ISPCOnfig with Nextcloud (suite) : error 403, no upload more than 11MB

ledufakademy · Oct 7, 2020

hello,

i'm facing an urging problerm with our migration to ispconfig (nextcloud site), it' seem ispconfig no taking snipets parameter (while they a re in /etc/nginx conf after applying) :

php option

upload_max_filesize = 512M
post_max_size = 512M
max_execution_time = 3600
request_terminate_timeout = 3600
opcache.enable = 1
opcache.enable_cli = 1
opcache.interned_strings_buffer = 8
opcache.max_accelerated_files = 10000
opcache.memory_consumption = 128
opcache.save_comments = 1
opcache.revalidate_freq = 1
memory_limit = 1024M
mbstring.func_overload = 0
default_charset = 'UTF-8'
output_buffering = 0
cgi.fix_pathinfo =
Click to expand...

nginx option

# Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this
# topic first

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;

#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;

# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;

location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
rewrite ^/.well-known/webfinger /public.php?service=webfinger last;

location = /.well-known/carddav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
location ~ /.well-known/acme-challenge {
allow all;
}

# set max upload size
client_max_body_size 512M;
fastcgi_buffers 64 4K;

# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;

location / {
rewrite ^ /index.php;
}

location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all;
}
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on;
# Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true;
{FASTCGIPASS}
fastcgi_read_timeout 3600s;
fastcgi_send_timeout 3600s;
fastcgi_connect_timeout 3600s;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}

location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404;
index index.php;
}

# Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;

# Optional: Don't log access to assets
access_log off;
}

location ~ \.(?ng|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets
access_log off;
}

location ~ \.php$ {##delete##
try_files /a1fc5821d2b5d92d0d04aa0046688818.htm @php;
}
Click to expand...

till · Oct 7, 2020

ledufakademy said: ↑

i'm facing an urging problerm with our migration to ispconfig (nextcloud site), it' seem ispconfig no taking snipets parameter (while they a re in /etc/nginx conf after applying) :
Click to expand...

If the snippets are in the generated vhost file and the vhost file has not a .err ending, then the problem is not on ispconfigs side as all what ISPConfig's task is, is to write the snippets into that file. But upload limits are not a nginx config, they are a php config. Check with a phpinfo() file if the php config change was applied.

ledufakademy · Oct 7, 2020

ok till i will do that (i'm not a webmaster !!!grrrhhhh)

ledufakademy · Oct 7, 2020

very strange answer :

so why php snipets are not enable ?

root@web2:/var/www/nuage.domain.com/web# sudo -u web53 php phpinfo.php |grep max
log_errors_max_len => 1024 => 1024
max_execution_time => 0 => 0
max_file_uploads => 20 => 20
max_input_nesting_level => 64 => 64
max_input_time => -1 => -1
max_input_vars => 1000 => 1000
post_max_size => 8M => 8M
upload_max_filesize => 2M => 2M
ldap.max_links => Unlimited => Unlimited
memcache.max_failover_attempts => 20 => 20
mysqli.max_links => Unlimited => Unlimited
mysqli.max_persistent => Unlimited => Unlimited
session.gc_maxlifetime => 1440 => 1440
opcache.max_accelerated_files => 10000 => 10000
opcache.max_file_size => 0 => 0
opcache.max_wasted_percentage => 5 => 5
Click to expand...

till · Oct 7, 2020

Try to manually restart the php-fpm daemon of the used php version and check again.

ledufakademy · Oct 7, 2020

done :

root@web2:/var/www/nuage.domain.com/web# systemctl restart php7.3-fpm.service
root@web2:/var/www/nuage.domain.com/web# sudo -u web53 php phpinfo.php |grep max
log_errors_max_len => 1024 => 1024
max_execution_time => 0 => 0
max_file_uploads => 20 => 20
max_input_nesting_level => 64 => 64
max_input_time => -1 => -1
max_input_vars => 1000 => 1000
post_max_size => 8M => 8M
upload_max_filesize => 2M => 2M
ldap.max_links => Unlimited => Unlimited
memcache.max_failover_attempts => 20 => 20
mysqli.max_links => Unlimited => Unlimited
mysqli.max_persistent => Unlimited => Unlimited
session.gc_maxlifetime => 1440 => 1440
opcache.max_accelerated_files => 10000 => 10000
opcache.max_file_size => 0 => 0
opcache.max_wasted_percentage => 5 => 5
root@web2:/var/www/nuage.ilinux.fr/web#
Click to expand...

