403 status no nginx no FreeBSD

Question

Estou tentando mudar de uma solução de hospedagem Apache para o nginx com php-fpm no FreeBSD 9.2.

Estou reescrevendo meu script para criar vHosts e material para o nginx agora e obter 403 status quando tento acessar o vHost.

Estou lutando há horas e não consigo identificar, quais permissões definir. Você tem alguma ideia?

Aqui está o meu createvhost.sh:

#!/usr/local/bin/bash

DOMAIN="example.com"
PHP_USER="chris_www"
PHP_GROUP="$PHP_USER"

NGINX_USER="www"
NGINX_GROUP="$NGINX_USER"
ADMIN_EMAIL="[email protected]"

NGINX_CONF_FOLER="/usr/local/etc/nginx"
PHP_FPM_CONF_FOLDER="/usr/local/etc/php-fpm.d"

WEBROOT="/www/vhosts"

IP="10.0.0.4"

VHOST_PORT=9000
source $WEBROOT/config/vhost_port.conf


## Create user and add it to $NGINX_GROUP
echo "Creating user and adding it to group $NGINX_GROUP"
pw user add $PHP_USER -s /sbin/nologin
pw group mod $PHP_GROUP -m $NGINX_GROUP

echo "Creating neccessary folders"
mkdir -p $WEBROOT/$DOMAIN/{conf,www,log,tmp,certs,sessions}

chown root:$PHP_USER $WEBROOT/$DOMAIN
chmod 750 $WEBROOT/$DOMAIN
chown $PHP_USER:$PHP_USER $WEBROOT/$DOMAIN/*
chown -R $PHP_USER:$PHP_USER $WEBROOT/$DOMAIN/www/*
chmod 755 $WEBROOT/$DOMAIN/*
chmod 550 $WEBROOT/$DOMAIN/conf

## Create template for ssl cert creation
cat > $WEBROOT/$DOMAIN/conf/ssleay.cnf  $NGINX_CONF_FOLER/sites-avaliable/$DOMAIN.conf  $PHP_FPM_CONF_FOLDER/$DOMAIN.conf  $WEBROOT/config/vhost_port.conf

echo "Restarting nginx"
/usr/local/etc/rc.d/nginx restart

echo "Restarting php-fpm"
/usr/local/etc/rc.d/php-fpm restart

echo "Finished." 

Aqui está o meu nginx.conf:

user www www;
worker_processes 8;
pid /var/run/nginx.pid;
worker_rlimit_nofile    8192;

events {
   use   kqueue;
   worker_connections   8192;
}

http {
    #set_real_ip_from xxx.xxx.xxx.xxx;
    real_ip_header 'X-Forwarded-For';

    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] $status "$request" $body_bytes_sent "$http_referer" "$http_user_agent"
"$http_x_forwarded_for"';
    access_log off;
    error_log /var/log/nginx-error.log crit;

    # MIME-Types
    include mime.types;
    default_type application/octet-stream;

# Allgemeines
    index index.php index.htm;
    server_tokens on;
    client_header_timeout 5;
    client_body_timeout 10;
    client_max_body_size 16m;
    ignore_invalid_headers on;
    send_timeout 10;

    # Performance-Tuning
    sendfile on;
    server_names_hash_bucket_size 128;
    tcp_nodelay on;
    tcp_nopush   on;
    aio   sendfile;
    keepalive_timeout   5;

 # DDoS-Bekämpfung
    limit_req_zone $binary_remote_addr zone=antiddos:10m rate=1r/s;

    # GZIP
    gzip on;
    gzip_min_length 1000;
    gzip_vary on;
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_proxied any;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/x-javascript text/xml application/xml text/javascript; gzip_disable "MSIE [1-6]\.";

    # SSL
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!MEDIUM:!LOW:!EXP:RC41RSA:1HIGH:!kEDH;

  # vHost-Konfigurationen
    include /usr/local/etc/nginx/sites-enabled/*.conf;

  # Leerer vHost (Default)
  server {
    server_name   _;
    listen   80   default;
    access_log   off;
    error_log        off;
        root /www/vhosts/defaulthost/www;

