3

I need to use the Nginx module ngx_http_auth_pam_module on a Centos 7 server. As a package is only available through the getpagespeed repository, which isn't gratis, I want to compile it myself.

Following various instructions I found, I downloaded the sources for the module and for Nginx, listed the compile options for the version of Nginx installed with nginx -V, then compiled the module with ./configure then make modules, installing some packages to fix the various errors in the process.

However, when I try to configure Nginx to use the newly compiled module, nginx -t gives me nginx: [emerg] module "/opt/nginx/modules/ngx_http_auth_pam_module.so" is not binary compatible in /usr/share/nginx/modules/mod-http-auth-pam.conf:1

From what I read, this "note binary compatible" error is due to different compile flags in the installed version of Nginx vs the module, however I made sure to copy all those given by nginx -V. I also made sure to download the source code for the same version of Nginx as installed.

Any idea what could be causing the issue ? Should I just uninstall Nginx and reinstall the compiled version, or does that come with its own issues ?

Appendix :

here is the entire ./configure command :

./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_auth_request_module --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' --with-compat --add-dynamic-module=../ngx_http_auth_pam_module/

And here the nginx -V

nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_auth_request_module --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
1

Turns out, the --with-compat option was causing the issue. I added it because the guide on nginx.com said so, but after removing it and compiling one more time, nginx -t tells me that the config is good.

0

Removing --with-compat option cannot possibly solve it.

If you got the error about binary incompatible module that was compiled with this option, it only means that you compiled it for one version and loaded into a different version. E.g. module was compiled against NGINX source 1.16.0 while you're loading it (using) in NGINX 1.12.2. And that version is very old by the way, and has HTTP/2 security vulnerabilities, for which you have to update.

If anything, there's not much reason not to use --with-compat.

I am very biased in saying this, but GetPageSpeed repo, while being not gratis for CentOS 7 (free for CentOS/RHEL 8 as of this writing), allows you to get always up-to-date modules for new NGINX versions, which are released on a regular basis and address new security issues as well as added features. Otherwise, you have to continuously recompile modules as opposed to yum update, and potentially end up with compilation software on the production system. Which is a security issue of its own.

The GetPageSpeed alternative is subscribing to NGINX Plus, which costs far more than a few dollars.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.