我使用的是 Ubuntu 16.04、Apache 2.4.29 和 php7.0-fpm。我尝试为多个用户和网站创建单独的池,以便它们在单独的用户下运行,并且每个网站都受到保护,以防其中一个网站被黑客入侵。我遵循了类似帖子关于这个问题,但它不太起作用。
下面是 /etc/php/7.0/fpm/pool.d 中的两个示例 pool.d conf 文件
用户名1.conf
[username]
user = username1
group = username1
listen = /run/php/php7.0-fpm.username1.sock
listen.owner = www-data #(I've already tried username1 here too)
listen.group = www-data #(I've already tried username1 here too)
listen.mode = 0660
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
-
用户名2.conf
[username]
user = username2
group = username2
listen = /run/php/php7.0-fpm.username2.sock
listen.owner = www-data #(I've already tried username2 here too)
listen.group = www-data #(I've already tried username2 here too)
listen.mode = 0660
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
请注意,每次保存conf文件后我都会重新加载php7.0-fpm和apache2。此外,这是我的两个Apache VirtualHost文件:
website1.com.conf (使用用户名1)
<VirtualHost *:80>
ServerAdmin [email protected]
ServerName www.website1.com
ServerAlias website1.com
RewriteEngine on
RewriteCond %{SERVER_NAME} =website1.com [OR]
RewriteCond %{SERVER_NAME} =www.website1.com
RewriteRule ^ https://www.website1.com%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:443>
<IfModule mod_fastcgi.c>
AddHandler php7-fcgi-username1 .php
Action php7-fcgi-username1 /php7-fcgi-username1
Alias /php7-fcgi-username1 /usr/lib/cgi-bin/php7-fcgi-username1
FastCgiExternalServer /usr/lib/cgi-bin/php7-fcgi-username1 -socket /run/php/php7.0-fpm.username1.sock -pass-header Authorization
<Directory "/usr/lib/cgi-bin">
Require all granted
</Directory>
</IfModule>
ServerAdmin [email protected]
ServerName www.website1.com
ServerAlias website1.com
DocumentRoot /home/username1/website1.com
DirectoryIndex index.html index.php
<Directory /home/username1/website1.com>
Options +SymLinksIfOwnerMatch
AllowOverride None
Require all granted
RewriteEngine On
RewriteCond %{HTTP_HOST} ^website1.com
RewriteRule (.*) https://www.website1.com/$1 [R=301,L]
<IfModule mod_fastcgi.c>
<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
SetHandler php7-fcgi-username1
</FilesMatch>
</IfModule>
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.website1.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.website1.com/privkey.pem
website2.com.conf (使用用户名2)
<VirtualHost *:80>
ServerAdmin [email protected]
ServerName www.website2.com
ServerAlias website2.com
RewriteEngine on
RewriteCond %{SERVER_NAME} =website2.com [OR]
RewriteCond %{SERVER_NAME} =www.website2.com
RewriteRule ^ https://www.website2.com%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:443>
<IfModule mod_fastcgi.c>
AddHandler php7-fcgi-username2 .php
Action php7-fcgi-username2 /php7-fcgi-username2
Alias /php7-fcgi-username2 /usr/lib/cgi-bin/php7-fcgi-username2
FastCgiExternalServer /usr/lib/cgi-bin/php7-fcgi-username2 -socket /run/php/php7.0-fpm.username2.sock -pass-header Authorization
<Directory "/usr/lib/cgi-bin">
Require all granted
</Directory>
</IfModule>
ServerAdmin [email protected]
ServerName www.website2.com
ServerAlias website2.com
DocumentRoot /home/username2/website2.com
DirectoryIndex index.html index.php
<Directory /home/username2/website2.com>
Options +SymLinksIfOwnerMatch
AllowOverride None
Require all granted
RewriteEngine On
RewriteCond %{HTTP_HOST} ^website2.com
RewriteRule (.*) https://www.website2.com/$1 [R=301,L]
<IfModule mod_fastcgi.c>
<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
SetHandler php7-fcgi-username2
</FilesMatch>
</IfModule>
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.website2.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.website2.com/privkey.pem
