Ngnix issues - wont start

[hersham]

Hi everyone, I have an on premise installation V20.8 and not too sure why but we kept getting ngnix failures, a quick start of the service would eventually get it going after several attempts. A few Window 11 updates and now it will not start at all.
The error log is as follows:

nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead in C:\Program Files\3CX Phone System\Bin\nginx/conf/nginx.conf:47
nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead in C:\Program Files\3CX Phone System\Bin\nginx/conf/nginx.conf:48
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_cert_********.3cx.uk.pem"
nginx: [emerg] bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket in a way forbidden by its access permissions)
nginx: [emerg] bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket in a way forbidden by its access permissions)

Our actual nginx config file contains:

worker_processes auto;

events {
accept_mutex on;
worker_connections 10240;
}


http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' $http_connection;
}

include mime.types;
default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;


limit_conn_zone $server_name zone=servers:10m;

geo $is_remote {
default 1;
192.168.0.0/16 0;
172.16.0.0/12 0;
10.0.0.0/8 0;
127.0.0.1 0;
}

upstream gateway {
server 127.0.0.1:5008;

keepalive 100;
}

upstream mc {
server 127.0.0.1:5004;

keepalive 100;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen 80;
listen [::]:80;
server_name ********.3cx.uk;
server_tokens off;

access_log off;
error_log nul crit;

if ($scheme = 'http'){
set $block_remote "1";
}
if ($is_remote){
set $block_remote "${block_remote}+1";
}
if ($block_remote = "1+1"){
return 403;
}

ssl_session_cache shared:SSL:60m;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;

ssl_certificate "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_cert_********.3cx.uk.pem";
ssl_certificate_key "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_key_********.3cx.uk.pem";

ssl_prefer_server_ciphers on;

client_max_body_size 300m;
root "C:/ProgramData/3CX/Data/Http/wwwroot/webclient";

location ~ ^/webclient(?!(/api|/3cx-worker.js)) {
set $new_request_uri $request_uri;

if ($request_uri ~ ^/webclient(.*)$) {
set $new_request_uri $1;
}
return 302 $scheme://$server_name:$server_port$new_request_uri;
}

location /manager {
return 403;
}

location ~ ^/swagger {
include "mc.conf";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "0";
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; img-src 'self' data:;";
add_header Strict-Transport-Security max-age=31536000;
}

location ~ ^/join/|^/meet/|^/open/|^/router|^/webmeeting|^/gateway {
# Limit of files is 4096 so we leave +1000 for system files here
limit_conn servers 2500;

add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1;mode=block";
add_header Content-Security-Policy "default-src 'self' *.3cx.net; style-src 'self' 'unsafe-inline' *.3cx.net; script-src 'self' 'unsafe-eval' *.3cx.net youtube.com www.youtube.com; worker-src blob:; frame-src 'self' www.youtube.com tcxwmrc:; connect-src *; img-src * data:;object-src 'none';";
add_header Strict-Transport-Security max-age=31536000 always;
add_header Referrer-Policy no-referrer;
add_header Cross-Origin-Opener-Policy same-origin;
add_header Permissions-Policy "geolocation=(),accelerometer=(),gamepad=(),magnetometer=(),midi=(),payment=(),serial=(),xr-spatial-tracking=()";
add_header Cross-Origin-Embedder-Policy credentialless;

add_header Cache-Control "no-store";
add_header Pragma "no-cache";

proxy_pass http://gateway;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host:$server_port;

proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}

location ~ ^/callus\.js|-worker\.js$|manifest\.webmanifest$|ngsw\.json$|index\.html$ {
include "shared-headers.conf";
add_header Cache-Control "no-cache";
add_header Pragma "no-cache";
add_header Permissions-Policy "geolocation=(),accelerometer=(),gamepad=(),magnetometer=(),midi=(),payment=(),serial=(),xr-spatial-tracking=()";
try_files $uri $uri/ @proxy;
}

location / {
include "shared-headers.conf";
add_header Cache-Control "public, immutable, max-age=31536000";
index index.html;
try_files $uri $uri/ @proxy;
}

