PHP5 FPM + Nginx socket issue

[jrdnrc]

Hi,

I installed a DigitalOcean machine with PHP5 FPM and Nginx. Whenever I try to access the server, I get a '502 bad gateway', and an error message in the Nginx access logs as follows:

2014/05/07 09:24:35 [crit] 4991#0: *1 connect() to unix:/var/run/php5-fpm.sock failed (13: Permission denied) while connecting to upstream, client: 37.139.2.9, server: jrdn.dev, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "jrdn.dev"

I've worked out that I can solve this issue by editing /etc/php5/fpm/pool.d/www-data, and changing ;listen.mode = 0660 to listen.mode = 0666 and that seems to work. However, I think this should work out of the box, and I can't figure out a way to pass that to the configuration when setting up the box on puphpet.com.

[lucidix]

This might be potentially related to #161. This is also an issue on VirtualBox with Debian Wheezy x64, but works fine with Ubuntu Precise x64.

[jrdnrc]

I will try deploying a Ubuntu box tonight, and see how it works. If it's also an issue with Debian on VirtualBox, could it be possible it's not VB or DO related and rather Debian or how Puphpet handles Debian boxes? I was using Debian Wheezy x64 on Digital Ocean.

[torches]

+1 Also having this issue here on a local Debian box.

[jrdnrc]

Can confirm it works fine on a Ubuntu Precise box deployed to Digital Ocean. Must be a Debian thing...

[danherd]

Just to add my two penneth - Debian Wheezy with Nginx + PHP 5.5 FPM doesn't work 'out of the box' with a socket connection (gives same permission error above).

Changing listen.mode (or reverting to using port binding) in the /etc/php5/fpm/pool.d/www-data works fine.

[danherd]

Looks like a recent change to the default php5-fpm config (permissions of the unix socket were changed to 0660 from 0666) caused Nginx to stop being able to connect to the socket (it runs as www-data:www-data and the php5-fpm socket is created as root:root).

https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1217737.html https://bugs.php.net/bug.php?id=67060

In other words - I don't think this is a PuPHPet issue...

[TrafeX]

It's indeed caused by a recent update of PHP that fixes this (security related) bug: https://bugs.php.net/bug.php?id=67060 Everyone who's running PHP >= 5.5.12 or >= 5.4.28 is affected.

It can only be fixed in PuPHPet by changing the listen.mode back to 0666 (not recommended) or making sure the correct user is using the socket. This must be changed in the PuPHPet configuration.

[Danielss89]

Can confirm this on local Debian, php 5.5 + nginx.

[eyes2design]

I'm having this bug within local vm box, as well. centos and ubuntu

[tomasfejfar]

Yup. Confirmed. Unescaping the listen.user/group/mode in /etc/php5/fpm/pool.d/www.conf fixes the problem

[leipert]

Actually it is not fixed. Please see this note at: https://github.com/puphpet/puphpet/commit/770aefd6e0d3654ef0bb35faa5c078c53ba2501c

It is needed (at least in debian) to alter /etc/php5/fpm/pool.d/www.conf and uncomment listen.user, listen.group and listen.mode

[jtreminio]

All,

I am unable to replicate issue.

/etc/php5/fpm/pool.d/www.conf:

 ; Start a new pool named 'www'.
 ; the variable $pool can we used in any directive and will be replaced by the
 ; pool name ('www' here)
 [www]

 ; Per pool prefix
 ; It only applies on the following directives:
 ; - 'slowlog'
 ; - 'listen' (unixsocket)
 ; - 'chroot'
 ; - 'chdir'
 ; - 'php_values'
 ; - 'php_admin_values'
 ; When not set, the global prefix (or /usr) applies instead.
 ; Note: This directive can also be relative to the global prefix.
 ; Default Value: none
 ;prefix = /path/to/pools/$pool

 ; Unix user/group of processes
 ; Note: The user is mandatory. If the group is not set, the default user's group
 ;       will be used.
 user = www-data
 group = www-data

 ; The address on which to accept FastCGI requests.
 ; Valid syntaxes are:
 ;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific address on
 ;                            a specific port;
 ;   'port'                 - to listen on a TCP socket to all addresses on a
 ;                            specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
 listen = /var/run/php5-fpm.sock

 ; Set listen(2) backlog.
 ; Default Value: 65535 (-1 on FreeBSD and OpenBSD)
 ;listen.backlog = 65535

 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions.
 ; Default Values: user and group are set as the running user
 ;                 mode is set to 0660
 listen.owner = www-data
 listen.group = www-data
 ;listen.mode = 0660

Even after a box restart, web page keeps loading fine.

Can I get some config.yaml contents so I can see if there are any differences?

Here's mine:

---
vagrantfile-local:
    vm:
        box: puphpet/debian75-x64
        box_url: puphpet/debian75-x64
        hostname: null
        memory: '512'
        chosen_provider: virtualbox
        network:
            private_network: 192.168.56.176
            forwarded_port:
                Jl9Ccc1Q4qUE:
                    host: '7748'
                    guest: '22'
        provider:
            virtualbox:
                modifyvm:
                    natdnshostresolver1: on
                setextradata:
                    VBoxInternal2/SharedFoldersEnableSymlinksCreate/v-root: 1
            vmware:
                numvcpus: 1
            parallels:
                cpus: 1
        provision:
            puppet:
                manifests_path: puphpet/puppet
                manifest_file: manifest.pp
                module_path: puphpet/puppet/modules
                options:
                    - '--verbose'
                    - '--hiera_config /vagrant/puphpet/puppet/hiera.yaml'
                    - '--parser future'
        synced_folder:
            XgInsa1REHQC:
                source: ./
                target: /var/www
                sync_type: default
                rsync:
                    args: '-z'
                    exclude: .vagrant/
                    auto: 'false'
        usable_port_range: 2200..2250
    ssh:
        host: null
        port: null
        private_key_path: null
        username: vagrant
        guest_port: null
        keep_alive: true
        forward_agent: false
        forward_x11: false
        shell: 'bash -l'
    vagrant:
        host: detect
server:
    packages:
        - vim
    dot_files:
        -
            bash_aliases: null
    _prevent_empty: ''
mailcatcher:
    install: 0
    settings:
        smtp_ip: 0.0.0.0
        smtp_port: 1025
        http_ip: 0.0.0.0
        http_port: '1080'
        mailcatcher_path: /usr/local/bin
        log_path: /var/log/mailcatcher/mailcatcher.log
firewall:
    install: '1'
    rules: null
apache:
    install: 0
    settings:
        user: www-data
        group: www-data
        default_vhost: true
        manage_user: false
        manage_group: false
        sendfile: 0
    modules:
        - php
        - rewrite
    vhosts:
        heumjA0rpsbZ:
            servername: awesome.dev
            serveraliases:
                - www.awesome.dev
            docroot: /var/www/awesome
            port: '80'
            setenv:
                - 'APP_ENV dev'
            override:
                - All
            options:
                - Indexes
                - FollowSymLinks
                - MultiViews
            custom_fragment: ''
            ssl_cert: ''
            ssl_key: ''
            ssl_chain: ''
            ssl_certs_dir: ''
    mod_pagespeed: 0
    mod_spdy: 0
nginx:
    install: '1'
    settings:
        default_vhost: 1
        proxy_buffer_size: 128k
        proxy_buffers: '4 256k'
    vhosts:
        OH573kviJkcJ:
            server_name: awesome.dev
            server_aliases:
                - www.awesome.dev
            www_root: /var/www/awesome.dev
            listen_port: '80'
            index_files:
                - index.html
                - index.htm
                - index.php
            envvars:
                - 'APP_ENV dev'
            ssl_cert: ''
            ssl_key: ''
php:
    install: '1'
    version: '55'
    composer: '1'
    composer_home: ''
    modules:
        php:
            - cli
            - intl
            - mcrypt
        pear: {  }
        pecl:
            - pecl_http
    ini:
        display_errors: On
        error_reporting: '-1'
        session.save_path: /var/lib/php/session
    timezone: America/Chicago
xdebug:
    install: 0
    settings:
        xdebug.default_enable: '1'
        xdebug.remote_autostart: '0'
        xdebug.remote_connect_back: '1'
        xdebug.remote_enable: '1'
        xdebug.remote_handler: dbgp
        xdebug.remote_port: '9000'
drush:
    install: 0
    settings:
        drush.tag_branch: 6.x
mysql:
    install: 0
    root_password: '123'
    adminer: 0
    databases:
        7g9vh7Mp6Szu:
            grant:
                - ALL
            name: dbname
            host: localhost
            user: dbuser
            password: '123'
            sql_file: ''
postgresql:
    install: 0
    settings:
        root_password: '123'
        user_group: postgres
        encoding: UTF8
        version: '9.3'
    databases: {  }
    adminer: 0
mariadb:
    install: 0
    root_password: '123'
    adminer: 0
    databases: {  }
    version: '10.0'
mongodb:
    install: 0
    settings:
        auth: 1
        port: '27017'
    databases: {  }
redis:
    install: 0
    settings:
        conf_port: '6379'
beanstalkd:
    install: 0
    settings:
        listenaddress: 0.0.0.0
        listenport: '13000'
        maxjobsize: '65535'
        maxconnections: '1024'
        binlogdir: /var/lib/beanstalkd/binlog
        binlogfsync: null
        binlogsize: '10485760'
    beanstalk_console: 0
    binlogdir: /var/lib/beanstalkd/binlog
rabbitmq:
    install: 0
    settings:
        port: '5672'

[tomasfejfar]

It works because your listen.user/group is uncommented ;)

[jtreminio]

@tomasfejfar I did not change anything, it's how it ended up. Would you mind trying it?

[Hellslicer]

In my case, the problem was solved many weeks ago. listen.owner and listen.group in /etc/php5/fpm/pool.d/www.conf aren't commented anymore by default.

[tomasfejfar]

Ahw! :dog:

Sorry I overlooked the second commit mentioned. Problem was that 770aefd6e0d3654ef0bb35faa5c078c53ba2501c from 17th May did not fix the core problem... but #784 does. So it's OK :)

[juan88]

Hi, I am having some issues related to this I think and I cannot fix them.

I'm experiencing issues to write files from the webserver (using php-fpm and nginx). I tried what is described here and the framework I'm using cannot create files somehow. I set the permissions manually to those folders but yet nginx cannot write to them somehow.

Tried tweaking the www.conf in php-fpm uncommenting those lines and changing the permissions of the listen.mode but still I am unable to make it work.

For the record I had apache2 working in the same project flawlessly. Everything happened after switching to nginx. Any ideas? Thanks!