Início / server / 问题

All perguntas(server)

Martin Hope
Nick Williams
Asked: 2024-12-29 09:46:44 +0800 CST
  • 5

Tenho um servidor PowerDNS Recursor 4.0.4 existente em execução no Debian Jessie 8 (eu sei, eu sei, desatualizado... Estou chegando lá). Ele lida com todas as solicitações de DNS para minha rede de laboratório doméstico. Ele tem uma configuração bastante simples e tem funcionado sem interrupção por literalmente anos seguidos. Ele também é configurado para validar e valida com sucesso todos os DNSSEC.

Ontem à noite, pouco depois da meia-noite, ele parou de resolver cerca de metade de todos os domínios no mundo, retornando SERVFAILpara eles. Às vezes, ele resolve o domínio primário (como athenahealth.com), mas não um subdomínio (como 20785-1.portal.athenahealth.com). Às vezes, ele não resolve o domínio primário (como serverfault.comou askubuntu.com). Não consegui encontrar nenhum padrão e, não importa o quanto eu tenha mexido na minha configuração (incluindo desligar completamente o DNSSEC), isso não resolve o problema.

Meu próximo pensamento foi que eu precisava atualizar o PowerDNS Recursor, mas não consegui por causa da idade do meu servidor DNS. Então, criei um servidor totalmente novo executando o PowerDNS Recursor 5.1.3 no Ubuntu 24.04.1. Novamente, a configuração é simples. Aqui está o arquivo primário:

$ cat /etc/powerdns/recursor.conf 
dnssec:
  # validation: process # default
  trustanchorfile: /usr/share/dns/root.key
recursor:
  hint_file: /usr/share/dns/root.hints
  include_dir: /etc/powerdns/recursor.d
#incoming:
 # listen:
 # - 127.0.0.1 # default
#outgoing:
 # source_address:
 # - 0.0.0.0 # default

E aqui está um arquivo em recursor.d:

$ cat /etc/powerdns/recursor.d/me.yml 
dnssec:
  validation: off # validate
#  log_bogus: true
incoming:
  listen:
    - 10.20.30.76:53
logging:
  common_errors: true
  facility: 1
  loglevel: 6
  quiet: true
  trace: fail
recursor:
  auth_zones:
    - zone: my-domain-1.com
      file: /etc/powerdns/my-domain-1.com.zone
  forward_zones:
    - zone: my-domain-2.com
      forwarders:
        - 10.20.31.2
  setgid: pdns
  setuid: pdns
  socket_dir: /var/run
  write_pid: true
webservice:
  address: 10.20.30.76
  allow_from:
    - 10.20.30.0/24
    - 172.24.52.0/24
  api_key: loremipsum
  password: foobarbazqux
  port: 8080

Esta configuração é idêntica à minha antiga configuração do PowerDNS Recursor, exceto que o DNSSEC está desabilitado para tentar fazê-lo funcionar. Se eu manualmente dig(eu amo dig) askubuntu.comda raiz para cima, eu encontro facilmente uma resposta:

# Using i.root-servers.net is 192.36.148.17
$ dig @192.36.148.17 com NS

; <<>> DiG 9.10.6 <<>> @192.36.148.17 com NS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2217
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 21

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;com.               IN  NS

;; ANSWER SECTION:
com.            136670  IN  NS  d.gtld-servers.net.
com.            136670  IN  NS  c.gtld-servers.net.
com.            136670  IN  NS  k.gtld-servers.net.
com.            136670  IN  NS  f.gtld-servers.net.
com.            136670  IN  NS  i.gtld-servers.net.
com.            136670  IN  NS  b.gtld-servers.net.
com.            136670  IN  NS  l.gtld-servers.net.
com.            136670  IN  NS  a.gtld-servers.net.
com.            136670  IN  NS  e.gtld-servers.net.
com.            136670  IN  NS  m.gtld-servers.net.
com.            136670  IN  NS  j.gtld-servers.net.
com.            136670  IN  NS  h.gtld-servers.net.
com.            136670  IN  NS  g.gtld-servers.net.

