Troubles with Chroot PHP-FPM(8.0)

Hello Community,

first of all the facts:
Attached you will find the htf_report.txt
OS: Ubuntu 20.04
PHP: PHP-FPM8.0 (also other versions installed)
Web service: Apache2
Server version: Apache/2.4.41 (Ubuntu)
Server built: 2022-01-05T14:49:56

Configurations:
/etc/php/8.0/fpm/pool.d/web346.conf

Code:

[web346]

listen = /var/lib/php8.0-fpm/web346.sock
listen.owner = web346
listen.group = www-data
listen.mode = 0660

user = web346
group = client58

pm = ondemand
pm.max_children = 10
pm.process_idle_timeout = 10s;
pm.max_requests = 0

chdir = /
chroot = /var/www/clients/client58/web346
php_admin_value[doc_root] = /web

env[HOSTNAME] = $HOSTNAME
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

php_admin_value[open_basedir] =
php_admin_value[session.save_path] = /tmp
php_admin_value[upload_tmp_dir] = /tmp
php_admin_value[sendmail_path] = "/usr/sbin/sendmail -t -i -f [email protected]"

/etc/apache2/sites-enabled/100-uhpatest.t-ws.at.vhost

Code:

<Directory /var/www/uhpatest.t-ws.at>
                AllowOverride None
                                Require all denied
                </Directory>

<VirtualHost *:80>


                                        DocumentRoot /var/www/clients/client58/web346/web

                ServerName uhpatest.t-ws.at
                ServerAdmin [email protected]


                ErrorLog /var/log/ispconfig/httpd/uhpatest.t-ws.at/error.log

                Alias /error/ "/var/www/uhpatest.t-ws.at/web/error/"
                ErrorDocument 400 /error/400.html
                ErrorDocument 401 /error/401.html
                ErrorDocument 403 /error/403.html
                ErrorDocument 404 /error/404.html
                ErrorDocument 405 /error/405.html
                ErrorDocument 500 /error/500.html
                ErrorDocument 502 /error/502.html
                ErrorDocument 503 /error/503.html


                <Directory /var/www/uhpatest.t-ws.at/web>
                                # Clear PHP settings of this website
                                <FilesMatch ".+\.ph(p[345]?|t|tml)$">
                                                SetHandler None
                                </FilesMatch>
                                Options +SymlinksIfOwnerMatch
                                AllowOverride All
                                                                Require all granted
                                                </Directory>
                <Directory /var/www/clients/client58/web346/web>
                                # Clear PHP settings of this website
                                <FilesMatch ".+\.ph(p[345]?|t|tml)$">
                                                SetHandler None
                                </FilesMatch>
                                Options +SymlinksIfOwnerMatch
                                AllowOverride All
                                                                Require all granted
                                                </Directory>




                <IfModule mod_fastcgi.c>
                                <Directory /var/www/clients/client58/web346/cgi-bin>
                                                                                Require all granted
                                                                    </Directory>
                                <Directory /var/www/uhpatest.t-ws.at/web>
                                        <FilesMatch "\.php[345]?$">
                                                <If "-f '%{REQUEST_FILENAME}'">
                                                        SetHandler php-fcgi
                                                </If>
</FilesMatch>
                                </Directory>
                                <Directory /var/www/clients/client58/web346/web>
                                        <FilesMatch "\.php[345]?$">
                                                <If "-f '%{REQUEST_FILENAME}'">
                                                        SetHandler php-fcgi
                                                </If>
                                        </FilesMatch>
                                </Directory>
                Action php-fcgi /php-fcgi virtual
                                Alias /php-fcgi /var/www/clients/client58/web346/cgi-bin/php-fcgi-*-80-uhpatest.t-ws.at
                FastCgiExternalServer /var/www/clients/client58/web346/cgi-bin/php-fcgi-*-80-uhpatest.t-ws.at -idle-timeout 300 -socket /var/lib/php8.0-fpm/web346.sock -pass-header Authorization  -pass-header Content-Type
                </IfModule>
                <IfModule mod_proxy_fcgi.c>
                        <IfVersion >= 2.4.26>
                                ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/web"
                                ProxyFCGISetEnvIf "true" CONTEXT_DOCUMENT_ROOT "%{reqenv:DOCUMENT_ROOT}"
                                ProxyFCGISetEnvIf "true" HOME "%{reqenv:DOCUMENT_ROOT}"
                                ProxyFCGISetEnvIf "true" SCRIPT_FILENAME "%{reqenv:DOCUMENT_ROOT}%{reqenv:SCRIPT_NAME}"
                        </IfVersion>
                        #ProxyPassMatch ^/(.*\.php[345]?(/.*)?)$ unix:///var/lib/php8.0-fpm/web346.sock|fcgi://localhost//var/www/clients/client58/web346/web/$1
                        <Directory /var/www/clients/client58/web346/web>
                                <FilesMatch "\.php[345]?$">
                                        <If "-f '%{REQUEST_FILENAME}'">
                                                SetHandler "proxy:unix:/var/lib/php8.0-fpm/web346.sock|fcgi://localhost"
                                        </If>
                                </FilesMatch>
                        </Directory>
                        </IfModule>



