[Solved] PHP-FPM broken on new installs

Which curl installer command did you specifically use ?

Seems related to PHP 7.1.17 compile and system OpenSSL 1.0.2k part of PHP-FPM compile. Is this CentOS 7.4 or newly updated CentOS 7.5 which has a newer system OpenSSL yum package revision CentOS 7.x - CentOS 7.5 1804 Released

Code (Text):

ext/openssl/.libs/xp_ssl.o: In function `php_openssl_sockop_set_option':
/usr/local/include/openssl/x509v3.h:165: undefined reference to `OPENSSL_sk_num'
/usr/local/include/openssl/x509v3.h:165: undefined reference to `OPENSSL_sk_value'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x1828): undefined reference to `OPENSSL_sk_value'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x1918): undefined reference to `TLS_client_method'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x1cb0): undefined reference to `SSL_CTX_set_options'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x24d8): undefined reference to `TLS_server_method'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x24e8): undefined reference to `SSL_CTX_get_options'
ext/openssl/.libs/xp_ssl.o:(.debug_addr+0x2850): undefined reference to `OPENSSL_sk_num'
ext/ftp/.libs/php_ftp.o: In function `zm_startup_ftp':
/svr-setup/php-7.1.17/ext/ftp/php_ftp.c:313: undefined reference to `OPENSSL_init_ssl'
/svr-setup/php-7.1.17/ext/ftp/php_ftp.c:314: undefined reference to `OPENSSL_init_crypto'
/svr-setup/php-7.1.17/ext/ftp/php_ftp.c:315: undefined reference to `OPENSSL_init_crypto'
/svr-setup/php-7.1.17/ext/ftp/php_ftp.c:316: undefined reference to `OPENSSL_init_crypto'
/svr-setup/php-7.1.17/ext/ftp/php_ftp.c:318: undefined reference to `OPENSSL_init_ssl'
ext/ftp/.libs/php_ftp.o:(.debug_addr+0x7f8): undefined reference to `OPENSSL_init_ssl'
ext/ftp/.libs/php_ftp.o:(.debug_addr+0x1188): undefined reference to `OPENSSL_init_crypto'
ext/ftp/.libs/ftp.o: In function `ftp_login':
/svr-setup/php-7.1.17/ext/ftp/ftp.c:283: undefined reference to `TLS_client_method'
/svr-setup/php-7.1.17/ext/ftp/ftp.c:292: undefined reference to `SSL_CTX_set_options'
ext/ftp/.libs/ftp.o:(.debug_addr+0x1300): undefined reference to `TLS_client_method'
ext/ftp/.libs/ftp.o:(.debug_addr+0x15d8): undefined reference to `SSL_CTX_set_options'
ext/phar/.libs/util.o: In function `phar_verify_signature':
/svr-setup/php-7.1.17/ext/phar/util.c:1563: undefined reference to `EVP_MD_CTX_new'
/svr-setup/php-7.1.17/ext/phar/util.c:1595: undefined reference to `EVP_MD_CTX_free'
/svr-setup/php-7.1.17/ext/phar/util.c:1586: undefined reference to `EVP_MD_CTX_free'
ext/phar/.libs/util.o: In function `phar_create_signature':
/svr-setup/php-7.1.17/ext/phar/util.c:1860: undefined reference to `EVP_MD_CTX_new'
/svr-setup/php-7.1.17/ext/phar/util.c:1892: undefined reference to `EVP_MD_CTX_free'
ext/phar/.libs/util.o:(.debug_addr+0x2a8): undefined reference to `EVP_MD_CTX_new'
ext/phar/.libs/util.o:(.debug_addr+0xd88): undefined reference to `EVP_MD_CTX_free'
collect2: error: ld returned 1 exit status
make: *** [sapi/cli/php] Error 1

PHP-FPM configure line used from your log

Code (Text):

../configure --enable-fpm --enable-opcache --enable-intl --enable-pcntl --with-mcrypt --with-snmp --enable-embed=shared --with-mhash --with-zlib --with-gettext --enable-exif --enable-zip --with-bz2 --enable-soap --enable-sockets --enable-sysvmsg --enable-sysvsem --enable-sysvshm --enable-shmop --with-pear --enable-mbstring --with-openssl --with-mysql=mysqlnd --with-libdir=lib64 --with-mysqli=mysqlnd --with-mysql-sock=/var/lib/mysql/mysql.sock --with-curl --with-gd --with-xmlrpc --enable-bcmath --enable-calendar  --enable-ftp --enable-gd-native-ttf --with-freetype-dir=/usr --with-jpeg-dir=/usr --with-png-dir=/usr --with-xpm-dir=/usr --with-webp-dir=/usr --with-t1lib=/usr --enable-pdo --with-pdo-sqlite --with-pdo-mysql=mysqlnd --enable-inline-optimization --with-imap --with-imap-ssl --with-kerberos --with-readline --with-libedit --with-gmp --with-pspell --with-tidy --with-enchant --with-fpm-user=nginx --with-fpm-group=nginx --disable-fileinfo --with-ldap --with-ldap-sasl --with-config-file-scan-dir=/etc/centminmod/php.d --with-xsl

looks like Core i7 family of cpu being used

Code (Text):

gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-28)
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

