Question Reverse Proxy Server (nginx) enabled + error.

[Hajime Tanaka]

I have enabled for "Reverse Proxy Server (Nginx)" then getting 403 forbidden - nginx from our site.

 

[Bitpalast]

What are the Nginx server logs saying about this?

 

[Hajime Tanaka]

Where is this file nginx error from location?
nginx error (proxy_error_log).

 

[Bitpalast]

/var/log/nginx/error.log

 

[Hajime Tanaka]

/var/log/nginx/error.log

I edited this file, there no error log.

 

[Bitpalast]

What about the virtual host error logs?
Nginx: /var/www/vhosts/<subscription>/logs/proxy_error_log
Apache: /var/www/vhosts/<subscription>/logs/error_log

 

[Hajime Tanaka]

Nginx: /var/www/vhosts/<subscription>/logs/proxy_error_log

2017/12/20 15:45:45 [error] 1286#0: *1 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 141.101.77.140, server: domain.com, request: "GET /find-new/211245/profile-posts HTTP/1.1", upstream: "http://127.0.0.1:7080/find-new/211245/profile-posts", host: "domain.com"
2017/12/20 15:50:09 [error] 1639#0: *37 openat() "/var/www/vhosts/domain.com/httpdocs/data/taigachat/messagesmini.html" failed (13: Permission denied), client: 141.101.77.200, server: domain.com, request: "GET /data/taigachat/messagesmini.html?_xfRequestUri=%2F&_xfNoRedirect=1&_xfToken=1039%2C1513777582%2C551855eea7525c1bc12b06b0086867fe0ec4c65e&_xfResponseType=json&_=1513785049225 HTTP/1.1", upstream: "http://127.0.0.1:7080/data/taigachat/messagesmini.html?_xfRequestUri=%2F&_xfNoRedirect=1&_xfToken=1039%2C1513777582%2C551855eea7525c1bc12b06b0086867fe0ec4c65e&_xfResponseType=json&_=1513785049225", host: "domain.com", referrer: "https://domain.com/"
2017/12/20 15:52:31 [error] 4034#0: *179 openat() "/var/www/vhosts/domain.com/httpdocs/robots.txt" failed (13: Permission denied), client: 172.69.22.194, server: domain.com, request: "GET /robots.txt HTTP/1.1", host: "domain.com"
2017/12/20 15:52:33 [error] 4034#0: *181 "/var/www/vhosts/domain.com/httpdocs/index.html" is forbidden (13: Permission denied), client: 141.101.77.200, server: domain.com, request: "GET / HTTP/1.1", host: "domain.com", referrer: "https://domain.com/threads/gangsta-bd-720p-hi10-hevc-dual-audio.3270/"
2017/12/22 17:01:22 [error] 31504#0: *1 openat() "/var/www/vhosts/domain.com/httpdocs/styles/uix_dark/uix/css/font-awesome.min.css" failed (13: Permission denied), client: 108.162.216.112, server: domain.com, request: "GET /styles/uix_dark/uix/css/font-awesome.min.css HTTP/1.1", upstream: "http://127.0.0.1:7080/styles/uix_dark/uix/css/font-awesome.min.css", host: "domain.com", referrer: "https://domain.com/"

