php-fpm, nginx configuration and all the commands for http://blog.madrzejewski.com/faire-fonctionner-curl-en-https-dans-un-environnement-php-fpm-chroote
| # All the command used here : http://blog.madrzejewski.com/faire-fonctionner-curl-en-https-dans-un-environnement-php-fpm-chroote | |
| # Centos 7.1, the libs named may changed in the future, so don't just copy/paste and check on your system first | |
| # First example, chroot bash | |
| mkdir chroot_bash | |
| mkdir -p chroot_bash/usr/bin | |
| cp /usr/bin/bash chroot_bash/usr/bin | |
| chroot chroot_bash/ bash | |
| chroot: failed to run command ‘bash’: No such file or directory | |
| ldd /usr/bin/bash | |
| linux-vdso.so.1 => (0x00007fff22d80000) | |
| libtinfo.so.5 => /lib64/libtinfo.so.5 (0x00007f15009d9000) | |
| libdl.so.2 => /lib64/libdl.so.2 (0x00007f15007d5000) | |
| libc.so.6 => /lib64/libc.so.6 (0x00007f1500413000) | |
| /lib64/ld-linux-x86-64.so.2 (0x00007f1500c0d000) | |
| mkdir chroot_bash/lib64 | |
| cp /lib64/libtinfo.so.5 /lib64/libdl.so.2 /lib64/libc.so.6 /lib64/ld-linux-x86-64.so.2 chroot_bash/lib64/ | |
| chroot chroot_bash/ bash | |
| bash-4.2# pwd | |
| / | |
| bash-4.2# ls | |
| bash: ls: command not found | |
| # Chroot php-fpm | |
| useradd -md /home/tuto tuto | |
| mkdir /home/tuto/www | |
| wget http://fr.wordpress.org/latest-fr_FR.zip | |
| unzip latest-fr_FR.zip && mv wordpress/* /home/tuto/www | |
| rm -rf wordpress/ latest-fr_FR.zip | |
| chwon -R tuto: ~tuto | |
| mkdir -p /home/tuto/{etc,usr/share,var/lib/php/session,var/log/php-fpm,tmp,lib64,lib,bin,dev} | |
| cp -r /usr/share/zoneinfo /home/tuto/usr/share/ | |
| cp -r /etc/ld.so.cache /etc/resolv.conf /etc/ld.so.conf /etc/nsswitch.conf /etc/hosts /etc/localtime /home/tuto/etc/ | |
| mkdir -p /home/tuto/var/lib/mysql && touch /home/tuto/var/lib/mysql/mysql.sock | |
| chown -R tuto: ~tuto | |
| mount --bind /var/lib/mysql/mysql.sock /home/tuto/var/lib/mysql/mysql.sock | |
| mknod /home/tuto/dev/null c 1 3 -m 666 | |
| # Problems with SSL and the DNS resolution | |
| cp -vaR /lib64/libdns-export.so.100.1.1 /lib64/libdns.so.100.1.1 /lib64/libnss_dns-2.17.so . | |
| cd /home/tuto/lib64 | |
| ln -s libdns-export.so.100.1.1 libdns-export.so.100 | |
| ln -s libdns.so.100.1.1 libdns.so.100 | |
| ln -s libnss_dns.so libnss_dns.so.2 | |
| ln -s libnss_dns-2.17.so libnss_dns.so | |
| # An quick example on how to use strace | |
| ps -ef |grep php-fpm | |
| strace -p PID_PROCESSUS 2> logs_ | |
| # Let's continue with the dns problem | |
| cp -vaR /etc/pki /home/tuto/etc/ | |
| cp -vaR /lib64/nss /home/tuto/lib64 | |
| # Another strace example to show the ssl problem | |
| strace chroot /home/tuto /bin/curl -v https://google.com 2> logs_3 | |
| # SSL solution | |
| cp /lib64/libsoftokn3.so /lib64/libnss3.so /etc/alternatives/libnssckbi.so.x86_64 /lib64/libnss_compat-2.17.so /lib64/libnss_compat.so.2 /lib64/libnss_db-2.17.so /lib64/libnss_db.so.2 libnss_db-2.17.so /lib64/libfreeblpriv3.so /lib64/libnss_dns-2.17.so /lib64/libnss_files-2.17.so /lib64/libnss_hesiod-2.17.so /lib64/libnss_myhostname.so.2 /lib64/libnss_nis-2.17.so /lib64/libnss_nisplus-2.17.so /lib64/libnsspem.so /lib64/libnss_sss.so.2 /lib64/libnsssysinit.so /lib64/libnssutil3.so /home/tuto/lib64 | |
| cp /lib64/libsqlite3.so.0 /lib64/libsqlite3.so.0.8.6 tuto/lib64/ |
| #!/bin/bash | |
| # Be careful, do not use in production | |
| # Just a quick script for messing around with chroot and ldd | |
| usage(){ | |
| echo "Usage : $0 cmd_name homedir" | |
| echo "Example : $0 cp /home/alex" | |
| exit 1 | |
| } | |
| error(){ | |
| test "$1" == "" && (echo "An unknow error occurded" ; exit 1) | |
| echo "$1" ; exit 1 | |
| } | |
| # $1 : cmd | |
| findCmdPath(){ | |
| oldIFS=$IFS | |
| IFS=$':' | |
| for dir in $PATH ; do | |
| fullPath=$(find $dir -name $1 2> /dev/null) | |
| test "$fullPath" != "" && (echo $fullPath ; return) | |
| done | |
| } | |
| # $1 : fullPath of cmd | |
| # I tried others commands to find the full/real path for a symlink | |
