502 Bad Gateway - Please, very urgent!!

[RecreH]

Hello friends:

I have finished today to configure my server with Plesk 11.5.

11 domains, 2 subdomains and more than 100 e-mail accounts.

All was work perfect!!, but I reboot server and now I have "502 Bad Gateway" in ALL DOMAINS AND SUBDOMAINS!!! (except Plesk Panel). I haven't touch nothing, all was work..., I can't understand how have that error.

I have search in Google for some HOURS!! trying to repair the problem, but I only can say that error is because HTTPD can't start:

# /etc/init.d/httpd start
Iniciando httpd: (13)Permission denied: make_sock: could not bind to address [::]:7080
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:7080
no listening sockets available, shutting down
Unable to open logs

In httpd.conf the onlly line with 7080 is:

Listen 7080

If I comment it, then the error is for 7081...

Please, I'm desperate..., I need that web server work in some hours!!, I can't find a solution. Please, help!!.

Thanks in advance!!.

 

[Nikolay.]

You did not specify your OS and its version, so we may only guess. Here's random suggestion: either disable or set SELinux into permissive mode.

 

[RecreH]

Sorry, my OS version is Centos 6, Plesk 11.5

The problem is that Httpd can't start:

# /etc/init.d/httpd start
Iniciando httpd: (13)Permission denied: make_sock: could not bind to address [::]:7080
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:7080
no listening sockets available, shutting down
Unable to open logs

And this is the errors that Nginx - /var/log/nginx/error.log

2013/09/16 09:44:02 [error] 1688#0: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 79.108.8.26, server: futbolbase.recreativohuelva.com, request: "GET / HTTP/1.1", upstream: "http://91.121.222.41:7080/", host: "futbolbase.recreativohuelva.com"

Nginx can't send to port 7080 because httpd can't start.

I have try with --reconfigure-all with not results...

Thanks!!

 

[Faris Raouf]

Nicolay's suggestion is almost certainly going to work for you: either disable selinux or set it into permissive mode.

http://www.cyberciti.biz/faq/howto-turn-off-selinux/

 

[RecreH]

Nicolay's suggestion is almost certainly going to work for you: either disable selinux or set it into permissive mode.

http://www.cyberciti.biz/faq/howto-turn-off-selinux/

Thanks!!!, it works!!!...., Thank You for solve this problem, at least, to find the ultimate solution with SELinux, because the system with SELinux off or permissive mode, the system lacks security.

How I can open 7080 and 7081 ports only in SELinux and preserve rest of security?.

Thanks!!.

 

[RecreH]

SOLVE IT DEFINITELY!!

For users that having this problem, SELinux is not need setting in Permissive mode or disable it. I found command line to ADD ONLY ports that httpd needs, and preserve all of security of SELinux.

Look if you have semanage utility, if you don't have, install it with Yum (in Centos 6: yum install policycoreutils-python-2.0.83-19.30.el6.x86_64).

For look SELinux ports opened to httpd you can try:

# semanage port -l|grep http

For open ports in SELinux you can use:

semanage port -a -t http_port_t -p tcp WRITE_PORT_TO_ADD

Don't forget to start httpd (/etc/init.d/httpd start)



In my case, I was make this:

------------------------------------------------
# semanage port -l|grep http
http_cache_port_t tcp 3128, 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 80, 443, 488, 8008, 8009, 8443
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989

# semanage port -a -t http_port_t -p tcp 7080
# semanage port -a -t http_port_t -p tcp 7081

# semanage port -l|grep http
http_cache_port_t tcp 3128, 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 7081, 7080, 80, 443, 488, 8008, 8009, 8443
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989

# /etc/init.d/httpd start
Iniciando httpd: [ OK ]


And it's all!!, problem solved!!

Thanks!!.

 

[Nikolay.]

That's all fine and dandy, and I'm really glad you could find a solution on your own, but the required policy changes are already present in Plesk SELinux policy. The fact that you have this error just means that either there is a bug in enabling these rules, or that for some reason the policy was not properly installed. The latter is more probable, obviously.

With semodule -l please check that you have 'plesk' policy installed and it has appropriate version.