I want to deploy my flask service in a server with centOS 7. So I followed this tutorial - https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uwsgi-and-nginx-on-centos-7 .
After runnning systemctl start nginx command, I got this error:
nginx: [emerg] bind() to 0.0.0.0:5000 failed (13: Permission denied)
My nginx.conf file:
server {
listen 5000;
server_name _;
location / {
include uwsgi_params;
uwsgi_pass unix:/root/fiproxy/fiproxyproject/fiproxy.sock;
}
}
Note: flask service and wsgi work ok. And I've tried to run nginx with superuser and the error remains.
After search a lot in Internet, I found a solution to my problem.
I ran this command to get all used ports in my machine: semanage port -l.
After that, I filtered the output with: semanage port -l | grep 5000.
I realized that this port 5000 is used by commplex_main_port_t, I searched in speedguide and I found: 5000 tcp,udp **UPnP**.
Conclusion, maybe my problem was bind a standard port.
To add your desired port use this command:
sudo semanage port -a -t http_port_t -p tcp [yourport]
Now run nginx with sudo:
sudo systemctl stop nginx
sudo systemctl start nginx
The Nginx master process needs root permission. Because it needs bind port.
You need start Nginx under root user.
Then you can define the user of child processes in nginx.conf.
Related
I'm running an instance of Debian on Amazon EC2 with Node.js installed. If I run the code below:
http = require('http');
http.createServer(function (request, response){
response.writeHead(200, {'Content-Type':'text/plain'});
response.end('Hello World\n');
}).listen(80);
console.log("Running server at port 80");
I get the output below which tells me there's another process listening at port 80:
Running server at port 80
events.js:72
throw er; // Unhandled 'error' event
^
Error: listen EACCES
at errnoException (net.js:901:11)
at Server._listen2 (net.js:1020:19)
at listen (net.js:1061:10)
at Server.listen (net.js:1127:5)
at Object.<anonymous> (/home/admin/nodetests/nodetest.js:6:4)
at Module._compile (module.js:456:26)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)
at Function.Module._load (module.js:312:12)
at Function.Module.runMain (module.js:497:10)
Now when I check to see if there's a process (as root in case anything is hidden) listening on port 80 using:
netstat -tupln
I get the below output, which tells me theres nothing listening at port 80:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1667/sshd
tcp6 0 0 :::22 :::* LISTEN 1667/sshd
I should note that the debian has port 80 open as an inbound rule if that makes a difference.
My question is: What am I doing wrong? How come I can't identify the process listening to port 80? Why is it blocked in Debian? What steps should I take to get the code running correctly?
The error code EACCES means you don't have proper permissions to run applications on that port. On Linux systems, any port below 1024 requires root access.
Instead of running on port 80 you can redirect port 80 to your application's port (>1024) using
iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3000
This will work if your application is running on port 3000.
Short answer: You can allow node access to that port using:
setcap 'cap_net_bind_service=+ep' /path/to/nodejs
long answer
Edit:
May not work on new node versions
Note that if you have apache running, you can create a reverse proxy on a vhost. If your node is running on port 8080:
<VirtualHost 127.0.0.1:80>
ServerName myLocalServer
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
</VirtualHost>
Of course, add server to /etc/hosts:
127.0.0.1 myLocalServer
You will need to enable the relevant apache modules:
sudo a2enmod proxy_html
sudo a2enmod proxy_http
sudo a2enmod proxy_connect
sudo a2enmod proxy_ajp
sudo service apache2 restart
...and now you can connect to http://myLocalServer.
For those looking for a quick and easy solution for a development environment, port forwarding via ssh can be a nice alternative:
ssh -L 80:localhost:3000 yourusername#localhost -N
This forwards port 80 on localhost to port 3000 on localhost.
It needs to be run as root (privileged port). To cancel it, simply hit ctrl-c in the terminal. (You can add the -f flag to have the command run in the background, but then you need to find it again to kill it).
This solution requires you to have an ssh server running locally. It can be done quickly, but please bear in mind the security implications if you are on a shared network. You might want to apply at least some level of additional security (disable password & root login).
I personally only ever use this on my local machine. I'm not sure how it affects the processing speed of your requests if you run this on production, maybe someone has an idea. Anyway, you would need to make sure this command keeps running all the time, which introduces more headaches. For production environments, I suggest using a reverse proxy like nginx.
the hexacyanide answer is right. but is there any solution to make this work?
the answer is yes.
how?
you can use a reverse proxy for example run a nginx reverse proxy on port 80 and pass the proxy to destination ip:port that node use it.
you can set this up using docker container that makes life even easier. this is the official build of nginx in docker hub that you can pull it.
there's even more benefits in using reverse proxy that you can google it.
I have got the same error and I tried running my application using sudo and it worked for me.
without sudo
mansi#mansi:~/NodePractice$ node myFirst.js
events.js:141
throw er; // Unhandled 'error' event
^
Error: listen EACCES 0.0.0.0:80
at Object.exports._errnoException (util.js:870:11)
at exports._exceptionWithHostPort (util.js:893:20)
at Server._listen2 (net.js:1224:19)
at listen (net.js:1273:10)
at Server.listen (net.js:1369:5)
at Object.<anonymous> (/home/mansi/NodePractice/myFirst.js:6:4)
at Module._compile (module.js:410:26)
at Object.Module._extensions..js (module.js:417:10)
at Module.load (module.js:344:32)
at Function.Module._load (module.js:301:12)
and with sudo
mansi#mansi:~/NodePractice$ sudo node myFirst.js
^C
The error code EACCES means you don't have proper permissions to run applications on that port.
On Linux systems, any port below 1024 requires root access.
Run the program with sudo permision.
Run sudo su command before running the program.
I am using nginx through brew and it appears to be configured and working correctly - to a point. I have multiple host files (around 20 sites) and almost all of them work fine, however, any new sites added will not work.
All old host files seem to load just fine, for example with server name site.test on port 80, but any new host files added return with a "Server not found" in my web browsers.
After much troubleshooting and Google searching, I've finally found something that seems odd in my setup and it was this post that triggered it: nginx.conf and nginx.pid users and permissions. Although it doesn't seem to solve my exact problem.
When I run nginx -t I get:
nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/etc/nginx/nginx.conf:1
nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: [emerg] open() "/usr/local/var/run/nginx.pid" failed (13: Permission denied)
nginx: configuration file /usr/local/etc/nginx/nginx.conf test failed
However, when I run sudo nginx -t I get:
nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
I have both killed nginx and stopped it gracefully with brew and restarted it with sudo, but I appear to get the same issue with nginx.pid.
When I start nginx, I use: sudo brew services start nginx
Running ps aux | grep nginx, returns:
Media32 7444 0.0 0.0 4339424 2016 ?? S 12:16pm 0:00.01 nginx: worker process
Media32 7443 0.0 0.0 4339424 1836 ?? S 12:16pm 0:00.00 nginx: worker process
root 7440 0.0 0.0 4297440 4876 ?? Ss 12:16pm 0:00.01 nginx: master process /usr/local/opt/nginx/bin/nginx -g daemon off;
Which should be correct as my user is setup in nginx.conf to be user Media32 staff.
I can provide any other code necessary, but I have been at a bit of a loss for days on this now and any help would be appreciated.
Update
I appear to have solved this by editing /etc/hosts and adding a record for the new host files, ie. 127.0.0.1 site.test and then after reloading nginx it worked, but I have never had to do this before, can anyone shed any light on why this is needed and wasn't needed prior?
I have solved this issue in macOS Catalina.
sudo brew services stop nginx
sudo chmod 777 /usr/local/var/run/nginx.pid
sudo brew services start nginx
nginx -t
Apart from the fact that setting any new host in /private/etc/hosts as
127.0.0.1 mysite.test
is a rule when adding a new host domain locally,
In my case I got a
the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/etc/nginx/nginx.conf:2
"/usr/local/var/run/nginx.pid" failed (13: Permission denied)
bind() to 0.0.0.0:80 failed (48: Address already in use)
and the working solution was made up of these steps:
stop root process
sudo nginx -s stop
check if process stopped
ps aux | grep nginx
restart process
sudo nginx -s reload
gave me the error
nginx: [error] open() “/usr/local/var/run/nginx.pid” failed (2: No such file or directory)
probabil .pid was started with the wrong root user as I uncommented the line with path to .pid in /usr/local/etc/nginx/nginx.conf and then I commented it back again
to start nginx as a user and not root
brew services start nginx
result at running command
ps aux | grep nginx
youruser 89212 0.0 0.0 4268280 644 s002 S+ 2:46PM 0:00.00 grep nginx
youruser 89179 0.0 0.0 4302204 1776 ?? S 2:45PM 0:00.00 nginx: worker process
youruser 89178 0.0 0.0 4275372 4368 ?? S 2:45PM 0:00.01 nginx: master process /usr/local/opt/nginx/bin/nginx -g daemon off;
And as it can be seen, the nginx process started with the expected user and not as root and the conflict between processes was gone and I could access the PHP application local domain.
Make sure you're running nginx -t as the root user using "sudo nginx -t" since the configuration checker requires root permissions.
(This solved the problem for me)
I am trying to run Nginx, but I am getting the error below:
bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a
socket in a way forbidden by its access permissions)
Please provide some help on what changes I need to do to make it working?
I have tried running on ports other than 80 and it works. but I need it to be running on 80.
Note: I am running on Windows 7 with command prompt running as Administrator.
If the port is already in use, you can change the default port of 80 to a different port that is not in use (maybe 8070). In conf\nginx.conf:
server {
listen 8070;
...
}
After startup, you should be able to hit localhost:8070.
tl;dr
netsh http add iplisten ipaddress=::
Faced similar issue. Run the above command in command prompt.
This should free up port 80, and you'd be able to run nginx.
Description:
netsh http commands are used to query and configure HTTP.sys settings and parameters.
add iplisten :
Adds a new IP address to the IP listen list, excluding the port number.
"::" means any IPv6 address.
For more netsh http commands refer the netsh http commands documentation.
Hope this helps!!
You have to be admin or root to bind port 80. Something you can do if you cannot run as root, is that your application listens to other port, like 8080, and then you redirect messages directed to 80 to 8080. If you are using Linux you redirect messages with iptables.
nginx: [emerg] bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket in a way forbidden by its access permissions)
I got a similar problem, My 80 port was listening to IIS (windows machine). Stopping IIS freed up 80 port.
The problem got resolved...!!
Please check if another Proxy is running under port 80 ---> in my case IIS was running as a reverse proxy, so nginx could not start..
Stopping IIS, and starting of NGXIN solved the problem
My Tomcat server was running on port 80. Changed the port number in conf\nginx.conf file and it started to work.
This is an old question but since I had this problem recently I thought of posting another possible reason in this problem.
If the user is using Docker and has already tried all proposed solutions as stated above and is wondering why port 80 is trying to bind although on your configurations you are overwriting the port to non root port e.g. listen 8080; it seems that the newer NGINX images have a default nginx.conf file in /etc/nginx/conf.d.
Sample:
$ grep -r 80 /etc/nginx/
/etc/nginx/conf.d/default.conf: listen 80;
On my case I removed it on my Dockerfile:
RUN set -x \
&& rm -f /etc/nginx/nginx.conf \
&& rm -f /etc/nginx/conf.d/default.conf
Next step pass from my custom configurations:
COPY ["conf/nginx.conf", "/etc/nginx/nginx.conf"]
I've gotten this error before, and can't seem to figure out why this occurred.
Ultimately its throwing a 502 Bad Gateway error.
if I do a nginx -t, I get:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
It appears my syntax in:
/etc/nginx/sites-enabled looks good.
Here's the site in sites-enabled:
server {
listen 80;
server_name <my-server-name-ip-here>;
error_log /home/user/project/nginx_error.error_log info;
root /home/user/project/projenv;
location / {
include proxy_params;
proxy_pass http://unix:/home/user/project/project.sock;
}
}
Error Im getting:
connect() to unix:/home/user/project/project.sock failed
Here's my init script:
start on runlevel [2345]
stop on runlevel [!2345]
respawn #respawn this on reboot
setuid user #set as unix user 'jd' to run as
setgid www-data #user used by nginx
env PATH=/home/user/project/projenv/bin
chdir /home/user/project
exec gunicorn --workers 3 --bind unix:project.sock -m 007 wsgi:app
any idea what I should fix??
Thank you!
I'd suggest that this is probably a permissions error. Check that the socket is readable and writable by both client and server.
I’d like to make a fully dockerized Drupal install. My first step is to get containers running with Nginx and php5-fpm, both Debian based. I’m on CoreOS alpha channel (using Digital Ocean.)
My Dockerfiles are the following:
Nginx:
FROM debian
MAINTAINER fvhemert
RUN apt-get update && apt-get install -y nginx && echo "\ndaemon off;" >> /etc/nginx/nginx.conf
CMD ["nginx"]
EXPOSE 80
This container build and runs nicely. I see the default Nginx page on my server ip.
Php5-fpm:
FROM debian
MAINTAINER fvhemert
RUN apt-get update && apt-get install -y \
php5-fpm \
&& sed 's/;daemonize = yes/daemonize = no/' -i /etc/php5/fpm/php-fpm.conf
CMD ["php5-fpm"]
EXPOSE 9000
This container also builds with no problems and it keeps running when started.
I start the php5-fpm container first with:
docker run -d --name php5-fpm freek/php5-fpm:1
Ad then I start Nginx,, linked to php5-fpm:
docker run -d -p 80:80 --link php5-fpm:phpserver --name nginx freek/nginx-php:1
The linking seems to work, there is an entry in /etc/hosts with name phpserver. Both dockers run:
core#dockertest ~ $ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
fd1a9ae0f1dd freek/nginx-php:4 "nginx" 38 minutes ago Up 38 minutes 0.0.0.0:80->80/tcp nginx
3bd12b3761b9 freek/php5-fpm:2 "php5-fpm" 38 minutes ago Up 38 minutes 9000/tcp php5-fpm
I have adjusted some of the config files. For the Nginx container I edited /etc/nginx/sites-enabled/default and changed:
server {
#listen 80; ## listen for ipv4; this line is default and implied
#listen [::]:80 default_server ipv6only=on; ## listen for ipv6
root /usr/share/nginx/www;
index index.html index.htm index.php;
(I added the index.php)
And further on:
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
# # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
#
# # With php5-cgi alone:
fastcgi_pass phpserver:9000;
# # With php5-fpm:
# fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
In the php5-fpm docker I changed /etc/php5/fpm/php.ini:
cgi.fix_pathinfo=0
php5-fpm runs:
[21-Nov-2014 06:15:29] NOTICE: fpm is running, pid 1
[21-Nov-2014 06:15:29] NOTICE: ready to handle connections
I also changed index.html to index.php, it looks like this (/usr/share/nginx/www/index.php):
<html>
<head>
<title>Welcome to nginx!</title>
</head>
<body bgcolor="white" text="black">
<center><h1>Welcome to nginx!</h1></center>
<?php
phpinfo();
?>
</body>
</html>
I have scanned the 9000 port from the Nginx docker, it appears as closed. Not a good sign of course:
root#fd1a9ae0f1dd:/# nmap -p 9000 phpserver
Starting Nmap 6.00 ( http://nmap.org ) at 2014-11-21 06:49 UTC
Nmap scan report for phpserver (172.17.0.94)
Host is up (0.00022s latency).
PORT STATE SERVICE
9000/tcp closed cslistener
MAC Address: 02:42:AC:11:00:5E (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds
The Nginx logs:
root#fd1a9ae0f1dd:/# vim /var/log/nginx/error.log
2014/11/20 14:43:46 [error] 13#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 194.171.252.110, server: localhost, request: "GET / HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "128.199.60.95"
2014/11/21 06:15:51 [error] 9#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 145.15.244.119, server: localhost, request: "GET / HTTP/1.0", upstream: "fastcgi://172.17.0.94:9000", host: "128.199.60.95"
Yes, that goes wrong and I keep getting a 502 bad gateway error when browsing to my Nginx instance.
My question is: What exactly goes wrong? My guess is that I’m missing some setting in the php config files.
EDIT FOR MORE DETAILS:
This is the result (from inside the php5-fpm container, after apt-get install net-tools):
root#3bd12b3761b9:/# netstat -tapen
Active Internet connections
(servers and established) Proto Recv-Q Send-Q Local Address
Foreign Address State User Inode PID/Program name
From inside the Nginx container:
root#fd1a9ae0f1dd:/# netstat -tapen
Active Internet connections
(servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program
name tcp 0 0 0.0.0.0:80 0.0.0.0:*
LISTEN 0 1875387 -
EDIT2:
Progression!
In the php5-fpm container, in the file:
/etc/php5/fpm/pool.d/www.conf
I changed the listen argument from some socket name to:
listen = 9000
Now when I go to my webpage I get the error:
"No input file specified."
Probably I have trailing / wrong somewhere. I'll look into it more closely!
EDIT3:
So I have rebuild the dockers with the above mentioned alterations and it seems that they are talking. However, my webpage tells me: "file not found."
I'm very sure it has to do with the document that nginx sents to php-fpm but I have no idea how it should look like. I used the defaults when using the socket method which always worked. Now it doesn't work anymore. What should be in /etc/nginx/sites-enabled/default under location ~ .php$ { ?
The reason it doesn't work is, as you have discovered yourself, that nginx only sends the path of the PHP file to PHP-FPM, not the file itself (which would be quite inefficient). The solution is to use a third, data-only VOLUME container to host the files, and then mount it on both docker instances.
FROM debian
VOLUME /var/www
CMD ['true']
Build the above Dockerfile and create an instance (call it for example: storage-www), then run both the nginx and the PHP-FPM containers with the option:
--volumes-from storage-www
That will work if you run both containers on the same physical server.
But you still could use different servers, if you put that data-only container on a networked file-system, such as GlusterFS, which is quite efficient and can be distributed over a large-scale network.
Hope that helps.
Update:
As of 2015, the best way to make persistent links between containers is to use docker-compose.
So, I have tested all settings and none worked between dockers while they did work with the same settings on 1 server (or also in one docker probably). Then I found out that php-fpm is not taking php files from nginx, it is receiving the path, if it can't find the same file in its own container it generates a "file not found". See here for more information: https://code.google.com/p/sna/wiki/NginxWithPHPFPM So that solves the question but not the problem, sadly. This is quite annoying for people that want to do load balancing with multiple php-fpm servers, they'd have to rsync everything or something like that. I hope someday I'll find a better solution. Thanx for the replies.
EDIT: Perhaps I can mount the same volume in both containers and get it to work that way. That won't be a solution when using multiple servers though.
When you are in your container as
root#fd1a9ae0f1dd:/#
, check the ports used with
netstat -tapen | grep ":9000 "
or
netstat -lntpu | grep ":9000 "
or the same commands without the grep