~/Rev_
← writeups

Recovering EVE-NG: Diagnose the Stack Before Repairing It

From 403 to 502 to a missing PHP-FPM socket, and the discovery that EVE-NG runs on Apache, which made a clean reinstall the right fix.

2025-11-19#CyberDen
work: Nov 2025 · Resolved (reinstall) · Networking, EVE-NG, Linux, Troubleshooting

Context

After fighting Cisco CML, I moved network research to EVE-NG for CCNA practice and router labs. The EVE VM's web UI wouldn't load.

The trail

  1. 403 Forbidden. nginx had no index.php/index.html to serve in /opt/unetlab/html, only api.php. Pointed the site's index at it.
  2. 502 Bad Gateway. nginx could now find PHP but couldn't reach PHP-FPM. The error log said: 
    connect() to unix:/run/php/php8.1-fpm.sock failed (2: No such file or directory)

    ls -l /run/php showed the socket was actually php-fpm.sock. I fixed the path and got a PHP page.

  3. The API still dead. restoredb, fixpermissions, a known-good config: nothing brought the EVE API back.
missing index.php
The first clue: nginx config is fine, but there's no index.php in the web root. Only api.php.

The real problem

A clean EVE-NG install from its ISO uses Apache + MySQL, with PHP loaded through Apache, not nginx + PHP-FPM. My VM had picked up an nginx stack along the way, so I'd spent the evening repairing a web server EVE doesn't use. The environment was inconsistent enough that the reliable fix was a fresh EVE install in a new VM.

Reinstall notes

  • The newer Community builds dropped the old curses first-boot wizard for cloud-init-style setup. Logging in as root triggers the first-run configuration.
  • Check that /opt/unetlab has the expected tree, then confirm apache2 and mysql are running before anything else.
  • Then: success.

Lessons

  • Check what the app expects before fixing the stack. The vendor's install method defines "correct".
  • The error log is the map. 403 → 502 → missing socket: each step told me the next layer.
  • Know when to stop repairing. A corrupted environment costs more to fix than to replace.

Sources: Fix nginx PHP-FPM (18 Nov 2025), CML free ISO networking (4 Nov 2025)