Apache: /var/www/vhosts/<subscription>/logs/error_log

[Fri Dec 22 02:15:31.730794 2017] [fcgid:warn] [pid 14449:tid 140233926436608] (104)Connection reset by peer: [client 162.158.138.64:34287] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Fri Dec 22 02:15:31.730860 2017] [core:error] [pid 14449:tid 140233926436608] [client 162.158.138.64:34287] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Fri Dec 22 02:15:31.740667 2017] [fcgid:warn] [pid 14440:tid 140233863497472] (104)Connection reset by peer: [client 162.158.138.64:37175] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Fri Dec 22 02:15:31.740712 2017] [core:error] [pid 14440:tid 140233863497472] [client 162.158.138.64:37175] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Fri Dec 22 02:15:35.351403 2017] [fcgid:warn] [pid 14449:tid 140233968396032] (32)Broken pipe: [client 162.158.138.64:28193] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://domain.com/members/giromcalica.1074/
[Fri Dec 22 17:01:21.184564 2017] [ssl:warn] [pid 31354:tid 140327629490304] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 17:01:21.407382 2017] [ssl:warn] [pid 31354:tid 140327629490304] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 17:04:43.598005 2017] [ssl:warn] [pid 32626:tid 140552877361280] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 17:04:43.779092 2017] [ssl:warn] [pid 32626:tid 140552877361280] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 17:04:48.793361 2017] [ssl:warn] [pid 694:tid 139920328063104] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 17:04:48.970154 2017] [ssl:warn] [pid 694:tid 139920328063104] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Fri Dec 22 19:14:01.323395 2017] [fcgid:warn] [pid 728:tid 139919722735360] (104)Connection reset by peer: [client 141.101.105.36:36977] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 19:14:01.323458 2017] [core:error] [pid 728:tid 139919722735360] [client 141.101.105.36:36977] End of script output before headers: proxy.php, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 19:14:01.332658 2017] [fcgid:warn] [pid 1193:tid 139919806654208] (104)Connection reset by peer: [client 172.69.54.15:36637] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 19:14:01.332718 2017] [core:error] [pid 1193:tid 139919806654208] [client 172.69.54.15:36637] End of script output before headers: proxy.php, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 19:14:01.338380 2017] [fcgid:warn] [pid 1193:tid 139919859103488] (104)Connection reset by peer: [client 162.158.114.22:16525] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 19:14:01.338421 2017] [core:error] [pid 1193:tid 139919859103488] [client 162.158.114.22:16525] End of script output before headers: proxy.php, referer: https://domain.com/threads/land-of-memes-shitposts-and-garbage.3355/page-3
[Fri Dec 22 22:47:07.244050 2017] [fcgid:warn] [pid 1193:tid 139919712245504] (32)Broken pipe: [client 162.158.75.232:20303] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://domain.com/threads/count-to-1000-v3-anime-funny-like-us.3148/page-6
[Sat Dec 23 06:06:19.000820 2017] [fcgid:warn] [pid 728:tid 139919796164352] (104)Connection reset by peer: [client 172.68.141.112:33089] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/threads/new-girl.3533/
[Sat Dec 23 06:06:19.017597 2017] [core:error] [pid 728:tid 139919796164352] [client 172.68.141.112:33089] End of script output before headers: css.php, referer: https://domain.com/threads/new-girl.3533/
[Sun Dec 24 02:15:21.501743 2017] [fcgid:warn] [pid 699:tid 139919764694784] (32)Broken pipe: [client 162.158.165.214:32337] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://domain.com/chat/
[Sun Dec 24 03:58:14.585440 2017] [fcgid:warn] [pid 1193:tid 139920001304320] (32)Broken pipe: [client 162.158.165.124:27681] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://domain.com/threads/what-are-you-currently-playing.125/page-39
[Sun Dec 24 05:08:12.932589 2017] [ssl:warn] [pid 694:tid 139920328063104] AH01909: RSA certificate configured for domain.com:443 does NOT include an ID which matches the server name
[Sun Dec 24 08:41:16.929729 2017] [fcgid:warn] [pid 23499:tid 139919848613632] (104)Connection reset by peer: [client 172.68.65.36:18143] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 08:41:16.929784 2017] [core:error] [pid 23499:tid 139919848613632] [client 172.68.65.36:18143] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 08:41:16.964195 2017] [fcgid:warn] [pid 23528:tid 139919701755648] (104)Connection reset by peer: [client 172.68.65.36:13899] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 08:41:16.964263 2017] [core:error] [pid 23528:tid 139919701755648] [client 172.68.65.36:13899] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 10:55:58.034323 2017] [fcgid:warn] [pid 23528:tid 139919796164352] (32)Broken pipe: [client 108.162.216.106:24561] mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://domain.com/threads/signature-battle-samet-vs-crazy-poll.3570/
[Sun Dec 24 12:50:27.169964 2017] [fcgid:warn] [pid 23528:tid 139919838123776] (104)Connection reset by peer: [client 162.158.138.52:30075] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 12:50:27.170013 2017] [core:error] [pid 23528:tid 139919838123776] [client 162.158.138.52:30075] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 12:50:27.315610 2017] [fcgid:warn] [pid 23586:tid 139919890573056] (104)Connection reset by peer: [client 162.158.138.52:29529] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 12:50:27.315676 2017] [core:error] [pid 23586:tid 139919890573056] [client 162.158.138.52:29529] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 12:50:27.344309 2017] [fcgid:warn] [pid 23586:tid 139919901062912] (104)Connection reset by peer: [client 162.158.138.52:10137] mod_fcgid: error reading data from FastCGI server, referer: https://domain.com/members/giromcalica.1074/
[Sun Dec 24 12:50:27.344353 2017] [core:error] [pid 23586:tid 139919901062912] [client 162.158.138.52:10137] End of script output before headers: proxy.php, referer: https://domain.com/members/giromcalica.1074/

 

[Bitpalast]

The permission denied errors are caused by insufficient file or directory permissions or owners

Make sure that your document root directory is owned by the subscription user and group psaserv.
Make sure it has the permission 0750, for example
# chmod 750 /var/www/vhosts/<subscription>/httpdocs

All directories and files that descend from the document root directory of your website must be owned by the subscription user and belong to the group psacln.
Their file permissions must be at least 0640, for example
# chmod 640 /var/www/vhosts/<subscription>/httpdocs/*

If this does not resolve the issue, check the permissions and ownership of the /var/www/vhosts/<subscription> directory. It must be owned by the subscription user, too.

 

[Hajime Tanaka]

The permission denied errors are caused by insufficient file or directory permissions or owners

Make sure that your document root directory is owned by the subscription user and group psaserv.
Make sure it has the permission 0750, for example
# chmod 750 /var/www/vhosts/<subscription>/httpdocs

All directories and files that descend from the document root directory of your website must be owned by the subscription user and belong to the group psacln.
Their file permissions must be at least 0640, for example
# chmod 640 /var/www/vhosts/<subscription>/httpdocs/*

File is 644 by XenForo default.
Folder is 755 by XenForo default

If this does not resolve the issue, check the permissions and ownership of the /var/www/vhosts/<subscription> directory. It must be owned by the subscription user, too.

It's "domain psaserv" and domain folder is 710 permission.

 

[Hajime Tanaka]

@Peter Debik, Are you looking into this issue?

 

[Bitpalast]

I thought that I already did. There is no additional advice that I can give in this matter at this time.

 

[mr-wolf]

plesk repair all -y -v

Plesk Repair Utility