帶Nginx，Passenger，Unix的403禁止在Rails應用上

Question

您好，盡管按照這里的步驟操作，我仍然遇到403錯誤

403禁止在帶有Nginx的Rails應用程序上使用，乘客

我的應用文件夾權限

namei -l /home/ubuntu/resume_consumer/current/public

f: /home/ubuntu/resume_consumer/current/public
drwxr-xr-x root   root   /
drwxr-xr-x root   root   home
drwxr-xr-x ubuntu ubuntu ubuntu
drwxrwxr-x ubuntu ubuntu resume_consumer
lrwxrwxrwx ubuntu ubuntu current -> /home/ubuntu/resume_consumer/releases/20150815211156
drwxr-xr-x root   root     /
drwxr-xr-x root   root     home
drwxr-xr-x ubuntu ubuntu   ubuntu
drwxrwxr-x ubuntu ubuntu   resume_consumer
drwxrwxr-x ubuntu ubuntu   releases
drwxrwxr-x ubuntu ubuntu   20150815211156
drwxrwxr-x ubuntu ubuntu public

Nginx應用程序無人運行

ps waux | grep nginx

root     12005  0.0  0.0  42480   900 ?        Ss   Jul28   0:00 nginx: master process /opt/nginx/sbin/nginx
nobody   12006  0.0  0.1  42804  2016 ?        S    Jul28   0:00 nginx: worker process

我的nginx配置如下

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    passenger_root /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14;
    passenger_ruby /home/ubuntu/.rvm/wrappers/ruby-2.2.1/ruby;

    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  qa.enterprise.getmeed.com;
        root /home/ubuntu/resume/current/public;
        passenger_enabled on;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

       # location / {
        #    root   html;
        #    index  index.html index.htm;
        #}

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        #error_page   500 502 503 504  /50x.html;
        #location = /50x.html {
        #    root   html;
        #}

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    server {
        listen       80;
        server_name  qa.getmeed.com;
        root /home/ubuntu/resume_consumer/current/public;
        index index.html index.htm;
        passenger_enabled on;
        rails_env production;
        passenger_friendly_error_pages on;
    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    }


    # HTTPS server
    #
    #server {
    #    listen       443;
    #    server_name  localhost;

    #    ssl                  on;
    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;
    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers   on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

當我查看日志時，我發現一條警告，指出PassengerAgent找不到另一個錯誤的目錄禁止錯誤。 我不確定警報是否相關。

2015/08/15 23:40:41 [notice] 20858#0: signal process started
2015/08/15 23:40:41 [alert] 12005#0: Unable to start Phusion Passenger: Support binary PassengerAgent not found (tried: /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14/buildout/support-binaries/PassengerAgent and /root/.passenger/support-binaries/5.0.14/PassengerAgent). This probably means that your Phusion Passenger installation is broken or incomplete, or that your 'passenger_root' setting contains the wrong value. Please reinstall Phusion Passenger or adjust the setting (see: https://www.phusionpassenger.com/documentation/Users%20guide%20Nginx.html#PassengerRoot). (-1: Unknown error)
2015/08/15 23:45:04 [error] 20859#0: *375 directory index of "/home/ubuntu/resume_consumer/current/public/" is forbidden, client: 104.135.15.7, server: qa.getmeed.com, request: "GET / HTTP/1.1", host: "qa.getmeed.com"                                  

Answer 1

您只需要查看是否可以讀取/home/ubuntu/resume_consumer/current/public 。 您正在向我們展示在Ubuntu主目錄中設置的權限，但是current和public也將擁有自己的權限。

首先假設public內有一個index.html，下面的操作是否返回錯誤：

sudo -u nobody /home/ubuntu/resume_consumer/current/public

如果是這樣，則您有權限問題。 您可以通過將nobody用戶添加到同一ubuntu組來解決此問題：

sudo adduser nobody ubuntu

然后確保集團ubuntu用戶具有相同的訪問，因為ubuntu用戶。

sudo chmod -R g=u /home/ubuntu/resume_consumer

Answer 2

謝謝大家！ 事實證明，nginx沒有問題。 Nginx日志中有一個關於乘客的錯誤，我不確定最初是否與之相關，但是事實證明這是根本原因。

我已經安裝了乘客，但是沒有為該應用程序專門安裝乘客。 我必須轉到應用程序目錄並安裝passenger gem，然后在nginx config中的應用程序中使用對應於gem的passenger_root。 這解決了問題。