Questions[fastcgi](server)

I am installing the latest version of PHP onto IIS 7.5 via FastCGI, and all of the instructions say that FastCGI should impersonate the calling client by setting

 fastcgi.impersonate = 1

If my website will have this configuration

• dedicated application pool
• application pool identity of ApplicationPoolIdentity
• anonymous authentication only (as IUSR)

why do I want to impersonate?

I come from an ASP.NET background, where the IUSR gets read-only permissions and the application pool identity gets any write permissions. Giving write access to the IUSR usually opens the door for WebDAV vulnerabilities. So I hesitate to let PHP run as the IUSR.

I can't find many people asking this question (1 | 2) so I think I must be missing something. Can someone clarify this for me?

After debugging for 6-hours - I am giving this up :|

We have a nginx+php-fpm+mysql in LAN with almost 100 wordpress (created and used by different designers/developers all working on test wordpres setup)

We are using nginx without any issues from long.

Today, all of a sudden - nginx started returning "504 Gateway Time-out" out of the blue...

I checked nginx error log for a virtual host...

2010/09/06 21:24:24 [error] 12909#0: *349 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 21:25:11 [error] 12909#0: *349 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 21:25:11 [error] 12909#0: *443 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 21:25:12 [error] 12909#0: *443 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:08:32 [error] 12909#0: *1025 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET / HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:09:33 [error] 12909#0: *1025 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:09:40 [error] 12909#0: *1064 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:09:40 [error] 12909#0: *1064 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:24:44 [error] 12909#0: *1313 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET / HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"
2010/09/06 22:24:53 [error] 12909#0: *1313 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.0.1, server: rahul286.rtcamp.info, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "rahul286.rtcamp.info"

As I run php-fpm on port 9000 via TCP mode, I ran "netstat | grep 9000" and noticed something unusual... (Pasting partial output here for ease of read)

tcp        9      0 localhost:9000          localhost:36094         CLOSE_WAIT  14269/php5-fpm  
tcp        0      0 localhost:46664         localhost:9000          FIN_WAIT2   -               
tcp     1257      0 localhost:9000          localhost:36135         CLOSE_WAIT  -               
tcp     1257      0 localhost:9000          localhost:36125         CLOSE_WAIT  -               
tcp        9      0 localhost:9000          localhost:36102         CLOSE_WAIT  14268/php5-fpm  
tcp        0      0 localhost:46662         localhost:9000          FIN_WAIT2   -               
tcp      745      0 localhost:9000          localhost:46644         CLOSE_WAIT  -               
tcp        0      0 localhost:46658         localhost:9000          FIN_WAIT2   -               
tcp     1265      0 localhost:9000          localhost:46607         CLOSE_WAIT  -               
tcp        0      0 localhost:46672         localhost:9000          ESTABLISHED 12909/nginx: worker
tcp     1257      0 localhost:9000          localhost:36119         CLOSE_WAIT  -               
tcp     1265      0 localhost:9000          localhost:46613         CLOSE_WAIT  -               
tcp        0      0 localhost:46646         localhost:9000          FIN_WAIT2   -               
tcp     1257      0 localhost:9000          localhost:36137         CLOSE_WAIT  -               
tcp        0      0 localhost:46670         localhost:9000          ESTABLISHED 12909/nginx: worker
tcp     1265      0 localhost:9000          localhost:46619         CLOSE_WAIT  -               
tcp     1336      0 localhost:9000          localhost:46668         ESTABLISHED -               
tcp        0      0 localhost:46648         localhost:9000          FIN_WAIT2   -               
tcp     1336      0 localhost:9000          localhost:46670         ESTABLISHED -               
tcp        9      0 localhost:9000          localhost:36108         CLOSE_WAIT  14274/php5-fpm  
tcp     1336      0 localhost:9000          localhost:46684         ESTABLISHED -               
tcp        0      0 localhost:46674         localhost:9000          ESTABLISHED 12909/nginx: worker
tcp     1336      0 localhost:9000          localhost:46666         ESTABLISHED -               
tcp     1257      0 localhost:9000          localhost:46648         CLOSE_WAIT  -               
tcp     1336      0 localhost:9000          localhost:46678         ESTABLISHED -               
tcp        0      0 localhost:46668         localhost:9000          ESTABLISHED 12909/nginx: wo             

There are plenty of "CLOSE_WAIT" & "FIN_WAIT2" pairs as highlighted below (in above output):

tcp     1337      0 localhost:9000          localhost:46680         CLOSE_WAIT  -               
tcp        0      0 localhost:46680         localhost:9000          FIN_WAIT2   -

Please note port 46680 in above.

