nginx重写规则导致403错误

Question

我正在使用Linux Mint 17.1 (Rebecca)、Nginx 和Phalcon PHP，我正在尝试让rewrite rules 使用它。位于/etc/nginx/sites-enabled/default的php配置文件内容：

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html index.php;

    server_name _;

        location ~ $root/phalcon_tutorial {
                rewrite ^/$ /public/ break;
                rewrite ^(.*)$ /public/$1\.php break;

                if (!-e $request_filename) {
                    rewrite ^(.*)$ /index.php?_url=/$1 break;
                }
        }

        location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404; 
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {

                #Credit to: www.slideshare.net/giorrgio/from-lamp-to-lnnp:
                #prevent cgi.fix_pathinfo=1 security hole
                if (!-f $request_filename) {
                    return 404;
                }
                #EndCredit

        include snippets/fastcgi-php.conf;

        # With php5-cgi alone:
        #fastcgi_pass 127.0.0.1:9000;
        # With php5-fpm:
        fastcgi_pass unix:/var/run/php5-fpm.sock;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#   listen 80;
#   listen [::]:80;
#
#   server_name example.com;
#
#   root /var/www/example.com;
#   index index.html;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}

和/etc/nginx/sites-available/default

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html index.php;

    server_name _;

        location ~ $root/phalcon_tutorial {
                rewrite ^/$ /public/ break;
                rewrite ^(.*)$ /public/$1\.php break;

                if (!-e $request_filename) {
                    rewrite ^(.*)$ /index.php?_url=/$1 break;
                }
        }

        location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404; 
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {

                #Credit to: www.slideshare.net/giorrgio/from-lamp-to-lnnp:
                #prevent cgi.fix_pathinfo=1 security hole
                if (!-f $request_filename) {
                    return 404;
                }
                #EndCredit

        include snippets/fastcgi-php.conf;

        # With php5-cgi alone:
        #fastcgi_pass 127.0.0.1:9000;
        # With php5-fpm:
        fastcgi_pass unix:/var/run/php5-fpm.sock;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#   listen 80;
#   listen [::]:80;
#
#   server_name example.com;
#
#   root /var/www/example.com;
#   index index.html;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}

我的 nginx 根目录在：/var/www/html

在此之下，我正在尝试从该站点做一个phalcon php 教程：http://docs.phalconphp.com/en/latest/reference/tutorial.html#checking-your-installation

他们使用文件夹 tutorial 作为本教程的根文件夹，但我使用文件夹名称 phalcon_tutorial 代替：

当我输入localhost/phalcon_tutorial 时，它应该将该网址重写为localhost/phalcon_tutorial/public/index.php，但我在localhost/phalcon_tutorial 上收到403 Forbidden 错误。

我在/var/www/html/phalcon_tutorial/ 下的目录如下所示：

phalcon_tutorial/
|
|_app/
| |
| |_controllers/
| | |
| | |_IndexController.php
| |
| |_models/
| |
| |_views/
|
|_public/
  |
  |_css/
  |
  |_img/
  |
  |_index.php
  |
  |_js/

index.php 文件如下所示：

<?php

try {

    //Register an autoloader
    $loader = new \Phalcon\Loader();
    $loader->registerDirs(array(
        '../app/controllers/',
        '../app/models/'
    ))->register();

    //Create a DI
    $di = new Phalcon\DI\FactoryDefault();

    //Setup the view component
    $di->set('view', function(){
        $view = new \Phalcon\Mvc\View();
        $view->setViewsDir('../app/views/');
        return $view;
    });

    //Setup a base URI so that all generated URIs include the "tutorial" folder
    $di->set('url', function(){
        $url = new \Phalcon\Mvc\Url();
        $url->setBaseUri('/phalcon_tutorial/');
        return $url;
    });

    //Handle the request
    $application = new \Phalcon\Mvc\Application($di);

    echo $application->handle()->getContent();

} catch(\Phalcon\Exception $e) {
     echo "PhalconException: ", $e->getMessage();
}

我的IndexController.php 文件看起来像：

<?php

class IndexController extends \Phalcon\Mvc\Controller
{

    public function indexAction()
    {
        echo "<h1>Hello!</h1>";
    }

}

我似乎找不到解决方案。我在想这可能是一个权限问题。我通过将sudo chmod -R www-data phalcon_tutorial 从/var/www/html 更改为从phalcon_tutorial 开始的所有文件夹和文件从root 拥有到www-data 拥有，并将文件夹的所有权限从phalcon_tutorial 更改为755，我搜索了互联网，我想也许我必须禁用 follow_symlinks，所以我去编辑 /etc/nginx/nginx.conf 并在 http block 下添加 disable_symlinks off - 该文件现在看起来像这样：

user www-data;
worker_processes 4;
pid /run/nginx.pid;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

        disable_symlinks off;
}


#mail {
#   # See sample authentication script at:
#   # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#   # auth_http localhost/auth.php;
#   # pop3_capabilities "TOP" "USER";
#   # imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#   server {
#       listen     localhost:110;
#       protocol   pop3;
#       proxy      on;
#   }
# 
#   server {
#       listen     localhost:143;
#       protocol   imap;
#       proxy      on;
#   }
#}

完成这一切后，我重新启动了我的nginx server，使用命令sudo /etc/init.d/nginx restart - 但就像我说的 - 当我转到localhost/phalcon_tutorial 时，它显示403 Forbidden 错误，但如果我转到localhost/phalcon_tutorial/public/或localhost/phalcon_tutorial/public/index.php 显示“你好！”

如何在 nginx 中正确使用此 url 重写 - 而无需获得 403 error？我对url rewriting 或一般的服务器配置文件不是很有经验，我一直在花费大量时间搜索互联网试图弄清楚这一点，但我不知所措。

Answer 1

1. /etc/nginx/sites-enabled/ 的条目应该是/etc/nginx/sites-available/ 中文件的符号链接。

基本上所有的虚拟主机配置都将在/etc/nginx/sites-available directory 中定义，要启用配置，您将在/etc/nginx/sites-enabled 目录中创建一个符号链接（或文件快捷方式），同样要禁用​​配置，您将删除符号链接。 Nginx 将完成剩下的工作并在 /etc/nginx/sites-enabled 目录中搜索活动的虚拟主机配置。

（指令include /etc/nginx/conf.d/*.conf;）

1. 您是否尝试过了解日志文件的问题？我认为，日志文件应该包含有关错误请求和目标文件的信息。

2. 我看到您的配置试图包含 /etc/nginx/sites-enabled/*.conf 文件，但您将站点配置为 /etc/nginx/sites-enabled/default（文件名与给定的文件掩码不匹配 *.conf）