arbales's questions

I currently have nginx setup to serve content through Varnish. Nginx listens on port 8000 and varnish connects users' requests from 80 to 8000.

The problem is, on some occasions, particularly when trying to hit a directory, like site.com/2010, nginx is redirecting the request to site.com:8000/2010/.

How can I prevent this?

I have a server (Leopard Server, not my choice) running Apache and MySQL. Several months ago, the server began to raise "Forbidden" errors at random intervals, preventing access to a PHP application. This behavior randomly ceased.

Now, several days ago I installed Passenger and deployed a Sintra/Rack application. The application runs as a user acarneg (for example) from /Library/WebServer/Documents/presto/current/public, acarneg owns the entire structure. The _www user has access to the directory via ACL chmod +a "_www allow read,write,...".

Everything works great! But after a randomish interval, often ~12 or ~24 hours, Passenger throws an error that also prevents the PHP application from running. Passenger Error #2. Cannot stat file config.ru. Permission denied. But the permissions haven't changed (confirmed) and all one has to do to resolve the error is sudo apachectl graceful.

If the permissions aren't changing and Apache doesn't seem to have a legit problem, what is causing this mess? Why did it stop before, and why has it resumed!?!?!?

Thanks for the help!

I'd like to see how to configure Nginx and Varnish.

I'm running several PHP sites and Rack-Sinatra sites as virtual hosts across two IP's. I'd like to prevent Nginx from having to serve static files, since I'm noticing some delays.

Edit: I've changed to Nginx, but the answer provided is pretty easy to port over to nginx.

Is is possible, and if so how, to configure Netatalk to respect ACL's? I'm running Debian Lenny, with the ACL packaged installed.

ACL's work great using SSH, which is why I started using it. But, if I login via AFP, I can't access the files.

So, for my clients to who have sites hosted on my server, I create user accounts, with standard home folders inside /home.

I setup an SSH jail for all the collective users, because I really am against using a separate FTP server. Then, I installed ACL and added acl to my /etc/fstab — all good.

1. I cd into /home and chmod 700 ./*.
   • At this point users cannot see into other users home directories (yay), but apache can't see them either (boo)
   • . I ran setfacl u:www-data:rx ./*. I also tried individual directories.
   • Now apache can see the sites again, but so can all the users. ACL changed the permissions of the home folders to 750.

How do I setup ACL's so that Apache can see the sites hosted in user's home folders AND 2. Users can't see outside their home and into others' files.

Edit: more details:

Output after chmod -R 700 ./*

sh-3.2# chmod 700 ./*
sh-3.2# ls -l
total 72
drwx------+ 24 austin  austin     4096 Jul 31 06:13 austin
drwx------+  8 jeremy  collective 4096 Aug  3 03:22 jeremy
drwx------+ 12 josh    collective 4096 Jul 26 02:40 josh
drwx------+  8 joyce   collective 4096 Jun 30 06:32 joyce

(Not accessible to others users OR apache)

setfacl -m u:www-data:rx jeremy

(Now accessible to members apache and collective — why collective, too?)

sh-3.2# getfacl jeremy 
# file: jeremy
# owner: jeremy
# group: collective
user::rwx
user:www-data:r-x
group::r-x
mask::r-x
other::---

Solution

Ultimately what I did was:

chmod 755 *
setfacl -R -m g::--- *
setfacl -R -m u:www-data:rx *