#fcgiwrap

nginx + fcgiwrap (spawn-fcgi) + Mailgraph

手上還是有固定一台機器是自己架設 Postfix 管理郵件系統，所以還是想跑個 Mailgraph 看一下有多少量在上面跑…

不過因為 Mailgraph 的 web interface 只有 CGI 界面，但 nginx 不支援 CGI，所以需要找個工具透過 nginx 支援的 FastCGI 轉換進去。

概念與設定都不算太難，但是得把工具找齊才會動 (這段花了不少時間)，所以記錄一下怎麼做，以後找比較好找資料。

首先先裝 Mailgraph 與 fcgiwrap：

sudo apt install -y fcgiwrap mailgraph

這兩個程式預設都會跑起來。如果沒有的話自己用 sudo service fcgiwrap status 與 sudo service mailgraph status。接下來在 nginx 的找個 virtual host 裡面這樣設：

#NGINX #honeypot - the easiest and fastest way to block bots! @nginxorg

The Internet is not a safe place these days. Hosting a public website means exposing it to multiple attacks from evil bots, which, at best will cause extra CPU and I/O load to your server.

If your web server is NGINX, you may be rightfully tempted to make use of some 3rd party WAF modules to counter the bad guys. One such module is nginx-module-security, other is NAXSI.

But what if I told you…

From the box nginx doesn’t support CGI applications deployment since CGI is very old and poor//http://godfatherhost.com/dedicated/index.html performance way to run them. But some applications still should be deployed with use of CGI (earlier, we covered setup ofNagios and OTRS with nginx). Here is another way to do that. In this case we will use fcgiwrap tool by Grzegorz Nosek. It’s written in C and should provide better performance in comparison with pure Perl wrapper we use before.

Firstly we need install it. If you use Debian or Ubuntu just install if with apt-get:

aptitude install fcgiwrap

For Fedora we’ll need compile it from sources. Download fcgiwrap from Github and unpack. Install fcgi-devel:

yum install fcgi-devel

Then run:

make install

Now you should have fcgiwrap installed in /usr/local/bin/. So, we can proceed with nginx. Here is a sample configuration. As you can see all .cgi files will be considered as CGI applications.

server { listen 80; server_name example.com; root /home/web; index index.html index.cgi; error_log /var/log/nginx/error.log; access_log /var/log/nginx/access.log main;

location / { root /home/web; index index.html index.htm; }

location ~ ^/cgi-bin/.*\.cgi$ { fastcgi_pass unix:/var/run/nginx/cgiwrap-dispatch.sock; fastcgi_index index.cgi; fastcgi_param SCRIPT_FILENAME /home/web/$fastcgi_script_name; fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param GATEWAY_INTERFACE CGI/1.1; fastcgi_param SERVER_SOFTWARE nginx; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_param REQUEST_URI $request_uri; fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; } }

At this step we need some way to spawn our FCGI wrapper instances. For that we will use spawn-fcgi:

spawn-fcgi -u web -g web -M 0775 -F 10 -s /var/run/nginx/cgiwrap-dispatch.sock -U web -G web /usr/local/bin/fcgiwrap

To use it we will also need some kind of init.d script. Modern versions of Fedora ship with systemd, so we can use it for managing of FCGI instances pool:

[Unit] Description=spawn-perl-fcgi

[Service] ExecStart=/usr/bin/spawn-fcgi -u web -g web -M 0775 -F 10 -s /var/run/nginx/cgiwrap-dispatch.sock -U web -G web /usr/local/bin/fcgiwrap Type=forking User=root Group=root Restart=always

[Install] WantedBy=multi-user.target

Put in in /lib/systemd/system/spawn-perl-fcgi.service and run:

systemctl enable spawn-perl-fcgi.service

For other systems you can use script provided in nginx wiki.

This is it.