ledufakademy · Oct 7, 2020

end :

nano /etc/php/7.3/fpm/pool.d/web53.conf

[web53]

listen = /var/lib/php7.3-fpm/web53.sock
listen.owner = web53
listen.group = www-data
listen.mode = 0660

user = web53
group = client6

pm = dynamic
pm.max_children = 10
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 5
pm.max_requests = 0

chdir = /

env[HOSTNAME] = $HOSTNAME
env[TMP] = /var/www/clients/client6/web53/tmp
env[TMPDIR] = /var/www/clients/client6/web53/tmp
env[TEMP] = /var/www/clients/client6/web53/tmp
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

php_admin_value[open_basedir] = /var/www/clients/client6/web53/web:/var/www/clients/client6/web53/private:/var/www/clients/client6/web53/tmp:/var/www/nuage.ilinux.fr/web:/srv/www/nuage.ilinux.fr/web:/usr/share/php5:/usr/share/php:/tmp:/usr/share/phpmyadmin:/etc/ph$
php_admin_value[session.save_path] = /var/www/clients/client6/web53/tmp
php_admin_value[upload_tmp_dir] = /var/www/clients/client6/web53/tmp
php_admin_value[sendmail_path] = "/usr/sbin/sendmail -t -i -f [email protected]"

php_admin_value[upload_max_filesize] = 512M
php_admin_value[post_max_size] = 512M
php_admin_value[max_execution_time] = 3600
php_admin_value[request_terminate_timeout] = 3600
php_admin_flag[opcache.enable] = 1
php_admin_flag[opcache.enable_cli] = 1
php_admin_value[opcache.interned_strings_buffer] = 8
php_admin_value[opcache.max_accelerated_files] = 10000
php_admin_value[opcache.memory_consumption] = 128
php_admin_flag[opcache.save_comments] = 1
php_admin_flag[opcache.revalidate_freq] = 1
php_admin_value[memory_limit] = 1024M
php_admin_flag[mbstring.func_overload] = off
php_admin_value[default_charset] = 'UTF-8'
php_admin_flag[output_buffering] = off
php_admin_flag[cgi.fix_pathinfo] = 1
Click to expand...

ledufakademy · Oct 7, 2020

till said: ↑

Try to manually restart the php-fpm daemon of the used php version and check again.
Click to expand...

i only have on version 7.3 (But , i also see a 7.2 folder under /etc/php/ )
but a systemctl only give me :

php7.3-fpm.service

ledufakademy · Oct 7, 2020

i'm really lost with this php stuff , cli, fpm , pool.d php.ini this is very very confusing me.
KISS ... not for php.

ledufakademy · Oct 7, 2020

For others sites : same issue ! (we have 2 others netcloud instance)

sudo -u web79 php phpinfo.php |grep max

post_max_size => 8M => 8M
upload_max_filesize => 2M => 2M
Click to expand...

is this a correct way for testing php info ? (because phpinfo.php , is not allowed with : https://website/phpinfo (for nextcloud )

it'seems that php pool.d is not working.
Because :
/etc/php/7.3/fpm/pool.d/web79.conf

it's filled with correct infomation.

php_admin_value[upload_max_filesize] = 512M
php_admin_value[post_max_size] = 512M
php_admin_value[max_execution_time] = 3600
php_admin_value[request_terminate_timeout] = 3600
php_admin_flag[opcache.enable] = 1
php_admin_flag[opcache.enable_cli] = 1
php_admin_value[opcache.interned_strings_buffer] = 8
php_admin_value[opcache.max_accelerated_files] = 10000
php_admin_value[opcache.memory_consumption] = 128
php_admin_flag[opcache.save_comments] = 1
php_admin_flag[opcache.revalidate_freq] = 1
php_admin_value[memory_limit] = 1024M
php_admin_flag[mbstring.func_overload] = off
php_admin_value[default_charset] = 'UTF-8'
php_admin_flag[output_buffering] = off
php_admin_flag[cgi.fix_pathinfo] = 1
Click to expand...

till · Oct 7, 2020

root@web2:/var/www/nuage.domain.com/web# sudo -u web53 php phpinfo.php |grep max
Click to expand...

