0

I have few WordPress websites, all with same config - difference only with user and domain, but got 403 only for newly created virtualhost:

# cat barelef-art.kiev.ua.conf
server {
    server_name barelef-art.kiev.ua;
    access_log /var/log/nginx/barelef-art.kiev.ua-access.log;
    error_log /var/log/nginx/barelef-art.kiev.ua-error.log;
    root /var/www/vhosts/barelef_art/barelef-art.kiev.ua;

    location / {
        index index.php;
    }

    location ~ \.php$ {
        include /etc/nginx/fastcgi_params;
        fastcgi_pass  127.0.0.1:9012;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /var/www/vhosts/barelef_art/barelef-art.kiev.ua$fastcgi_script_name;
    }
}

And also - similar php-fpm configs for few sites:

# cat barelef-art.kiev.ua.conf
[barelef-art.kiev.ua]

listen = 127.0.0.1:9012

listen.allowed_clients = 127.0.0.1

user = barelef_art
group = barelef_art

pm = dynamic
pm.max_children = 20
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 1
pm.max_requests = 50

slowlog = /var/log/nginx/barelef-art.kiev.ua-slow.log

;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
;php_flag[display_errors] = off
php_admin_value[error_log] = /var/log/nginx/barelef-art.kiev.ua-error.log
php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 128M

; Set session path to a directory owned by process user
php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

php_admin_value[session.save_path] = /var/lib/php/session/barelef_art

User exist:

# id barelef_art
uid=523(barelef_art) gid=523(barelef_art) groups=523(barelef_art)

And virtualhost directory have correct owner:

# ls -l /var/www/vhosts/barelef_art/barelef-art.kiev.ua/
total 192
-rw-r--r--  1 barelef_art barelef_art   418 Dec 11 18:59 index.php
-rw-r--r--  1 barelef_art barelef_art 19930 Dec 11 18:59 license.txt
-rw-r--r--  1 barelef_art barelef_art 10691 Dec 11 18:59 readme.html
-rw-r--r--  1 barelef_art barelef_art  4951 Dec 11 18:59 wp-activate.php
...
drwxr-xr-x 12 barelef_art barelef_art  4096 Dec 11 18:59 wp-includes
...

# ls -l /var/lib/php/session/
total 328
drwxr-xr-x 2 barelef_art barelef_art   4096 Dec 11 19:06 barelef_art

But when I try open index.php - I got in log:

2014/12/11 20:39:18 [error] 13839#0: *133 "/var/www/vhosts/barelef_art/barelef-art.kiev.ua/index.php" is forbidden (13: Permission denied), client: 37.***.***.56, server: barelef-art.kiev.ua, request: "GET / HTTP/1
.1", host: "barelef-art.kiev.ua"

What I'm doing wrong?

Once again - same configuration files used for few websites with same CMS, and they works. One of them I added today morning. In evening - added this new - and it's don't work... Seems - I missed something, but - can't understood what and where.

CentOS 6.6, Nginx 1.6.2.

UPD

Adding index.html and open it directly with http://barelef-art.kiev.ua/index.html also returns 403;

ps return correct user for PHP-FPM process:

# ps -eo user:$(cut -d: -f1 /etc/passwd | wc -L),pid,ppid,c,stime,tname,time,cmd | grep "php-fpm.*barelef" | grep -v grep
barelef_art 14883 14868  0 21:33 ?        00:00:00 php-fpm: pool barelef-art.kiev.ua

# lsof -p 14883 | head
COMMAND   PID        USER   FD   TYPE  DEVICE SIZE/OFF    NODE NAME
php-fpm 14883 barelef_art  cwd    DIR   253,0     4096       2 /
php-fpm 14883 barelef_art  rtd    DIR   253,0     4096       2 /
php-fpm 14883 barelef_art  txt    REG   253,0  3309952 1051669 /usr/sbin/php-fpm
php-fpm 14883 barelef_art  mem    REG   253,0    65928 1709260 /lib64/libnss_files-2.12.so
php-fpm 14883 barelef_art  mem    REG   253,0    83088 1179907 /usr/lib64/php/modules/zip.so

But it seems more NGINX issue...

  • Are you serving PHP or HTML? – eyoung100 Dec 11 '14 at 19:25
  • PHP. HTML index was added just for check. – setevoy Dec 11 '14 at 19:27
  • 2
    What are the permissions on the directories /var/www/vhosts/barelef_art/barelef-art.kiev.ua/ & /var/www/vhosts/barelef_art/? – Chris Davidson Dec 11 '14 at 20:01
  • Aggr! Thanks, @Dayvo. There was 700 on /var/www/vhosts/barelef_art/ :-) P.S. If you'll add this as answer - I'll can accept it. Very stupid mistake :-( – setevoy Dec 11 '14 at 20:14
  • 1
    No probem :), always worth working your way back up the directory tree when you see permissions issues. – Chris Davidson Dec 11 '14 at 20:26
1

Check the permissions of directories /var/www/vhosts/barelef_art/barelef-art.kiev.ua/ & /var/www/vhosts/barelef_art/.

When getting forbidden errors in either Nginx or Apache it is always worth working your way back up the tree of directories to ensure the web server can access at each level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.