On Mon, 23 Nov 2009, Ken Irwin wrote:

> Hi Joe,
>
> That's really helpful, thanks.
> Actually finding out what the error message is nice:
>
> HTTP Error : 500 Can't connect to www.npr.org:80 (connect: Permission denied)
>
> I've tried this with a few websites and always get the same error, which 
> tells me that the problem is on my server side. Any idea what I can 
> change so I don't get a permission-denied rejection? I'm not even sure 
> what system I should be looking at.


I'm not even sure what could be causing the permission denied.
Normally, I get that response when the port's not open, or there's a 
firewall, and I can't think of a time when it'd work from the command 
line, but not from a CGI.

(well, okay, one, but it's a really odd case, that wouldn't happen for 
most people -- if you edit the web pages from a different machine than 
actually serves the pages, they might have the IP of the server blocked 
from being able to go outbound as a security privilege.  Most security 
folks wouldn't even think about this, but I used to work with a former 
Wittenberg IT person when I worked on Fark, and Mike came up with some 
*very* interesting solutions to things, and one of 'em was adding special 
IP pools so our ISP's customers were served special messages by being 
routed through an invisible proxy that'd serve alternate pages, such as 
informing them that they were late in paying their bills)

They could also be screwing with DNS, but I can think of a reason anyone 
would do it, and again it'd be per-machine, not per-user.

Anyway, try running this from both command line and via a CGI, and see if 
their output matches:

 	#!/bin/perl --
 	print "Content-type: text/plain\n\n";
 	print `uname -a`,"\n\n", `ifconfig -a`;
 	__END__

If you have to connecct using one name to make modifications, but a 
different name for the webserver, that could be a sign, as well.



> I tried Vishwam's suggestion of granting 777 permissions to both the 
> file and the directory and I get the same response.

Um ... you should _never_ need 777.  (occassionally 1777, but I can't 
think of a time when 0777 is a good idea.)

777 = executable, readable and writable by _everyone_.
755 = only writable to you.

(1777 has the 'sticky' bit set, which allows the /tmp directory to be 
written to, but you can't go deleting other people's files like you could 
if it were 0777).


> Is there some Apache setting someplace that says "hey, don't you go making web calls while I'm in charge"?
> (This is a Fedora server running Apache, btw).


It might be possible under suExec, but I'm not that familiar with it, as I 
used CGIwrap when I dealt with locking down multi-user systems.  (and to 
the best of my knowledge, it's not possible with CGIwrap).


...


And if all of this fails, you might want to consider asking on either:

 	http://stackoverflow.com/
 	http://serverfault.com/

(just ask on one; odds are, you'll ask on one, and they'll decide that 
it's more appropriate on the other one.)


-Joe