Serving webpages using symlinks

Yes, you do need to make sure that the pictures are readable by others, and you'll want FollowSymLinks on the Options line of your <Directory> entry.

 

Hmph. Do you also have FollowSymLinks enabled on your DocumentRoot directory?

 

Okay, it just dawned on me that this is the problem:

That doesn't create a symlink, it creates an alias file. Just to add to the confusion, if you create a symlink in Terminal, it looks just like an alias in the Finder.

Trash that alias, and instead create it from Terminal:

Code:

cd  /Library/WebServer/Documents
ln -s /path/to/the/real/mypics mypics

 

That's good, it means we are getting closer.

The next thing to do is start up Console in your Utilities folder, and drill down in the drawer to the /var/log section, then httpd, and look at error_log.

Scroll down to the bottom and check out the messages. See if there is an error like:

If that is the message, that means that one of the directories in the path to your (real) pictures folder needs read+execute permissions for "others" added (I think Apache may be happy with just execute).

----

On a related note, that <Directory> entry that you added -- the path is that of the symlink you created, right?

 

Okay, let's say for example that your pictures are located at /Users/imeowbot/stuff/Pictures

In Terminal, cd /Users/imeowbot/stuff and then ls -ld Pictures

You may see something like:

Code:

drwx------   imeowbot imeowbot 72   2448 Aug 30 06:21 Pictures

That --- and the end of the left column will interfere with Apache, fix it with chmod o+x Pictures so that the ls command returns:

Code:

drwx-----x   imeowbot imeowbot 72   2448 Aug 30 06:21 Pictures

Then step up the tree with cd .. and use the same ls command on the stuff directory, checking again for that x, and again using chmod to open it up if needed.

You can try reloading the page in your browser at each step to see if the error is cleared.

As you can guess, this will let any other users on your Mac see the contents of those folders. Apache is one of those other users who needs to see.

 

The Apache that comes with OS X client is really pretty secure out of the box, the add-on modules that usually get exploited (PHP and so on) aren't enabled unless you go in and add them by hand.

Just in case, it's a good idea to assume that the whole world can look your whole filesystem. Make sure that any files and directories you don't want the whole world to see are not world readable (and especially not writable by the world or the www user). Really, Apache does a good job of restricting access, this is only to defend against undiscovered bugs.

As we saw here, it usually takes some effort to let Apache serve files outside its own folder.

 

It's up to you. The options will be inherited unless you want different ones for that particular directory.