nginx, php-fpm on diff server bad gateway (and security too)

Tallboy asked:

This is somewhat of a multipart question.

First and foremost, I have 502 bad gateway, but I’m sure that’s just because one of these lines I have below is wrong.

Second, I would love to know how I did ‘security wise’. I understand that many guides out there give terrible advice. I have tried to intelligently assemble all the knowledge from all of them, but I am very new so I could have missed something. Security is really important to me so I would love a quick and dirty ‘audit’ if you feel like it 🙂

For my topology I am using EC2 with a VPC. Amazon Linux AMI. I have an elastic load balancer which links to 2 nginx servers. these servers are linked to a separate php-fpm server.

1 nginx server is disabled while i debug this.

Here is the error I’m getting. I find this odd because I’m not actually using anywhere (to my knowledge). I’m using *.210 and *.248.

2013/03/27 14:33:10 [error] 2724#0: *1 connect() failed (111: Connection refused) while connecting to upstream, client:, server:, request: "GET /index.php HTTP/1.1", upstream: "fastcgi://", host: ""

edit: one thing i forgot to mention. I think that because php-fpm is a separate server, I read that i must have the same files on it as the nginx servers. I dont have rsync or anything setup yet… i just uploaded a simple index.php file to both in /var/www/html/ as a test.

Server 1 & 2 (nginx)


# Run as a less privileged user for security reasons.
user  www www;

worker_processes  auto;

events {
    worker_connections  1024;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/;

http {

    server_tokens  off;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    # How long to allow each connection to stay idle; longer values are better
    # for each individual client, particularly for SSL, but means that worker
    # connections are tied up longer. (Default: 65)
    keepalive_timeout  65;

    # Speed up file transfers by using sendfile() to copy directly
    # between descriptors rather than using read()/write().
    sendfile        on;

    # Tell Nginx not to send out partial frames; this increases throughput
    # since TCP frames are filled up before being sent out. (adds TCP_CORK)
    tcp_nopush      on;

    # Tell Nginx to enable the Nagle buffering algorithm for TCP packets, which
    # collates several smaller packets together into one larger packet, thus saving
    # bandwidth at the cost of a nearly imperceptible increase to latency. (removes TCP_NODELAY)
    tcp_nodelay     off; 

    gzip          on;
    gzip_http_version 1.0;
    gzip_disable      "msie6";
    gzip_comp_level   5;
    gzip_min_length   256;
    gzip_proxied      any;
    gzip_vary         on;
      # text/html is always compressed by HttpGzipModule

    # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols.
    # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support.
    ssl_protocols              SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
    # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
    # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
    # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
    ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
    ssl_session_timeout  10m;

    # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
    # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
    # ssl_certificate      /etc/nginx/default_ssl.crt;
    # ssl_certificate_key  /etc/nginx/default_ssl.key;

    upstream php {
        # ip_hash;

    include sites-enabled/*;


server {
    listen       80;
    root         /var/www/html/;

    index  index.html index.htm index.php;
    charset utf-8;

    error_page 404 /system/404.html;
    error_page 403 /system/404.html;

    location ~ .php$ {
        fastcgi_index  index.php;
        fastcgi_pass   php;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        # fastcgi_intercept_errors on;

    include conf/base.conf;

server {
    listen      80;
    return 301  $scheme://$request_uri;

Server 3 (php-fpm)


cgi.fix_pathinfo = 0


; FPM Configuration ;


; Global Options ;

pid = /var/run/php-fpm/

error_log = /var/log/php-fpm/error.log

emergency_restart_threshold = 5

emergency_restart_interval = 2



listen =

listen.allowed_clients =

user = www
group = www

pm = dynamic
pm.max_children = 50
pm.start_servers = 15
pm.min_spare_servers = 5
pm.max_spare_servers = 25

request_terminate_timeout = 30
slowlog = /var/log/php-fpm/www-slow.log
security.limit_extensions = .php

php_flag[display_errors] = off
php_admin_value[error_reporting] = 0
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 128M

php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

Thats about all i’ve got so far 😐 Slowly making progress… thanks!

My answer:

So here’s your problem, in /etc/php-fpm.d/www.conf:

listen =

You are only listening to the loopback address, so it can’t receive connections from other servers in your VPC.

Try instead:

listen = 9001

As for a ‘security audit’, there really isn’t enough info here to give you anything meaningful. Just double check your security group.

View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.