nginx+php 5.2.17 +FastCGI 0.6(无Nginx文件类型错误解析漏洞）

背景：使用nginx+php-5.2.17+FastCGI-0.5.14 ,存在Nginx文件类型错误解析漏洞,把FastCGI 升级到0.6，可以避免这个问题。

目的：升级FastCGI为0.6以上版本，以解决在打开PATH_INFO 路由模式（php.ini 中参数cgi.fix_pathinfo = 1;）时，nginx+php上传文件时所产生的的安全漏洞。

其他方法：http://blog.s135.com/nginx_0day/

注意事项：升级脚本（脚本见附件）必需和 memcache-2.2.5.tgz  eaccelerator-0.9.6.tar.bz2   PDO_MYSQL-1.0.2.tgz ImageMagick.tar.gz imagick-2.3.0.tgz  在同一目录下。且和该处表明版本一致。
       
         
步骤：

先执行 yum -y install libevent-devel
1、root账户执行脚本 ins_php-5.2.17-fpm-0.5.14-to-0.6.sh
2、修改vim /etc/php-fpm.conf   参考原有 /usr/local/php/etc/php-fpm.conf 修改
<?xml version="1.0" ?>
<configuration>

    All relative paths in this config are relative to php's install prefix

    <section name="global_options">

        Pid file
        <value name="pid_file">/var/run/php-fpm.pid</value>

        Error log file
        <value name="error_log">/var/log/php-fpm.log</value>

        Log level
        <value name="log_level">notice</value>

        When this amount of php processes exited with SIGSEGV or SIGBUS ...
        <value name="emergency_restart_threshold">10</value>

        ... in a less than this interval of time, a graceful restart will be initiated.
        Useful to work around accidental curruptions in accelerator's shared memory.
        <value name="emergency_restart_interval">1m</value>

        Time limit on waiting child's reaction on signals from master
        <value name="process_control_timeout">5s</value>

        Set to 'no' to debug fpm
        <value name="daemonize">yes</value>

    </section>

    <workers>

        <section name="pool">

            Name of pool. Used in logs and stats.
            <value name="name">default</value>

            Address to accept fastcgi requests on.
            Valid syntax is 'ip.ad.re.ss:port' or just 'port' or '/path/to/unix/socket'
            <value name="listen_address">127.0.0.1:9000</value>

            <value name="listen_options">

                Set listen(2) backlog
                <value name="backlog">-1</value>

                Set permissions for unix socket, if one used.
                In Linux read/write permissions must be set in order to allow connections from web server.
                Many BSD-derrived systems allow connections regardless of permissions.
                #以下两行修改用户和组，由nobody改为 www
                <value name="owner">www</value>
                <value name="group">www</value>
                <value name="mode">0666</value>
            </value>

            Additional php.ini defines, specific to this pool of workers.
            These settings overwrite the values previously defined in the php.ini.
            <value name="php_defines">
                #去掉以下四行注释 <!--    -->
                 <value name="sendmail_path">/usr/sbin/sendmail -t -i</value>
                 <value name="display_errors">0</value>
                 <value name="error_log">/var/log/php-error.log</value>
                 <value name="log_errors">true</value>
            </value>

            Unix user of processes
            <value name="user">www</value>   #修改用户由nobody 为 www

            Unix group of processes
            <value name="group">www</value>  #修改组 由 nobody 为 www

            Process manager settings
            <value name="pm">

                Sets style of controling worker process count.
                Valid values are 'static' and 'apache-like'
                <value name="style">static</value>

                Sets the limit on the number of simultaneous requests that will be served.
                Equivalent to Apache MaxClients directive.
                Equivalent to PHP_FCGI_CHILDREN environment in original php.fcgi
                Used with any pm_style.
                <value name="max_children">128</value> #修改值由 5 改为 128

                Settings group for 'apache-like' pm style
                <value name="apache_like">

                    Sets the number of server processes created on startup.
                    Used only when 'apache-like' pm_style is selected
                    <value name="StartServers">20</value>

                    Sets the desired minimum number of idle server processes.
                    Used only when 'apache-like' pm_style is selected
                    <value name="MinSpareServers">5</value>

