php-fpm, nginx configuration and all the commands for http://blog.madrzejewski.com/faire-fonctionner-curl-en-https-dans-un-environnement-php-fpm-chroote
# All the command used here : http://blog.madrzejewski.com/faire-fonctionner-curl-en-https-dans-un-environnement-php-fpm-chroote | |
# Centos 7.1, the libs named may changed in the future, so don't just copy/paste and check on your system first | |
# First example, chroot bash | |
mkdir chroot_bash | |
mkdir -p chroot_bash/usr/bin | |
cp /usr/bin/bash chroot_bash/usr/bin | |
chroot chroot_bash/ bash | |
chroot: failed to run command ‘bash’: No such file or directory | |
ldd /usr/bin/bash | |
linux-vdso.so.1 => (0x00007fff22d80000) | |
libtinfo.so.5 => /lib64/libtinfo.so.5 (0x00007f15009d9000) | |
libdl.so.2 => /lib64/libdl.so.2 (0x00007f15007d5000) | |
libc.so.6 => /lib64/libc.so.6 (0x00007f1500413000) | |
/lib64/ld-linux-x86-64.so.2 (0x00007f1500c0d000) | |
mkdir chroot_bash/lib64 | |
cp /lib64/libtinfo.so.5 /lib64/libdl.so.2 /lib64/libc.so.6 /lib64/ld-linux-x86-64.so.2 chroot_bash/lib64/ | |
chroot chroot_bash/ bash | |
bash-4.2# pwd | |
/ | |
bash-4.2# ls | |
bash: ls: command not found | |
# Chroot php-fpm | |
useradd -md /home/tuto tuto | |
mkdir /home/tuto/www | |
wget http://fr.wordpress.org/latest-fr_FR.zip | |
unzip latest-fr_FR.zip && mv wordpress/* /home/tuto/www | |
rm -rf wordpress/ latest-fr_FR.zip | |
chwon -R tuto: ~tuto | |
mkdir -p /home/tuto/{etc,usr/share,var/lib/php/session,var/log/php-fpm,tmp,lib64,lib,bin,dev} | |
cp -r /usr/share/zoneinfo /home/tuto/usr/share/ | |
cp -r /etc/ld.so.cache /etc/resolv.conf /etc/ld.so.conf /etc/nsswitch.conf /etc/hosts /etc/localtime /home/tuto/etc/ | |
mkdir -p /home/tuto/var/lib/mysql && touch /home/tuto/var/lib/mysql/mysql.sock | |
chown -R tuto: ~tuto | |
mount --bind /var/lib/mysql/mysql.sock /home/tuto/var/lib/mysql/mysql.sock | |
mknod /home/tuto/dev/null c 1 3 -m 666 | |
# Problems with SSL and the DNS resolution | |
cp -vaR /lib64/libdns-export.so.100.1.1 /lib64/libdns.so.100.1.1 /lib64/libnss_dns-2.17.so . | |
cd /home/tuto/lib64 | |
ln -s libdns-export.so.100.1.1 libdns-export.so.100 | |
ln -s libdns.so.100.1.1 libdns.so.100 | |
ln -s libnss_dns.so libnss_dns.so.2 | |
ln -s libnss_dns-2.17.so libnss_dns.so | |
# An quick example on how to use strace | |
ps -ef |grep php-fpm | |
strace -p PID_PROCESSUS 2> logs_ | |
# Let's continue with the dns problem | |
cp -vaR /etc/pki /home/tuto/etc/ | |
cp -vaR /lib64/nss /home/tuto/lib64 | |
# Another strace example to show the ssl problem | |
strace chroot /home/tuto /bin/curl -v https://google.com 2> logs_3 | |
# SSL solution | |
cp /lib64/libsoftokn3.so /lib64/libnss3.so /etc/alternatives/libnssckbi.so.x86_64 /lib64/libnss_compat-2.17.so /lib64/libnss_compat.so.2 /lib64/libnss_db-2.17.so /lib64/libnss_db.so.2 libnss_db-2.17.so /lib64/libfreeblpriv3.so /lib64/libnss_dns-2.17.so /lib64/libnss_files-2.17.so /lib64/libnss_hesiod-2.17.so /lib64/libnss_myhostname.so.2 /lib64/libnss_nis-2.17.so /lib64/libnss_nisplus-2.17.so /lib64/libnsspem.so /lib64/libnss_sss.so.2 /lib64/libnsssysinit.so /lib64/libnssutil3.so /home/tuto/lib64 | |
cp /lib64/libsqlite3.so.0 /lib64/libsqlite3.so.0.8.6 tuto/lib64/ |
#!/bin/bash | |
# Be careful, do not use in production | |
# Just a quick script for messing around with chroot and ldd | |
usage(){ | |
echo "Usage : $0 cmd_name homedir" | |
echo "Example : $0 cp /home/alex" | |
exit 1 | |
} | |
error(){ | |
test "$1" == "" && (echo "An unknow error occurded" ; exit 1) | |
echo "$1" ; exit 1 | |
} | |
# $1 : cmd | |
findCmdPath(){ | |
oldIFS=$IFS | |
IFS=$':' | |
for dir in $PATH ; do | |
fullPath=$(find $dir -name $1 2> /dev/null) | |
test "$fullPath" != "" && (echo $fullPath ; return) | |
done | |
} | |