                # add support for apache mpm_itk
                <IfModule mpm_itk_module>
                        AssignUserId web346 client58
                </IfModule>

                <IfModule mod_dav_fs.c>
                # Do not execute PHP files in webdav directory
                        <Directory /var/www/clients/client58/web346/webdav>
                                <ifModule mod_security2.c>
                                        SecRuleRemoveById 960015
                                        SecRuleRemoveById 960032
                                </ifModule>
                                <FilesMatch "\.ph(p3?|tml)$">
                                        SetHandler None
                                </FilesMatch>
                        </Directory>
                        DavLockDB /var/www/clients/client58/web346/tmp/DavLock
                        # DO NOT REMOVE THE COMMENTS!
                        # IF YOU REMOVE THEM, WEBDAV WILL NOT WORK ANYMORE!
      # WEBDAV BEGIN
                        # WEBDAV END
                </IfModule>

                        DocumentRoot "/var/www/clients/client58/web346/web/web/"


</VirtualHost>

ISP Config GUI Setting:



The Problem:
I want to install the CMS "Contao", which specifies that the DocumentRoot of Apache points to a subfolder "web".
There I put a test index.php, which should show me a phpinfo. Instead, unfortunately, an error message appears:

In the browser:
"File not found."

In the apache error.log:

Code:

[Thu Mar 03 14:13:02.164074 2022] [proxy_fcgi:error] [pid 211657:tid 140588447926016] [client 172.18.2.221:1760] AH01071: Got error 'Primary script unknown'

Unfortunately, I haven't found anything in the forum or at Google that helps to solve my problem or takes me one step further. I am open for any suggestions.

Best regards
Patrick

 

That does not work, but htf_report reveals you ISPConfig is not using PHP 8.
Where did you get the common_issues script? The report is missing some test results.
Is your system working at all since port check show so many services not running.
What shows command

Code:

systemctl --state=failed

 

Hello,
sorry I forgot that this is a multiserver environment (Web, DB, DNS, MAIL).

This is set by the ispconfig gui in the website settings:



I also configured multiple php versions (in the "additional php versions" settings): 7.1, 7.2, 7.3, 7.4. 8.0
Here the output for "systemctl --state=failed":

Code:

  UNIT                       LOAD   ACTIVE SUB    DESCRIPTION
● obmaua.service             loaded failed failed SYSV: Running obmaua on system startup
● snap.certbot.renew.service loaded failed failed Service for snap application certbot.renew

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

2 loaded units listed.

Best regards,
Patrick

 

Have you modified the .conf and .vhost files for the website? I have never touched those files on host running ISPConfig, and everything just works.
What is owner and permissions for index.php? Try adding index.html with contents that assure you it is that particular file.

 

No, the configuration is created by ISPConfig. If I would edit the files manually, then they would be overwritten if necessary.

To rule out an permission problem, I have now set 777. Unfortunately no change:

Code:

-rwxrwxrwx 1 web346 client58       27 Mar  3 14:06 index.php

 

Just tried, unfortunately no change.

 

No one on the forum who has/had a similar problem?

 

Are you sure you run the htf_report as root user?
The web346.conf in #1 looks strange, very different settings compared to my server. The /tmp on my server are the website tmp directory, for instance. How much have you changed the setup yourself on that host? Have you altered setups editing files or using ISPConfig panel?

 

Yes, I just made another report, it looks the same.
Both the ISPConfig installation and the Ubuntu server are standard without any major customizations.

 

Thanks for your test! What does your virtual host file look like? Did you change the DocumentRoot to a sub folder?

 

yes unfortunately no change.

 

After browsing the Apache tracelog now, I found the problem, but no solution yet.

The problem is the following:
If the DOCUMENT_ROOT is not "/web" but a subfolder e.g.: /web/web, then ISP-Config does not set this path.

Code:

ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/web" ==> ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/web/web"

Code:

php_admin_value[doc_root] = /web ==> php_admin_value[doc_root] = /web/web

I saw that there is a template variable in the ISP config for this: https://git.ispconfig.org/ispconfig...46c7#6f39cd1c52d49a59e97acff30ec7ecbdb9d63919

Where can I set this?

 

Thanks for the quick reply.
I am now a little confused. As far as I understand, then parameters in the "conf-custom" folder become active for all clients or?

Currently there is one (test user) that has php-fpm & chroot active. Then it would be better to have another field for this in the GUI or am I misunderstanding something here?

 

I'll give it a try, unfortunately I couldn't find anything yet. I also think that this will not work because "php_admin_value[doc_root]" is set in the pool configuration and not in php.ini.

The CMS "contao" requires the subfolder unfortunately. I have no choice unfortunately.

 

Unfortunately, I have not found a way to set these two config parameters via the GUI:

Code:

php_admin_value[doc_root] = /web
ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/web"

Do you maybe have another idea or a good tip? I don't want/need to set these parameters globally, but only for this one website.