php-fpm启动以后，没有出现9000端口

最近在复现一个php扩展的后门，需要搭建Nginx+php环境，nginx我是用源码裸装的，不带任何第三方模块。

php-cli和php-fpm 则是通过ubuntu的标准apt-get命令安装的。

随后需要修改nginx的nginx.conf文件让其支持php脚本解析。

经查询网上的配置有两种，一种是

支持127.0.0.1：9000

location ~ \.php$ {
    root           html;
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME   /usr/local/nginx/html/$fastcgi_script_name;
    include        fastcgi_params;
}

另一种是使用sock文件

location ~ .php$ {
        root           /usr/share/nginx/html;
        fastcgi_pass   unix:/var/run/php-fpm/php5-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

刚开始使用第一种9000端口的方式进行配置，php解析不了，后经过查询php-fpm日志，发现有sock

[17-Sep-2019 00:23:02] NOTICE: fpm is running, pid 5617
[17-Sep-2019 00:23:02] NOTICE: ready to handle connections
[17-Sep-2019 00:23:02] NOTICE: systemd monitor interval set to 10000ms
[17-Sep-2019 00:31:28] ERROR: An another FPM instance seems to already listen on /var/run/php5-fpm.sock
[17-Sep-2019 00:31:28] ERROR: FPM initialization failed
[17-Sep-2019 00:37:34] NOTICE: configuration file /etc/php5/fpm/php-fpm.conf test is successful

随后在nginx配置文件中改用第二种sock文件交互的模式，发现还是页面解析不了。

最后找到/etc/php5/fpm/pool.d/www.conf 配置文件，将listen改为127.0.0.1:9000

又将nginx改回用端口监听的方式，重启nginx和php-fpm以后，终于可以解析php脚本了。。

root@ubuntu:/usr/local/nginx# netstat -tln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN     
tcp6       0      0 ::1:631                 :::*                    LISTEN     
root@ubuntu:/usr/local/nginx# pgrep nginx|xargs kill -s 9
root@ubuntu:/usr/local/nginx# vim conf/nginx.conf
root@ubuntu:/usr/local/nginx# sbin/nginx 
root@ubuntu:/usr/local/nginx# 

nginx.conf配置文件

 server {
        listen       80;
        server_name  localhost;
        root   html;
        index  index.php;
        location ~\.php$ {
            fastcgi_pass  127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }

/etc/php5/fpm/pool.d/www.conf文件修改的地方：

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses on a
;                            specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = 127.0.0.1:9000