Php
nginx, php-fpm on diff server bad gateway (以及安全性)
這有點像一個多部分的問題。
首先，我有 502 bad gateway，但我確信這只是因為我下面的這些行之一是錯誤的。
其次，我很想知道我是如何做到“安全”的。我知道那裡的許多指南都給出了糟糕的建議。我試圖巧妙地收集所有這些知識，但我很新，所以我可能會錯過一些東西。安全對我來說真的很重要，所以如果你願意的話，我會喜歡一個快速而骯髒的“審計”:)
對於我的拓撲，我將 EC2 與 VPC 一起使用。亞馬遜 Linux AMI。我有一個彈性負載均衡器，它連結到 2 個 nginx 伺服器。這些伺服器連結到一個單獨的 php-fpm 伺服器。
1 nginx 伺服器在我調試時被禁用。
這是我得到的錯誤。我覺得這很奇怪，因為我實際上並沒有
10.0.0.94在任何地方使用（據我所知）。我正在使用 *.210 和 *.248。
2013/03/27 14:33:10 [error] 2724#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 10.0.0.94, server: www.example.com, request: "GET /index.php HTTP/1.1", upstream: "fastcgi://10.0.0.210:9001", host: "xxx.us-east-1.elb.amazonaws.com"編輯：我忘了提一件事。我認為因為 php-fpm 是一個單獨的伺服器，所以我讀到我必須在其上具有與 nginx 伺服器相同的文件。我還沒有 rsync 或任何設置…我只是將一個簡單的 index.php 文件上傳到兩者
/var/www/html/example.com/index.php作為測試。伺服器 1 和 2 (nginx)
nginx.conf
# Run as a less privileged user for security reasons. user www www; worker_processes auto; events { worker_connections 1024; } error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; http { server_tokens off; include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; # How long to allow each connection to stay idle; longer values are better # for each individual client, particularly for SSL, but means that worker # connections are tied up longer. (Default: 65) keepalive_timeout 65; # Speed up file transfers by using sendfile() to copy directly # between descriptors rather than using read()/write(). sendfile on; # Tell Nginx not to send out partial frames; this increases throughput # since TCP frames are filled up before being sent out. (adds TCP_CORK) tcp_nopush on; # Tell Nginx to enable the Nagle buffering algorithm for TCP packets, which # collates several smaller packets together into one larger packet, thus saving # bandwidth at the cost of a nearly imperceptible increase to latency. (removes TCP_NODELAY) tcp_nodelay off; gzip on; gzip_http_version 1.0; gzip_disable "msie6"; gzip_comp_level 5; gzip_min_length 256; gzip_proxied any; gzip_vary on; gzip_types # text/html is always compressed by HttpGzipModule text/css text/plain text/x-component application/javascript application/json application/xml application/xhtml+xml application/x-font-ttf application/x-font-opentype application/vnd.ms-fontobject image/svg+xml image/x-icon; # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols. # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support. ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes. # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection. # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state. # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS. ssl_session_cache shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions ssl_session_timeout 10m; # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication). # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors. # ssl_certificate /etc/nginx/default_ssl.crt; # ssl_certificate_key /etc/nginx/default_ssl.key; upstream php { # ip_hash; server 10.0.0.210:9001; } include sites-enabled/*; }啟用站點/example.com
server { listen 80; server_name www.example.com; root /var/www/html/example.com; index index.html index.htm index.php; charset utf-8; error_page 404 /system/404.html; error_page 403 /system/404.html; location ~ \.php$ { fastcgi_index index.php; fastcgi_pass php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; # fastcgi_intercept_errors on; } include conf/base.conf; } server { listen 80; server_name example.com; return 301 $scheme://www.example.com$request_uri; }伺服器 3 (php-fpm)
php.ini
cgi.fix_pathinfo = 0php-fpm.conf
;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; include=/etc/php-fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] pid = /var/run/php-fpm/php-fpm.pid error_log = /var/log/php-fpm/error.log emergency_restart_threshold = 5 emergency_restart_interval = 2/etc/php-fpm.d/www.conf
[www] listen = 127.0.0.1:9001 listen.allowed_clients = 10.0.0.248 user = www group = www pm = dynamic pm.max_children = 50 pm.start_servers = 15 pm.min_spare_servers = 5 pm.max_spare_servers = 25 request_terminate_timeout = 30 slowlog = /var/log/php-fpm/www-slow.log security.limit_extensions = .php php_flag[display_errors] = off php_admin_value[error_reporting] = 0 php_admin_value[error_log] = /var/log/php-fpm/www-error.log php_admin_flag[log_errors] = on php_admin_value[memory_limit] = 128M php_value[session.save_handler] = files php_value[session.save_path] = /var/lib/php/session這就是我到目前為止所擁有的一切：| 慢慢進步…謝謝！
所以這是你的問題，在
/etc/php-fpm.d/www.conf：listen = 127.0.0.1:9001您只是在偵聽環回地址，因此它無法接收來自您 VPC 中其他伺服器的連接。
請嘗試：
listen = 9001至於“安全審計”，這裡確實沒有足夠的資訊來給你任何有意義的東西。只需仔細檢查您的安全組。