  -m64                                [enabled]
  -m80387                             [enabled]
  -m96bit-long-double                 [enabled]
  -maes                               [enabled]
  -malign-stringops                   [enabled]
  -march=                             corei7
  -mcx16                              [enabled]
  -mfancy-math-387                    [enabled]
  -mfentry                            [enabled]
  -mfp-ret-in-387                     [enabled]
  -mfpmath=                           387
  -mfxsr                              [enabled]
  -mglibc                             [enabled]
  -mhard-float                        [enabled]
  -mieee-fp                           [enabled]
  -mlong-double-80                    [enabled]
  -mpclmul                            [enabled]
  -mpopcnt                            [enabled]
  -mpush-args                         [enabled]
  -mred-zone                          [enabled]
  -msahf                              [enabled]
  -msse                               [enabled]
  -msse2                              [enabled]
  -msse3                              [enabled]
  -msse4                              [enabled]
  -msse4.1                            [enabled]
  -msse4.2                            [enabled]
  -mssse3                             [enabled]
  -mstackrealign                      [enabled]
  -mtls-direct-seg-refs               [enabled]
  -mtune=                             corei7

 

You log also has heaps of errors like

Code (Text):

tput: No value for $TERM and no -T specified

could be specific to your SSH client and environment settings too

 

Also are you using any persistent config variables in /etc/centminmod/custom_config.inc ? i.e. setting PHP_CUSTOMSSL='y' ? That currently should be left as PHP_CUSTOMSSL='n' which is default as PHP using custom OpenSSL version is not 100% working as yet.

 

Nice that snippet to set latest PHP 7.1 version looks nice - might borrow it for betainstaller71.sh installer and similar for betainstaller72.sh and betainstaller7.sh

have you always used a cronjob to start the installer ? or this is something you started to do now ?

maybe try an install on openvz template with default centos 7.4 first and compare to install with updated centos 7.5 template with server reboot vs without server reboot. Maybe an related ? I just did OpenVZ CentOS 7.5 test PHP 7.1.17 recompile and works for me though I did reboot server after yum updated CentOS 7.5 was in place.

 

Yeah on my E3-1270v1 server with CentOS 7.4 and even updated 7.5 rebooted getting same problem with PHP 7.0.29, 7.1.17 and 7.2.5. Not seeing any PHP 7 bugs logged that are similar for OpenSSL related issues besides LibreSSL issue that is logged at here (not related as centmin mod doesn't use LibreSSL for php but system OpenSSL).

Investigating now.

 

On PHP 5.6.36 failed installs I see deprecated declarations warnings so could actually be related to GCC yum updates may have changed something will check

Code (Text):

   ^
/svr-setup/php-5.6.36/ext/openssl/xp_ssl.c:954:3: warning: ‘TLSv1_server_method’ is deprecated (declared at /usr/local/include/openssl/ssl.h:1628) [-Wdeprecated-declarations]
/svr-setup/php-5.6.36/ext/openssl/xp_ssl.c:957:3: warning: ‘TLSv1_1_client_method’ is deprecated (declared at /usr/local/include/openssl/ssl.h:1635) [-Wdeprecated-declarations]
   return is_client ? TLSv1_1_client_method() : TLSv1_1_server_method();

Code (Text):

/svr-setup/php-5.6.36/ext/openssl/openssl.c:664:4: warning: ‘ASN1_STRING_data’ is deprecated (declared at /usr/local/include/openssl/asn1.h:553) [-Wdeprecated-declarations]
    to_add = ASN1_STRING_data(str);
    ^

This is on 123.09beta01 where i also rolled back and reverted to March 30th, 2018 code to verify if it's an issue with my code and noticed reference to /usr/local/include/openssl hmmm

Code (Text):

fgrep  '/usr/local/include/openssl' /root/centminlogs/centminmod_123.09beta01.b021_100518-152125_php_upgrade.log | tail -5
/usr/local/include/openssl/x509.h:97: undefined reference to `OPENSSL_sk_num'
/usr/local/include/openssl/x509.h:97: undefined reference to `OPENSSL_sk_value'
/usr/local/include/openssl/x509.h:97: undefined reference to `OPENSSL_sk_num'
/usr/local/include/openssl/x509v3.h:165: undefined reference to `OPENSSL_sk_num'
/usr/local/include/openssl/x509v3.h:165: undefined reference to `OPENSSL_sk_value'

OpenSSL custom path is for Nginx OpenSSL builds and isn't even in /usr/local it's at /opt/openssl

