sometimes, the index file or autoindex was overridden by .htaccess somewhere. try switching back Apache temporarily, if apache is the same, it is a configuration problem, if not, it is a compatibility issue, we will look into it.
http://www.litespeedtech.com/support/wiki/doku.php?id=litespeed_wiki:apache:other_cp
you also need to build a matching php used by apache setup
http://www.litespeedtech.com/support/wiki/doku.php#php
a third party guide for kloxo (former Lxadmin)...
What you did should work with vhost configured in native config, if apache vhost is used, need to configure it in apache configuration.
You can check error log, and enable debug logging see if you can figure something out.
make sure you have tested the customer error page URL directly and it works.
Can you do the same file upload with LSWS "DEBUG" logging enabled, with 4.0.20 and 4.1.6, then send the log file to bug@litespeed...
Or, if you prefer, you can send us a temp root password, we can login and trouble shoot for you.
"LSWS Request Filter" is the equivalent to "Apache mod_security".
vhost from Apache conf use rules from apache conf, LSWS native vhosts only use rules from LSWS native "Request Filter" configuration, but the backend engine is the same.
those request variables are not supported, related rule will be ignored.
LSWS does not produce REQBODY related error, and does not check against response header/body.
You can locate and comment out that rule, or use
SecRuleRemoveById xxxxx
to exclude that rule for that URL.
Maybe you enabled Request Body scan by default, which may cause trouble with gotroot rules.
For those 403 error, LSWS should log something about it. maybe you can turn on debug logging and try again. make sure debug level is "HIGH", log level is at "DEBUG".
Please try the latest 4.1.5 package, see if it is fixed.
If not, we may need to setup a test Rails application to reproduce the bug in our lab. If you have a simple Rails app can be used to reproduce it, please send to us.
4.1.5 package has been updated to disable the new security feature, default for "Script Restricted Permission Mask" and "Script Restricted Directory Permission Mask" has been changed to "000".
You need to manually enable it if you want it.
Please check if PHP suEXEC is function properly or not.
write test PHP script to run "id" command, see if php processes is running as correct user ID.
I assume you are using PHP suEXEC, each web site uses its own lsphp5 running as the user id of the owner of the site.
So, you have configured vhosts in native configuration?
It should be /usr/local/lsws/logs/error.log, maybe you should enable full debug logging for a while, and search for log entries with your IP address.
I wonder if it is a 403 error from LiteSpeed or from somewhere else.