;; ADDITIONAL SECTION:
b.gtld-servers.net. 43604   IN  A   192.33.14.30
b.gtld-servers.net. 71837   IN  AAAA    2001:503:231d::2:30
l.gtld-servers.net. 44115   IN  A   192.41.162.30
l.gtld-servers.net. 74612   IN  AAAA    2001:500:d937::30
a.gtld-servers.net. 59944   IN  A   192.5.6.30
a.gtld-servers.net. 52029   IN  AAAA    2001:503:a83e::2:30
e.gtld-servers.net. 11582   IN  A   192.12.94.30
e.gtld-servers.net. 63219   IN  AAAA    2001:502:1ca1::30
m.gtld-servers.net. 27782   IN  A   192.55.83.30
m.gtld-servers.net. 50020   IN  AAAA    2001:501:b1f9::30
j.gtld-servers.net. 39663   IN  A   192.48.79.30
h.gtld-servers.net. 79936   IN  A   192.54.112.30
g.gtld-servers.net. 57527   IN  A   192.42.93.30
g.gtld-servers.net. 63219   IN  AAAA    2001:503:eea3::30
d.gtld-servers.net. 44435   IN  A   192.31.80.30
d.gtld-servers.net. 10633   IN  AAAA    2001:500:856e::30
c.gtld-servers.net. 50185   IN  A   192.26.92.30
k.gtld-servers.net. 32146   IN  A   192.52.178.30
i.gtld-servers.net. 48002   IN  A   192.43.172.30
i.gtld-servers.net. 27967   IN  AAAA    2001:503:39c1::30

$ dig @192.33.14.30 askubuntu.com NS

; <<>> DiG 9.10.6 <<>> @192.33.14.30 askubuntu.com NS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46168
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 13

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;askubuntu.com.         IN  NS

;; ANSWER SECTION:
askubuntu.com.      86400   IN  NS  sureena.ns.cloudflare.com.
askubuntu.com.      86400   IN  NS  damian.ns.cloudflare.com.

;; ADDITIONAL SECTION:
damian.ns.cloudflare.com. 48087 IN  A   172.64.35.50
damian.ns.cloudflare.com. 48087 IN  A   162.159.44.50
damian.ns.cloudflare.com. 48087 IN  A   108.162.195.50
damian.ns.cloudflare.com. 13178 IN  AAAA    2803:f800:50::6ca2:c332
damian.ns.cloudflare.com. 13178 IN  AAAA    2606:4700:58::a29f:2c32
damian.ns.cloudflare.com. 13178 IN  AAAA    2a06:98c1:50::ac40:2332
sureena.ns.cloudflare.com. 38809 IN A   108.162.194.126
sureena.ns.cloudflare.com. 38809 IN A   172.64.34.126
sureena.ns.cloudflare.com. 38809 IN A   162.159.38.126
sureena.ns.cloudflare.com. 32427 IN AAAA    2a06:98c1:50::ac40:227e
sureena.ns.cloudflare.com. 32427 IN AAAA    2803:f800:50::6ca2:c27e
sureena.ns.cloudflare.com. 32427 IN AAAA    2606:4700:50::a29f:267e

$ dig @172.64.35.50 askubuntu.com A

; <<>> DiG 9.10.6 <<>> @172.64.35.50 askubuntu.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35705
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;askubuntu.com.         IN  A

;; ANSWER SECTION:
askubuntu.com.      300 IN  A   172.64.150.156
askubuntu.com.      300 IN  A   104.18.37.100

Perfeito. Mas se eu perguntar ao meu servidor PowerDNS Recursor 4.0.4 existente ou ao meu novo servidor PowerDNS Recursor 5.1.3, eu recebo SERVFAIL:

$ dig @10.20.30.76 askubuntu.com A

; <<>> DiG 9.10.6 <<>> @10.20.30.76 askubuntu.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 58213
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; OPT=15: 00 16 64 65 6c 65 67 61 74 69 6f 6e 20 63 6f 6d ("..delegation com")
;; QUESTION SECTION:
;askubuntu.com.         IN  A

A OPT=15linha com algum tipo de assinatura plus delegation comé interessante. Não está acontecendo em todos os domínios que estão falhando em resolver, então pode ser uma pista falsa (e muda... como executar a mesma consulta novamente resultou em OPT=15: 00 16 64 65 6c 65 67 61 74 69 6f 6e 20 61 73 6b 75 62 75 6e 74 75 2e 63 6f 6d ("..delegation askubuntu.com")).