You can not test php like this, you've tested the wrong PHP, not the one of this website. To test the right PHP, put the phpinfo.php file into the web folder of this website, then open the URL of the site + /phpinfo.php in a web browser and check its content.

till · Oct 7, 2020

ledufakademy said: ↑

For others sites : same issue ! (we have 2 others netcloud instance)
it'seems that php snipets are not working.
Click to expand...

The test you made is wrong, it can not show the php settings of a website. So what it shows must be wrong and not the PHP config of the website. I just explained you how to test correctly. Btw. the pool file in #7 show that the settings must be correct for the site that sues this pool.

ledufakademy · Oct 7, 2020

hummm, i put phpinfo(); in index.php of nextcloud and i cn see the correct info !!!!
ISPconfig and pool.d are correct

So the issue is not here with php max post etc !!!!

ledufakademy · Oct 7, 2020

till said: ↑

The test you made is wrong, it can not show the php settings of a website. So what it shows must be wrong and not the PHP config of the website. I just explained you how to test correctly. Btw. the pool file in #7 show that the settings must be correct for the site that sues this pool.
Click to expand...

you're right.
bad test. sure.

ledufakademy · Oct 7, 2020

so return to the begining. arghghhhh.

ledufakademy · Oct 7, 2020

Till, i read that :
ispconfig block .file ? (not sure but ...)

We have deployed a patch on the server and allows the .file which is being created while you are uploading the files/directory over NEXT CLOUD.
Basically nextcloud app uploads files as .file .Once the file was uploaded the nextcloud app was trying to move the .file file in the relevant directory with its relevant name hence we were getting 403 Forbidden

We at Cloudways don’t allow any .extension files like .env, .htaccess to be directly accessible as this is a huge security risk that may cause issues.

I have set the rule on the server to allow only .file and hope now it should work for you. Please check and let us know if there is anything else required from us in this regard.
Click to expand...

source : https://help.nextcloud.com/t/cant-upload-file-size-more-than-10mb/86266/3

ledufakademy · Oct 7, 2020

the problem occurs at DigitalOcean hoster too ... so perphaps an ispconfig conf. issue .... with file moving with .file inside chroot user ....

ledufakademy · Oct 7, 2020

here the issue with nginx ...
https://github.com/nextcloud/documentation/pull/1748/files

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

If you configure nginx (globally) to block all requests to (hidden) dot files,
it may be not possible to upload files greater than 10 MiB using the webpage
due to Nextclouds requirement to upload the file to an url ending with ``/.file``.

You may require to change:

.. code-block:: nginx

location ~ /\. {

to the following to re-allow file uploads:

.. code-block:: nginx

location ~ /\.(?!file).* {

See `issue #8802 on nextcloud/server <https://github.com/nextcloud/server/issues/8802>` for more information.
Upload of files greater than 10 MiB fails
Click to expand...

ledufakademy · Oct 7, 2020

yes !
this ispconfig ... lol:

here :

location ~ /\. {
deny all;
}
Click to expand...

no i need to merge option ... (but this was clearly the default nginx conf made by ispconfig)

ledufakademy · Oct 7, 2020

Now , how can i change this ISPconfig default confn ? permanently ?

location ~ /\. {
deny all;
}
Click to expand...

wtih

location ~ /\.(?!file).* {
deny all;
}
Click to expand...

Because this doesn't work ...

location ~ /\.(?!file).* {##merge##
deny all;
}
Click to expand...

Log in or Sign up

ISPCOnfig with Nextcloud (suite) : error 403, no upload more than 11MB

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

Share This Page

Log in or Sign up

ISPCOnfig with Nextcloud (suite) : error 403, no upload more than 11MB

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

till Super Moderator Staff Member ISPConfig Developer

till Super Moderator Staff Member ISPConfig Developer

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

ledufakademy Member

Share This Page

Useful Searches