# $1 : fullPath of cmd | |
# I tried others commands to find the full/real path for a symlink | |
# for example "readlink" but it was not working properly for my usage | |
# I just wanted the "first degree" of symlink so ls -l worked fine for this | |
findLibs(){ | |
ldd $1 |tr -d '\t'| tr -d ' ' |cut -d '>' -f 2|cut -d '(' -f 1|grep -E '^/' 2> /dev/null || error "LDD error" | |
} | |
# $1 : lib path (or symlink) | |
# $2 : homedir without the trailing / | |
copyLib(){ | |
if test -L $1 ; then | |
# symlink | |
currentPath=$(dirname $1) | |
# copy the symlink | |
mkdir -p $2$currentPath 2> /dev/null | |
cp -va $1 $2$currentPath | |
# find the real file | |
realFile=$(ls -lh $1 | tr -d ' ' | cut -d '>' -f 2) | |
realFile=$currentPath'/'$realFile | |
mkdir -p $2$currentPath 2> /dev/null | |
cp -va $realFile $2$currentPath | |
else | |
# file | |
currentPath=$(dirname $1) | |
mkdir -p $2$currentPath 2> /dev/null | |
cp -va $1 $2$currentPath | |
fi | |
} | |
# Tests | |
test "$#" != 2 && usage | |
cmdPath=$(findCmdPath $1) | |
test "$cmdPath" == "" && error "$1 was not found in the PATH" | |
homeDir=$(echo $2 | sed 's:/*$::') # remove the trailing / | |
test ! -d "$homeDir" && error "$homeDir is not a directory" | |
# main | |
for lib in $(findLibs $cmdPath) ; do | |
copyLib $lib $homeDir | |
done |
[tuto] | |
listen = /var/run/tuto.sock | |
listen.allowed_clients = 127.0.0.1 | |
listen.owner = nginx | |
listen.group = nginx | |
user = tuto | |
group = tuto | |
pm = dynamic | |
pm.max_children = 50 | |
pm.start_servers = 5 | |
pm.min_spare_servers = 5 | |
pm.max_spare_servers = 20 | |
pm.max_requests = 500 | |
slowlog = /var/log/php-fpm/tuto-slow.log | |
chroot = /home/tuto | |
chdir = /www | |
env[HOSTNAME] = $HOSTNAME | |
env[TMP] = /tmp | |
env[TMPDIR] = /tmp | |
env[TEMP] = /tmp | |
php_flag[display_errors] = on | |
php_admin_value[error_log] = /var/log/php-fpm/www-error.log | |
php_admin_flag[log_errors] = on | |
php_value[session.save_handler] = files | |
php_value[session.save_path] = /var/lib/php/session |
server { | |
listen 80; | |
server_name tuto.madrzejewski.com; | |
root /home/tuto/www; | |
access_log /var/log/nginx/tuto.madrzejewski.com-access.log; | |
error_log /var/log/nginx/tuto.madrzejewski.com-error.log; | |
location = /favicon.ico { | |
log_not_found off; | |
access_log off; | |
} | |
location = /robots.txt { | |
allow all; | |
log_not_found off; | |
access_log off; | |
} | |
# auth for admin directory | |
location /wp-admin/ { | |
auth_basic "Access restreint"; | |
auth_basic_user_file /etc/nginx/htpasswd/passwd; | |
} | |
# no PHP in upload directory | |
location ~* /(?:uploads|files)/.*\.php$ { | |
deny all; | |
} | |
# hide sensitive files | |
#location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_ | |
#{ | |
# return 444; | |
#} | |
# no cgi | |
location ~* \.(pl|cgi|py|sh|lua)\$ { | |
return 444; | |
} | |
# no access to specific files | |
location ~ /(\.|wp-config.php|readme.html|license.txt) { | |
deny all; | |
} | |
location / { | |
# This is cool because no php is touched for static content. | |
# include the "?$args" part so non-default permalinks doesn't break when using query string | |
try_files $uri $uri/ /index.php?$args; | |
} | |
# no weird request | |
if ($request_method !~ ^(GET|HEAD|POST)$ ) | |
{ | |
return 444; | |
} | |
location ~ [^/]\.php(/|$) { | |
include /etc/nginx/fastcgi.conf; | |
fastcgi_split_path_info ^(.+?\.php)(/.*)$; | |
if (!-f $document_root$fastcgi_script_name) { | |
return 404; | |
} | |
#fastcgi_pass 127.0.0.1:9000; | |
# debug test chroot phpfpm | |
fastcgi_param SCRIPT_FILENAME /www/$fastcgi_script_name; | |
fastcgi_pass unix:/var/run/tuto.sock; | |
fastcgi_index index.php; | |
} | |
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ { | |
expires max; | |
log_not_found off; | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment