40

We have deployed our rails application on on nginx and passenger.Intermittently pages of application get loaded partially.There is no error in application log.But nginx error log shows the following :

2011/02/14 05:49:34 [crit] 25389#0: *645 open() "/opt/nginx/proxy_temp/2/02/0000000022" failed (13: Permission denied) while reading upstream, client: x.x.x.x, server: y.y.y.y, request: "GET /signup/procedures?count=0 HTTP/1.1", upstream: "passenger:unix:/passenger_helper_server:", host: "y.y.y.y", referrer: "http://y.y.y.y/signup/procedures"

39

I had the same problem on an NGINX/PHP-FPM setup (php-fpm=improved fcgi for php).

You can find out which user the nginx processes are running as

ps aux | grep "nginx: worker process"

And then check out if the permissions in your proxy files are correct

ls -l /opt/nginx/proxy_temp/

In my case, nginx was running as www-data and two of the directories in my proxy directory belonged to root.

I don't know how it happened yet, but I fixed it by doing (as root)

chown www-data.www-data /opt/nginx/proxy_temp
  • 4
    The best solution! – efkan Dec 23 '16 at 12:42
  • Why isn't it accepted yet? – Kishor Pawar Mar 30 '17 at 9:17
  • 1
    for those who use #openresty - "chown www-data:www-data -R /usr/local/openresty/nginx/*_temp" – BG Bruno Nov 6 '17 at 23:30
  • 1
    I stopped my nginx process, renamed the folder to another name, restarted the nginx process and it had created the folder again with correct permissions. Worked like a charm! – Chirayu Shishodiya May 16 at 13:51
8

You probably started with user root, then changed it. Now the problem is that the cache folders, i.e.

/var/cache/nginx/client_temp
/var/cache/nginx/fastcgi_temp
/var/cache/nginx/proxy_temp
/var/cache/nginx/scgi_temp
/var/cache/nginx/uwsgi_temp

are already owned by root, so your nginx (or whatever you're trying to switch to) user can't access them coz they have a permission of 700.

So the solution is easy. Stop nginx, then:

rm -rf /var/cache/nginx/*

or whatever the path is on your distro and release. Then restart nginx which will re-create these folders with the appropriate permissions.

8

Also check the nginx.conf file to make sure you are specifying the correct user AND group.

I had a problem where the permissions on the directory were setup for username/nginx, but the nginx.conf user only specified username. By default, if no group is given to the user directive, it uses the same name as user. So, username/username was trying to access a directory instead of username/nginx. Updating the config fixed my problems.

See: http://nginx.org/en/docs/ngx_core_module.html#user

  • 2
    Can you please post the config you mentioned here? – paweloque Jan 23 '14 at 11:00
4

So I did all of the above and unfortunately for me it was giving me the same error. I am running a rails app packaged into a jar file with torquebox on a centos 6.7 machine with nginx. I battled this for about 3 hours until I found another solution and I hope it helps someone else. According to this article nginx may run on enforcing mode. I just simply changed nginx to permissive mode with

setenforce 0

With that, the error was gone and I was able to run my application on a staging/production environment.

I was clueless until I found the error on the audit.log

type=AVC msg=audit(1444454198.438:466): avc:  denied  { name_connect } for  pid=3201 comm="nginx" dest=8080 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

I really hope this saves someone the 3 hours I just lost.

  • 1
    You're not wrong, I don't know why someone vote -1 (shame on him/her). The problem is in RedHat/CentOS based hosts and selinux. One way is setenforce 0 (rude), other way is with setsebool and networking options. – periket2000 May 25 '17 at 16:48
  • It helped with CentOS 7.2. – MKatleast3 Aug 27 '17 at 4:54
  • setsebool -P httpd_can_network_connect 1 from stackoverflow.com/a/24830777/721331 – McKelvin Aug 7 '18 at 6:56
3

When starting nginx from an unprivileged account the use_temp_path=off.

proxy_cache_path ... use_temp_path=off;

This needed to avoid nginx trying to put the files into the default proxy_temp_path. From the nginx docs:

The directory for temporary files is set based on the use_temp_path parameter (1.7.10). If this parameter is omitted or set to the value on, the directory set by the proxy_temp_path directive for the given location will be used. If the value is set to off, temporary files will be put directly in the cache directory.

-3
chmod 777 /opt/nginx/proxy_temp/

I had the same problem and it solved by chmod to that directory.

  • 13
    chmod 777 is never a good idea. – sendmoreinfo Sep 14 '12 at 4:10

protected by Michael Hampton Nov 3 '15 at 3:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.