Apache, php on Win2k3 Server

[StrangerInBeijing]

I just installed Apache, Php5, MySQL on our new server running Win2K3 Server (no choice.....got another system coming from partner that require windows)

All works fine, and if i put a "index.php" with phpinfo in the document_root folder it show the php info page.

However,if I rename index.php to say abc.php, or create a subdirectory and put index.php in there,Iget a "You are not authorized to view this page
You might not have permission to view this directory or page using the credentials you supplied. " error.

Obviously I need to set some permission on the server (I have full access),but i'm not sure what.

[dclamp]

right click on the folder > Properties > Web Sharing (Or similar) > Click "Share This Foler" > Edit Properties > Check "Read", "Directory browsing", Script source access"

[StrangerInBeijing]

What Windows user are you giving read/write permission to the server? That's where I'm stuck.

I know that IIS creates the IUSR account when it is installed but there is no such account for Apache on Windows without IIS.

I took another look in apache.org and found the following:

Permission denied

A Permission denied error in the error_log, accompanied by a Forbidden message to the client usually indicates a problem with your filesystem permissions, rather than a problem in the Apache HTTP Server configuration files. Check to make sure that the User and Group running the child processes has adequate permission to access the files in question. Also check that the directory and all parent directories are at least searchable for that user and group (i.e., chmod +x).

It sounds to me like Apache org is saying to use the Apache user for permissions to directories. Does this sound like that to you too?

I’m very careful not to go ahead and assign permissions to just any account on the server, for obvious reasons.

[penagate]

Apache is a service. The user account it runs under is configured from the Services management console. Ensure that that account has the appropriate permissions to access the file.

Also check your permissions rules in httpd.conf and any applicable .htaccess files.

[StrangerInBeijing]

Yep, that seems to be the problem.
Found the answer here on apache.org
Look under Running Apache as a Service (just saying for anyone that might run into this problem)

By default, all Apache services are registered to run as the system user (the LocalSystem account). The LocalSystem account has no privileges to your network via any Windows-secured mechanism, including the file system, named pipes, DCOM, or secure RPC. It has, however, wide privileges locally.
Never grant any network privileges to the LocalSystem account! If you need Apache to be able to access network resources, create a separate account for Apache as noted below.

You may want to create a separate account for running Apache service(s). Especially, if you have to access network resources via Apache, this is strongly recommended.

1. Create a normal domain user account, and be sure to memorize its password.
2. Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system. On Windows NT 4.0 these privileges are granted via User Manager for Domains, but on Windows 2000 and XP you probably want to use Group Policy for propagating these settings. You can also manually set these via the Local Security Policy MMC snap-in.
3. Confirm that the created account is a member of the Users group.
4. Grant the account read and execute (RX) rights to all document and script folders (htdocs and cgi-bin for example).
5. Grant the account change (RWXD) rights to the Apache logs directory.
6. Grant the account read and execute (RX) rights to the Apache.exe binary executable.

I contacted the host (actually I'm figuring this out for them. No experience with apache on win2k3), to create this account. I can RDC, but not a Win Server expert, and seems you have to add roles or whatever to be able to create user accounts.

Will update this once the jobs done with any additional things to note. Thanks for the input!

[penagate]

If you have the permission for it, you can create new user accounts through the Server Management console.

[StrangerInBeijing]

Seems I do.
But that management console just list "add roles"...
Seems I have to create a Domain Controller Role....
Naah...Scared I mess up. Will let the host people take care of it.
Hope to get it running today.
Dont want to split threads, but once all this is working, having phpAdmin and working with it from elsewhere (without actually using the console via RDC) wont be a big deal rigt?

[penagate]

phpMyAdmin can be a little awkward to set up initially, but yes, it's no big deal.
I prefer RDC or SSH, but that's just because I like a command line better than a web-based GUI.