Nginx and PHP-FPM Permissions Security Configuration

Environment:

• A single Gentoo host
• Two WordPress Blogs
• Nginx
• PHP-FPM 5.6
• Mysql

Need to do two WordPress blog permissions on the security of each other isolated.

Approximate steps:

• New two system users: Blog1, blog2. The shell is nologin.
• MySQL new two users blog1/blog2, two new database dbblog1/dbblog2, respectively, to open the user to their respective database
• WordPress Compressed Package After decompression, the owner of all changed to BLOG1/BLOG2
• PHP-FPM use sock communication; Process belongs to the master is blog1/blog2, sock file of the owner is blog1/blog2, belong to the group is nginx; Open chroot
• Nginx Process permission is Nginx

The following record steps, for Blog1, blog2 and BLOG1 configurations, are identical, so that individual fields can be changed:

Create two system service users:

Because it is a service user, the shell needs to be set to/sbin/nologin prohibit login; In addition, you do not need to generate a home directory.

$ useradd-u 1201-s/sbin/nologin-d/dev/null blog1

MySQL new user, database, configure permissions:

Database-level permissions are isolated, and each user has only the permissions of their own related databases.

CREATE DATABASE Dbblog1; CREATE USER ' blog1 ' @ ' localhost ' identified by '
 
  
   
  ; GRANT all on dbblog1.* to ' blog1 ' @ ' localhost '; FLUSH PRIVILEGE;
 
  

WordPress Compressed Package Decompression, change the owner of the file:

The main change is to PHP-FPM have permission to read and write site files.

$ tar zxvf wordpress-4.4.2-zh_cn.tar.gz$ mv WordPress blog1$ chown-r blog1 blog1$ ls-alhd blog1drwxr-xr-x 5 blog1 Nogrou P 4.0K Feb  3 08:13 blog1

PHP-FPM configuration:

First modify the master configuration/etc/php/fpm-php5.6/php-fpm.conf:

Comment out all the configuration items in the Pool definitions, i.e. remove the default wwwpool; To open the Include item:

; Include one or more files. If Glob (3) exists, it is used to include a bunch of; Files from a glob (3) pattern. This directive can is used everywhere in the; file.; Relative path can also be used. They would be prefixed by:;  -The global prefix if it ' s been set (-P argument);  -/usr/lib64/php5.6 otherwiseinclude=/etc/php/fpm-php5.6/etc/fpm.d/*.conf

A separate PHP-FPM configuration for each Web site (see the default configuration file for specific explanations):

$ cat/etc/php/fpm-php5.6/etc/fpm.d/blog1.conf[blog1]user = Blog1    ; uidgroup = Nogrouplisten of PHP-FPM child process =/var/run/ Php-fpm-blog1.socklisten.owner = Nginx    ; Sock communication file owner, and nginx communication listen.group = Nginx    ; sock communication file belongs to the group, and Nginx Communication Listen.mode = 0660pm = Dynamicpm.max_children = 5pm.start_servers = 2pm.min_spare_servers = 1pm.max_spare_ Servers = 3chroot =/var/www/blog1chdir =/

User is configured to control permissions and read and write site files.

Configuration Listen.owner/group is for Nginx to have permissions and PHP-FPM communication.

Set the chroot to the site directory, limiting the minimum access rights. Command PWDX to view the current working directory of the specified process.

$ ps aux | grep phproot      5646  0.0  0.3 247836  7192?        Ss   14:55   0:00 php-fpm:master process (/etc/php/fpm-php5.6/php-fpm.conf) blog1     5647  0.0  0.6 247944 13884?        S    14:55   0:00 php-fpm:pool blog1blog1     5648  0.0  0.6 247812 13192?        S    14:55   0:00 php-fpm:pool blog1blog2     5649  0.0  1.4 251840 29756?        S    14:55   0:00 php-fpm:pool blog2blog2     5650  0.0  0.3 247812  6636?        S    14:55   0:00 php-fpm:pool blog2root     10071  0.0  0.1 112700  2100 PTS/4    s+   15:52   0:00 grep--color php$ pwdx 56475647:/var/www/blog1

Nginx Configuration:

server {    listen;    server_name blog1.tankywoo.com;    Index index.php;    Access_log/var/log/nginx/blog1_log main;    Error_log/var/log/nginx/blog1_error_log;    root/var/www/blog1/;    Location ~. php$ {        try_files      $uri  =404;        Fastcgi_pass   Unix:///var/run/php-fpm-blog1.sock;        Include        fastcgi.conf;        Fastcgi_param  script_filename    /$fastcgi _script_name;    }}

Note the Fastcgi_param configuration. If it is the default:

Fastcgi_param script_filename $document _root$fastcgi_script_name;

Then PHP-FPM (fastcgi) reads index.php, which is/var/www/blog1/inex.php.

Because PHP-FPM is configured with chroot, this directory is the directory after chroot.

That is, the actual read/var/www/blog1/var/www/blog1/index.php

In the middle of the process, encountered several errors:

PHP-FPM log:

PHP-FPM chroot FastCGI sent in stderr: "Primary script Unknown" while reading response headers from upstream

The PHP file could not be found because FastCGI's script_filename configuration did not match.

Database connection Failed

The reason is that WordPress by default is connected to the database through the socket, and at this time the Web site is chroot, so cannot find sock file.

Method 1 is to mount the sock file in:

$ mkdir-p/var/www/blog1/var/run/mysqld$ Mount--bind/var/run/mysqld/var/www/blog1/var/run/mysqld

But this method is not perfect.

Method 2 is to change WordPress via TCP link MySQL, wp-config.php add:

Define (' Db_host ', ' 127.0.0.1 ');

Reference Links:

• Nginx and PHP-FPM Configuration and optimizing Tips and Tricks
• How to Host multiple Websites securely with Nginx and php-fpm on Ubuntu 14.04
• Nginx + php-fpm with chroot
• Apache + php-fpm + chroot results "File not found." Error