location /user_images {
include "shared-headers.conf";
add_header Cache-Control "public, immutable, max-age=31536000";
root "C:/ProgramData/3CX/Data/Http/wwwroot";
try_files $uri $uri/;
}

location /MyPhone {
include "shared-headers.conf";
alias "C:/ProgramData/3CX/Instance1/Data/Http/Interface/MyPhone";
try_files $uri $uri/ @proxy;
}

location ~ ^(/xapi/v1/Report|/xapi/v1/ChatHistory|/xapi/v1/ChatMessages|/xapi/v1/InstallUpdates|/xapi/v1/Users/Pbx\.InstallFirmware|/xapi/v1/Users/Import) {
include "shared-headers.conf";
include "mc.conf";
proxy_read_timeout 1h;
}

location /xapi/v1/Firmwares {
include "shared-headers.conf";
include "mc.conf";
client_max_body_size 1G;
}

location @proxy {
include "shared-headers.conf";
include "mc.conf";
}

include "snippets/*.conf";
}


}

Oviously without nginx server running we can't access anything from an admin point, niether can we use the PCX app, any help would be appreciated.

 

[Claas Felix Beyersdorf]

Up front i have to say we never had many customers that used Windows for their 3CX and now we don't have one left. So I'm not an Windows expert. But nowadays I would think most 3cx are running under debian.

But for me the nginx log is clear.
You can ignore the warn messages and concentrate on the emerg.
For me it is obvious your Windows is blocking port 80 so this might be one of two problems. Some other process is already listening on port 80 so nginx can't access it.

Or you need some registry hacks to allow listening on an port below 1024 (1024 is the first user port).

So for me it is a problem caused by Windows, might be an update or something.

So what i would check first. Change the listen 80; to something like listen 8080; the second listen for ipv6 should also Changed. Than you can try to start if this works you can search inside Windows for the security problem. You might also change the 443 lines to higher ports. If the error message changes and indicates something like this.

Or you do yourself a favor and take a backup. Install a debian based 3cx and restore the backup. Where 3cx keeps operating system and 3cx up to date.

You might ask the AI you like most about the problem.

One last point. As nginx is only the reverse proxy you should be able to access the managmentconsole directly.
Http://127.0.0.1:5004 using a Browser inside the system.

As you can see inside the nginx.conf you have posted.

I hope some of my informations are helpfull to you. Or some more advanced windows admins can give you the missing registry hack.

Best regards,
Claas

 

[Evolute IT]

Hi everyone, I have an on premise installation V20.8 and not too sure why but we kept getting ngnix failures, a quick start of the service would eventually get it going after several attempts. A few Window 11 updates and now it will not start at all.
The error log is as follows:

nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead in C:\Program Files\3CX Phone System\Bin\nginx/conf/nginx.conf:47
nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead in C:\Program Files\3CX Phone System\Bin\nginx/conf/nginx.conf:48
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_cert_********.3cx.uk.pem"
nginx: [emerg] bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket in a way forbidden by its access permissions)
nginx: [emerg] bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket in a way forbidden by its access permissions)

Our actual nginx config file contains:

worker_processes auto;

events {
accept_mutex on;
worker_connections 10240;
}


http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' $http_connection;
}

include mime.types;
default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;


limit_conn_zone $server_name zone=servers:10m;

geo $is_remote {
default 1;
192.168.0.0/16 0;
172.16.0.0/12 0;
10.0.0.0/8 0;
127.0.0.1 0;
}

upstream gateway {
server 127.0.0.1:5008;

keepalive 100;
}

upstream mc {
server 127.0.0.1:5004;

keepalive 100;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen 80;
listen [::]:80;
server_name ********.3cx.uk;
server_tokens off;

access_log off;
error_log nul crit;

if ($scheme = 'http'){
set $block_remote "1";
}
if ($is_remote){
set $block_remote "${block_remote}+1";
}
if ($block_remote = "1+1"){
return 403;
}

ssl_session_cache shared:SSL:60m;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;

ssl_certificate "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_cert_********.3cx.uk.pem";
ssl_certificate_key "C:/ProgramData/3CX/Bin/nginx/conf/Instance1/domain_key_********.3cx.uk.pem";

ssl_prefer_server_ciphers on;

