0

Recently I discovered my server is outputting php code out. The cause is that nginx is working but the php-fpm is not. As you can imagine this can be a serious security threat.

So is there a way to prevent nginx to serve php files unless it is receiving response from the php engine? I think it is some simple tweak in nginx.conf but I haven't sort that out yet.Hope someone can help!

server {
listen       80;
server_name example.com;


location / {
    root   /usr/share/nginx/html;
    index index.php  index.html index.htm;
}

error_page  404              /404.html;
location = /404.html {
    root   /usr/share/nginx/html;
}

error_page   500 502 503 504  /50x.html;
location = /50x.html {
    root   /usr/share/nginx/html;
}

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
    root           /usr/share/nginx/html;
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
    include        fastcgi_params;
}

}

5
  • This doesn't make sense to me. fastcgi_pass shouldn't fallback to serving the PHP as a static file like that.
    – ceejayoz
    Mar 27, 2013 at 17:42
  • I think the problem is not fastcgi serving the static file, rather nginx fetches the static file itself.
    – StCee
    Mar 27, 2013 at 17:50
  • What is causing PHP-FPM to fail? What is in the logs? It should really die on you out of the blue Mar 27, 2013 at 18:33
  • Hi in this case I perhaps did some upgrading job to cause pph-fpm to stop. But I am concerned if there is such a way to prevent bad security flaw as mentioned.
    – StCee
    Mar 27, 2013 at 18:40
  • Did you not UAT your system after an upgrade? Mar 27, 2013 at 18:44

1 Answer 1

-3

Your could write a cron job to verify php-fpm service is running and if it is not, swap out nginx .conf files and restart nginx.

12
  • Which'd leave you with source code exposed for up to a minute until cron runs, and a broken server after the "fix".
    – ceejayoz
    Mar 27, 2013 at 17:41
  • True, you could always add a call in your HTML to verify the service is up and conditionality pass PHP or HTML on the fly. -- The real question is why does PHP-FPM fail? I wouldnt even have the site up if you cannot rely on it to work properly. Mar 27, 2013 at 18:32
  • "A call in your HTML"? What?!
    – ceejayoz
    Mar 27, 2013 at 18:35
  • Well you can have javascript or call and check for a process running on your server. Or have a call to Java or along the lines of that. Not straight HTML, but in your webpage, have a system call to verify the service it up and running. Mar 27, 2013 at 18:43
  • You're really not making any sense. If JavaScript's able to check PHP-FPM's status, you've got a badly insecure config going. HTML can't "have a call to Java"... and given that the HTML is usually generated by PHP, it wouldn't work regardless.
    – ceejayoz
    Mar 27, 2013 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .