🎯 Mission Briefing: 403 Forbidden

Marko uploaded a new photo gallery to /var/www/gallery and set up http://gallery.local in nginx. Every visitor gets 403 Forbidden, "but the files are definitely there". His note is in ~/gallery-note.txt.

Why 403?

nginx doesn't read the files as you, or as root. Its worker processes run as the user www-data: a file www-data can't read is 403 Forbidden, and so is a folder it can't enter. Files copied with rsync -a or scp -p keep the permissions they had on the computer they came from.

Investigation toolkit

curl -I http://gallery.local              # The answer, without the page
sudo tail /var/log/nginx/error.log        # nginx says which file, and why
ls -l /var/www/gallery                    # Who owns the files? Who may read them?
ls -ld /var/www/gallery/photos            # The folder itself (-d)
ps aux | grep nginx                       # Which user the workers run as

Fix and verify

sudo chmod 644 FILE      # rw-r--r--: everyone may read, only the owner may write
sudo chmod 755 FOLDER    # rwxr-xr-x: everyone may enter and list it
curl -I http://gallery.local

💡 Don't reach for chmod 777. It "works", but then anyone on the server can change the website. Readable is enough: 644 for files, 755 for folders.

💡 chmod -R 755 on a whole site makes every file executable too. chmod -R a+rX adds read for everyone, and x only where it belongs: on folders.