[Error 403 on apache]

Yes, I have read that. But due to a successful manual invalidation I think the cron invalidation doesn't work as expected. I looked into your code

# lib/Froxlor/Cron/MasterCron.php line 137
# lib/Froxlor/Cron/System/TasksCron.php 243
                        // clear NSCD cache if using fcgid or fpm, #1570 - not needed for nss-extrausers
                        if ((\Froxlor\Settings::Get('system.mod_fcgid') == 1 || (int) \Froxlor\Settings::Get('phpfpm.enabled') == 1) && \Froxlor\Settings::Get('system.nssextrausers') == 0) {
                                $false_val = false;
                                \Froxlor\FileDir::safe_exec('nscd -i passwd 1> /dev/null', $false_val, array(
                                        '>'
                                ));
                                \Froxlor\FileDir::safe_exec('nscd -i group 1> /dev/null', $false_val, array(
                                        '>'
                                ));

Could it be, that in our setup (php-fpm and nssextrausers) we do need this invalidation there while you exclude it with your condition?

[Error 403 on apache]

Well, setup is almost like described in Simon's initial post (fpm-php, libnss-extrausers, ...). 

After creating a new client with standard subdomain and performing

php /var/www/froxlor/scripts/froxlor_master_cronjob.php --force --debug

will lead to 403 Forbidden even after a manual apache2 restart. 

But the following solves the problem and all works as expected: 

nscd -i passwd
nscd -i group
/etc/init.d/apache2 restart

That's why I think there's a misbehaviour of my nscd invalidation. Where do you fire the nscd invalidation for froxlor_master_cronjob.php?

Thank you very much for your patience, by the way 🙂

[Error 403 on apache]

Indeed. I guess that nscd's invalidation doesn't work as expected thus apache2 still have old user information after reload. A complete server restart solves this of course. I figured out that this procedure also works:

nscd -i passwd
nscd -i group
/etc/init.d/apache2 restart

How can we fire nscd invalidation before apache2 and php-fpm restart in froxlor_master_cronjob.php?

[Error 403 on apache]

vor 1 Minute schrieb d00p:

error says it all, check permissions of /var/customers/webs/[user]

Permissions are all good:

ls -la /var/customers/webs/testabcd/
drwxr-x---  6 testabcd testabcd 4096 Nov  4 13:47 .

It only happens when you setup the first domain for a brand new user. php-fpm runs as correct user, new user is listed in /var/lib/extrausers/*, folders are setup correctly, all seems good. But without chroot in php-fpm config I need a restart of the complete server, manual restarts of apache2, nscd and php-fpm are not sufficient.

[Error 403 on apache]

Same here. A reboot of the server solves the problem as well (restarting apache2, php-fpm and nscd is not enough). After php-fpm chroot happened once, it also works without it. Strange.