Month: July 2008

  • Apache: DocumentRoot does not exist. Why SELinux?

    Once more SELinux has been playing up with the normal operations of a box. During the installation and set up of an Apache instance and a few virtual hosts I simply could not get around the dreaded error message:

    Starting httpd: Warning: DocumentRoot [/home/www/myhost] does not exist
    

    No matter which permissions and owners were given to the directories or files related the error still came up hindering the Apache httpd service to start. Obviously the path was correct, copied and pasted, to exclude any spelling issues.

    After experiencing similar conundrums in the past I had a slight suspicion regarding SELinux, which comes enabled by default on Fedora, may have been blocking access to the directory somehow.

    A bit of searching did confirm that SELinux indeed also intervened at this level blocking Apache’s normal operations. I fully understand and agree with the goal of SELinux, but it is simply too big a compromise between security and usability. As Theodore Tso pretty much summarises it:

    SELINUX is so horrible to use, that after wasting a large amount of time enabling it and then watching all of my applications die a horrible death since they didn’t have the appropriate hand-crafted security policy, caused me to swear off of it. For me, given my threat model and how much my time is worth, life is too short for SELinux.

    SELinux stays disabled again…

  • Thunderbird + Gmail = invalid username and password

    I have been using Gmail accounts inside Thunderbird for some time and every now and then I received those annonying error messages stating that the username or password was invalid. This was somehow a conundrum as the passwords were saved within the Thunderbird profile and had not changed.

    Looking up the issue today I came across both the problem, the trigger, and the solution. I realised that Gmail does not let you check for mailbox changes more often than every 10 minutes. Thunderbird was set to check for new mail every 6 minutes which seems to have triggered the account to be locked out. First when the Captcha had been passed the email account was again available via IMAP.