Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to switch from an Apache hosting solution to nginx with php-fpm on FreeBSD 9.2.

I'm rewriting my script for creating vHosts and stuff for nginx now and get 403 statuses when I try to access the vHost.

I'm struggling for hours now and can't get no clue, which permissions to set. Do you have any ideas?

Here's my createvhost.sh:


#!/usr/local/bin/bash

DOMAIN="example.com"
PHP_USER="chris_www"
PHP_GROUP="$PHP_USER"

NGINX_USER="www"
NGINX_GROUP="$NGINX_USER"
ADMIN_EMAIL="root@example.com"

NGINX_CONF_FOLER="/usr/local/etc/nginx"
PHP_FPM_CONF_FOLDER="/usr/local/etc/php-fpm.d"

WEBROOT="/www/vhosts"

IP="10.0.0.4"

VHOST_PORT=9000
source $WEBROOT/config/vhost_port.conf


## Create user and add it to $NGINX_GROUP
echo "Creating user and adding it to group $NGINX_GROUP"
pw user add $PHP_USER -s /sbin/nologin
pw group mod $PHP_GROUP -m $NGINX_GROUP

echo "Creating neccessary folders"
mkdir -p $WEBROOT/$DOMAIN/{conf,www,log,tmp,certs,sessions}

chown root:$PHP_USER $WEBROOT/$DOMAIN
chmod 750 $WEBROOT/$DOMAIN
chown $PHP_USER:$PHP_USER $WEBROOT/$DOMAIN/*
chown -R $PHP_USER:$PHP_USER $WEBROOT/$DOMAIN/www/*
chmod 755 $WEBROOT/$DOMAIN/*
chmod 550 $WEBROOT/$DOMAIN/conf

## Create template for ssl cert creation
cat > $WEBROOT/$DOMAIN/conf/ssleay.cnf  $NGINX_CONF_FOLER/sites-avaliable/$DOMAIN.conf  $PHP_FPM_CONF_FOLDER/$DOMAIN.conf  $WEBROOT/config/vhost_port.conf

echo "Restarting nginx"
/usr/local/etc/rc.d/nginx restart

echo "Restarting php-fpm"
/usr/local/etc/rc.d/php-fpm restart

echo "Finished." 

Here's my nginx.conf:

user www www;
worker_processes 8;
pid /var/run/nginx.pid;
worker_rlimit_nofile    8192;

events {
   use   kqueue;
   worker_connections   8192;
}

http {
    #set_real_ip_from xxx.xxx.xxx.xxx;
    real_ip_header 'X-Forwarded-For';

    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] $status "$request" $body_bytes_sent "$http_referer" "$http_user_agent"
"$http_x_forwarded_for"';
    access_log off;
    error_log /var/log/nginx-error.log crit;

    # MIME-Types
    include mime.types;
    default_type application/octet-stream;

# Allgemeines
    index index.php index.htm;
    server_tokens on;
    client_header_timeout 5;
    client_body_timeout 10;
    client_max_body_size 16m;
    ignore_invalid_headers on;
    send_timeout 10;

    # Performance-Tuning
    sendfile on;
    server_names_hash_bucket_size 128;
    tcp_nodelay on;
    tcp_nopush   on;
    aio   sendfile;
    keepalive_timeout   5;

 # DDoS-Bekämpfung
    limit_req_zone $binary_remote_addr zone=antiddos:10m rate=1r/s;

    # GZIP
    gzip on;
    gzip_min_length 1000;
    gzip_vary on;
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_proxied any;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/x-javascript text/xml application/xml text/javascript; gzip_disable "MSIE [1-6]\.";

    # SSL
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!MEDIUM:!LOW:!EXP:RC41RSA:1HIGH:!kEDH;

  # vHost-Konfigurationen
    include /usr/local/etc/nginx/sites-enabled/*.conf;

  # Leerer vHost (Default)
  server {
    server_name   _;
    listen   80   default;
    access_log   off;
    error_log        off;
        root /www/vhosts/defaulthost/www;

