Upgrade PHP-FPM Beta Branch Centmin Mod .09 beta branch Testing

Add NGXMODULE_ALTORDER='n' variable to centmin.sh

---

nginx configuration and install of nginx modules in a particular order is important especially for ngx_pagespeed. Added NGXMODULE_ALTORDER='n' to centmin.sh. When set to NGXMODULE_ALTORDER='y' in centmin.sh or via persistent configuration outlined at Upgrade Centmin Mod - CentminMod.com LEMP Nginx web stack for CentOS the Nginx module ordering will use a different order. This is for testing purposes until I find a more optimal order. To use persistent config file method (recommended), create file at /etc/centminmod/custom_config.inc and add to it below variable and then recompile Nginx via centmin.sh menu option 4

Code:

NGXMODULE_ALTORDER='y'

with NGXMODULE_ALTORDER='y' + NGINX_LIBBROTLI=y set in /etc/centminmod/custom_config.inc, the new nginx configuration order for nginx modules is

 

More info would be nice though

• Server or VPS details ? XEN, KVM, OpenVZ, VMWare or dedicated server ? OS ? CentOS 6.6 or 7.1 ? 32bit or 64bit ?
• Was it fresh install or upgrade ?
• How long ago did you install Centmin Mod ?

Troubleshooting Initial Install

To troubleshoot initial installation, you need to check the initial install log at /root/centminlogs. You can see full details at How to troubleshoot Centmin Mod initial install issues

fyi 123.09beta01 commits history Commits · centminmod/centminmod · GitHub

 

@Matt Williams ah yes tested fresh 123.09 beta01 install and there's something broken, will investigate

looks like problem is with updated ccache 3.2.4 tarball file

Code:

Download ccache-3.2.4.tar.gz ...
ccache 3.2.4 Archive found, skipping download...

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
Error: ccache-3.2.4.tar.gz extraction failed.
check Centmin Mod log for details at /root/centminlogs/
Aborting script...

that would cascade down the line with problems as ccache is used for source compilation

edit: strange manual extract works though

Code:

