【南唐】《相见欢·林花谢了春红》 李煜：林花谢了春红，太匆匆！无奈朝来寒雨晚来风。胭脂泪，留人醉，几时重？自是人生长恨水长东！

永夜

没有不值得去解决的问题，也没有不值得去学习的技术！

Troubleshooting 502 Bad Gateway Under nginx/1.17.8 Without ModSecurity

Upgrade to Nginx version: nginx version: nginx/1.17.8, a 502 Bad Gateway response occurs under nginx/1.17.8.

作者：

永夜

在

, , , , , ,
Views: 37

1. The Nginx configuration file that returns a 200 response is as follows.

Nginx

server {
    listen 82;
    charset utf-8;
    
    root /mcloud/creditshop_back/app/webroot;
    index  index.php;

    location / {
                modsecurity on;
                modsecurity_rules_file /etc/nginx/modsec_includes_lite.conf;
        if (!-e $request_filename) {
            rewrite ^/(.+)$ /index.php?url=$1 last;
            break;
        }
    }

        location /creditf {
                modsecurity on;
                modsecurity_rules_file /etc/nginx/modsec_includes_lite.conf;
                alias /webtv/wangjie/creditshop_back/h5jifen/files;
            index index.html;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /mcloud/creditshop_back/app/webroot$fastcgi_script_name;
        include        fastcgi_params;
    }
    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }

        location ~ ^/(status|ping)$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
        access_log off;
        allow 127.0.0.1;
        allow 10.42.0.0/16;
        allow 10.244.0.0/8;
        allow 192.168.0.0/8;
        allow 172.17.0.0/8;
        deny all;
    }
}

2. Check the Nginx version: nginx version: nginx/1.10.3. As shown in Figure 1.

Check the Nginx version: nginx version: nginx/1.10.3.
Figure 1
Plaintext

nginx version: nginx/1.10.3
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) 
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --add-module=/data/openresty-1.11.2.3/bundle/ngx_devel_kit-0.3.0 --add-module=/data/openresty-1.11.2.3/bundle/iconv-nginx-module-0.14 --add-module=/data/openresty-1.11.2.3/bundle/echo-nginx-module-0.60 --add-module=/data/openresty-1.11.2.3/bundle/xss-nginx-module-0.05 --add-module=/data/openresty-1.11.2.3/bundle/ngx_coolkit-0.2rc3 --add-module=/data/openresty-1.11.2.3/bundle/set-misc-nginx-module-0.31 --add-module=/data/openresty-1.11.2.3/bundle/form-input-nginx-module-0.12 --add-module=/data/openresty-1.11.2.3/bundle/encrypted-session-nginx-module-0.06 --add-module=/data/openresty-1.11.2.3/bundle/srcache-nginx-module-0.31 --add-module=/data/openresty-1.11.2.3/bundle/ngx_lua-0.10.8 --add-module=/data/openresty-1.11.2.3/bundle/ngx_lua_upstream-0.06 --add-module=/data/openresty-1.11.2.3/bundle/headers-more-nginx-module-0.32 --add-module=/data/openresty-1.11.2.3/bundle/array-var-nginx-module-0.05 --add-module=/data/openresty-1.11.2.3/bundle/memc-nginx-module-0.18 --add-module=/data/openresty-1.11.2.3/bundle/redis2-nginx-module-0.14 --add-module=/data/openresty-1.11.2.3/bundle/redis-nginx-module-0.3.7 --add-module=/data/openresty-1.11.2.3/bundle/rds-json-nginx-module-0.14 --add-module=/data/openresty-1.11.2.3/bundle/rds-csv-nginx-module-0.07 --add-module=/data/ModSecurity-nginx-master --with-ld-opt=-Wl,-rpath,/usr/local/openresty/luajit/lib --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_perl_module=dynamic --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic' --with-pcre

3. After upgrading to Nginx version: nginx version: nginx/1.17.8, a 502 Bad Gateway response occurs under nginx/1.17.8. As shown in Figure 2.

Upgrade to Nginx version: nginx version: nginx/1.17.8, a 502 Bad Gateway response occurs under nginx/1.17.8.
Figure 2
Plaintext

[root@back-7d88c84cdd-xpc6x /]# nginx -V
nginx version: mcloud web server/v1.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --add-module=/data/openresty-1.13.6.2/bundle/ngx_devel_kit-0.3.0 --add-module=/data/openresty-1.13.6.2/bundle/echo-nginx-module-0.61 --add-module=/data/openresty-1.13.6.2/bundle/xss-nginx-module-0.06 --add-module=/data/openresty-1.13.6.2/bundle/ngx_coolkit-0.2rc3 --add-module=/data/openresty-1.13.6.2/bundle/set-misc-nginx-module-0.32 --add-module=/data/openresty-1.13.6.2/bundle/form-input-nginx-module-0.12 --add-module=/data/openresty-1.13.6.2/bundle/encrypted-session-nginx-module-0.08 --add-module=/data/openresty-1.13.6.2/bundle/srcache-nginx-module-0.31 --add-module=/data/openresty-1.13.6.2/bundle/ngx_lua-0.10.13 --add-module=/data/openresty-1.13.6.2/bundle/ngx_lua_upstream-0.07 --add-module=/data/openresty-1.13.6.2/bundle/array-var-nginx-module-0.05 --add-module=/data/openresty-1.13.6.2/bundle/memc-nginx-module-0.19 --add-module=/data/openresty-1.13.6.2/bundle/redis2-nginx-module-0.15 --add-module=/data/openresty-1.13.6.2/bundle/rds-json-nginx-module-0.15 --add-module=/data/openresty-1.13.6.2/bundle/rds-csv-nginx-module-0.09 --add-module=/data/ModSecurity-nginx-master --with-ld-opt=-Wl,-rpath,/usr/local/openresty/luajit/lib --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_perl_module=dynamic --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic' --with-pcre

4. Edit the Nginx configuration file as follows. ModSecurity is no longer enabled. The response is 200. As shown in Figure 3.

Edit the Nginx configuration file as follows. ModSecurity is no longer enabled. The response is 200.
Figure 3
Nginx

server {
    listen 82;
    charset utf-8;
    
    root /mcloud/creditshop_back/app/webroot;
    index index.php;

    location / {
        # modsecurity on;
        # modsecurity_rules_file /etc/nginx/modsec_includes_lite.conf;
        if (!-e $request_filename) {
            rewrite ^/(.+)$ /index.php?url=$1 last;
            break;
        }
    }

    location /creditf {
        # modsecurity on;
        # modsecurity_rules_file /etc/nginx/modsec_includes_lite.conf;
        alias /webtv/wangjie/creditshop_back/h5jifen/files;
        index index.html;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /mcloud/creditshop_back/app/webroot$fastcgi_script_name;
        include        fastcgi_params;
    }
    #error_page  404              /404.html;
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
}

关于作者 · 持续学习与技术实践

我是一名拥有 15 年以上开发经验的技术从业者，自 2013 年起持续运营个人技术博客，记录工作与个人项目中遇到的真实问题，以及解决问题过程中的探索、实践和思考。

除了技术写作，我也在持续开发和维护自己的独立项目，探索新技术和新工具在实际场景中的应用。我始终相信，没有不值得去解决的问题，也没有不值得去学习的技术。

如果这篇文章对你有所帮助，欢迎浏览博客中的其他文章，也欢迎交流技术经验与想法。

关于我  ·  GitHub  ·  邮件联系

更多文章