| # for example "readlink" but it was not working properly for my usage | |
| # I just wanted the "first degree" of symlink so ls -l worked fine for this | |
| findLibs(){ | |
| ldd $1 |tr -d '\t'| tr -d ' ' |cut -d '>' -f 2|cut -d '(' -f 1|grep -E '^/' 2> /dev/null || error "LDD error" | |
| } | |
| # $1 : lib path (or symlink) | |
| # $2 : homedir without the trailing / | |
| copyLib(){ | |
| if test -L $1 ; then | |
| # symlink | |
| currentPath=$(dirname $1) | |
| # copy the symlink | |
| mkdir -p $2$currentPath 2> /dev/null | |
| cp -va $1 $2$currentPath | |
| # find the real file | |
| realFile=$(ls -lh $1 | tr -d ' ' | cut -d '>' -f 2) | |
| realFile=$currentPath'/'$realFile | |
| mkdir -p $2$currentPath 2> /dev/null | |
| cp -va $realFile $2$currentPath | |
| else | |
| # file | |
| currentPath=$(dirname $1) | |
| mkdir -p $2$currentPath 2> /dev/null | |
| cp -va $1 $2$currentPath | |
| fi | |
| } | |
| # Tests | |
| test "$#" != 2 && usage | |
| cmdPath=$(findCmdPath $1) | |
| test "$cmdPath" == "" && error "$1 was not found in the PATH" | |
| homeDir=$(echo $2 | sed 's:/*$::') # remove the trailing / | |
| test ! -d "$homeDir" && error "$homeDir is not a directory" | |
| # main | |
| for lib in $(findLibs $cmdPath) ; do | |
| copyLib $lib $homeDir | |
| done |
| [tuto] | |
| listen = /var/run/tuto.sock | |
| listen.allowed_clients = 127.0.0.1 | |
| listen.owner = nginx | |
| listen.group = nginx | |
| user = tuto | |
| group = tuto | |
| pm = dynamic | |
| pm.max_children = 50 | |
| pm.start_servers = 5 | |
| pm.min_spare_servers = 5 | |
| pm.max_spare_servers = 20 | |
| pm.max_requests = 500 | |
| slowlog = /var/log/php-fpm/tuto-slow.log | |
| chroot = /home/tuto | |
| chdir = /www | |
| env[HOSTNAME] = $HOSTNAME | |
| env[TMP] = /tmp | |
| env[TMPDIR] = /tmp | |
| env[TEMP] = /tmp | |
| php_flag[display_errors] = on | |
| php_admin_value[error_log] = /var/log/php-fpm/www-error.log | |
| php_admin_flag[log_errors] = on | |
| php_value[session.save_handler] = files | |
| php_value[session.save_path] = /var/lib/php/session |
| server { | |
| listen 80; | |
| server_name tuto.madrzejewski.com; | |
| root /home/tuto/www; | |
| access_log /var/log/nginx/tuto.madrzejewski.com-access.log; | |
| error_log /var/log/nginx/tuto.madrzejewski.com-error.log; | |
| location = /favicon.ico { | |
| log_not_found off; | |
| access_log off; | |
| } | |
| location = /robots.txt { | |
| allow all; | |
| log_not_found off; | |
| access_log off; | |
| } | |
| # auth for admin directory | |
| location /wp-admin/ { | |
| auth_basic "Access restreint"; | |
| auth_basic_user_file /etc/nginx/htpasswd/passwd; | |
| } | |
| # no PHP in upload directory | |
| location ~* /(?:uploads|files)/.*\.php$ { | |
| deny all; | |
| } | |
| # hide sensitive files | |
| #location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_ | |
| #{ | |
| # return 444; | |
| #} | |
| # no cgi | |
| location ~* \.(pl|cgi|py|sh|lua)\$ { | |
| return 444; | |
| } | |
| # no access to specific files | |
| location ~ /(\.|wp-config.php|readme.html|license.txt) { | |
| deny all; | |
| } | |
| location / { | |
| # This is cool because no php is touched for static content. | |
| # include the "?$args" part so non-default permalinks doesn't break when using query string | |
| try_files $uri $uri/ /index.php?$args; | |
| } | |
| # no weird request | |
| if ($request_method !~ ^(GET|HEAD|POST)$ ) | |
| { | |
| return 444; | |
| } | |
| location ~ [^/]\.php(/|$) { | |
| include /etc/nginx/fastcgi.conf; | |
| fastcgi_split_path_info ^(.+?\.php)(/.*)$; | |
| if (!-f $document_root$fastcgi_script_name) { | |
| return 404; | |
| } | |
| #fastcgi_pass 127.0.0.1:9000; | |
| # debug test chroot phpfpm | |
| fastcgi_param SCRIPT_FILENAME /www/$fastcgi_script_name; | |
| fastcgi_pass unix:/var/run/tuto.sock; | |
| fastcgi_index index.php; | |
| } | |
| location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ { | |
| expires max; | |
| log_not_found off; | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment