<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
<channel>
<title><![CDATA[刘新修]]></title> 
<link>http://pic1.liuxinxiu.com:80/index.php</link> 
<description><![CDATA[刘新修的个人博客 (Liuxinxiu'S Blog)]]></description> 
<language>zh-cn</language> 
<copyright><![CDATA[刘新修]]></copyright>
<item>
<link>http://pic1.liuxinxiu.com:80/php_fpm_spawn_fcgi/</link>
<title><![CDATA[【转载】使用PHP-FPM避免Nginx下的spawn-fcgi漏洞]]></title> 
<author>刘新修 &lt;admin@yourname.com&gt;</author>
<category><![CDATA[web服务器]]></category>
<pubDate>Tue, 28 Sep 2010 05:20:09 +0000</pubDate> 
<guid>http://pic1.liuxinxiu.com:80/php_fpm_spawn_fcgi/</guid> 
<description>
<![CDATA[ 
	<p>之前传出的nginx漏洞其实不算是nginx的问题，而是<b style="color: black; background-color: #ff9999">spawn-fcgi</b>的漏洞。张宴的博客总结了一份比较简单的方法（<a class="external text" title="http://blog.s135.com/nginx_0day/" rel="nofollow" href="http://blog.s135.com/nginx_0day/">再提供一种解决Nginx文件类型错误解析漏洞的方法</a>），利用正则规避了这个问题。不过这些解决方法都是治标不治本，我个人建议使用<a class="external text" title="http://php-fpm.org/" rel="nofollow" href="http://php-fpm.org/"><b style="color: black; background-color: #ffff66">php-</b>fpm</a>代替<b style="color: black; background-color: #ff9999">spawn-fcgi</b>。</p><p><b style="color: black; background-color: #ffff66">php-</b>fpm曾经是PHP项目的一个补丁，旨在将FastCGI进程管理整合进PHP包中。现在我们可以在最新的PHP 5.3.2的源码树里下载得到直接整合了<b style="color: black; background-color: #ffff66">php-</b>fpm的分支，据说下个版本会融合进PHP的主分支去。</p><p>相对<b style="color: black; background-color: #ff9999">spawn-fcgi</b>，<b style="color: black; background-color: #ffff66">php-</b>fpm在CPU和内存方面的控制都更胜一筹，而且前者很容易崩溃，必须用crontab进行监控，而<b style="color: black; background-color: #ffff66">php-</b>fpm则没有这种烦恼。</p><p>如果你使用Ubuntu/Debian而且不想编译，可以尝试这个<a class="external text" title="http://www.howtoforge.com/installing-php-5.3-nginx-and-php-fpm-on-ubuntu-debian" rel="nofollow" href="http://www.howtoforge.com/installing-php-5.3-nginx-and-php-fpm-on-ubuntu-debian">方法</a>，安装最新的PHP 5.3.2及<b style="color: black; background-color: #ffff66">php-</b>fpm 0.6包。但我个人使用的过程中发现这种方式可能导致一些像mcrypt等扩展无法使用，所以还是采用了源码安装的方式。</p><p><br />先确定安装了subversion等一些包</p><p>&nbsp;</p><pre class="bash" style="font-family: monospace">$ <span style="font-weight: bold; color: #c20cb9">sudo</span> <span style="font-weight: bold; color: #c20cb9">apt-get</span> <span style="font-weight: bold; color: #c20cb9">install</span> <span style="font-weight: bold; color: #c20cb9">bison</span> libxml2-dev libbz2-dev libpcre3-dev libssl-dev zlib1g-dev libmcrypt-dev libmhash-dev libmhash2 libcurl4-openssl-dev libpq-dev libpq5 libsyck0-dev</pre><pre class="bash" style="font-family: monospace">$ <span style="font-weight: bold; color: #c20cb9">svn</span> <span style="font-weight: bold; color: #c20cb9">co</span> http:<span style="font-weight: bold; color: #000000">//</span>svn.php.net<span style="font-weight: bold; color: #000000">/</span>repository<span style="font-weight: bold; color: #000000">/</span>php<span style="font-weight: bold; color: #000000">/</span><b style="color: black; background-color: #ffff66">php-</b>src<span style="font-weight: bold; color: #000000">/</span>branches<span style="font-weight: bold; color: #000000">/</span>PHP_5_3_FPM php_5_3_fpm$ <span style="font-weight: bold; color: #7a0874">cd</span> php_5_3_fpm</pre><p>请先确定已经安装了autoconf2.13这个包，注意版本号。新版本的autoconf可能会导致无法生成配置文件</p><pre class="bash" style="font-family: monospace">$ .<span style="font-weight: bold; color: #000000">/</span>buildconf <span style="color: #660033">--force</span></pre><p>配置你的php，一定要有--enable-fpm</p><pre class="bash" style="font-family: monospace">$ .<span style="font-weight: bold; color: #000000">/</span>configure <span style="color: #660033">--enable-fpm</span> <span style="color: #660033">--with-foo</span> --enable-bar...</pre><p>我使用的配置方式，ubuntu的很多开发包没有安装，所以这个步要安装各种开发包，挺花时间的。</p><pre class="bash" style="font-family: monospace">$ .<span style="font-weight: bold; color: #000000">/</span>configure <span style="color: #660033">--enable-fastcgi</span> <span style="color: #660033">--enable-fpm</span> <span style="color: #660033">--with-mcrypt</span> <span style="color: #660033">--with-zlib</span> <span style="color: #660033">--enable-mbstring</span> <span style="color: #660033">--with-pdo</span> <span style="color: #660033">--with-pgsql</span> <span style="color: #660033">--with-curl</span> <span style="color: #660033">--disable-debug</span> <span style="color: #660033">--enable-pic</span> <span style="color: #660033">--enable-inline-optimization</span> <span style="color: #660033">--with-xml</span> <span style="color: #660033">--enable-sockets</span> <span style="color: #660033">--enable-sysvsem</span> <span