Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is somewhat of a multipart question.

First and foremost, I have 502 bad gateway, but I'm sure that's just because one of these lines I have below is wrong.

Second, I would love to know how I did 'security wise'. I understand that many guides out there give terrible advice. I have tried to intelligently assemble all the knowledge from all of them, but I am very new so I could have missed something. Security is really important to me so I would love a quick and dirty 'audit' if you feel like it :)

For my topology I am using EC2 with a VPC. Amazon Linux AMI. I have an elastic load balancer which links to 2 nginx servers. these servers are linked to a separate php-fpm server.

1 nginx server is disabled while i debug this.

Here is the error I'm getting. I find this odd because I'm not actually using 10.0.0.94 anywhere (to my knowledge). I'm using *.210 and *.248.

2013/03/27 14:33:10 [error] 2724#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 10.0.0.94, server: www.example.com, request: "GET /index.php HTTP/1.1", upstream: "fastcgi://10.0.0.210:9001", host: "xxx.us-east-1.elb.amazonaws.com"

edit: one thing i forgot to mention. I think that because php-fpm is a separate server, I read that i must have the same files on it as the nginx servers. I dont have rsync or anything setup yet... i just uploaded a simple index.php file to both in /var/www/html/example.com/index.php as a test.

Server 1 & 2 (nginx)

nginx.conf

# Run as a less privileged user for security reasons.
user  www www;

worker_processes  auto;

events {
    worker_connections  1024;
}

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

http {

    server_tokens  off;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    # How long to allow each connection to stay idle; longer values are better
    # for each individual client, particularly for SSL, but means that worker
    # connections are tied up longer. (Default: 65)
    keepalive_timeout  65;

    # Speed up file transfers by using sendfile() to copy directly
    # between descriptors rather than using read()/write().
    sendfile        on;

    # Tell Nginx not to send out partial frames; this increases throughput
    # since TCP frames are filled up before being sent out. (adds TCP_CORK)
    tcp_nopush      on;

    # Tell Nginx to enable the Nagle buffering algorithm for TCP packets, which
    # collates several smaller packets together into one larger packet, thus saving
    # bandwidth at the cost of a nearly imperceptible increase to latency. (removes TCP_NODELAY)
    tcp_nodelay     off; 

    gzip          on;
    gzip_http_version 1.0;
    gzip_disable      "msie6";
    gzip_comp_level   5;
    gzip_min_length   256;
    gzip_proxied      any;
    gzip_vary         on;
    gzip_types
      # text/html is always compressed by HttpGzipModule
      text/css
      text/plain
      text/x-component
      application/javascript
      application/json
      application/xml
      application/xhtml+xml
      application/x-font-ttf
      application/x-font-opentype
      application/vnd.ms-fontobject
      image/svg+xml
      image/x-icon;

    # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols.
    # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support.
    ssl_protocols              SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
    # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
    # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
    # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
    ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
    ssl_session_timeout  10m;

    # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
    # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
    # ssl_certificate      /etc/nginx/default_ssl.crt;
    # ssl_certificate_key  /etc/nginx/default_ssl.key;

    upstream php {
        # ip_hash;
        server  10.0.0.210:9001;
    }

    include sites-enabled/*;
}

sites-enabled/example.com

server {
    listen       80;
    server_name  www.example.com;
    root         /var/www/html/example.com;

    index  index.html index.htm index.php;
    charset utf-8;

    error_page 404 /system/404.html;
    error_page 403 /system/404.html;

    location ~ \.php$ {
        fastcgi_index  index.php;
        fastcgi_pass   php;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        # fastcgi_intercept_errors on;
    }

    include conf/base.conf;
}

server {
    listen      80;
    server_name example.com;
    return 301  $scheme://www.example.com$request_uri;
}

Server 3 (php-fpm)

php.ini

cgi.fix_pathinfo = 0

php-fpm.conf

;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
;;;;;;;;;;;;;;;;;;;;;


include=/etc/php-fpm.d/*.conf

;;;;;;;;;;;;;;;;;;
; Global Options ;
;;;;;;;;;;;;;;;;;;

[global]
pid = /var/run/php-fpm/php-fpm.pid

error_log = /var/log/php-fpm/error.log

emergency_restart_threshold = 5

emergency_restart_interval = 2

/etc/php-fpm.d/www.conf

[www]

listen = 127.0.0.1:9001

listen.allowed_clients = 10.0.0.248

user = www
group = www

pm = dynamic
pm.max_children = 50
pm.start_servers = 15
pm.min_spare_servers = 5
pm.max_spare_servers = 25

request_terminate_timeout = 30
slowlog = /var/log/php-fpm/www-slow.log
security.limit_extensions = .php

php_flag[display_errors] = off
php_admin_value[error_reporting] = 0
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 128M

php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

Thats about all i've got so far :| Slowly making progress... thanks!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

So here's your problem, in /etc/php-fpm.d/www.conf:

listen = 127.0.0.1:9001

You are only listening to the loopback address, so it can't receive connections from other servers in your VPC.

Try instead:

listen = 9001

As for a 'security audit', there really isn't enough info here to give you anything meaningful. Just double check your security group.

share|improve this answer
    
It works!! Dude! Awesome! –  Tallboy Mar 27 '13 at 15:33
    
Well I meant.. moreso does it look like I'm protected against the obvious vulnerabilities (like the zero day exploits and so on) –  Tallboy Mar 27 '13 at 15:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.