDaemonProcess myapp python-path=/home/user/projects/myapp python-home=/home/user/projects/app/env/lib/python3.6/site-packages user=<user>
Now im getting these errors
[Tue Mar 12 10:38:09.111397 2019] [mime_magic:error] [pid 18804] [client ip] AH01512: mod_mime_magic: can't read `/home/user/project/myapp/new/wsgi.py'
ImportError: No module named site
ImportError: No module named site
ImportError: No module named site
so it looks like i need to uninstall mod_wsgi and reinstall to compile with python3.6 and not 2.7
How can i succesfully do this? i uninstall mod_wsgi and try mreinstall using sudo pip3.6 install mod_wsgi Now it doesnt recognize the new install of mod_wsgi and wont start the server because of an invalid command 'WSGIDaemonProcess' this is bc the new download isnt configured with httpd? how would i do this?
EDIT 5
Successfully installed mod_wsgi compiled with correct python version and able to run server, set SELinux to permissive to get rid of cant find '/route/to/wsgi/py. and now I am now getting no module name 'encoding' errors that repeats.
[Wed Mar 13 15:20:46.133597 2019] [core:notice] [pid 4403] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
Fatal Python error: Py_Initialize: Unable to get the locale encoding
ModuleNotFoundError: No module named 'encodings'
[Tue Mar 12 14:11:57.520271 2019] [core:notice] [pid 866] AH00052: child pid 891 exit signal Aborted (6)
Fatal Python error: Py_Initialize: Unable to get the locale encoding
ModuleNotFoundError: No module named 'encodings'
currently my permissions are all under user apache and group apache, and seems they are all under the right permissions, and i tried changing the root user/group to apache as well, and ran chmod -R 777 at the Myapp directory to make sure it had proper permissions.
Permissions under projects:
home/user/projects# ls -l
total 0
drwxrw-r-x. 7 apache apache 109 Mar 12 12:48 myapp
home/user/projects/myapp# ls -l
Permissions under myapp:
total 12
drwxrwxr-x. 7 apache apache 4096 Mar 7 13:18 app
drwxr-xr-x. 5 apache apache 56 Mar 12 12:48 env
-rwxrwxr-x. 1 apache apache 535 Mar 5 13:33 manage.py
drwxrwxr-x. 3 apache apache 110 Mar 7 14:27 new
-rw-rw-r--. 1 apache apache 869 Mar 7 14:42 requirements.txt
According to mod_wsgi's documentation:
user=name | user=#uid
Defines the UNIX user name or numeric user uid of the user that the daemon processes should be run as. If this option is not supplied the daemon processes will be run as the same user that Apache would run child processes, as defined by the User directive, and it is not necessary to set this to the Apache user yourself.
I suppose that the apache user cannot access your home directory. Either try to add the user=myUserdirective to your WSGIDaemonProcess or chown your directory to the apache user. Another possible way would be to put your application inside a directory owned by apache user.
EDIT
I really should learn to read. According to the docs, it looks like you should recompile mod_wsgi using a python3.X interpreter in order to run python3.X applications (use the same versions for both compiling and application's environment)
If you want to use a different version of Python, you will need to reinstall mod_wsgi, compiling it for the version you want. It is not possible for the one mod_wsgi instance to run applications for both Python 2 and 3 at the same time.
EDIT 2
To answer one of your comments: It's normal that yum won't remove the version you installed through pip. It has no way to guess that you installed packages through other package managers AFAIK. I think that you should copy some the .so (I think it's mod_wsgi[version].so) files that lies in the directory where pip installed mod_wsgi (inside your venv/global site_packages I think) into the folder where Apache/Httpd loads its modules files (it's something like /usr/lib/apache2/modules on alpine/ubuntu so I guess it is /usr/lib/httpd/modules for CentOS, but can be different, sorry I can't give you more specific help) after moving out of this folder the old mod_wsgi.so. Don't forget to shutdown httpd before doing this, and restart it after.
Source: https://modwsgi.readthedocs.io/en/develop/configuration-directives/WSGIDaemonProcess.html (section python-home)
Try permission on dir level rather on file.
<Directory /home/user/projects/myapp/new>
Require all granted
</Directory>
You can check user and group for apache by
egrep -i '^user|^group' /etc/httpd/conf/httpd.conf
So make sure you have permissions on /home/user/projects/myapp/new/wsgi.py
recheck by ls -l
Try after for example if User is apache and group is apache
sudo chown apache:apache /home/user/projects/myapp/new/wsgi.py
You have to pass library location for env variable.
WSGIDaemonProcess myapp python-path=/home/user/projects/myapp python-home=/home/user/projects/myapp/env/lib/<PYTHON VERSION>/site-packages/

Getting Photologue was unable to import the Python Imaging Library error in django_inventory while deploying with Apache+Mod_wsgi

I am trying to deploy Django Inventory with Apache + Mod_wsgi in Virtual environment. But It gives 500 server side error claiming that it cannot import PIL. But PIL and Photologue are already installed within my virtualenv. And I had no problem getting a hello-world project running within this setup.
FYI: Django Inventory itself installs as an app when installed with pip. And resides in the site-packages of the virtual-environment. But I have copied it fro the ste packages and put it in the /var/www/html root to serve from apache. Could this be a reason?
Thanks in advance.
[Tue Jun 21 10:50:24.308075 2016] [wsgi:error] [pid 19197] [remote ::1:224] File "/var/www/html/imsenv/lib/python2.7/site-packages/django_inventory/apps/photos/models.py", line 6, in <module>
[Tue Jun 21 10:50:24.308099 2016] [wsgi:error] [pid 19197] [remote ::1:224] from photologue.models import ImageModel
[Tue Jun 21 10:50:24.308108 2016] [wsgi:error] [pid 19197] [remote ::1:224] File "/var/www/html/imsenv/lib/python2.7/site-packages/photologue/models.py", line 33, in <module>
[Tue Jun 21 10:50:24.308131 2016] [wsgi:error] [pid 19197] [remote ::1:224] raise ImportError('Photologue was unable to import the Python Imaging Library. Please confirm it`s installed and available on your current Python path.')
[Tue Jun 21 10:50:24.308170 2016] [wsgi:error] [pid 19197] [remote ::1:224] ImportError: Photologue was unable to import the Python Imaging Library. Please confirm it`s installed and available on your current Python path.
This is probably not the answer that you're looking for, but...
Django-photologue 2.3 is a really old version - about 6 years old.
Installing PIL was often troublesome; I am the maintainer of Django-photologue since 2012, and I've had to write some ugly code in order to import PIL correctly (the installation path tended to change from installation to installation). I think it was in version 2.6 that I made these changes.
Nowadays everyone just uses Pillow instead :-)
By the way, I looked at the requirements file for django-inventory and it uses very old 3rd party software. For example, Django 1.6 - which is no longer supported.

raise ImportError 'PILKit was unable to import the Imaging Library'

when i try to install PIL on my ubuntu server in virtualenv it is throwing this error
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-3qvaiv6l/PIL
however i have pillow installed. even then it is showing this error in error.logs
[Mon Mar 30 16:24:14.892127 2015] [:error] [pid 31004:tid 139913894803200] [client 122.167.116.201:57073] raise ImportError('PILKit was unable to import the P$
$n Imaging Library. Please confirm it`s installed and available on your current Python path.
What is the case here and how should i proceed?
Finally i got the answer. the problem was occuring because thewsgi.py file was not having the python path for the virtual environment in appropriate way.