I enabled mysql slow queries error log, but it didn't work.

As of now restarting php5-fpm every minute via a cronjob (see command below) keeping everything running "smoothly" but I hate patchwork and want to solve this...

1 * * * * service php5-fpm restart > /dev/null

I searched extensively on Google - got no help. As mentioned, this a test-server in LAN, CPU load is never crossed 0.10 and memory usage is also below 25% (System has 2GB RAM and ubuntu-server installed) So if you find its time-confusing to help me out, please atleast drop a hint.

Thanks in advance for help.

-Rahul

(note - this is reposting of - http://forum.nginx.org/read.php?11,127694)

Update: I found answer, which is posted below.

I've got nginx 0.7x + PHP-FPM running under PHP 5.2.10 on one RHEL5 server, but trying to duplicate that setup under the bundled-in PHP-FPM in PHP 5.3.3 on a second server, I'm having some trouble with permission errors every time there's a GET.

FPM is started, and confirmed that fastcgi is listening on 9000, but each time I do a GET, I see this error in the nginx log:

2010/08/12 23:38:53 [crit] 5019#0: *5 stat() "/home/noisepages/www/" failed (13: Permission denied), client: 24.215.173.141, server: dev.noisepages.com, request: "GET / HTTP/1.1", host: "dev.noisepages.com"

Barebones nginx.conf.default works, at least. Here's my nginx.conf

server {
        listen       80;
        server_name  dev.noisepages.com;
        root   /home/noisepages/www;
        index  index.html index.htm index.php;

        access_log  logs/dev.access.log;
 error_log logs/dev.error.log;

        location / {

 if (-f $request_filename) {
  expires 30d;
  break;
  }

 # this sends all non-existing file or directory requests to index.php
 rewrite ^.*/files/(.*) /wp-includes/ms-files.php?file=$1;
 if (!-e $request_filename) {
     rewrite ^.+?(/wp-.*) $1 last;
  rewrite ^.+?(/.*\.php)$ $1 last;
  rewrite ^ /index.php last;
  }
        }

        location ~ \.php$ {
            include        fastcgi_params;
            fastcgi_pass   unix:/dev/shm/php-fastcgi.sock;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME    /home/dev/www/$fastcgi_script_name;
        }
    }

(The extra rewrite directives are for the use of WordPress multisite aka WordPress MU)

I've also verified that user www-data is declared not only in nginx.conf but also in php-fpm.conf for user and group values.

Maybe I'm not understanding what causes the error 13 message? Oddly enough, I'd tried to set up dev.noisepages.com on the first server in parallel to a couple of other virtual hosts -- each of which was working fine - and got the same error.

I have been investigating the differences between Apache and Nginx recently and am confused about which I should choose.

I have done some searching but there is no definitive comparison between the two and I was wondering if someone here could give their views on the differences between the two.

My current knowledge allows me to understand that mod_php is faster and more secure than fastcgi however Apache is much worse when it comes to simultaneous connections and memory consumption.

My site is using a lot of long polling but has a non AJAX web base (i.e. Apache with long polling over the top).

My original solution to Apaches memory problems were to send the long polling through node.js and then get node.js to access Apache every 2 secs in which case Apache would not have an open connection but instead node.js would. I have come to the realisation this might not be good enough and am looking at different solutions. I am still interested as to whether my original idea would have worked.

So which is better for the modern web? Apache or Nginx?

Update: All the suggestions given were good and valid. I have gone with the original second idea which is to use a full Nginx server. I am satisfied that being a dedicated server I could not suffer security issues from fastcgi and since my long polling scripts need to be written in PHP I require a server that can deal with high load simultaneous connections and Apache just cannot do that no matter how much I change the structure it will still be memory hungry.

I have marked Martin F's answer since he gave such a clear and complete answer to my questions points that I feel he deserves the mark, however, all three answers were good and valid and will most definately look into using reverse proxy for another site I own since I just found something very very very kool that Nginx can do in proxying.

Thanks,

It was recently suggested to me that I use FastCGI with PHP. Now I went to the FastCGI page and read it but I don't really understand what the advantages are.