tar xvf ccache-3.2.4.tar.gz
ccache-3.2.4/
ccache-3.2.4/install-sh
ccache-3.2.4/compopt.c
ccache-3.2.4/macroskip.h
ccache-3.2.4/execute.c
ccache-3.2.4/AUTHORS.html
ccache-3.2.4/snprintf.c
ccache-3.2.4/hash.c
ccache-3.2.4/mdfour.h
ccache-3.2.4/hashtable_itr.c
ccache-3.2.4/autogen.sh
ccache-3.2.4/dev.mk.in
ccache-3.2.4/language.c
ccache-3.2.4/dev_mode_disabled
ccache-3.2.4/murmurhashneutral2.h
ccache-3.2.4/murmurhashneutral2.c
ccache-3.2.4/version.c
ccache-3.2.4/args.c
ccache-3.2.4/Makefile.in
ccache-3.2.4/ccache.1
ccache-3.2.4/unify.c
ccache-3.2.4/envtoconfitems.gperf
ccache-3.2.4/LICENSE.html
ccache-3.2.4/hashtable_itr.h
ccache-3.2.4/INSTALL.html
ccache-3.2.4/test/
ccache-3.2.4/test/test_lockfile.c
ccache-3.2.4/test/framework.h
ccache-3.2.4/test/test_hash.c
ccache-3.2.4/test/suites.h
ccache-3.2.4/test/test_compopt.c
ccache-3.2.4/test/util.h
ccache-3.2.4/test/framework.c
ccache-3.2.4/test/test_util.c
ccache-3.2.4/test/test_counters.c
ccache-3.2.4/test/test_hashutil.c
ccache-3.2.4/test/test_conf.c
ccache-3.2.4/test/main.c
ccache-3.2.4/test/util.c
ccache-3.2.4/test/test_args.c
ccache-3.2.4/test/test_argument_processing.c
ccache-3.2.4/test/test_stats.c
ccache-3.2.4/AUTHORS.txt
ccache-3.2.4/system.h
ccache-3.2.4/README.html
ccache-3.2.4/hashutil.h
ccache-3.2.4/exitfn.c
ccache-3.2.4/counters.h
ccache-3.2.4/MANUAL.txt
ccache-3.2.4/hashtable.h
ccache-3.2.4/MANUAL.html
ccache-3.2.4/conf.c
ccache-3.2.4/configure.ac
ccache-3.2.4/README.txt
ccache-3.2.4/lockfile.c
ccache-3.2.4/confitems.gperf
ccache-3.2.4/getopt_long.c
ccache-3.2.4/conf.h
ccache-3.2.4/config.h.in
ccache-3.2.4/config.sub
ccache-3.2.4/getopt_long.h
ccache-3.2.4/manifest.h
ccache-3.2.4/hashtable.c
ccache-3.2.4/mdfour.c
ccache-3.2.4/GPL-3.0.txt
ccache-3.2.4/manifest.c
ccache-3.2.4/envtoconfitems_lookup.c
ccache-3.2.4/test.sh
ccache-3.2.4/main.c
ccache-3.2.4/NEWS.txt
ccache-3.2.4/config.guess
ccache-3.2.4/util.c
ccache-3.2.4/language.h
ccache-3.2.4/HACKING.txt
ccache-3.2.4/cleanup.c
ccache-3.2.4/NEWS.html
ccache-3.2.4/stats.c
ccache-3.2.4/configure
ccache-3.2.4/zlib/
ccache-3.2.4/zlib/zutil.c
ccache-3.2.4/zlib/deflate.h
ccache-3.2.4/zlib/zutil.h
ccache-3.2.4/zlib/gzread.c
ccache-3.2.4/zlib/gzwrite.c
ccache-3.2.4/zlib/gzclose.c
ccache-3.2.4/zlib/gzlib.c
ccache-3.2.4/zlib/inflate.h
ccache-3.2.4/zlib/inffast.h
ccache-3.2.4/zlib/inffixed.h
ccache-3.2.4/zlib/trees.h
ccache-3.2.4/zlib/crc32.c
ccache-3.2.4/zlib/zconf.h
ccache-3.2.4/zlib/inftrees.h
ccache-3.2.4/zlib/adler32.c
ccache-3.2.4/zlib/inffast.c
ccache-3.2.4/zlib/zlib.h
ccache-3.2.4/zlib/trees.c
ccache-3.2.4/zlib/inflate.c
ccache-3.2.4/zlib/crc32.h
ccache-3.2.4/zlib/gzguts.h
ccache-3.2.4/zlib/deflate.c
ccache-3.2.4/zlib/inftrees.c
ccache-3.2.4/hashtable_private.h
ccache-3.2.4/confitems_lookup.c
ccache-3.2.4/counters.c
ccache-3.2.4/LICENSE.txt
ccache-3.2.4/hashutil.c
ccache-3.2.4/ccache.h
ccache-3.2.4/ccache.c
ccache-3.2.4/compopt.h
ccache-3.2.4/INSTALL.txt

edit: fixed recompress ccache-3.2.3.tar.gz in downloads/svr-setup.zip · centminmod/centminmod@af088d8 · GitHub

i had to extract ccache 3.2.4 files and recompress the tarball + gzip as the official download isn't 100% correct for gzip

submitted bug report to ccache folks at Bug 11560 – download ccache-3.2.4.tar.gz invalid gzip file

Code:

--------------------------------------------------------
Check ccache Version:
--------------------------------------------------------
ccache version 3.2.4

Copyright (C) 2002-2007 Andrew Tridgell
Copyright (C) 2009-2015 Joel Rosdahl

This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation; either version 3 of the License, or (at your option) any later
version.

--------------------------------------------------------
Check Nginx Version:
--------------------------------------------------------
nginx version: nginx/1.9.5
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with LibreSSL 2.2.3
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-c++11-extensions -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module --with-http_secure_link_module --with-http_realip_module --with-http_geoip_module --with-openssl-opt=enable-tlsext --add-module=../ngx-fancyindex-ngx-fancyindex --add-module=../ngx_cache_purge-2.3 --add-module=../nginx-accesskey-2.0.3 --add-module=../nginx-http-concat-master --add-module=../openresty-memc-nginx-module-4f6f78f --add-module=../openresty-srcache-nginx-module-ffa9ab7 --add-module=../ngx_devel_kit-0.2.19 --add-module=../set-misc-nginx-module-0.29 --add-module=../echo-nginx-module-0.58 --add-module=../redis2-nginx-module-0.12 --add-module=../ngx_http_redis-0.3.7 --add-module=../lua-nginx-module-0.9.16 --add-module=../lua-upstream-nginx-module-0.03 --add-module=../lua-upstream-cache-nginx-module-0.1.1 --add-module=../nginx_upstream_check_module-0.3.0 --add-module=../nginx-module-vts --add-module=../headers-more-nginx-module-0.261 --with-openssl=../libressl-2.2.3 --with-libatomic --with-threads --with-stream --with-stream_ssl_module --with-pcre=../pcre-8.37 --with-pcre-jit --add-module=../ngx_pagespeed-1.9.32.10-beta

--------------------------------------------------------
Check PHP-FPM Version:
--------------------------------------------------------
PHP 5.5.30 (cli) (built: Oct 16 2015 03:21:14)
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies

also updated ccache download link to local centminmod.com mirror version with correctly compressed file switch to local ccache mirror for corrupted gzipped file · centminmod/centminmod@3db5961 · GitHub until official download file is corrected.

 

yeah thanks for bug report.. only 123.09beta01 is playing with ccache 3.2.4 while 123.08stable is using ccache 3.2.2. I switched 123.09beta01 to local centminmod.com mirror switch to local ccache mirror for corrupted gzipped file · centminmod/centminmod@3db5961 · GitHub for now so the correctly compressed download ccache-3.2.4.tar.gz is downloaded

local mirror at centminmod.com/centminmodparts/ccache/

 

Add tools/nginxupdate.sh

Add a standalone unattended Nginx updater tool which must be run from tools/nginxupdate.sh. October 17th list of commits Commits · centminmod/centminmod · GitHub

You pass the Nginx version number you want to update or compile via command line like:

Code:

./tools/nginxupdate.sh 1.9.5

or

Code:

/usr/local/src/centminmod/tools/nginxupdate.sh 1.9.5

end of install would have something like

Code:

Sat Oct 17 04:39:31 UTC 2015
Success: Nginx was installed properly

Starting nginx:                                            [  OK  ]
nginx version: nginx/1.9.5
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with LibreSSL 2.2.3
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-c++11-extensions -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module --with-http_secure_link_module --with-http_realip_module --with-http_geoip_module --with-openssl-opt=enable-tlsext --add-module=../ngx-fancyindex-ngx-fancyindex --add-module=../ngx_cache_purge-2.3 --add-module=../nginx-accesskey-2.0.3 --add-module=../nginx-http-concat-master --add-module=../openresty-memc-nginx-module-4f6f78f --add-module=../openresty-srcache-nginx-module-ffa9ab7 --add-module=../ngx_devel_kit-0.2.19 --add-module=../set-misc-nginx-module-0.29 --add-module=../echo-nginx-module-0.58 --add-module=../redis2-nginx-module-0.12 --add-module=../ngx_http_redis-0.3.7 --add-module=../lua-nginx-module-0.9.16 --add-module=../lua-upstream-nginx-module-0.03 --add-module=../lua-upstream-cache-nginx-module-0.1.1 --add-module=../nginx_upstream_check_module-0.3.0 --add-module=../nginx-module-vts --add-module=../headers-more-nginx-module-0.261 --with-openssl=../libressl-2.2.3 --with-libatomic --with-threads --with-stream --with-stream_ssl_module --with-pcre=../pcre-8.37 --with-pcre-jit --add-module=../ngx_pagespeed-release-1.9.32.10-beta
*************************************************
* nginx updated
*************************************************

tools/nginxupdate.sh is also logged to /root/centminlogs for troubleshooting - centminmod_1.2.3-eva2000.09_171015-044300_nginxupdate.sh.log log

Code:

ls -lAhrt /root/centminlogs/
total 3.9M
-rw-r--r-- 1 root root  15K Aug 16 23:33 centminmod_1.2.3-eva2000.09_170815-093315_yuminstall_centos6.log
-rw-r--r-- 1 root root  38K Aug 16 23:35 centminmod_yumtimes_170815-093315.log
-rw-r--r-- 1 root root   38 Aug 16 23:35 centminmod_profiletimes_170815-093315.log
-rw-r--r-- 1 root root    0 Aug 16 23:35 timedhosts_170815-093315.txt
-rw-r--r-- 1 root root 221K Aug 16 23:36 centminmod_downloadtimes_170815-093315.log
-rw-r--r-- 1 root root 1.5K Aug 16 23:36 securedtmp.log
-rw-r--r-- 1 root root   45 Aug 16 23:38 centminmod_libresslinstalltime_170815-093315.log
-rw-r--r-- 1 root root  750 Aug 16 23:39 gcc_native.log
-rw-r--r-- 1 root root 940K Aug 16 23:42 centminmod_ngxinstalltime_170815-093315.log
-rw-r--r-- 1 root root   58 Aug 16 23:48 centminmod_phpinstalltime_170815-093315.log
-rw-r--r-- 1 root root  382 Aug 16 23:48 zendopcache_passfile.txt
-rw-r--r-- 1 root root 1.5K Aug 16 23:53 centminmod_1.2.3-eva2000.09_170815-093315_yum-log.log
-rw-r--r-- 1 root root   20 Aug 16 23:53 install.utc.time.log
-rw-r--r-- 1 root root 2.6M Aug 16 23:53 centminmod_1.2.3-eva2000.09_170815-093315_install.log
-rw-r--r-- 1 root root   48 Aug 16 23:53 firstyum_installtime_170815-093132.log
-rw-r--r-- 1 root root 1.7K Aug 18 01:41 centminmod_1.2.3-eva2000.09_180815-014045_git_envsetup.log
-rw-r--r-- 1 root root 985K Oct 17 04:45 centminmod_1.2.3-eva2000.09_171015-044300_nginxupdate.sh.log

 

Update inc/sshd.inc

Update initial openssh 5.3p1 sshd configuration tweaks for CentOS 6.x only to properly configure openssh's backported ecdsa key and ecdh-sha2-* key exchange support. It's not automatically configured like on CentOS 7.x which uses openssh 6.6p1. Commit at update inc/sshd.inc · centminmod/centminmod@99f0efb · GitHub

The change allows CentOS 6.x to also use ecdsa ssh keys instead of rsa ssh keys for SSH Open ssh 7.0 is out | Centmin Mod Community

Existing CentOS 6.x ONLY users using OpenSSH 5.3p1 can configure this via these 4 commands. CentOS 7 already has this out of box with OpenSSH 6.6p1

Code:

ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

Code:

sed -i 's|^HostKey \/etc\/ssh\/ssh_host_rsa_key|HostKey \/etc\/ssh\/ssh_host_ecdsa_key\nHostKey \/etc\/ssh\/ssh_host_rsa_key|' /etc/ssh/sshd_config

Code:

echo "KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1" >> /etc/ssh/sshd_config

Code:

service sshd restart

 

Nginx LibreSSL 2.2.4 Security Update

Nginx's LibreSSL version has been updated from 2.2.3 to 2.2.4 to fix security memory leak and buffer overflow vulnerabilities. Details on how to update are at Security - LibreSSL 2.2.4 Released security fixes | Centmin Mod Community

 

Update inc/phpsededit.inc defaults

Updated Centmin Mod 123.09beta01 build inc/phpsededit.inc. So that centmin initial install dynamically assigns memory and settings for PHP upload/post max limit and realpath cache and ttl values depending on detected memory available on server

commit update inc/phpsededit.inc · centminmod/centminmod@03c3707 · GitHub

To update your Centmin Mod builds follow instructions at centminmod.com/upgrade.html and thread below:

• Centmin Mod 123.09beta thread

 

Letsencrypt content-type changes

Updated both Centmin Mod 123.08stable and 123.09beta01 builds for latest Letsencrypt supported content-type outlined at SSL - Letsencrypt Free SSL certificates with web root authentication method | Centmin Mod Community

To update your Centmin Mod builds follow instructions at centminmod.com/upgrade.html and respective version threads below:

• Centmin Mod 1.2.3-eva2000.08 stable install & update thread
• Centmin Mod 123.09beta thread

Once updated, run centmin.sh once to allow auto syncing of the changes to your existing server configuration.

 

Update nginx modules for 123.09 beta

Updated the following module versions and prepackaged /downloads/svr-setup.zip update nginx modules for 123.09 beta · centminmod/centminmod@75e4cf1 · GitHub

Code:

- openresty lua-nginx-module https://github.com/openresty/lua-nginx-module to 0.9.18
- openresty lua-upstream-nginx-module https://github.com/openresty/lua-upstream-nginx-module 0.04
- openresty headers-more-nginx-module https://github.com/openresty/headers-more-nginx-module 0.28

To update your Centmin Mod builds follow instructions at centminmod.com/upgrade.html and respective version thread below:

• Centmin Mod 123.09beta thread

 

nope correct as nginx and php-fpm are owned by same user nginx.

 

weird then, it's default for months now