FreeBSD/Apache/php5.6-fpm: 503 error on login

[bolwerk]

I recently upgraded my version of FreeBSD to 11.x and in the process decided to begin transitioning an installation of PHP from custom source compilations to FreeBSD ports. (I will do the same with Apache soon.) I more or less left configuration settings intact though. So as of now I am using Apache 2.4.23, compiled from source, and PHP 5.6.27 compiled from FreeBSD ports.

Now roundcube seems to be giving an error only when there is a successful login. If I enter an incorrect username/password combination, it attempts to log in and fails with the expected "Login failed" message. So it seems to be reading from MySQL okay. But if I type the correct username/password combination I get thrown an HTTP error

Service Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Any ideas? PHP is obviously at least partly working.  I get a login screen, it seems to be going so far as to try to authenticate against the imap server (which is working with other clients).  Other app pools are running. I tried upgrading to the latest version of RoundCube.  Was at 1.1.x, now I am at 1.2.2.  All other diagnostic information I can think to include is below.  I also have a similar server running PHP7 and Apache 2.4.x from FreeBSD 11 ports where RoundCube is fine.

Apache configuration:

Code Select Expand

./configure --enable-so --enable-ssl --enable-proxy --enable-proxy-http --enable-rewrite --enable-threads=yes --enable-userdir --enable-dumpio --with-mpm=prefork

Here is the php configuration string reported by phpinfo() if it helps:

Code Select Expand

'./configure' '--with-layout=GNU' '--localstatedir=/var' '--with-config-file-scan-dir=/usr/local/etc/php' '--disable-all' '--enable-libxml' '--enable-mysqlnd' '--with-libxml-dir=/usr/local' '--with-pcre-regex=/usr/local' '--with-zlib-dir=/usr' '--program-prefix=' '--enable-fpm' '--with-fpm-user=www' '--with-fpm-group=www' '--with-regex=php' '--with-zend-vm=CALL' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.0' 'build_alias=amd64-portbld-freebsd11.0' 'CC=cc' 'CFLAGS=-O2 '-pipe' '-fstack-protector' '-fno-strict-aliasing'' 'LDFLAGS= '-fstack-protector'' 'LIBS=-lpthread' 'CPPFLAGS=' 'CPP=cpp' 'CXX=c++' 'CXXFLAGS=-O2 '-pipe' '-fstack-protector' '-fno-strict-aliasing'

When I was compiling PHP from source I did it this way (worked fine):

Code Select Expand

./configure --with-mysql --with-mysqli --with-openssl --enable-mbstring --with-pear --with-gettext --enable-sockets --with-mcrypt --enable-exif --enable-intl --with-imap=/usr/local/lib --with-imap-ssl --with-zlib --with-pdo-mysql --with-curl --with-gd=/usr/local --with-jpeg-dir=/usr/local/lib/ --with-png-dir=/usr/local/lib/ --with-xpm-dir=/usr/local --disable-all --enable-cli --with-pcre-regex --with-zlib-dir=/usr --enable-pdo --enable-mysqlnd --enable-libxml --enable-xml --enable-filter --enable-fpm --enable-session --enable-dom --enable-json


The error log contains this, I have no idea whether it is related:

Code Select Expand

[Wed Nov 16 10:06:24.930053 2016] [proxy_fcgi:error] [pid 56175] [client ip.##.##.##:40028] AH01067: Failed to read FastCGI header, referer: https://webmail.[redacted].net/
[Wed Nov 16 10:06:24.930098 2016] [proxy_fcgi:error] [pid 56175] (70014)End of file found: [client ip.##.##.##:40028] AH01075: Error dispatching request to : , referer: https://webmail.[redacted].net/

The only other possibly diagnostic information I can find comes from php-fpm.log. Specifically, every time this problem occurs something like this happens

Code Select Expand

[16-Nov-2016 10:09:25.628703] WARNING: pid 56306, fpm_children_bury(), line 252: [pool webmail] child 57127 exited with code 1 after 180.697415 seconds from start
[16-Nov-2016 10:09:25.629192] NOTICE: pid 56306, fpm_children_make(), line 421: [pool webmail] child 57163 started

PHP-FPM configuration:

Code Select Expand

[webmail]
user = daemon
group = daemon
listen = 127.0.0.1:9000
listen.owner = daemon
listen.group = daemon
listen.mode = 0666
pm = dynamic
pm.max_children = 5
pm.min_spare_servers = 1
pm.start_servers = 2
pm.max_spare_servers = 3
; chroot = /usr/vhosts/webmail/
; chdir = /htdocs
; php_admin_value[open_basedir] = /usr/vhosts/webmail/:/tmp/
php_admin_value[error_log] = /log/php-fpm.log

When I turn on diagnostic information in the roundcube configuration,  I get this in the userlogins log:

Code Select Expand

[16-Nov-2016 11:43:30 -0500]: <e7lmgo6h> Failed login for [redacted]@[redacted].net from ip.##.##.## in session e7lmgo6h9qt2r6sp5tpa5bfts6 (error: 0)

[bolwerk]

Okay, the good news is I fixed it yesterday and it works.  The bad news is I don't know why.  I ended up using the FreeBSD port of Apache 2.4 so I could import a configuration of Apache 2.4 from another server that worked. That didn't work, but it moved my migration plans forward.  Next thing I tried to mirror that other server was migrate to PHP7, and that is what finally fixed it.

Wondering if there is just a bug in PHP 5.6.27? Or the FreeBSD port of PHP 5.6.27 (or PHP 5.6.*)? Or maybe I didn't compile a PHP feature and overlooked it. Some .htaccess file issue?   I have been using Apache 2.4.x since within months of its release and am a long-time php-fpm user, so I figured my configuration files should be more or less right.

One way or another,  I installed php70 from FreeBSD ports and it worked fine.  The problem for Roundcube is it appeared *.php URLs were being rewritten badly somehow. When I tried to access the installer, it brought me to /index.php instead of /installer/index.php but was looking for images and whatnot relative to the installer directory.

This may not be helpful to a non-FreeBSD user, but if anyone Googles this problem and finds this, the best I can offer are the the php70 and php70-extensions compilation options I used to compile this from ports (attached as images). I just used FreeBSD's defaults for Apache 2.4. The configuration details I mentioned above are more or less intact with some username changes.