Aqui está o rastreamento de falha do PowerDNS Recursor 5.1.3 para uma pesquisa com falha de askubuntu.com: https://gist.github.com/beamerblvd/d8fa24bdf1037e2a670f8e331b7e4905

Para sua informação, estou na Classe Executiva da Comcast com uma delegação de IP estático de 5 endereços.

O que estou fazendo errado?

powerdns
Martin Hope
Owais Nooe
Asked: 2024-12-29 03:06:36 +0800 CST
  • 2

Estou tentando configurar Https para meu servidor Ubuntu usando Nginx . Estou executando um aplicativo no localhost e usando proxy reverso . Esta é a primeira vez que uso Linux e nginx. Minha solicitação https está falhando toda vez . Tentarei incluir o máximo de detalhes relevantes do servidor:

Atribuí um nome de domínio ao meu site e configurei os certificados SSL usando o certbot.

Quando faço uma solicitação usando http , ela é bem-sucedida: solicitação curl para porta http

No entanto, as solicitações https sempre falham: solicitação curl para porta https

Ambas as portas 443 e 80 estão ativas e escutando: portas ativas

Para simplificar a depuração, configurei o nginx para redirecionar solicitações http (porta 80) para https (porta 443). Isso significa que as solicitações feitas ao meu http agora também falham. Este é o arquivo de configuração do meu site agora: arquivo conf nginx

A seguir está um trecho do log de depuração do nginx depois que fiz uma solicitação https:

2024/12/28 18:27:40 [debug] 21424#21424: *207 http script copy: "https://"
2024/12/28 18:27:40 [debug] 21424#21424: *207 http script var: "chatbot.sweatsupport.site"
2024/12/28 18:27:40 [debug] 21424#21424: *207 http script var: "/ws/socket.io/?EIO=4&transport=polling&t=PGEXYJx"
2024/12/28 18:27:40 [debug] 21424#21424: *207 http finalize request: 301, "/ws/socket.io/?EIO=4&transport=polling&t=PGEXYJx" a:1, c:1
2024/12/28 18:27:40 [debug] 21424#21424: *207 http special response: 301, "/ws/socket.io/?EIO=4&transport=polling&t=PGEXYJx"
2024/12/28 18:27:40 [debug] 21424#21424: *207 http set discard body
2024/12/28 18:27:40 [debug] 21424#21424: *207 HTTP/1.1 301 Moved Permanently
Server: nginx/1.24.0 (Ubuntu)
Date: Sat, 28 Dec 2024 18:27:40 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://chatbot.sweatsupport.site/ws/socket.io/?EIO=4&transport=polling&t=PGEXYJx

O que interpretei do log é que uma resposta 301 http é feita. Parece que não há logs upstream mostrando nenhuma solicitação para localhost:8000. Eu tento entender o log, mas isso leva a mais confusões, então não mencionarei isso.

Estou preso nesse erro há 3 dias e naveguei no máximo de fóruns que pude, mas sem sucesso. Por favor, me avise se precisar de mais informações. Ficarei grato por qualquer conselho.

nginx
Martin Hope
Jiří
Asked: 2024-12-29 00:46:29 +0800 CST
  • 7

A documentaçãoopendkim-genkey menciona a existência do -rswitch:

Restringe a chave para uso somente em assinatura de e-mail. O padrão é permitir que a chave seja usada para qualquer serviço.

Gostaria de saber se isso significa que a chave pode ser usada na prática para algo diferente de assinar e-mails. E também se há algum motivo para incluir ou não o -rswitch ao gerar a chave.

dkim
Martin Hope
Andrius
Asked: 2024-12-28 20:55:22 +0800 CST
  • 5

Estamos usando o proxy Cloudflare, então o IP real está oculto. Mas se você souber o IP real, ainda poderá acessar o site usando-o. Existe uma maneira de limitar o acesso por esse IP?

Quero dizer:


by domain: https://some-domain.com -> OK
by proxy IP: https://1.2.3.4 -> OK
by real IP: https://5.6.7.8 -> to restrict.

Ou é inútil tentar restringi-lo?

Exemplo de blocos do servidor nginx.conf:

    server {
        listen 80 default_server;
        server_name some-domain.com;
        return 301 https://$host$request_uri;
    }
    charset utf-8;
    server {
        server_name some-domain.com;
        listen 443 ssl http2;
        ...
        ...
    }
nginx
Martin Hope
bajtec
Asked: 2024-12-28 19:35:57 +0800 CST
  • 4

Tenho um problema ao atualizar o Linux. Recebi um 404 não encontrado para o IP do servidor de destino, o que foi estranho o suficiente. Mais tarde, descobri que o traceroute passa por um nó backbone.rt.ru do núcleo.

Isso é um possível sequestro de BGP?

Os domínios ru hoje em dia parecem muito suspeitos, especialmente na Europa Central.

root@XXXXXXX:~# apt-get update
Hit:1 http://ftp.pl.debian.org/debian buster InRelease
Hit:2 http://ftp.pl.debian.org/debian buster-updates InRelease
Hit:3 http://security.debian.org buster/updates InRelease
Hit:4 https://deb.nodesource.com/node_12.x buster InRelease
Ign:5 http://apt.postgresql.org/pub/repos/apt buster-pgdg InRelease
Err:6 http://apt.postgresql.org/pub/repos/apt buster-pgdg Release
 ** 404  Not Found [IP: 217.196.149.55 80]**
Reading package lists... Done
E: The repository 'http://apt.postgresql.org/pub/repos/apt buster-pgdg Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
root@XXXXXXX:~# ^C
root@XXXXXXX:~#

Aqui está o traceroute:

root@XXXXXXX:~# traceroute 217.196.149.55
traceroute to 217.196.149.55 (217.196.149.55), 30 hops max, 60 byte packets
 1  * * *
 2  XXXXXXXXXXXXXX  0.465 ms  0.438 ms
 3  164.next4.zicom.pl (185.175.107.164)  6.748 ms  7.108 ms  7.089 ms
 4  et-0-0-18-590.edge5.Warsaw1.Level3.net (213.249.126.109)  7.345 ms  7.777 ms  7.271 ms
 5  ae2.3601.edge5.ber1.neo.colt.net (171.75.8.27)  15.454 ms  15.421 ms  15.572 ms
 6  195.122.181.74 (195.122.181.74)  16.261 ms  16.202 ms  16.138 ms
 7  ae6-2082.ams10.core-backbone.com (80.255.14.33)  27.831 ms  27.767 ms  27.473 ms
 8  core-backbone.rt.ru (81.95.2.150)  26.598 ms  26.359 ms  26.919 ms
 9  * * *
10  185.69.160.214 (185.69.160.214)  37.410 ms  37.011 ms 195.192.211.124 (195.192.211.124)  37.004 ms
11  fabrina.postgresql.org (217.196.149.55)  44.516 ms  44.481 ms *
debian
Martin Hope
jurijus01
Asked: 2024-12-27 02:54:11 +0800 CST
  • 5

Olá e boas festas,

Tenho um servidor de e-mail mail.giftbutton.com, que está recebendo e enviando e-mails. O problema é que ele não tem registro MX, acroding para https://mxtoolbox.com e https://www.mail-tester.com/ test.

Os registros DNS são:

A   @   51.89.216.247
A   mail    146.59.32.248
MX  @   mail.giftbutton.com. (Priority: 10)
TXT dkim._domainkey.mail v=DKIM1;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUBorg14HW4dVb61hgTPKhGBaef2Qn7R5arBSmKitKqL2wySVUn3TIRd1DGqDG00TEAPhMkvzexm680y5OEV+lYlmBh/EZNrinYUZToL61vp4tKt690YbI3EuaJcIZryT40eGg8JWMmL6CvAwrRh2lC7ynhmqC1u8YfXiN/hJ7U7GUMrJWnXzKqDytqPkwPstnxwlYwPY+picMBtqqp7gWhmoSROj5vu47XROg3V1THEw7d5tmpEPbTx26+NRstxE9Gg6bJWpjkfdA4545LQh2Ykv4elChyMlnTwCbcS4ySfiQpK1/0zhnylxzcPeZGpw1TNWciX7rd0BbAYOQMDBQIDAQAB
TXT mail v=spf1 ip4:146.59.32.248 ip6:2001:41d0:601:1100::5a97 ~all
TXT _dmarc.mail v=DMARC1; p=reject; rua=mailto:[email protected];

O que eu configurei errado?

Qualquer ideia é muito bem vinda.

Atualização: este é o relatório que o mail-tester.com está retornando:

 [SPF] Your server 146.59.32.248 is authorized to use [email protected]
 Your DKIM signature is valid
 Your message passed the DMARC test
 Your server 146.59.32.248 is successfully associated with mail.giftbutton.com
 We didn't find a mail server (MX Record) behind your domain name mail.giftbutton.com.

Por que o mail-tester.com não está vendo o registro MX para mail.giftbutton.com se ele existe?

Como alguém aqui explicou há algum tempo, enviar e-mails de um subdomínio é melhor do que de um domínio. Se um usuário teve um dia ruim e marca o e-mail de notificação como spam, os pontos de spam serão acumulados para o subdomínio. Isso não afetará outros subdomínios - como accounts.giftbutton.com.

O que preciso alterar na configuração de DNS para passar completamente na verificação de spam?

mx-record
Martin Hope
lostsoul6
Asked: 2024-12-26 07:14:06 +0800 CST
  • 5

Eu tenho um servidor de jogo (counter strike 2) no Oriente Médio. Estou tentando configurar um painel web para ele que está hospedado na Europa em um VPS Ubuntu 22. Este site tem uma ferramenta que permite que comandos remotos sejam executados no servidor de jogo a partir do site usando o protocolo RCON de origem.

O site usa PHP (Laravel). Quando tento usar o console RCON no site para executar comandos, recebo Nginx 504 gateway time-out.

O log do Nginx mostra o seguinte:

2024/12/25 22:21:34 [error] 1431#1431: *2081 upstream timed out (110: Unknown error) while reading response header from upstream, client: 88.196.213.143, server: some.domain.com, request: "GET /servers/1/players HTTP/1.1", upstream: "fastcgi://unix:/run/php/php8.3-fpm.sock", host: "some.domain.com", referrer: "https://some.domain.com/"

No começo, pensei que talvez houvesse um problema de conexão entre o VPS da Europa e meu servidor de jogo, então instalei o rcon-cli no meu VPS da Europa e, usando isso, consegui conectar com sucesso ao servidor de jogo. Como resultado, imaginei que o problema estivesse relacionado apenas à ferramenta PHP RCON.

Já que muitas pessoas estão usando este painel de site e não têm problemas, duvido que haja algo errado com o código também. A única coisa que me vem à mente é minha configuração Nginx.

Aqui está meu Nginx site.conf:

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl;
    server_name some.domain.com;
    root /var/www/html/aim1/public; ##<----THIS IS THE ACTUAL PATH 

    ssl_certificate     /root/cert/some.domain.com/fullchain.pem;
    ssl_certificate_key /root/cert/some.domain.com/privkey.pem;

 
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
 
    index index.php;
 
    charset utf-8;
 
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
 
    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }
 
    error_page 404 /index.php;
 
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
    }
 
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

Aqui está meu fastcgi.conf:

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  REMOTE_USER        $remote_user;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

E por último, aqui está meu arquivo nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#   # See sample authentication script at:
#   # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#   # auth_http localhost/auth.php;
#   # pop3_capabilities "TOP" "USER";
#   # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#   server {
#       listen     localhost:110;
#       protocol   pop3;
#       proxy      on;
#   }
#
#   server {
#       listen     localhost:143;
#       protocol   imap;
#       proxy      on;
#   }
#}

Alguém pode me ajudar a me livrar desse erro do Nginx?

nginx
Martin Hope
lostsoul6
Asked: 2024-12-25 22:09:54 +0800 CST
  • 4

Já li todos os tópicos semelhantes, mas não consegui resolver o problema, então postei aqui:

Posso executar um arquivo PHP no Terminal SSH com sucesso:

root@skins:~/public1# php8.3 /root/public1/public/index.php
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='http://:/requirement#'" />

        <title>Redirecting to http://:/requirement#</title>
    </head>
    <body>
        Redirecting to <a href="http://:/requirement#">http://:/requirement#</a>.
    </body>

Entretanto, não consigo executar o mesmo arquivo no navegador e recebo o erro Arquivo Nginx não encontrado.

Aqui está meu Nginx site.conf:

server {
    listen 80;
    listen [::]:80;
    server_name some.domain.com;
    root /root/public1/public; ##<----THIS IS THE ACTUAL PATH 
 
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
 
    index index.php;
 
    charset utf-8;
 
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
 
    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }
 
    error_page 404 /index.php;
 
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
    }
 
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

No log de erros do Nginx tenho o seguinte:

2024/12/25 13:55:05 [crit] 74930#74930: *5 stat() "/root/public1/public/" failed (13: Permission denied), client: 88.198.213.143, server: some.domain.com, request: "GET / HTTP/1.1", host: "some.domain.com"
2024/12/25 13:55:05 [crit] 74930#74930: *5 stat() "/root/public1/public/" failed (13: Permission denied), client: 88.198.213.143, server: some.domain.com, request: "GET / HTTP/1.1", host: "some.domain.com"
2024/12/25 13:55:05 [crit] 74930#74930: *5 realpath() "/root/public1/public" failed (13: Permission denied), client: 88.198.213.143, server: some.domain.com, request: "GET / HTTP/1.1", host: "some.domain.com"
2024/12/25 13:55:05 [error] 74930#74930: *5 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 88.198.213.143, server: some.domain.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/run/php/php8.3-fpm.sock:", host: "some.domain.com"
2024/12/25 13:55:05 [error] 74930#74930: *5 open() "/root/public1/public/favicon.ico" failed (13: Permission denied), client: 88.198.213.143, server: some.domain.com, request: "GET /favicon.ico HTTP/1.1", host: "some.domain.com", referrer: "http://some.domain.com/"

Alguém pode me ajudar com o que há de errado com minha configuração do Nginx?

nginx
Martin Hope
St.Antario
Asked: 2024-12-25 14:18:39 +0800 CST
  • 5

Ubuntu 22.04

Tenho um IPv6registro marcado como INCOMPLETE:

$ip neigh
xxxx::xxxx dev eth0 INCOMPLETE

Tentando excluí-lo como

$sudo ip neighbo del xxxx::xxxx dev eth0

não o apaga de fato, já que ip neigho reporta da mesma forma. Existe uma maneira de remover o INCOMPLETEregistro vizinho?

linux
Martin Hope
Tobia
Asked: 2024-12-24 23:04:50 +0800 CST
  • 5

Tenho uma diretiva de cache no meu balanceador nginx sem nenhuma configuração específica.
Vejo que quando pressiono CTRL-F5 no meu navegador, todos os recursos são solicitados com Cache-Control:no-cachecabeçalhos, mas o nginx ainda responde com conteúdo em cache.

É por design que o nginx honra apenas o cabeçalho de cache do servidor de backend e não o do cliente?

Esta é a parte relevante da configuração de cache do nginx:

  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mycache:100m max_size=500m inactive=60m use_temp_path=off;
  proxy_cache_key $host$request_uri;

  proxy_cache mycache;
  add_header X-Cache-Status $upstream_cache_status;

Os valores X-Cache-Status são HIT mesmo que o Cache-Control do cliente não seja cache

Esta é a configuração completa:

# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    server_tokens off;
    client_max_body_size 100M;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    log_format cache_st '$remote_addr - $upstream_cache_status [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
    access_log /var/log/nginx/access.log cache_st;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    #
    ## Cache
    #
    
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mycache:100m max_size=500m inactive=60m use_temp_path=off;


    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#   # See sample authentication script at:
#   # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#   # auth_http localhost/auth.php;
#   # pop3_capabilities "TOP" "USER";
#   # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#   server {
#       listen     localhost:110;
#       protocol   pop3;
#       proxy      on;
#   }
#
#   server {
#       listen     localhost:143;
#       protocol   imap;
#       proxy      on;
#   }
#}

# configuration file /etc/nginx/modules-enabled/50-mod-http-auth-pam.conf:
load_module modules/ngx_http_auth_pam_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-cache-purge.conf:
load_module modules/ngx_http_cache_purge_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-dav-ext.conf:
load_module modules/ngx_http_dav_ext_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-echo.conf:
load_module modules/ngx_http_echo_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-fancyindex.conf:
load_module modules/ngx_http_fancyindex_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip.conf:
load_module modules/ngx_http_geoip_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-headers-more-filter.conf:
load_module modules/ngx_http_headers_more_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-perl.conf:
load_module modules/ngx_http_perl_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-subs-filter.conf:
load_module modules/ngx_http_subs_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-uploadprogress.conf:
load_module modules/ngx_http_uploadprogress_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-upstream-fair.conf:
load_module modules/ngx_http_upstream_fair_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-nchan.conf:
load_module modules/ngx_nchan_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip.conf:
load_module modules/ngx_stream_geoip_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;

# configuration file /etc/nginx/mime.types:

types {
    text/html                             html htm shtml;
    text/css                              css;
    text/xml                              xml;
    image/gif                             gif;
    image/jpeg                            jpeg jpg;
    application/javascript                js;
    application/atom+xml                  atom;
    application/rss+xml                   rss;

    text/mathml                           mml;
    text/plain                            txt;
    text/vnd.sun.j2me.app-descriptor      jad;
    text/vnd.wap.wml                      wml;
    text/x-component                      htc;

    image/png                             png;
    image/tiff                            tif tiff;
    image/vnd.wap.wbmp                    wbmp;
    image/x-icon                          ico;
    image/x-jng                           jng;
    image/x-ms-bmp                        bmp;
    image/svg+xml                         svg svgz;
    image/webp                            webp;

    application/font-woff                 woff;
    application/java-archive              jar war ear;
    application/json                      json;
    application/mac-binhex40              hqx;
    application/msword                    doc;
    application/pdf                       pdf;
    application/postscript                ps eps ai;
    application/rtf                       rtf;
    application/vnd.apple.mpegurl         m3u8;
    application/vnd.ms-excel              xls;
    application/vnd.ms-fontobject         eot;
    application/vnd.ms-powerpoint         ppt;
    application/vnd.wap.wmlc              wmlc;
    application/vnd.google-earth.kml+xml  kml;
    application/vnd.google-earth.kmz      kmz;
    application/x-7z-compressed           7z;
    application/x-cocoa                   cco;
    application/x-java-archive-diff       jardiff;
    application/x-java-jnlp-file          jnlp;
    application/x-makeself                run;
    application/x-perl                    pl pm;
    application/x-pilot                   prc pdb;
    application/x-rar-compressed          rar;
    application/x-redhat-package-manager  rpm;
    application/x-sea                     sea;
    application/x-shockwave-flash         swf;
    application/x-stuffit                 sit;
    application/x-tcl                     tcl tk;
    application/x-x509-ca-cert            der pem crt;
    application/x-xpinstall               xpi;
    application/xhtml+xml                 xhtml;
    application/xspf+xml                  xspf;
    application/zip                       zip;

    application/octet-stream              bin exe dll;
    application/octet-stream              deb;
    application/octet-stream              dmg;
    application/octet-stream              iso img;
    application/octet-stream              msi msp msm;

    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

    audio/midi                            mid midi kar;
    audio/mpeg                            mp3;
    audio/ogg                             ogg;
    audio/x-m4a                           m4a;
    audio/x-realaudio                     ra;

    video/3gpp                            3gpp 3gp;
    video/mp2t                            ts;
    video/mp4                             mp4;
    video/mpeg                            mpeg mpg;
    video/quicktime                       mov;
    video/webm                            webm;
    video/x-flv                           flv;
    video/x-m4v                           m4v;
    video/x-mng                           mng;
    video/x-ms-asf                        asx asf;
    video/x-ms-wmv                        wmv;
    video/x-msvideo                       avi;
}

# configuration file /etc/nginx/sites-enabled/010-mysiteb:
# HTTP

server {
        server_name mysite2 mysiteb mysite3 mysiteb;
    listen 80;  
    include commons/http-location.inc;
}

# BALANCED HAPROXY2 - TCP 81

server {
        server_name mysiteb;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/mysiteb/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysiteb/privkey.pem;
    include commons/ha-location-2.inc;
}

# BALANCED HAPROXY WEB - TCP 82

server {
        server_name mysite3 mysiteb;
    listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite3/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite3/privkey.pem;
        include commons/ha-location-web.inc;
}

server {
        server_name mysite2;
        listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite2/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite2/privkey.pem;
        include commons/ha-location-web.inc;
}

# configuration file /etc/nginx/commons/http-location.inc:
        location /.well-known {
                alias /var/www/html/.well-known;
        }
        location / {
                return 301 https://$host$request_uri;
        }

# configuration file /etc/nginx/commons/ha-location-2.inc:
        location / {
                proxy_pass http://127.0.0.1:81;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                error_page 502 /502error.html;
        }
        location /ws {
                proxy_pass http://127.0.0.1:81;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                proxy_read_timeout 120;
        }
        location = /502error.html {
                root   /usr/share/nginx/html;
                internal;
        }

# configuration file /etc/nginx/commons/ha-location-web.inc:
        location / {
                proxy_pass http://127.0.0.1:82;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                error_page 502 /502error.html;
        proxy_cache mycache;
        add_header X-Cache-Status $upstream_cache_status;
        }
        location = /502error.html {
                root   /usr/share/nginx/html;
                internal;
        }

# configuration file /etc/nginx/commons/srvap1-location.inc:
        location / {
                proxy_pass http://srvap1/;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                error_page 502 /502error.html;
        }
        location /ws {
                proxy_pass http://srvap1;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                proxy_read_timeout 120;
        }
        location = /502error.html {
                root   /usr/share/nginx/html;
                internal;
        }

# configuration file /etc/nginx/commons/srvap2-location.inc:
        location / {
                proxy_pass http://srvap2/;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                error_page 502 /502error.html;
        }
        location /ws {
                proxy_pass http://srvap2;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-SSL on;
        proxy_set_header X-Forwarded-Proto https;
                proxy_read_timeout 120;
        }
        location = /502error.html {
                root   /usr/share/nginx/html;
                internal;
        }

# configuration file /etc/nginx/sites-enabled/030-mysitea:
# HTTP

server {
        server_name mysite1 mysite4 mysite5;
    listen 80;  
    include commons/http-location.inc;
}

# BALANCED HAPROXY - TCP 81

server {
        server_name mysite4;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/mysite4/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysite4/privkey.pem;
    include commons/ha-location-2.inc;
}

server {
        server_name mysite5 mysitea;
    listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite5/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite5/privkey.pem;
        include commons/ha-location-web.inc;
}

server {
        server_name mysite1;
        listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite1/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite1/privkey.pem;
        include commons/ha-location-web.inc;
}

# AP1 - TCP 10001

server {
        server_name mysite4;
        listen 10001 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite4/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite4/privkey.pem;
    include commons/srvap1-location.inc;
}

server {
        server_name mysite5 mysitea;
        listen 10001 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite5/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite5/privkey.pem;
        include commons/srvap1-location.inc;
}

server {
        server_name mysite1;
        listen 10001 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite1/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite1/privkey.pem;
        include commons/srvap1-location.inc;
}

# AP2 - TCP 10002

server {
        server_name mysite4;
        listen 10002 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite4/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite4/privkey.pem;
        include commons/srvap2-location.inc;
}

server {
        server_name mysite5 mysitea;
        listen 10002 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite5/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite5/privkey.pem;
        include commons/srvap2-location.inc;
}

server {
        server_name mysite1;
        listen 10002 ssl;
        ssl_certificate /etc/letsencrypt/live/mysite1/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite1/privkey.pem;
        include commons/srvap2-location.inc;
}


# configuration file /etc/nginx/sites-enabled/default:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
    }

}
server {

    listen 127.0.0.1:1935;

    root /var/www/html;

    location / {
        stub_status;
    }

}
nginx
Prev
Próximo