Nginx 403 error (directory index forbidden)?

frostrox

I'm trying to get Flarum working locally on Nginx but accessing the index after setting up the nginx.conf gives me a 403.


#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       8080;
        root         /usr/local/var/www;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / { try_files $uri $uri/ /index.php?$query_string; }
        location /api { try_files $uri $uri/ /api.php?$query_string; }
        location /admin { try_files $uri $uri/ /admin.php?$query_string; }

        location ~* ^/(flarum|storage|vendor) {
            deny all;
            return 404;
        }

        location ~* \.php$ {
            fastcgi_split_path_info ^(.+.php)(/.+)$;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param HTTP_PROXY ""; # Fix for https://httpoxy.org/ vulnerability
            fastcgi_index index.php;
        }
        
        location ~* \.html$ {
            expires -1;
        }

        location ~* \.(css|js|gif|jpe?g|png)$ {
            expires 1M;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
        }

        gzip on;
        gzip_http_version 1.1;
        gzip_vary on;
        gzip_comp_level 6;
        gzip_proxied any;
        gzip_types application/atom+xml
                application/javascript
                application/json
                application/vnd.ms-fontobject
                application/x-font-ttf
                application/x-web-app-manifest+json
                application/xhtml+xml
                application/xml
                font/opentype
                image/svg+xml
                image/x-icon
                text/css
                #text/html -- text/html is gzipped by default by nginx
                text/plain
                text/xml;
        gzip_buffers 16 8k;
        gzip_disable "MSIE [1-6]\.(?!.*SV1)";

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
    include servers/*;
}

Logs

2018/03/05 09:23:44 [error] 28746#0: *3 directory index of "/usr/local/var/www/" is forbidden, client: 127.0.0.1, server: localhost, request: "GET / HTTP/1.1", host: "localhost:8080"

Is anyone able to tell me what I am doing wrong? I have set the permissions of /usr/local/var/www (which contains Flarum) to 755.

luceos

frostrox the nginx user cannot access the directory you configured.

frostrox

luceos can you expand on that? I have already changed the permissions to 755 so it should have access, right?

luceos

frostrox files owned by root are in most os'es not accessible to anyone.

frostrox

luceos I've chown fang /usr/local/var/www and I am still getting the 403 error after reloading Nginx. Same Nginx error logs as well.

DogSports

In my configuration I was forced to comment (delete) line:

fastcgi_index index.php;

And if you would, after line:

root         /usr/local/var/www;

add this line:

index index.php;

frostrox

DogSports I tried that and am now getting a 404 with these logs:

2018/03/05 11:53:30 [crit] 38006#0: *2 connect() to unix:/var/run/php5-fpm.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: localhost, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "localhost:8080"
2018/03/05 11:53:30 [error] 38006#0: *2 open() "/usr/local/Cellar/nginx/1.13.9/html/50x.html" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock", host: "localhost:8080"

DogSports

Also check the owner/group unix permissions.

Perhaps:

chown -R www:data:www-data /usr/local/var/www

DogSports

/var/run/php5-fpm.sock exist ?

frostrox

DogSports no, it doesn't. How do I get it?

DogSports

Search in config file /etc/php*/fpm/pool.d/*.conf the line that starts with listen =

It's just an example: listen = /var/run/php5-fpm.sock or listen = /run/php/php7.0-fpm.sock

And replace your link /..../..../....-fpm.sock in your nginx.conf

frostrox

DogSports looks like there is no config file in /etc/. I did find a /private/etc/php-fpm.d/www.conf.default which had listen = 127.0.0.1:9000

DogSports

You seem to be locally on a MAC? I will not be able to help you anymore.

frostrox

Yeah, I'm trying to setup a local dev environment. Thanks for trying to help though.

Frink

frostrox I am trying to setup a dev-master install, and it isn't working for me either, although I am on Apache on Linux