client_max_body_size 300m;
root "C:/ProgramData/3CX/Data/Http/wwwroot/webclient";

location ~ ^/webclient(?!(/api|/3cx-worker.js)) {
set $new_request_uri $request_uri;

if ($request_uri ~ ^/webclient(.*)$) {
set $new_request_uri $1;
}
return 302 $scheme://$server_name:$server_port$new_request_uri;
}

location /manager {
return 403;
}

location ~ ^/swagger {
include "mc.conf";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "0";
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; img-src 'self' data:;";
add_header Strict-Transport-Security max-age=31536000;
}

location ~ ^/join/|^/meet/|^/open/|^/router|^/webmeeting|^/gateway {
# Limit of files is 4096 so we leave +1000 for system files here
limit_conn servers 2500;

add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1;mode=block";
add_header Content-Security-Policy "default-src 'self' *.3cx.net; style-src 'self' 'unsafe-inline' *.3cx.net; script-src 'self' 'unsafe-eval' *.3cx.net youtube.com www.youtube.com; worker-src blob:; frame-src 'self' www.youtube.com tcxwmrc:; connect-src *; img-src * data:;object-src 'none';";
add_header Strict-Transport-Security max-age=31536000 always;
add_header Referrer-Policy no-referrer;
add_header Cross-Origin-Opener-Policy same-origin;
add_header Permissions-Policy "geolocation=(),accelerometer=(),gamepad=(),magnetometer=(),midi=(),payment=(),serial=(),xr-spatial-tracking=()";
add_header Cross-Origin-Embedder-Policy credentialless;

add_header Cache-Control "no-store";
add_header Pragma "no-cache";

proxy_pass http://gateway;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host:$server_port;

proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}

location ~ ^/callus\.js|-worker\.js$|manifest\.webmanifest$|ngsw\.json$|index\.html$ {
include "shared-headers.conf";
add_header Cache-Control "no-cache";
add_header Pragma "no-cache";
add_header Permissions-Policy "geolocation=(),accelerometer=(),gamepad=(),magnetometer=(),midi=(),payment=(),serial=(),xr-spatial-tracking=()";
try_files $uri $uri/ @proxy;
}

location / {
include "shared-headers.conf";
add_header Cache-Control "public, immutable, max-age=31536000";
index index.html;
try_files $uri $uri/ @proxy;
}

location /user_images {
include "shared-headers.conf";
add_header Cache-Control "public, immutable, max-age=31536000";
root "C:/ProgramData/3CX/Data/Http/wwwroot";
try_files $uri $uri/;
}

location /MyPhone {
include "shared-headers.conf";
alias "C:/ProgramData/3CX/Instance1/Data/Http/Interface/MyPhone";
try_files $uri $uri/ @proxy;
}

location ~ ^(/xapi/v1/Report|/xapi/v1/ChatHistory|/xapi/v1/ChatMessages|/xapi/v1/InstallUpdates|/xapi/v1/Users/Pbx\.InstallFirmware|/xapi/v1/Users/Import) {
include "shared-headers.conf";
include "mc.conf";
proxy_read_timeout 1h;
}

location /xapi/v1/Firmwares {
include "shared-headers.conf";
include "mc.conf";
client_max_body_size 1G;
}

location @proxy {
include "shared-headers.conf";
include "mc.conf";
}

include "snippets/*.conf";
}


}

Oviously without nginx server running we can't access anything from an admin point, niether can we use the PCX app, any help would be appreciated.

Is there anything else installed on that same machine? Port 80 is not blocked on Windows by default, it should work perfectly fine unless other softwares are installed and are listening on that port (like IIS perhaps.)

 

[hersham]

Hi Chaps, thanks for the response, I couldn't find the offending item that was also using port 80, so I took the decision to uninstall 3CX, delete all the folders, then reinstall and from a backup recreate the system but chose port 5000 & 5001 for the http sessions, this seems to have cured the situation.
Regards
Sam Adcock

 

[SweetAction]

While your issue is solved, I'll leave this here for others who may find this thread.

you can use Resource Monitor on Windows to see a list of ports and what PID is tied to them. In many cases the process name is enough to find out the conflict, but you can also take the PID and reverse that to the process or service.