Code (Text):

fgrep 'OPENSSL_CUSTOMPATH=' centmin.sh
OPENSSL_CUSTOMPATH='/opt/openssl'  # custom directory path for OpenSSL 1.0.2+

 

Looks like could be related to Nginx recompile as it's only reference to /usr/local/include/openssl i can see from recursive fgrep of /root/centminlogs which logs all centmin.sh options' runs

specifically it's from
/root/centminlogs/centminmod_123.09beta01.b021_100518-003034_nginx_upgrade.log that i see it

Code (Text):

fgrep -ro '/usr/local/include/openssl' /root/centminlogs/ | uniq
/root/centminlogs/centminmod_123.09beta01.b021_100518-144637_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-003034_nginx_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-142826_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-143923_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-144306_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-144941_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-145204_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-152125_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b019_100518-154132_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b017_100518-154746_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b017_100518-155112_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b017_100518-154451_php_upgrade.log:/usr/local/include/openssl
/root/centminlogs/centminmod_123.09beta01.b021_100518-160142_php_upgrade.log:/usr/local/include/openssl

 

Ah found the culprit it was my OpenSSL 1.1.1 control variable for compiling OpenSSL 1.1.1 with no-tls1_3 flag. It isn't a supported flag in OpenSSL 1.1.0h which is default Nginx OpenSSL 1.1.0h version so seems to have tripped up OpenSSL 1.1.0h compile as you can see below during OpenSSL compile prefix is set to /opt/openssl but after unsupported options error for no-tls1_3 it seems to used /usr/local/ssl as directory of choice for compile !

Code (Text):

./config -Wl,--enable-new-dtags,-rpath=/opt/openssl/lib --prefix=/opt/openssl --openssldir=/opt/openssl shared enable-ec_nistp_64_gcc_128 no-tls1_3
Operating system: x86_64-whatever-linux2
Configuring for linux-x86_64
***** Unsupported options: no-tls1_3
Configuring OpenSSL version 1.1.0h (0x1010008fL)
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" crypto/include/internal/bn_conf.h.in > crypto/include/internal/bn_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" crypto/include/internal/dso_conf.h.in > crypto/include/internal/dso_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" include/openssl/opensslconf.h.in > include/openssl/opensslconf.h
make depend && make _all
make[1]: Entering directory `/svr-setup/openssl-1.1.0h'
make[1]: Leaving directory `/svr-setup/openssl-1.1.0h'
make[1]: Entering directory `/svr-setup/openssl-1.1.0h'
cc  -I. -Icrypto/include -Iinclude -DNDEBUG -DOPENSSL_NO_DYNAMIC_ENGINE -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\"" -O   -MMD -MF crypto/aes/aes_cbc.d.tmp -MT crypto/aes/aes_cbc.o -c -o crypto/aes/aes_cbc.o crypto/aes/aes_cbc.c
cc  -I. -Icrypto/include -Iinclude -DNDEBUG -DOPENSSL_NO_DYNAMIC_ENGINE -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\"" -O   -MMD -MF crypto/aes/aes_cfb.d.tmp -MT crypto/aes/aes_cfb.o -c -o crypto/aes/aes_cfb.o crypto/aes/aes_cfb.c

 

Okay first draft of the fix for Nginx compiled OpenSSL has been committed to 123.09beta01 latest code. This bug will affect fresh 123.09beta01 installs PHP compilations as it's picking up incorrect OpenSSL compilation at /usr/local/include/openssl due to a bug I introduced in commits from May 10th, 2018. You can see inc/openssl_install.inc file's github blame history which line by line links the current state to the commit that made that line. Which was specifically related to commit here.

If it's a completely fresh CentOS Centmin Mod install made in past 24hrs of May 10th, 2018, it would be easier to just reload fresh CentOS OS and do a new Centmin Mod install to be 100% certain. Though not necessary if you don't want to.

If you have an existing Centmin Mod 123.09beta01 install with this issue, you will need to update code via command = cmupdate, and then recompile Nginx's OpenSSL first via centmin.sh menu option 4. You can verify that is fixed using command below which lists all nginx_upgrade logs in reverse ascending data order and does a fgrep for the clean up markers I introduced. If you see these 3 lines, then Nginx OpenSSL is fixed.

Code (Text):

cd /root/centminlogs/
ls -rt /root/centminlogs/ | grep nginx_upgrade | while read l; do fgrep 'clean up no-tls1_3 bug' $l; done
clean up no-tls1_3 bug /usr/local/ssl
clean up no-tls1_3 bug /usr/local/lib/engines-1.1
clean up no-tls1_3 bug /usr/local/include/openssl

 

You're welcome. Interesting as never would expect an unsupported OpenSSL flag would override the configuration prefix setting used instead of just erroring out and stop right there.

FYI, you can remove link to the log in your first post too

 

k will remove it for ya