44

We have deployed our rails application on on Nginx and passenger. Intermittently, pages of application get loaded partially. There is no error in application log, but the Nginx error log shows the following:

2011/02/14 05:49:34 [crit] 25389#0: *645 open() "/opt/nginx/proxy_temp/2/02/0000000022" 
  failed (13: Permission denied) while reading upstream, client: x.x.x.x, 
  server: y.y.y.y, request: "GET /signup/procedures?count=0 HTTP/1.1", 
  upstream: "passenger:unix:/passenger_helper_server:", host: "y.y.y.y", 
  referrer: "http://y.y.y.y/signup/procedures"
1
45

I had the same problem on an NGINX/PHP-FPM setup (php-fpm=improved fcgi for php).

You can find out which user the nginx processes are running as

ps aux | grep "nginx: worker process"

And then check out if the permissions in your proxy files are correct

ls -l /opt/nginx/proxy_temp/

In my case, nginx was running as www-data and two of the directories in my proxy directory belonged to root.

I don't know how it happened yet, but I fixed it by doing (as root)

chown www-data.www-data /opt/nginx/proxy_temp
4
  • 5
    The best solution!
    – efkan
    Dec 23 '16 at 12:42
  • Why isn't it accepted yet? Mar 30 '17 at 9:17
  • 1
    for those who use #openresty - "chown www-data:www-data -R /usr/local/openresty/nginx/*_temp"
    – BGBRUNO
    Nov 6 '17 at 23:30
  • 1
    I stopped my nginx process, renamed the folder to another name, restarted the nginx process and it had created the folder again with correct permissions. Worked like a charm! May 16 '19 at 13:51
11

You probably started with user root, then changed it. Now the problem is that the cache folders, i.e.

/var/cache/nginx/client_temp
/var/cache/nginx/fastcgi_temp
/var/cache/nginx/proxy_temp
/var/cache/nginx/scgi_temp
/var/cache/nginx/uwsgi_temp

are already owned by root, so your nginx (www-data or whatever you're trying to switch to) user can't access them because they have a permission of 700.

So the solution is easy. Stop nginx, then:

rm -rf /var/cache/nginx/*

or whatever the path is on your distribution and release. Then restart nginx which will re-create these folders with the appropriate permissions.

1
  • I've executed the following commands: ``` cd /usr/local sudo mv fastcgi_temp/ _fastcgi_temp/ sudo nginx -s reload ``` It worked! Thank you! Apr 26 '20 at 16:05
8

Also check the nginx.conf file to make sure you are specifying the correct user AND group.

I had a problem where the permissions on the directory were setup for username/nginx, but the nginx.conf user only specified username. By default, if no group is given to the user directive, it uses the same name as user. So, username/username was trying to access a directory instead of username/nginx. Updating the config fixed my problems.

See: http://nginx.org/en/docs/ngx_core_module.html#user

1
  • 2
    Can you please post the config you mentioned here?
    – paweloque
    Jan 23 '14 at 11:00
6

So I did all of the above and unfortunately for me it was giving me the same error. I am running a rails app packaged into a jar file with torquebox on a centos 6.7 machine with nginx. I battled this for about 3 hours until I found another solution and I hope it helps someone else. According to this article nginx may run on enforcing mode. I just simply changed nginx to permissive mode with

setenforce 0

With that, the error was gone and I was able to run my application on a staging/production environment.

I was clueless until I found the error on the audit.log

type=AVC msg=audit(1444454198.438:466): avc:  denied  { name_connect } for  pid=3201 comm="nginx" dest=8080 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

I really hope this saves someone the 3 hours I just lost.

3
  • 1
    You're not wrong, I don't know why someone vote -1 (shame on him/her). The problem is in RedHat/CentOS based hosts and selinux. One way is setenforce 0 (rude), other way is with setsebool and networking options. May 25 '17 at 16:48
  • It helped with CentOS 7.2.
    – MKatleast3
    Aug 27 '17 at 4:54
  • setsebool -P httpd_can_network_connect 1 from stackoverflow.com/a/24830777/721331
    – McKelvin
    Aug 7 '18 at 6:56
3

When starting nginx from an unprivileged account the use_temp_path=off.

proxy_cache_path ... use_temp_path=off;

This needed to avoid nginx trying to put the files into the default proxy_temp_path. From the nginx docs:

The directory for temporary files is set based on the use_temp_path parameter (1.7.10). If this parameter is omitted or set to the value on, the directory set by the proxy_temp_path directive for the given location will be used. If the value is set to off, temporary files will be put directly in the cache directory.

-3
chmod 777 /opt/nginx/proxy_temp/

I had the same problem and it solved by chmod to that directory.

1
  • 13
    chmod 777 is never a good idea. Sep 14 '12 at 4:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.