    # Error-Pages
    #include    error_pages.conf;

    location / {
      index   index.htm;
      rewrite ^   index.htm;
        }
    limit_req zone=antiddos burst=5 nodelay;
    }
}

And here's the output of ls -ARl /www/

ls -ARl /www/
total 2
drwxr-xr-x  5 www  www  5 20 Dez 00:48 vhosts

/www/vhosts:
total 5
drwxr-xr-x  2 root       wheel      3 20 Dez 00:10 config
drwxr-x---  8 root       www        8 20 Dez 00:48 defaulthost
drwxr-x---  8 chris_www  chris_www  8 20 Dez 00:09 example.com

/www/vhosts/config:
total 1
-rw-r--r--  1 root  wheel  16 20 Dez 00:10 vhost_port.conf

/www/vhosts/defaulthost:
total 9
drwxr-x---  2 root  www  2 20 Dez 00:50 certs
drwxr-x---  2 root  www  2 20 Dez 00:48 conf
drwxr-x---  2 root  www  2 20 Dez 00:50 log
drwxr-x---  2 root  www  2 20 Dez 00:48 sessions
drwxr-x---  2 root  www  2 20 Dez 00:48 tmp
drwxr-x---  2 root  www  3 20 Dez 00:48 www

/www/vhosts/defaulthost/certs:
total 0

/www/vhosts/defaulthost/conf:
total 0

/www/vhosts/defaulthost/log:
total 0

/www/vhosts/defaulthost/sessions:
total 0

/www/vhosts/defaulthost/tmp:
total 0

/www/vhosts/defaulthost/www:
total 1
-rwxr-x---  1 root  www  24 20 Dez 00:48 index.htm

/www/vhosts/example.com:
total 9
drwxr-x---  2 chris_www  chris_www  5 20 Dez 00:10 certs
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 conf
drwxr-x---  2 chris_www  chris_www  5 20 Dez 00:10 log
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 sessions
drwxr-x---  2 chris_www  chris_www  2 20 Dez 00:09 tmp
drwxr-x---  2 chris_www  chris_www  3 20 Dez 00:42 www

/www/vhosts/example.com/certs:
total 5
-rwxr-x---  1 chris_www  chris_www  757 20 Dez 00:10 example.com.crt
-rwxr-x---  1 chris_www  chris_www  603 20 Dez 00:10 example.com.csr
-rwxr-x---  1 chris_www  chris_www  887 20 Dez 00:10 example.com.key

/www/vhosts/example.com/conf:
total 0

/www/vhosts/example.com/log:
total 65
-rwxr-x---  1 chris_www  chris_www  23432 20 Dez 01:11 nginx.access.log
-rwxr-x---  1 chris_www  chris_www  40968 20 Dez 01:11 nginx.error.log
-rwxr-x---  1 chris_www  chris_www      0 20 Dez 00:10 php-fpmslow.log

/www/vhosts/example.com/sessions:
total 0

/www/vhosts/example.com/tmp:
total 0

/www/vhosts/example.com/www:
total 1
-rwxr-x---  1 chris_www  chris_www  24 20 Dez 00:34 index.htm
share|improve this question
    
If 403 returned by nginx (not upstream) - reason should be in error_log –  citrin Dec 20 '13 at 13:50
add comment

2 Answers

If you didn't want to add the www user to the chris_www group, and presuming you also don't want to add the +x flag to example.com, you could consider using FreeBSD's Access Control List (ACL) support for UFS. I did a little write-up on it recently: http://pgib.me/blog/2014/01/06/freebsd-acls-ftw/

share|improve this answer
add comment

This:

user www www;
worker_processes 8;

And this:

/www/vhosts:
total 5
drwxr-xr-x  2 root       wheel      3 20 Dez 00:10 config
drwxr-x---  8 root       www        8 20 Dez 00:48 defaulthost
drwxr-x---  8 chris_www  chris_www  8 20 Dez 00:09 example.com

Without looking further, I presume your intent is to have nginx serve example.com from /www/vhosts/example.com.

But how could it possibly do so, without having a permission to a read/execute?

You have to ensure user and/or group www have access to all directories leading to the content which they're supposed to serve.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.