2

Since I started hosting a website on the server, I get 505's, 504's, timeouts on it, as well as for the other websites hosted on that same server (but these other websites have no issues).

The server's OS is Ubuntu16.04 and it has php7.0-fpm nginx, apparently misconfigured.

How to avoid all other websites to suffer from the newly hosted website's timeouts? Or how to avoid these timeouts at all (without fixing the php errors as I have nothing to do with that)?

The php code has many errors. php7.0-fpm logs reveal a timeout.

/var/log/php7.0-fpm.log

[26-Mar-2018 20:29:54] WARNING: [pool www] child 17012, script '/var/www/xxxxxx.com/index.php' (request: "POST /index.php?function=my-profile") execution timed out (306.572078 sec), terminating [26-Mar-2018 20:29:54] WARNING: [pool www] child 17012 exited on signal 15 (SIGTERM) after 1100.011016 seconds from start [26-Mar-2018 20:29:54] NOTICE: [pool www] child 19559 started

/var/log/nginx/error.log

Nginx reveals so many php warnings that I'm not quite sure where to look at.

/etc/nginx/nginx.conf

http {
    # ...
    fastcgi_buffers 8 16k;
    fastcgi_buffer_size 32k;
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    # ...
}

/etc/php/7.0/fpm/pool.d

pm = dynamic
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.process_idle_timeout = 10s
pm.max_requests = 500

/etc/php/7.0/fpm

default_socket_timeout = 60
max_execution_time = 300
max_input_time = 60
memory_limit = 128M

The server block includes this part /etc/nginx/global/wordpress.conf

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
location ~* /(?:uploads|files)/.*\.php$ {
    deny all;
}

# Directives to send expires headers and turn off 404 error logging for Static assets
location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpe?g|gif|png|ico|zip|pdf|t?gz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|swf|bmp|txt|rtf|md)$ {
    access_log off;
    log_not_found off;
    expires max;

    # CORS headers; this is wide-open, you want to tight it up a bit
    add_header Cache-Control public;
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods GET,OPTIONS;
    add_header Access-Control-Allow-Headers *;
}

# Attempted to match last if rules below fail.
location / {
    try_files $uri $uri/ /index.php?$args;
}

# Add trailing slash to */wp-admin requests.
rewrite /wp-admin$ $scheme://$host$uri/ permanent;

# Pass PHP scripts to PHP-FPM daemon
# Check: http://wiki.nginx.org/Pitfalls
location ~* \.php$ {
    # filter out problem conditions
    try_files $uri $uri/ =404;

    # bring in parameters
    include fastcgi.conf;

    # send requests to upstream
    # fastcgi_pass phpfpm;
    # fastcgi_pass 127.0.0.1:9000;
    fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    fastcgi_read_timeout 300;

}
Improve this question
0
2

Despite your will, you have created the same situation when someone is under a PHP-POOL attack. This means exactly what is happening to you, the PHP get's stuck for one website, and the rest cannot operate because of that. What I strongly recommend is the following:

Create a new PHP pool for each of the websites. You can achieve this by creating new config files. On CentOS 7, I have them in /etc/php-fpm.d/mywebsite.conf. Find your current pool config file and simply create a copy for it to the same folder. Then you have to change the followings:

  • [mywebsite]
  • user = nginx
  • group = nginx
  • listen = /run/php/mywebsite.sock
  • listen.owner = nginx
  • listen.group = nginx
  • listen.mode = 0660

Some just needs to be uncommented, some needs to be edited. After you have done this, do the same for each of the websites. Then in the websites nginx config, replace the fastcgi_pass unix:/run/php/php7.0-fpm.sock; with the appropriate file locations of the sock files. Restart NginX and PHP-FPM and you should be ready to go.

Also... 128MB for a PHP? That is thin like one hair piece. Increase it to 1024M at the least, or 2048 if you can. Depends on your HW OFC.

Improve this answer
3
  • Thank you @Bert, that's exactly the kind of answer I was waiting for. I wasn't quite sure if one php-fpm config per website was the solution but with your explanation it makes sense. – ccl18 Mar 27 '18 at 11:29
  • Would you have a little more insight of what's happening "behind the scenes" ? What creates that situation similar to a php-pool attack? Is it because each process is used by multiple websites or are there more reasons than this? – ccl18 Mar 27 '18 at 11:32
  • 1
    Let's compare yout PHP pool to a toilet and the websites are the people who want's to use it. If you have one toilet, everyone needs to use that and only one can use it at a time. They will form a line for it and everyone will wait for their time on it. If somebody has a stomachache then he will sit there for sh*t tons fo time, and nobody will be able to use the toilet. But if you have a toilet / people, then anyone can go out anytime they want, no matter if anyone else is also enjoying their time on the toilet or not. Was this good enough? :) – Bert Mar 27 '18 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.