style="color: #660033">--enable-sysvshm</span> <span style="color: #660033">--enable-pcntl</span> <span style="color: #660033">--enable-mbregex</span> <span style="color: #660033">--with-mhash</span> <span style="color: #660033">--enable-xslt</span> <span style="color: #660033">--enable-memcache</span> <span style="color: #660033">--enable-zip</span> <span style="color: #660033">--with-pcre-regex</span> <span style="color: #660033">--with-gd</span> <span style="color: #660033">--with-sqlite</span> <span style="color: #660033">--enable-exif</span> <span style="color: #660033">--enable-zip</span> <span style="color: #660033">--enable-ftp</span> <span style="color: #660033">--with-pear</span> <span style="color: #660033">--with-libxml-dir</span> <span style="color: #660033">--with-mysql</span> <span style="color: #660033">--with-openssl</span></pre><p>编译和安装</p><pre class="bash" style="font-family: monospace">$ <span style="font-weight: bold; color: #c20cb9">sudo</span> <span style="font-weight: bold; color: #c20cb9">make</span> <span style="font-weight: bold; color: #000000">&amp;&amp;</span> <span style="font-weight: bold; color: #c20cb9">make</span> <span style="font-weight: bold; color: #c20cb9">install</span></pre><p>安装后修改/usr/local/etc/<b style="color: black; background-color: #ffff66">php-</b>fpm.conf，把所有的nobody改成你运行<b style="color: black; background-color: #ffff66">php-</b>fpm的用户组和用户名，一般是www-data。修改一下，如果你的服务器内存比较小，建议从5开始递增修改，子进程会占用比较多的内存。</p><pre class="xml" style="font-family: monospace"><span style="color: #009900"><span style="font-weight: bold; color: #000000">&lt;value</span> <span style="color: #000066">name</span>=<span style="color: #ff0000">&quot;max_children&quot;</span><span style="font-weight: bold; color: #000000">&gt;</span></span>5<span style="color: #009900"><span style="font-weight: bold; color: #000000">&lt;/value<span style="font-weight: bold; color: #000000">&gt;</span></span></span></pre><p>完成后，运行</p><pre class="bash" style="font-family: monospace"><b style="color: black; background-color: #ffff66">php-</b>fpm <span style="color: #660033">-c</span> <span style="font-weight: bold; color: #000000">/</span>path<span style="font-weight: bold; color: #000000">/</span>to<span style="font-weight: bold; color: #000000">/</span>your<span style="font-weight: bold; color: #000000">/</span>php.ini</pre><p>这个操作没有回显，默认在127.0.0.1:9000打开一个PHP的fastcgi服务，用类似<b style="color: black; background-color: #ff9999">spawn-fcgi</b>的方法把php文件的处理pass给<b style="color: black; background-color: #ffff66">php-</b>fpm即可。记得加入下面的参数，以避免一些古怪的问题引起502 Gateway错误。</p><pre class="bash" style="font-family: monospace">&nbsp;&nbsp;location ~ &#92;.php$ <span style="font-weight: bold; color: #7a0874">&#123;</span>&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_pass&nbsp;&nbsp; 127.0.0.1:<span style="color: #000000">9000</span>;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_index&nbsp;&nbsp;index.php;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_param&nbsp;&nbsp;SCRIPT_FILENAME&nbsp;&nbsp;<span style="font-weight: bold; color: #000000">/</span>path<span style="font-weight: bold; color: #000000">/</span>to<span style="font-weight: bold; color: #000000">/</span>your<span style="font-weight: bold; color: #000000">/</span>root<span style="color: #007800">$fastcgi_script_name</span>;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_connect_timeout <span style="color: #000000">60</span>;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_send_timeout <span style="color: #000000">180</span>;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_read_timeout <span style="color: #000000">180</span>;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_buffer_size 128k;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_buffers <span style="color: #000000">4</span> 256k;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_busy_buffers_size 256k;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_temp_file_write_size 256k;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_intercept_errors on;&nbsp;&nbsp;&nbsp;&nbsp;include fastcgi_params;&nbsp;&nbsp;<span style="font-weight: bold; color: #7a0874">&#125;</span></pre>
]]>
</description>
</item><item>
<link>http://pic1.liuxinxiu.com:80/php_fpm_spawn_fcgi/#blogcomment</link>
<title><![CDATA[[评论] 【转载】使用PHP-FPM避免Nginx下的spawn-fcgi漏洞]]></title> 
<author> &lt;user@domain.com&gt;</author>
<category><![CDATA[评论]]></category>
<pubDate>Thu, 01 Jan 1970 00:00:00 +0000</pubDate> 
<guid>http://pic1.liuxinxiu.com:80/php_fpm_spawn_fcgi/#blogcomment</guid> 
<description>
<![CDATA[ 
	
]]>
</description>
</item>
</channel>
</rss>