Sympa Webinterface: Index missing (403 Forbidden)

[AZ-ROVE]

Dear community

I am struggling with getting the sympa web service into production and hopefully someone can help me on this.
While accessing the web interface I get a 403 Forbidden and the following error in the logs:

[autoindex:error] AH01276: Cannot serve directory /usr/share/sympa/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive

My Environment:
Debian GNU/Linux 12 (bookworm)
sympa 6.2.70~dfsg-2 and apache 2.4.57-2 (both installed with apt)

When I enable "Options Indexes" on the .conf, I can see the content of /usr/share/sympa/ on the webinterface.

The error clearly states a missing index and I didn't find out which file it should be. I have a feeling, that my /usr/share/sympa/ is uncomplete:

$ ls -ls /usr/share/sympa/
total 16
4 drwxr-xr-x 2 root root 4096 Nov  6 09:06 bin
4 drwxr-xr-x 7 root root 4096 Nov  6 09:06 default
4 drwxr-xr-x 3 root root 4096 Nov  6 09:06 lib
4 drwxr-xr-x 5 root root 4096 Nov  6 09:06 static_content

With the help of the sympa.community documantation I used...

• a single domain setting
• systemd socket (already configured by apt package; did some troubleshooting with changing SocketUser to apache; without success)
• apache2 webserver

The services and sockets (apache2, sympa, wwsympa) are all running active without errors.

Below you find the most important config files. Please note, that I..

• changed the wwysmpa_url to the plain FQDN without /sympa suffix (and accordingly on the webserver-configuration)
• anonymised the URL's to abc.com or .local

/etc/sympa/sympa/sympa.conf

###\\\\ Service description ////###

## domain
## Primary mail domain name
## Example: domain      mail.example.org
domain abc.com

## listmaster
## Email addresses of listmasters
## Email addresses of the listmasters (users authorized to perform global
## server commands). Some error reports may also be sent to these addresses.
## Listmasters can be defined for each virtual host, however, the default
## listmasters will have privileges to manage all virtual hosts.
## Example: listmaster  [email protected]
listmaster      [email protected]

###\\\\ Database related ////###

## db_type
## Type of the database
## Possible types are "MySQL", "PostgreSQL", "Oracle" and "SQLite".
db_type SQLite

## db_name
## Name of the database
## With SQLite, this must be the full path to database file.
## With Oracle Database, this must be SID, net service name or easy connection
## identifier (to use net service name, db_host should be set to "none" and
## HOST, PORT and SERVICE_NAME should be defined in tnsnames.ora file).
db_name /var/lib/dbconfig-common/sqlite3/sympa/sympa

###\\\\ List definition ////###

## lang
## Language of the list
## This parameter defines the language used for the list. It is used to
## initialize a user's language preference; Sympa command reports are
## extracted from the associated message catalog.
lang    de

###\\\\ Web interface parameters ////###

## wwsympa_url
## URL prefix of web interface
## This is used to construct URLs of web interface. The protocol (either
## https:// or http://) is required.
## Example: wwsympa_url https://web.example.org/sympa
wwsympa_url     http://VM1234.abc.local

## static_content_path
## Directory for static contents
static_content_path     /usr/share/sympa/static_content

## css_path
## Directory for static style sheets (CSS)
## After an upgrade, static CSS files are upgraded with the newly installed
## "css.tt2" template. Therefore, this is not a good place to store customized
## CSS files.
css_path        /var/lib/sympa/css

## css_url
## URL for style sheets (CSS)
## To use auto-generated static CSS, HTTP server have to map it with
## "css_path".
css_url /css-sympa

## pictures_path
## Directory for subscribers pictures
pictures_path   /var/lib/sympa/pictures

## pictures_url
## URL for subscribers pictures
## HTTP server have to map it with "pictures_path" directory.
pictures_url    /pictures-sympa

/etc/apache2/sites-enabled/VM1234.abc.local.conf

<VirtualHost *:80>
        ServerName      VM1234.abc.local
        DocumentRoot    /usr/share/sympa
        ErrorLog        /var/log/apache2/VM1234.abc.local.log
        include         /etc/apache2/conf-available/sympa.conf
</VirtualHost>

/etc/apache2/conf-enabled/sympa.conf

#
# Apache >> 2.4 configuration for Sympa
#

LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
LoadModule proxy_fcgi_module /usr/lib/apache2/modules/mod_proxy_fcgi.so

<IfModule mod_proxy_fcgi.c>
    Alias /static-sympa /usr/share/sympa/static_content
    <Directory /usr/share/sympa/static_content>
        Require all granted
    </Directory>

    Alias /css-sympa /var/lib/sympa/css
    <Directory /var/lib/sympa/css>
        Require all granted
    </Directory>

    Alias /pictures-sympa /var/lib/sympa/pictures
    <Directory /var/lib/sympa/pictures>
        Require all granted
    </Directory>

#    <Location /wws>
    <Location "^/(?!.*-sympa)">
#    <Location />
       SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://"
       Require all granted
    </Location>
</IfModule>