                    Sets the desired maximum number of idle server processes.
                    Used only when 'apache-like' pm_style is selected
                    <value name="MaxSpareServers">35</value>

                </value>

            </value>

            The timeout (in seconds) for serving a single request after which the worker process will be terminated
            Should be used when 'max_execution_time' ini option does not stop script execution for some reason
            '0s' means 'off'
            <value name="request_terminate_timeout">0s</value>

            The timeout (in seconds) for serving of single request after which a php backtrace will be dumped to slow.log file
            '0s' means 'off'
            <value name="request_slowlog_timeout">3s</value>  #值由0 改为 3 ，记录超过3s 的响应

            The log file for slow requests
            <value name="slowlog">/var/log/php-fpm.log.slow</value>

            Set open file desc rlimit
            <value name="rlimit_files">65535</value>   #打开文件数限制，由 1024 改为 65535

            Set max core size rlimit
            <value name="rlimit_core">0</value>

            Chroot to this directory at the start, absolute path
            <value name="chroot"></value>

            Chdir to this directory at the start, absolute path
            <value name="chdir"></value>

            Redirect workers' stdout and stderr into main error log.
            If not set, they will be redirected to /dev/null, according to FastCGI specs
            <value name="catch_workers_output">yes</value>

            How much requests each process should execute before respawn.
            Useful to work around memory leaks in 3rd party libraries.
            For endless request processing please specify 0
            Equivalent to PHP_FCGI_MAX_REQUESTS
            <value name="max_requests">500</value>

            Comma separated list of ipv4 addresses of FastCGI clients that allowed to connect.
            Equivalent to FCGI_WEB_SERVER_ADDRS environment in original php.fcgi (5.2.2+)
            Makes sense only with AF_INET listening socket.
            <value name="allowed_clients">127.0.0.1</value>

            Pass environment variables like LD_LIBRARY_PATH
            All $VARIABLEs are taken from current environment
            <value name="environment">
                <value name="HOSTNAME">$HOSTNAME</value>
                <value name="PATH">/usr/local/bin:/usr/bin:/bin</value>
                <value name="TMP">/tmp</value>
                <value name="TMPDIR">/tmp</value>
                <value name="TEMP">/tmp</value>
                <value name="OSTYPE">$OSTYPE</value>
                <value name="MACHTYPE">$MACHTYPE</value>
                <value name="MALLOC_CHECK_">2</value>
            </value>

        </section>

    </workers>

</configuration>

3、cp /usr/local/php/etc/php.ini /usr/local/php-fpm/etc  ,注意修改
extension_dir = "/usr/local/php/lib/php/extensions/no-debug-non-zts-20060613/"
为： extension_dir = "/usr/local/php-fpm/lib/php/extensions/no-debug-non-zts-20060613/"

4、/sbin/chkconfig --add php-fpm ， /sbin/chkconfig php-fpm on

5、vim /etc/rc.local   ,注释掉 #/usr/local/php/sbin/php-fpm start

6、 /usr/local/php/sbin/php-fpm stop  ,再 /etc/init.d/php-fpm start



以下为本次升级相关的测试验证：
一、交叉依赖测试
升级后，使用0.6 版本的php-fpm ，且修改 原有/usr/local/php 路径。测试验证 /etc/ini.d/php-fpm  restart 正常。网页访问正常。


二、phpinfo 区别
获取方式：
/usr/local/php/bin/php -i > /root/fpm-0.5.13
/usr/local/php-fpm/bin/php -i > /root/fpm-0.6
diff 比较 diff fpm-0.5.13 fpm-0.6
1、编译参数不同：
a、定义路径做修改，不影响原有php-fpm，且可以快速回滚到原有版本：0.5.13 版本路径为：--prefix=/usr/local/php --with-config-file-path=/usr/local/php/etc 0.6版本路径为：--prefix=/usr/local/php-fpm --with-config-file-path=/usr/local/php-fpm/etc
b、fpm参数修改： 由 0.5.13 的--enable-fpm 改为 0.6 的 --with-fpm ,编译时，0.6 版本 fpm 需要libevent支持，新增参数 --with-libevent=shared
c、因在修改以上参数的基础上，使用原有其他编译参数编译时会报错  configure: error: cannot compute sizeof (char *), 77  ，0.6 版本需要去掉--disable-rpath   #参考：http://www.linuxde.net/2011/08/662.html