</VirtualHost>
以下是我已启用的所有 Apache 模块的列表:
Apache Mods 已启用
authn_core.load@ --> /etc/apache2/mods-available/authn_core.load
authn_file.load@ --> /etc/apache2/mods-available/authn_file.load
authz_core.load@ --> /etc/apache2/mods-available/authz_core.load
authz_host.load@ --> /etc/apache2/mods-available/authz_host.load
authz_user.load@ --> /etc/apache2/mods-available/authz_user.load
autoindex.conf@ --> /etc/apache2/mods-available/autoindex.conf
autoindex.load@ --> /etc/apache2/mods-available/autoindex.load
deflate.conf@ --> /etc/apache2/mods-available/deflate.conf
deflate.load@ --> /etc/apache2/mods-available/deflate.load
dir.conf@ --> /etc/apache2/mods-available/dir.conf
dir.load@ --> /etc/apache2/mods-available/dir.load
env.load@ --> /etc/apache2/mods-available/env.load
fastcgi.conf@ --> /etc/apache2/mods-available/fastcgi.conf
fastcgi.load@ --> /etc/apache2/mods-available/fastcgi.load
filter.load@ --> /etc/apache2/mods-available/filter.load
headers.load@ --> /etc/apache2/mods-available/headers.load
http2.load@ --> /etc/apache2/mods-available/http2.load
mime.conf@ --> /etc/apache2/mods-available/mime.conf
mime.load@ --> /etc/apache2/mods-available/mime.load
mpm_event.conf@ --> /etc/apache2/mods-available/mpm_event.conf
mpm_event.load@ --> /etc/apache2/mods-available/mpm_event.load
negotiation.conf@ --> /etc/apache2/mods-available/negotiation.conf
negotiation.load@ --> /etc/apache2/mods-available/negotiation.load
proxy.conf@ --> /etc/apache2/mods-available/proxy.conf
proxy.load@ --> /etc/apache2/mods-available/proxy.load
proxy_fcgi.load@ --> /etc/apache2/mods-available/proxy_fcgi.load
reqtimeout.conf@ --> /etc/apache2/mods-available/reqtimeout.conf
reqtimeout.load@ --> /etc/apache2/mods-available/reqtimeout.load
rewrite.load@ --> /etc/apache2/mods-available/rewrite.load
security2.conf@ --> /etc/apache2/mods-available/security2.conf
security2.load@ --> /etc/apache2/mods-available/security2.load
setenvif.conf@ --> /etc/apache2/mods-available/setenvif.conf
setenvif.load@ --> /etc/apache2/mods-available/setenvif.load
socache_shmcb.load@ --> /etc/apache2/mods-available/socache_shmcb.load
ssl.conf@ --> /etc/apache2/mods- available/ssl.conf
ssl.load@ --> /etc/apache2/mods-available/ssl.load
status.conf@ --> /etc/apache2/mods-available/status.conf
status.load@ --> /etc/apache2/mods-available/status.load
unique_id.load@ --> /etc/apache2/mods-available/unique_id.load
userdir.conf@ --> /etc/apache2/mods-available/userdir.conf
userdir.load@ --> /etc/apache2/mods-available/userdir.load
问题:似乎只有一个网站以这种方式正常工作。第二个网站在浏览器中收到 500 错误。我会收到如下错误:
[Fri Mar 09 00:01:36.965019 2018] [fastcgi:error] [pid 31964:tid 134959322724992] (2)No such file or directory: [client ***.***.***.***:47348] FastCGI: failed to connect to server "/usr/lib/cgi-bin/php7-fcgi-username2": connect() failed
[Fri Mar 09 00:01:36.966129 2018] [fastcgi:error] [pid 31964:tid 139355612722992] [client ***.***.***.***:47348] FastCGI: incomplete headers (0 bytes) received from server "/usr/lib/cgi-bin/php7-fcgi-username2"
此外,当我查看 /var/run/php 目录时,我看到:
php7.0-fpm.sock
php7.0-fpm.username1.sock
php7.0-fpm.pid
# (without php7.0-fpm.username2.sock)
在我的“/home”目录中,“www-data”是所有用户及其网站的组所有者:
drwx--x--- 11 username1 www-data 4096 Mar 3 07:25 username1
drwx--x--- 11 username2 www-data 4096 Mar 3 07:25 username1
请告诉我下一步该怎么做。我将有大约 30 个用户运行大约 60 个网站。我需要 Apache 以用户身份运行网站(而不是 www-data)。需要以这样的方式完成,即如果黑客入侵 Wordpress 网站,他们无法使用 www-data 访问和感染其他用户及其网站。如果黑客入侵,则需要将损害限制在仅一个用户身上。
答案1
两个pool.d
配置的第一行是相同的[username]
。这就是为什么它们被视为单个配置,并且您只看到/run/php/php7.0-fpm.username1.sock
。编辑第一行以包含实际用户名作为池名称。