Pete
Both QTMHHTTP and QTMHHTP1 are relevant where permissions are concerned. However, your specific problem concerned access to HTML templates in your IFS. Apache <directory> directives relate to resources in your document root that Apache must have access to in order to deliver it to the browser (like static HTML, CSS, images, javascript etc). Apache should *not* have access to HTML templates at all. They are just read by your CGI program(s), and therefore the current user of the CGI thread (QTMHHTP1) must be able to read them. The QTMHHTTP user must have permission to other things, like the Apache logs and the aforementioned static resources.
This IBM link explains it quite well. Even though it is for V5R2 it is still relevant to the latest OS release as far as I can see:
http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzaie/rzaiesetauth.htm
Cheers
Kevin
-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Pete Helgren
Sent: 27 January 2012 00:19
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] IFS File permissions
Thanks for the feedback. Adding the "directory" directives was just a
shot in the dark since I am not sure how CGIDEV2 handles permissions to
read the files in the IFS. Your post straightened that out. So let me
run this by you....
If, as both you and Kevin said, these files should be accessible to
QTMHHTP1 because that is the profile CGIDEV2 will run under, then
changing the permissions to have *RX for QTMHHTP1 on those files and
removing permissions for QTMHHTTP should fix the permissions
(correct?). That would also solve any problems with "stray" directives
that I might have (like the one you mentioned) because it seems that PHP
and Apache run under the QTMHHTTP user profile (at least it looks like
most of the files in my php apps have *RX permissions for QTMHHTTP on
them). If the files have only QTMHHTP1 permissions, then QTMHHTTP
(browsing) wouldn't be able to read them. However, I WILL remove the
directive since it isn't helping me and potentially could come back to
haunt me.
Pete Helgren
Value Added Software, Inc
www.petesworkshop.com
GIAC Secure Software Programmer-Java
On 1/26/2012 11:26 AM, Scott Klement wrote:
CGI programs do not typically run under userid QTMHHTTP. They run under
QTMHHTP1 by default. (Though, my shop, and others I've worked with like
to change this to make the user sign-in and access files under their own
authority.)
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
http://archive.midrange.com/web400.
NOTICE: The information in this electronic mail transmission is intended by CoralTree Systems Ltd for the use of the named individuals or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone, so that the sender's address records can be corrected.
--------------------------------------------------------------------------------
CoralTree Systems Limited
25 Barnes Wallis Road
Segensworth East, Fareham
PO15 5TT
Company Registration Number 5021022.
Registered Office:
12-14 Carlton Place
Southampton, UK
SO15 2EA
VAT Registration Number 834 1020 74.
midrange.com
