带Nginx，Passenger，Unix的403禁止在Rails应用上

Question

您好，尽管按照这里的步骤操作，我仍然遇到403错误

403禁止在带有Nginx的Rails应用程序上使用，乘客

我的应用文件夹权限

namei -l /home/ubuntu/resume_consumer/current/public

f: /home/ubuntu/resume_consumer/current/public
drwxr-xr-x root   root   /
drwxr-xr-x root   root   home
drwxr-xr-x ubuntu ubuntu ubuntu
drwxrwxr-x ubuntu ubuntu resume_consumer
lrwxrwxrwx ubuntu ubuntu current -> /home/ubuntu/resume_consumer/releases/20150815211156
drwxr-xr-x root   root     /
drwxr-xr-x root   root     home
drwxr-xr-x ubuntu ubuntu   ubuntu
drwxrwxr-x ubuntu ubuntu   resume_consumer
drwxrwxr-x ubuntu ubuntu   releases
drwxrwxr-x ubuntu ubuntu   20150815211156
drwxrwxr-x ubuntu ubuntu public

Nginx应用程序无人运行

ps waux | grep nginx

root     12005  0.0  0.0  42480   900 ?        Ss   Jul28   0:00 nginx: master process /opt/nginx/sbin/nginx
nobody   12006  0.0  0.1  42804  2016 ?        S    Jul28   0:00 nginx: worker process

我的nginx配置如下

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    passenger_root /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14;
    passenger_ruby /home/ubuntu/.rvm/wrappers/ruby-2.2.1/ruby;

    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  qa.enterprise.getmeed.com;
        root /home/ubuntu/resume/current/public;
        passenger_enabled on;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

       # location / {
        #    root   html;
        #    index  index.html index.htm;
        #}

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        #error_page   500 502 503 504  /50x.html;
        #location = /50x.html {
        #    root   html;
        #}

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    server {
        listen       80;
        server_name  qa.getmeed.com;
        root /home/ubuntu/resume_consumer/current/public;
        index index.html index.htm;
        passenger_enabled on;
        rails_env production;
        passenger_friendly_error_pages on;
    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    }


    # HTTPS server
    #
    #server {
    #    listen       443;
    #    server_name  localhost;

    #    ssl                  on;
    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;
    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers   on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

当我查看日志时，我发现一条警告，指出PassengerAgent找不到另一个错误的目录禁止错误。 我不确定警报是否相关。

2015/08/15 23:40:41 [notice] 20858#0: signal process started
2015/08/15 23:40:41 [alert] 12005#0: Unable to start Phusion Passenger: Support binary PassengerAgent not found (tried: /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14/buildout/support-binaries/PassengerAgent and /root/.passenger/support-binaries/5.0.14/PassengerAgent). This probably means that your Phusion Passenger installation is broken or incomplete, or that your 'passenger_root' setting contains the wrong value. Please reinstall Phusion Passenger or adjust the setting (see: https://www.phusionpassenger.com/documentation/Users%20guide%20Nginx.html#PassengerRoot). (-1: Unknown error)
2015/08/15 23:45:04 [error] 20859#0: *375 directory index of "/home/ubuntu/resume_consumer/current/public/" is forbidden, client: 104.135.15.7, server: qa.getmeed.com, request: "GET / HTTP/1.1", host: "qa.getmeed.com"                                  

Answer 1

您只需要查看是否可以读取/home/ubuntu/resume_consumer/current/public 。 您正在向我们展示在Ubuntu主目录中设置的权限，但是current和public也将拥有自己的权限。

首先假设public内有一个index.html，下面的操作是否返回错误：

sudo -u nobody /home/ubuntu/resume_consumer/current/public

如果是这样，则您有权限问题。 您可以通过将nobody用户添加到同一ubuntu组来解决此问题：

sudo adduser nobody ubuntu

然后确保集团ubuntu用户具有相同的访问，因为ubuntu用户。

sudo chmod -R g=u /home/ubuntu/resume_consumer

Answer 2

谢谢大家！ 事实证明，nginx没有问题。 Nginx日志中有一个关于乘客的错误，我不确定最初是否与之相关，但是事实证明这是根本原因。

我已经安装了乘客，但是没有为该应用程序专门安装乘客。 我必须转到应用程序目录并安装passenger gem，然后在nginx config中的应用程序中使用对应于gem的passenger_root。 这解决了问题。