/etc/apache2/apache2.conf

# Global configuration
#

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# NOTE!  If you intend to place this on an NFS (or otherwise network)
# mounted filesystem then please read the Mutex documentation (available
# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
# you will save yourself a lot of trouble.
#
# Do NOT add a slash at the end of the directory path.
#
#ServerRoot "/etc/apache2"

#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
#Mutex file:${APACHE_LOCK_DIR} default

#
# The directory where shm and other runtime files will be stored.
#

DefaultRuntimeDir ${APACHE_RUN_DIR}

#
# PidFile: The file in which the server should record its process
# identification number when it starts.
# This needs to be set in /etc/apache2/envvars
#
PidFile ${APACHE_PID_FILE}

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 5


# These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

#
# HostnameLookups: Log the names of clients or just their IP addresses
# e.g., www.apache.org (on) or 204.62.129.132 (off).
# The default is off because it'd be overall better for the net if people
# had to knowingly turn this feature on, since enabling it means that
# each client request will result in AT LEAST one lookup request to the
# nameserver.
#
HostnameLookups Off

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog ${APACHE_LOG_DIR}/error.log

#
# LogLevel: Control the severity of messages logged to the error_log.
# Available values: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the log level for particular modules, e.g.
# "LogLevel info ssl:warn"
#
LogLevel warn

# Include module configuration:
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

# Include list of ports to listen on
Include ports.conf


# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
#<Directory />
#       Options FollowSymLinks
#       AllowOverride None
#       Require all denied
#</Directory>

#<Directory /usr/share>
#       Options FollowSymLinks
#       Options Indexes
#       AllowOverride None
#       Require all granted
#</Directory>

#<Directory /var/www/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>

#<Directory /srv/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>




# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>


#
# The following directives define some format nicknames for use with
# a CustomLog directive.
#
# These deviate from the Common Log Format definitions in that they use %O
# (the actual bytes sent including headers) instead of %b (the size of the
# requested file), because the latter makes it impossible to detect partial
# requests.
#
# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
# Use mod_remoteip instead.
#
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# Include of directories ignores editors' and dpkg's backup files,
# see README.Debian for details.

# Include generic snippets of statements
IncludeOptional conf-enabled/*.conf

# Include the virtual host configurations:
IncludeOptional sites-enabled/*.conf

/lib/systemd/system/wwsympa.socket

[Unit]
Description=Sympa Web Interface Socket

[Socket]
SocketUser=www-data
SocketGroup=www-data
SocketMode=0660

ListenStream=/run/sympa/wwsympa.socket

[Install]
WantedBy=sockets.target

/lib/systemd/system/wwsympa.service

[Unit]
Description=Sympa Web Interface FastCGI backend
After=sympa.service
Requires=wwsympa.socket
Documentation=man:wwsympa(8)

[Service]
User=sympa
Group=sympa
ExecStart=/usr/bin/multiwatch -f $WWS_FCGI_CHILDREN \
          -- /usr/lib/cgi-bin/sympa/wwsympa.fcgi
StandardOutput=null
StandardInput=socket
StandardError=null

Environment="WWS_FCGI_CHILDREN=5"
EnvironmentFile=-/etc/default/sympa

Restart=on-failure
RestartSec=15

PrivateTmp=true

[Install]
Also=wwsympa.socket
WantedBy=multi-user.target

[ikedas]

/etc/apache2/sites-enabled/VM1234.abc.local.conf

<VirtualHost *:80>
        ServerName      VM1234.abc.local
        DocumentRoot    /usr/share/sympa
        ErrorLog        /var/log/apache2/VM1234.abc.local.log
        include         /etc/apache2/conf-available/sympa.conf
</VirtualHost>

Not everything under /usr/share/sympa should be accessible from the Internet. If you want to set up DocumentRoot, use a directory that has nothing to do with Sympa at all.

On Debian, running a2ensite 000-default (or a2ensite default-ssl for HTTPS site) will set DocumentRoot to /var/www/html. The additional file sites-enabled/VM1234.abc.local.conf is not necessarily needed. (Incidentally, the intended operation on Debian is to run a2enconf sympa instead of including conf-available/sympa.conf into the other file.)

[AZ-ROVE]

Thanks @ikedas for your answer!

I don't necessarily want a DocumentRoot, but thought it was necessary. But if I understand correctly now, it is not necessarily needed, because the wwsympa FastCGI service takes care of everything.

If I now leave the apache2 configuration on default with the debian default page of /var/www/html/index.html and activate the default sympa.conf with a2enconf sympa, I should be able to call the webinterface under the suffix /wws, right? This is the default definition of wwsympa_url in /etc/sympa/sympa/sympa.conf and /etc/apache2/conf-available/sympa.conf.

I have now tested this by calling http://hostname/wws and get a 404 Not Found without any logs under /var/log/apache2/error.log

[AZ-ROVE]

Sorry, the modules were not loaded - now it works!

Many thanks !!