2、< _SERVER["REQUEST_TIME"] 值不同，可忽略# 请求开始时的时间戳。从 PHP 5.1.0 起有效。和time函数效果一样。

3、其他的都是因路径不同，而不同。
详细diff 如下：
5,6c5,6
< Build Date => Nov 11 2011 22:46:59
< Configure Command =>  './configure'  '--prefix=/usr/local/php' '--with-config-file-path=/usr/local/php/etc' '--with-mysql=/usr/local/mysql' '--with-mysqli=/usr/local/mysql/bin
/mysql_config' '--with-iconv-dir=/usr/local' '--with-freetype-dir' '--with-jpeg-dir' '--with-png-dir' '--with-zlib' '--with-libxml-dir=/usr' '--enable-xml' '--disable-rpath' '--
enable-discard-path' '--enable-safe-mode' '--enable-bcmath' '--enable-shmop' '--enable-sysvsem' '--enable-inline-optimization' '--with-curl' '--with-curlwrappers' '--enable-mbre
gex' '--enable-fastcgi' '--enable-fpm' '--enable-force-cgi-redirect' '--enable-mbstring' '--with-mcrypt' '--with-gd' '--enable-gd-native-ttf' '--with-openssl' '--with-mhash' '--
enable-pcntl' '--enable-sockets' '--with-ldap' '--with-ldap-sasl' '--with-xmlrpc' '--enable-zip' '--enable-soap' '--enable-ftp'
---
> Build Date => Dec 15 2011 17:45:08
> Configure Command =>  './configure'  '--prefix=/usr/local/php-fpm' '--with-config-file-path=/usr/local/php-fpm/etc' '--with-mysql=/usr/local/mysql' '--with-mysqli=/usr/local/m
ysql/bin/mysql_config' '--with-iconv-dir=/usr/local' '--with-freetype-dir' '--with-jpeg-dir' '--with-png-dir' '--with-zlib' '--with-libxml-dir=/usr' '--enable-xml' '--enable-dis
card-path' '--enable-safe-mode' '--enable-bcmath' '--enable-shmop' '--enable-sysvsem' '--enable-inline-optimization' '--with-curl' '--with-curlwrappers' '--enable-mbregex' '--en
able-fastcgi' '--with-fpm' '--enable-force-cgi-redirect' '--enable-mbstring' '--with-mcrypt' '--with-gd' '--enable-gd-native-ttf' '--with-openssl' '--with-mhash' '--enable-pcntl
' '--enable-sockets' '--with-ldap' '--with-ldap-sasl' '--with-xmlrpc' '--enable-zip' '--enable-soap' '--enable-ftp' '--with-libevent=shared'
9,10c9,10
< Configuration File (php.ini) Path => /usr/local/php/etc
< Loaded Configuration File => /usr/local/php/etc/php.ini
---
> Configuration File (php.ini) Path => /usr/local/php-fpm/etc
> Loaded Configuration File => /usr/local/php-fpm/etc/php.ini
78c78
< include_path => .:/usr/local/php/lib/php => .:/usr/local/php/lib/php
---
> include_path => .:/usr/local/php-fpm/lib/php => .:/usr/local/php-fpm/lib/php
567c567
< _ => /usr/local/php/bin/php
---
> _ => /usr/local/php-fpm/bin/php
592c592
< _SERVER["_"] => /usr/local/php/bin/php
---
> _SERVER["_"] => /usr/local/php-fpm/bin/php
598c598
< _SERVER["REQUEST_TIME"] => 1324265322
---
> _SERVER["REQUEST_TIME"] => 1324265350
624c624
< _ENV["_"] => /usr/local/php/bin/php
---
> _ENV["_"] => /usr/local/php-fpm/bin/php