简体繁体 English

apache2 + MPM-ITK + PHP = 套接字不起作用

[英]apache2 + MPM-ITK + PHP = socket doesn't work

原文 2017-06-15 02:16:59 7 2 php/ apache/ sockets

I have 2 servers running an proprietary software that I can access by an specific port and sending/receiving JSON string.我有 2 台服务器运行专有软件，我可以通过特定端口访问并发送/接收 JSON 字符串。 In both servers, I have apache2 with ITK for each virtual host.在两台服务器中，我都为每个虚拟主机安装了带有 ITK 的 apache2。 In server "A", I have an PHP script that uses socket to connect to server "A" and "B" to get data and display on webpage.在服务器“A”中，我有一个 PHP 脚本，它使用套接字连接到服务器“A”和“B”以获取数据并显示在网页上。 The problem is that PHP can connect only to server "A" (localhsot), but can't connect to server "B".问题是 PHP 只能连接到服务器“A”（localhsot），而无法连接到服务器“B”。 The PHP doesn't show any error (display_errors are on in php.ini) and when I try to get last error from socket (I don't remember the php function right now), I get nothing. PHP 没有显示任何错误（显示错误在 php.ini 中），当我尝试从套接字获取最后一个错误时（我现在不记得 php 函数），我什么也没得到。 On apache log, I got this error:在 apache 日志上，我收到此错误：

Operation not permitted: AH02156: setgid: unable to set group id to Group 0不允许的操作：AH02156：setgid：无法将组 ID 设置为组 0

There's no firewall blocking between hosts, I can 'telnet' both servers in any direction without any problem.主机之间没有防火墙阻止，我可以在任何方向“telnet”两台服务器而没有任何问题。 Just PHP doesn't connect to 'external' hsot, just localhost.只是 PHP 不连接到“外部”hsot，只是本地主机。 The only change in my vhost file is to add itk option:我的 vhost 文件中唯一的变化是添加 itk 选项：

AssignUserId rpi rpi分配用户 ID rpi rpi

So my question is: how to I configure apache-itk to allow my PHP to open external sockets?所以我的问题是：如何配置 apache-itk 以允许我的 PHP 打开外部套接字？ I have tried to change LimitUIDRange to "LimitUIDRange 0 0", but no success.我试图将 LimitUIDRange 更改为“LimitUIDRange 0 0”，但没有成功。

2 个解决方案

maybe related to the Apache module:可能与 Apache 模块有关：

mpm_itk_module mpm_itk_module

or或

AssignUserId分配用户 ID

Apache config.阿帕奇配置。

Please see this links:请看这个链接：

I'm trying to solve the same problem.我正在尝试解决同样的问题。

If you set LimitUIDRange 0 0 , that means that only root is allowed, which doesn't make sense.如果你设置LimitUIDRange 0 0 ，那意味着只允许 root ，这是没有意义的。 The correct directives would be LimitUIDRange 0 65534 and LimitGIDRange 0 65534 .正确的指令是LimitUIDRange 0 65534和LimitGIDRange 0 65534 。 As long as you don't set any hosts to be run as root, this is not any more insecure than default apache.只要您不将任何主机设置为以 root 身份运行，这并不比默认的 apache 更不安全。 Especialy does it not mean that website users are allowed to change their own user id.特别是这并不意味着网站用户可以更改自己的用户 ID。 However, they will be allowed to run executables with the setuid bit set, like any other normal user.但是，他们将被允许运行设置了 setuid 位的可执行文件，就像任何其他普通用户一样。