Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Recently I discovered my server is outputting php code out. The cause is that nginx is working but the php-fpm is not. As you can imagine this can be a serious security threat.

So is there a way to prevent nginx to serve php files unless it is receiving response from the php engine? I think it is some simple tweak in nginx.conf but I haven't sort that out yet.Hope someone can help!

server {
listen       80;
server_name example.com;


location / {
    root   /usr/share/nginx/html;
    index index.php  index.html index.htm;
}

error_page  404              /404.html;
location = /404.html {
    root   /usr/share/nginx/html;
}

error_page   500 502 503 504  /50x.html;
location = /50x.html {
    root   /usr/share/nginx/html;
}

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
    root           /usr/share/nginx/html;
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
    include        fastcgi_params;
}

}

share|improve this question
    
This doesn't make sense to me. fastcgi_pass shouldn't fallback to serving the PHP as a static file like that. –  ceejayoz Mar 27 '13 at 17:42
    
I think the problem is not fastcgi serving the static file, rather nginx fetches the static file itself. –  StCee Mar 27 '13 at 17:50
    
What is causing PHP-FPM to fail? What is in the logs? It should really die on you out of the blue –  ProfessionalAmateur Mar 27 '13 at 18:33
    
Hi in this case I perhaps did some upgrading job to cause pph-fpm to stop. But I am concerned if there is such a way to prevent bad security flaw as mentioned. –  StCee Mar 27 '13 at 18:40
    
Did you not UAT your system after an upgrade? –  ProfessionalAmateur Mar 27 '13 at 18:44

1 Answer 1

Your could write a cron job to verify php-fpm service is running and if it is not, swap out nginx .conf files and restart nginx.

share|improve this answer
    
Which'd leave you with source code exposed for up to a minute until cron runs, and a broken server after the "fix". –  ceejayoz Mar 27 '13 at 17:41
    
True, you could always add a call in your HTML to verify the service is up and conditionality pass PHP or HTML on the fly. -- The real question is why does PHP-FPM fail? I wouldnt even have the site up if you cannot rely on it to work properly. –  ProfessionalAmateur Mar 27 '13 at 18:32
    
"A call in your HTML"? What?! –  ceejayoz Mar 27 '13 at 18:35
    
Well you can have javascript or call and check for a process running on your server. Or have a call to Java or along the lines of that. Not straight HTML, but in your webpage, have a system call to verify the service it up and running. –  ProfessionalAmateur Mar 27 '13 at 18:43
    
You're really not making any sense. If JavaScript's able to check PHP-FPM's status, you've got a badly insecure config going. HTML can't "have a call to Java"... and given that the HTML is usually generated by PHP, it wouldn't work regardless. –  ceejayoz Mar 27 '13 at 18:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.