    # Error-Pages
    #include    error_pages.conf;

    location / {
      index   index.htm;
      rewrite ^   index.htm;
        }
    limit_req zone=antiddos burst=5 nodelay;
    }
}

E aqui está a saída de ls -ARl / www /

ls -ARl /www/
total 2
drwxr-xr-x  5 www  www  5 20 Dez 00:48 vhosts

/www/vhosts:
total 5
drwxr-xr-x  2 root       wheel      3 20 Dez 00:10 config
drwxr-x---  8 root       www        8 20 Dez 00:48 defaulthost
drwxr-x---  8 chris_www  chris_www  8 20 Dez 00:09 example.com

/www/vhosts/config:
total 1
-rw-r--r--  1 root  wheel  16 20 Dez 00:10 vhost_port.conf

/www/vhosts/defaulthost:
total 9
drwxr-x---  2 root  www  2 20 Dez 00:50 certs
drwxr-x---  2 root  www  2 20 Dez 00:48 conf
drwxr-x---  2 root  www  2 20 Dez 00:50 log
drwxr-x---  2 root  www  2 20 Dez 00:48 sessions
drwxr-x---  2 root  www  2 20 Dez 00:48 tmp
drwxr-x---  2 root  www  3 20 Dez 00:48 www

/www/vhosts/defaulthost/certs:
total 0

/www/vhosts/defaulthost/conf:
total 0

/www/vhosts/defaulthost/log:
total 0

/www/vhosts/defaulthost/sessions:
total 0

/www/vhosts/defaulthost/tmp:
total 0

/www/vhosts/defaulthost/www:
total 1
-rwxr-x---  1 root  www  24 20 Dez 00:48 index.htm

/www/vhosts/example.com:
total 9
drwxr-x---  2 chris_www  chris_www  5 20 Dez 00:10 certs
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 conf
drwxr-x---  2 chris_www  chris_www  5 20 Dez 00:10 log
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 sessions
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 tmp
drwxr-x---  2 chris_www  chris_www  3 20 Dez 00:42 www

/www/vhosts/example.com/certs:
total 5
-rwxr-x---  1 chris_www  chris_www  757 20 Dez 00:10 example.com.crt
-rwxr-x---  1 chris_www  chris_www  603 20 Dez 00:10 example.com.csr
-rwxr-x---  1 chris_www  chris_www  887 20 Dez 00:10 example.com.key

/www/vhosts/example.com/conf:
total 0

/www/vhosts/example.com/log:
total 65
-rwxr-x---  1 chris_www  chris_www  23432 20 Dez 01:11 nginx.access.log
-rwxr-x---  1 chris_www  chris_www  40968 20 Dez 01:11 nginx.error.log
-rwxr-x---  1 chris_www  chris_www      0 20 Dez 00:10 php-fpmslow.log

/www/vhosts/example.com/sessions:
total 0

/www/vhosts/example.com/tmp:
total 0

/www/vhosts/example.com/www:
total 1
-rwxr-x---  1 chris_www  chris_www  24 20 Dez 00:34 index.htm

    

Answer 1

Isto:

user www www;
worker_processes 8;

E isso:

/www/vhosts:
total 5
drwxr-xr-x  2 root       wheel      3 20 Dez 00:10 config
drwxr-x---  8 root       www        8 20 Dez 00:48 defaulthost
drwxr-x---  8 chris_www  chris_www  8 20 Dez 00:09 example.com

Sem mais, presumo que sua intenção seja ter nginx serve example.com de /www/vhosts/example.com .

Mas como é possível fazê-lo, sem ter permissão para ler / executar?

Você precisa garantir que o usuário e / ou o grupo www tenham acesso a todos os diretórios que levam ao conteúdo que eles devem veicular.

    

Answer 2

Se você não quisesse adicionar o usuário www ao grupo chris_www, e presumindo que você também não quisesse adicionar o sinalizador + x ao example.com, você poderia considerar o uso do suporte ao Access Control List (ACL) do FreeBSD. para o UFS. Eu fiz um pequeno artigo sobre isso recentemente: link