Web nginx、php-fpm和tilde用户目录

Web nginx、php-fpm和tilde用户目录,web,nginx,php,Web,Nginx,Php,我正在Debian系统上使用nginx和php5 fpm 我希望我的服务器像这样服务 ip/index.html在nginx web根目录下提供静态html页面(或文件) 同样,ip/somefile.php(或index.php)通过php fpm为php服务 ip/~user/index.html在/home/user/public\u html 同样地,ip/~user/somefile.php(或index.php)通过php fpm为php服务 (其中,ip是IPv4或IPv6地址

我正在Debian系统上使用
nginx
php5 fpm

我希望我的服务器像这样服务

  • ip/index.html
    在nginx web根目录下提供静态html页面(或文件)
  • 同样,
    ip/somefile.php
    (或
    index.php
    )通过php fpm为php服务
  • ip/~user/index.html
    /home/user/public\u html
  • 同样地,
    ip/~user/somefile.php
    (或
    index.php
    )通过php fpm为php服务
(其中,
ip
是IPv4或IPv6地址)


以下是我对
nginx
的配置:

server {
        listen 80;
        listen [::]:80 default_server ipv6only=on;

        server_name _;
        root /usr/share/nginx/www;
        index index.php index.html index.htm;

        # Deny access to all dotfiles
        location ~ /\. {
                deny all;
        }

        location ~ \.php$ {
                include /etc/nginx/fastcgi_params;

                try_files $uri = 404; # Prevents exploit
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
        }

        # Serve user directories
        location ~ ^/~(.+?)(/.*)?$ {
                alias /home/$1/public_html$2;
                autoindex on;
        }
}
对于
php fpm

; Start a new pool named 'www'.
; the variable $pool can we used in any directive and will be replaced by the
; pool name ('www' here)
[www]

; Per pool prefix
; It only applies on the following directives:
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
user = www-data
group = www-data

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses on a
;                            specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /var/run/php5-fpm.sock

; Set listen(2) backlog.
; Default Value: 128 (-1 on FreeBSD and OpenBSD)
;listen.backlog = 128

; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions.
; Default Values: user and group are set as the running user
;                 mode is set to 0666
;listen.owner = www-data
;listen.group = www-data
;listen.mode = 0666

; List of ipv4 addresses of FastCGI clients which are allowed to connect.
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
; must be separated by a comma. If this value is left blank, connections will be
; accepted from any ip address.
; Default Value: any
;listen.allowed_clients = 127.0.0.1

; ... and more that doesn't matter, just defaults
静态文件和PHP都在nginx web根目录中工作(
ip/blah.html
ip/blah.PHP
),静态文件也在用户目录中工作(
ip/~user/blah.html
),但PHP在用户目录中给出了404

有人能帮我修改配置吗


编辑:some
ls-la
s,以防出现权限问题

kvanb@pegasus:~$ ls -la
total 32
drwxr-xr-x 3 kvanb sudo  4096 Jan  4 04:04 .
drwxr-xr-x 6 root  root  4096 Jan  4 01:36 ..
-rw------- 1 kvanb kvanb  570 Jan  4 02:54 .bash_history
-rw-r--r-- 1 kvanb sudo   220 Jan  4 01:36 .bash_logout
-rw-r--r-- 1 kvanb sudo  3392 Jan  4 01:36 .bashrc
-rw-r--r-- 1 kvanb sudo   675 Jan  4 01:36 .profile
drwxr-xr-x 2 kvanb sudo  4096 Jan  4 03:41 public_html
-rw------- 1 kvanb sudo  3303 Jan  4 04:04 .viminfo

kvanb@pegasus:~/public_html$ ls -la
total 20
drwxr-xr-x 2 kvanb sudo 4096 Jan  4 03:41 .
drwxr-xr-x 3 kvanb sudo 4096 Jan  4 04:04 ..
-rwxr-xr-x 1 kvanb sudo   21 Jan  4 03:40 index.php
-rwxr-xr-x 1 kvanb sudo   20 Jan  4 03:09 info.php
-rw-r--r-- 1 kvanb sudo    4 Jan  4 03:41 test.html

kvanb@pegasus:/usr/share/nginx/www$ ls -la
total 20
drwxr-xr-x 2 root root 4096 Jan  4 03:28 .
drwxr-xr-x 3 root root 4096 Jan  4 01:34 ..
-rw-r--r-- 1 root root  383 Jul  7  2006 50x.html
-rw-r--r-- 1 root root  151 Oct  4  2004 index.html
-rw-r--r-- 1 root root   20 Jan  4 03:28 info.php

您需要在初始php规则之前添加此规则:

    # Serve user directories php files
    location ~ ^/~(.+?)(/.*\.php)$ {
            alias /home/$1/public_html;
            autoindex on;
            include /etc/nginx/fastcgi_params;

            try_files $2 = 404; # Prevents exploit
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
    }

这一个匹配用户目录中的所有php文件,通过php fpm引导它们。您拥有的php规则匹配所有这些php文件,但试图在错误的目录中找到它们。

我在尝试解决类似问题时遇到了这个问题。因此,我将添加我找到的解决方案。这是在拱门上,但与系统有关

此解决方案适用于我的开发机器,出于充分的理由,您不应该从/home文件夹运行公共站点

我将php fpm和nginx配置为以我的用户身份运行。编辑以下文件,并删除ProtectHome=true行

sudo vi /etc/systemd/system/multi-user.target.wants/php-fpm.service
重新加载,然后重新启动所有内容

systemctl daemon-reload
systemctl restart nginx.service
systemctl restart php-fpm.service

这是有道理的,但当我将其添加到用户目录中第14行的配置中时,php文件会给出404(既不能使用
index.php
,也不能使用类似
info.php
)。还有,有没有办法让它更通用,这样我就不必重复配置了?我更改了匹配的url和
try_文件
,检查是否效果更好。为了更好地组织它,您可以将其解压缩到php配置文件中,然后使用include(),可能是对
$uri
->
$2
背后的原理的注释,以及这是否仍然提供了漏洞利用保护。因此,$uri与整个uri匹配,这并不是我们在本例中真正想要的。所以我使用了$2,这只是第二个括号中的表达式
(/.*\.php)
。这将为文件创建正确的路径。至于漏洞保护,在更改我们正在尝试的文件时应该不会有任何更改。显然,将类似Joomla的内容放入用户目录会导致它生成包含到样式表中的URL,如
/path/to/thing
,而实际上它处于
/~user/path/to/thing
,因此它会中断。有人知道为什么会这样吗?