Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a clean Centos 6.4 (x64) minimal edition installed (fully updated).

Once the OS was setup, I followed this relatively simple guide to setup my FTP: http://www.krizna.com/centos/how-to-configure-ftp-server-on-centos-6/

SELinux is disabled.
anonymous_enable=NO (vsFTPD Config)
chroot_local_user=YES (vsFTPD Config)

instead of creating a linux local user acc on /ftp/[username] (as per guide), I opted to use the standard location of /home/[username] where [username] was server (in my setup)

I tested my FTP Server and it is installed & running fine/. So I logged on to FTP and created a folder called "public_html" and then created a index.php file inside it with <?php phpinfo(); ?> code in it. ( So full path is : /home/server/public_html/index.php )

I then installed nginx & php-fpm and proceeded to create the following configuration files for each in this order.

/etc/php-fpm.d/server.conf (php-fpm pool for my local nix acc: server):

[server]

listen = '/var/run/php-fcgi-server.sock'
listen.allowed_clients = 127.0.0.1
user = server
group = server

pm = static
pm.max_children = 5
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 10
pm.max_requests = 200

php_admin_value[error_log] = /var/log/php-fpm/server-php-errors.log
php_admin_flag[log_errors] = on
php_admin_flag[display_errors] = on

/etc/nginx/conf.d/dev-minecraft.local.conf (nginx vHost):

upstream serverbackend {
    server unix:/var/run/php-fcgi-server.sock;
}

server {
    listen *:80 default;
    server_name dev-minecraft.local;

    root /home/server/public_html;

    location / {
        index index.html index.php;
        try_files $uri $uri/ @handler;
        expires 30d;
    }

    client_max_body_size 10M;

    location  /. {
        return 404;
    }

    location @handler {
        rewrite / /index.php;
    }

    location ~ .php/ {
        rewrite ^(.*.php)/ $1 last;
    }

    location ~ .php$ {
        if (!-e $request_filename) { rewrite / /index.php last; }
        expires        off;
        fastcgi_pass   serverbackend;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
}

Now, if I visit the site no my browser : http://dev-minecraft.local/ I get the following error: 500 Internal Server Error

And I see the following errors in my /var/log/nginx/error.log file:

2013/07/22 12:58:07 [crit] 2039#0: *1 stat() "/home/server/public_html/" failed (13: Permission denied), client: 192.168.1.15, server: dev-minecraft.local, request: "GET / HTTP/1.1", host: "192.168.1.54"
2013/07/22 12:58:07 [crit] 2039#0: *1 stat() "/home/server/public_html/" failed (13: Permission denied), client: 192.168.1.15, server: dev-minecraft.local, request: "GET / HTTP/1.1", host: "192.168.1.54"
2013/07/22 12:58:07 [crit] 2039#0: *1 stat() "/home/server/public_html/index.php" failed (13: Permission denied), client: 192.168.1.15, server: dev-minecraft.local, request: "GET / HTTP/1.1", host: "192.168.1.54"

Any idea what I am doing wrong here? One thing I noticed in WinSCP (after i login via FTP), the file owner/group is set to a numeric identifier (500) instead of the account username "server". Is this the reason why nginx/php-fpm is unable to access the site files? How can I fix this?

share|improve this question
    
Are you sure that you are using proftpd and not vsftpd? Because chroot_local_user is an option of vsftpd –  ALex_hha Jul 22 '13 at 12:26
    
apologies, I was looking at proftpd earlier and went with vsftpd, but the name stuck in my head. Yes, it is vsFTPD. –  Latheesan Kanes Jul 22 '13 at 13:33
    
I've fixed the 500 Internal Server Error error by editing the nginx vhost config file and replacing "last" with "break" -> pastebin.com/uExiUZ6Y fixed config (however, that permission denied for stat() still exists on nginx error log –  Latheesan Kanes Jul 22 '13 at 14:22
    
# ls -lad /home/server/ /home/server/public_html/ ? –  ALex_hha Jul 22 '13 at 14:35

2 Answers 2

The permissions of /home/server deny access to anyone but its owner. That is what drwx------ means.

To resolve the issue, allow other users to descend into the directory.

chmod a+x /home/server
share|improve this answer

Definitely a permission problem. The php-fpm user and the nginx user must have read access to the files in your directory. Also your nginx configuration is a bit problematic. Please try the following:

client_max_body_size    10M;
index index.html        index.php;

upstream serverbackend {
    server unix:/var/run/php-fcgi-server.sock;
}

server {
    server_name   dev-minecraft.local;
    root          /home/server/public_html;
    expires       30d;

    location / {

        location ~ \.php$ {
            expires         off;
            include         fastcgi_params;
            fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass    serverbackend;
        }

        try_files $uri $uri/ =404;
    }
}
share|improve this answer
    
Hi, I would love to know what was wrong with my nginx config. I've been using something similar for allot of my projects and it's been fine. What have I been doing wrong? –  Latheesan Kanes Jul 23 '13 at 8:52
    
Always specify options in the most outer scope and change them on a server basis if you need to. E.g. index is most certainly the same for all your servers, so specify it in the http context (outermost allowed place for it). You can always check the documentation to know which is the outermost place for an option. Keep things as easy as possible. Nest regular expression locations in other locations (create a tree). Do not allow PHP execution on folders where user uploads are allowed, instead of complicated rewrites and file system checks. Your config is not(!) wrong, just not optimal. –  Fleshgrinder Jul 23 '13 at 9:08
    
Thanks Fleshgrinder, advice/info is much appreciated. –  Latheesan Kanes Jul 30 '13 at 16:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.