I have been spending few hours on that issue and despite the high number of posts related to it, I cannot solve it. I have a Fedora 20 box with Nginx + PHP-FPM that worked quite good until today (after I reloaded php-fpm.service I guess). Nginx is serving static files with no problem, but any PHP file triggers an error 403.
The permissions are ok, nginx and php-fpm are running under the user "nginx":
root 13763 0.0 0.6 490428 24924 ? Ss 15:47 0:00 php-fpm: master process (/etc/php-fpm.conf)
nginx 13764 0.0 0.1 490428 7296 ? S 15:47 0:00 php-fpm: pool www
nginx 13765 0.0 0.1 490428 7296 ? S 15:47 0:00 php-fpm: pool www
nginx 13766 0.0 0.1 490428 7296 ? S 15:47 0:00 php-fpm: pool www
nginx 13767 0.0 0.1 490428 7296 ? S 15:47 0:00 php-fpm: pool www
nginx 13768 0.0 0.1 490428 6848 ? S 15:47 0:00 php-fpm: pool www
The served files have been set to nginx user as well, I even ended chmoding 777 those files to try, but still "Access denied" for any PHP files.
Below is a server of my Nginx config:
server {
listen 80;
server_name localhost;
root /var/www/html;
location ~ \.php$ {
fastcgi_intercept_errors on;
try_files $uri =404;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
The PHP-FPM pool:
[www]
...
listen = 127.0.0.1:9000
user = nginx
group = nginx
...
For the versions:
php-5.5.11 (as well as php-fpm-5.5.11 of course)
nginx-1.4.7
I am adding the Nginx error log:
FastCGI sent in stderr: "Access to the script '/var/www/html' has been denied (see security.limit_extensions)" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: localhost, request: "GET /index.php HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "xxx.xxx.xxx.xxx"
And precise that security.limit_extensions is correct, set to: security.limit_extensions = .php.
About the path permissions, /var/www/html can be traversed. What am I missing?
limit_extensionsis present only in the FPM pool, for me with Fedora 20 in/etc/php-fpm.d/www.conf.. But thank you John – Wanfastcgi_passto the socket address instead of the serveraddress (e.g. unix:/var/run/php-fpm/php-fpm.sock;)? – Dimityfastcgi_param SCRIPT_FILENAMEto$fastcgi_script_name, reload fpm and try again? Without$document_root... – Dimitysecurity.limit_extensionsso it looks like this:security.limit_extensions =.. – DimityFastCGI sent in stderr: "Unable to open primary script: /var/www/html (Success)" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: localhost, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm.sock:", host: "xxx.xxx.xxx.xxx"Some thread suggested to set it to FALSE too, same result. – Wanlimit_extensionsempty and includefastcgi_split_path_info ^(.+\.php)(/.+)$;in your location block and try again with and without the $doc_root inSCRIPT_FILENAME– Dimitylocation ~ \.php$ { include /etc/nginx/fastcgi_params; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;}– Magnumcgi.fix_pathinfofrom 0 to 1 and everything is working now. Thank you for your time, you support helped! ;] – Wan