0

This is somewhat of a multipart question.

First and foremost, I have 502 bad gateway, but I'm sure that's just because one of these lines I have below is wrong.

Second, I would love to know how I did 'security wise'. I understand that many guides out there give terrible advice. I have tried to intelligently assemble all the knowledge from all of them, but I am very new so I could have missed something. Security is really important to me so I would love a quick and dirty 'audit' if you feel like it :)

For my topology I am using EC2 with a VPC. Amazon Linux AMI. I have an elastic load balancer which links to 2 nginx servers. these servers are linked to a separate php-fpm server.

1 nginx server is disabled while i debug this.

Here is the error I'm getting. I find this odd because I'm not actually using 10.0.0.94 anywhere (to my knowledge). I'm using *.210 and *.248.

2013/03/27 14:33:10 [error] 2724#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 10.0.0.94, server: www.example.com, request: "GET /index.php HTTP/1.1", upstream: "fastcgi://10.0.0.210:9001", host: "xxx.us-east-1.elb.amazonaws.com"

edit: one thing i forgot to mention. I think that because php-fpm is a separate server, I read that i must have the same files on it as the nginx servers. I dont have rsync or anything setup yet... i just uploaded a simple index.php file to both in /var/www/html/example.com/index.php as a test.

Server 1 & 2 (nginx)

nginx.conf

# Run as a less privileged user for security reasons.
user  www www;

worker_processes  auto;

events {
    worker_connections  1024;
}

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

http {

    server_tokens  off;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    # How long to allow each connection to stay idle; longer values are better
    # for each individual client, particularly for SSL, but means that worker
    # connections are tied up longer. (Default: 65)
    keepalive_timeout  65;

    # Speed up file transfers by using sendfile() to copy directly
    # between descriptors rather than using read()/write().
    sendfile        on;

    # Tell Nginx not to send out partial frames; this increases throughput
    # since TCP frames are filled up before being sent out. (adds TCP_CORK)
    tcp_nopush      on;

    # Tell Nginx to enable the Nagle buffering algorithm for TCP packets, which
    # collates several smaller packets together into one larger packet, thus saving
    # bandwidth at the cost of a nearly imperceptible increase to latency. (removes TCP_NODELAY)
    tcp_nodelay     off; 

    gzip          on;
    gzip_http_version 1.0;
    gzip_disable      "msie6";
    gzip_comp_level   5;
    gzip_min_length   256;
    gzip_proxied      any;
    gzip_vary         on;
    gzip_types
      # text/html is always compressed by HttpGzipModule
      text/css
      text/plain
      text/x-component
      application/javascript
      application/json
      application/xml
      application/xhtml+xml
      application/x-font-ttf
      application/x-font-opentype
      application/vnd.ms-fontobject
      image/svg+xml
      image/x-icon;

    # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols.
    # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support.
    ssl_protocols              SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
    # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
    # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
    # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
    ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
    ssl_session_timeout  10m;

    # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
    # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
    # ssl_certificate      /etc/nginx/default_ssl.crt;
    # ssl_certificate_key  /etc/nginx/default_ssl.key;

    upstream php {
        # ip_hash;
        server  10.0.0.210:9001;
    }

    include sites-enabled/*;
}

sites-enabled/example.com

server {
    listen       80;
    server_name  www.example.com;
    root         /var/www/html/example.com;

    index  index.html index.htm index.php;
    charset utf-8;

    error_page 404 /system/404.html;
    error_page 403 /system/404.html;

    location ~ \.php$ {
        fastcgi_index  index.php;
        fastcgi_pass   php;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        # fastcgi_intercept_errors on;
    }

    include conf/base.conf;
}

server {
    listen      80;
    server_name example.com;
    return 301  $scheme://www.example.com$request_uri;
}

Server 3 (php-fpm)

php.ini

cgi.fix_pathinfo = 0

php-fpm.conf

;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
;;;;;;;;;;;;;;;;;;;;;


include=/etc/php-fpm.d/*.conf

;;;;;;;;;;;;;;;;;;
; Global Options ;
;;;;;;;;;;;;;;;;;;

[global]
pid = /var/run/php-fpm/php-fpm.pid

error_log = /var/log/php-fpm/error.log

emergency_restart_threshold = 5

emergency_restart_interval = 2

/etc/php-fpm.d/www.conf

[www]

listen = 127.0.0.1:9001

listen.allowed_clients = 10.0.0.248

user = www
group = www

pm = dynamic
pm.max_children = 50
pm.start_servers = 15
pm.min_spare_servers = 5
pm.max_spare_servers = 25

request_terminate_timeout = 30
slowlog = /var/log/php-fpm/www-slow.log
security.limit_extensions = .php

php_flag[display_errors] = off
php_admin_value[error_reporting] = 0
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 128M

php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

Thats about all i've got so far :| Slowly making progress... thanks!

1 Answer 1

1

So here's your problem, in /etc/php-fpm.d/www.conf:

listen = 127.0.0.1:9001

You are only listening to the loopback address, so it can't receive connections from other servers in your VPC.

Try instead:

listen = 9001

As for a 'security audit', there really isn't enough info here to give you anything meaningful. Just double check your security group.

2
  • It works!! Dude! Awesome!
    – Tallboy
    Mar 27, 2013 at 15:33
  • Well I meant.. moreso does it look like I'm protected against the obvious vulnerabilities (like the zero day exploits and so on)
    – Tallboy
    Mar 27, 2013 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .