403 Forbidden on Rails app w/ Nginx、Passenger、unix答案

【问题标题】：403 Forbidden on Rails app w/ Nginx, Passenger, unix403 Forbidden on Rails app w/ Nginx、Passenger、unix
【发布时间】：2015-08-17 05:03:33
【问题描述】：

您好，尽管按照此处的步骤操作，但我遇到了 403 错误

403 Forbidden on Rails app w/ Nginx, Passenger

我的应用文件夹权限

namei -l /home/ubuntu/resume_consumer/current/public

f: /home/ubuntu/resume_consumer/current/public
drwxr-xr-x root   root   /
drwxr-xr-x root   root   home
drwxr-xr-x ubuntu ubuntu ubuntu
drwxrwxr-x ubuntu ubuntu resume_consumer
lrwxrwxrwx ubuntu ubuntu current -> /home/ubuntu/resume_consumer/releases/20150815211156
drwxr-xr-x root   root     /
drwxr-xr-x root   root     home
drwxr-xr-x ubuntu ubuntu   ubuntu
drwxrwxr-x ubuntu ubuntu   resume_consumer
drwxrwxr-x ubuntu ubuntu   releases
drwxrwxr-x ubuntu ubuntu   20150815211156
drwxrwxr-x ubuntu ubuntu public

Nginx 应用程序以无人身份运行

ps waux | grep nginx

root     12005  0.0  0.0  42480   900 ?        Ss   Jul28   0:00 nginx: master process /opt/nginx/sbin/nginx
nobody   12006  0.0  0.1  42804  2016 ?        S    Jul28   0:00 nginx: worker process

我的 nginx 配置如下所示

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    passenger_root /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14;
    passenger_ruby /home/ubuntu/.rvm/wrappers/ruby-2.2.1/ruby;

    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  qa.enterprise.getmeed.com;
        root /home/ubuntu/resume/current/public;
        passenger_enabled on;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

       # location / {
        #    root   html;
        #    index  index.html index.htm;
        #}

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        #error_page   500 502 503 504  /50x.html;
        #location = /50x.html {
        #    root   html;
        #}

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    server {
        listen       80;
        server_name  qa.getmeed.com;
        root /home/ubuntu/resume_consumer/current/public;
        index index.html index.htm;
        passenger_enabled on;
        rails_env production;
        passenger_friendly_error_pages on;
    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    }


    # HTTPS server
    #
    #server {
    #    listen       443;
    #    server_name  localhost;

    #    ssl                  on;
    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;
    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers   on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

当我查看日志时，我发现一条警告说，PassengerAgent 没有发现另一个目录被禁止的错误。我不确定警报是否相关。

2015/08/15 23:40:41 [notice] 20858#0: signal process started
2015/08/15 23:40:41 [alert] 12005#0: Unable to start Phusion Passenger: Support binary PassengerAgent not found (tried: /home/ubuntu/.rvm/gems/ruby-2.2.1/gems/passenger-5.0.14/buildout/support-binaries/PassengerAgent and /root/.passenger/support-binaries/5.0.14/PassengerAgent). This probably means that your Phusion Passenger installation is broken or incomplete, or that your 'passenger_root' setting contains the wrong value. Please reinstall Phusion Passenger or adjust the setting (see: https://www.phusionpassenger.com/documentation/Users%20guide%20Nginx.html#PassengerRoot). (-1: Unknown error)
2015/08/15 23:45:04 [error] 20859#0: *375 directory index of "/home/ubuntu/resume_consumer/current/public/" is forbidden, client: 104.135.15.7, server: qa.getmeed.com, request: "GET / HTTP/1.1", host: "qa.getmeed.com"

【问题讨论】：

标签： ruby ruby-on-rails-3 ubuntu nginx passenger

【解决方案1】：

您只需要查看是否可以读取/home/ubuntu/resume_consumer/current/public 中的文件。您向我们展示了在 Ubuntu 主目录中设置的权限，但 current 和 public 也将拥有自己的权限。

首先假设public里面有一个index.html，下面是不是会返回错误：

sudo -u nobody /home/ubuntu/resume_consumer/current/public

如果是这样，那么您有权限问题。您可以通过将nobody 用户添加到同一个ubuntu 组来解决此问题：

sudo adduser nobody ubuntu

然后确保ubuntu 组用户与ubuntu 用户具有相同的访问权限。

sudo chmod -R g=u /home/ubuntu/resume_consumer

【讨论】：

我认为我拥有该文件夹的权限。我尝试了以下命令sudo -u nobody ls /home/ubuntu/resume_consumer/current/public，它列出了目录中的所有文件
OK 再次查看您的问题，看来您需要一个 index.html 文件。目前没有什么可以默认的，所以 nginx 检查它是否可以列出它决定不做的目录，然后抛出一个错误。

【解决方案2】：

谢谢大家！事实证明nginx没有问题。 nginx 日志中有关于乘客的错误，我最初不确定是否相关，但事实证明这是根本原因。

我安装了乘客，但没有专门为应用程序安装乘客。我必须去应用程序目录并安装乘客gem，然后在nginx配置中使用与应用程序中的gem相对应的passenger_root。这解决了问题。

【讨论】：