文章目录
Nginx收尾以及Tomcat应用
一、Nginx中的if判断功能
1.作用
if ( 条件 ) {
规则
}
根据某条件判断是否符合,符合则执行相应的规则
2.应用场景
-
限制某IP访问的资源
案例:wordpress 只允许10.0.0.1访问 vim /usr/local/nginx/conf/conf.d/wordpress.conf if ( $remote_addr !~ '10.0.0.1' ){ return 404; }
-
通过判断UA,显示pc页面和手机页面
1.准备环境 # 手机站点 vim /usr/local/nginx/conf/conf.d/mb.conf server { listen 9090; server_name mb.dms.com; root /html/mb; index index.html; } # pc站点 vim /usr/local/nginx/conf/conf.d/pc.conf server { listen 80; server_name pc.dms.com; root /html/pc; index index.html; } # 准备代码 mkdir /html/{mb,pc} -p echo 'mobile index' >/html/mb/index.html echo 'PC index' >/html/pc/index.html /bin/nginx -s reload
2.代理 vim /usr/local/nginx/conf/conf.d/pc.conf server { listen 80; server_name pc.dms.com; location / { if ( $http_user_agent ~* "Android|iphone|Mac os|pad" ) { return http://mb.dms.com:9090; } proxy_pass http://10.0.0.11; proxy_set_header HOST $host; } }
-
防页面盗链
- 什么是盗链:一个网站盗用别人网站的链接
1.准备环境 ## 被盗链网站 vim /usr/local/nginx/conf/conf.d/target.conf server { listen 80; server_name target.dms.com; root /html/target; index index.html; } ## 盗链网站 vim /usr/local/nginx/conf/conf.d/payload.conf server { listen 80; server_name payload.dms.com; root /html/payload; index index.html; } # 代码路径 mkdir /html/payload vim /html/payload/index.html <html> <body> <img src='http://target.dms.com/%E9%AB%98%E6%B8%85%E6%97%A0%E7%A0%81.jpg'> </body> </html>
2.配置防盗链 # 配置白名单,允许谁调取外链 valid_referers none blocked www.baidu.com 123.dms.com; # 除去白名单的客户端都被拒绝返回404 if ($invalid_referer) { return 404; # return 200 "偷图狗,gunduzi"; # default_type application/json }
二、Nginx安全性优化
1.nginx版本信息优化
版本信息泄露容易被利用导致网站出现风险
方法一:隐藏版本号
vim /usr/local/nginx/conf/nginx.conf
写入
server_tokens off;
方式二:修改版本信息
通过修改nginx源码编译安装实现
# 修改下面源码中的nginx版本信息
vim /usr/local/src/nginx-1.27.0/src/core/nginx.h
13 #define NGINX_VERSION "110"
14 #define NGINX_VER "Apache/" NGINX_VERSION
vim /usr/local/src/nginx-1.27.0/src/http/ngx_http_header_filter_module.c
49 static u_char ngx_http_server_string[] = "Server: Apache" CRLF;
vim /usr/local/src/nginx-1.27.0/src/http/ngx_http_special_response.c
36 "<hr><center>Apache</center>" CRLF
# 重新编译Nginx
cd /usr/local/src/nginx-1.27.0/
./configure --prefix=/usr/local/nginx --sbin-path=/bin/ --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module
# make
# 注意不要make install,手动复制替换就的Nginx命令
/bin/nginx -s stop
rm -rf /bin/nginx
cp -a /usr/local/src/nginx-1.27.0/objs/nginx /bin/
2.Nginx添加防护应用–waf
1.什么是waf
web application firewalld #web应用防火墙
在web页面实现安全防护,防护非法请求
注入攻击
流量攻击
#waf产品
雷池waf
云盾waf
nginx-waf
2.准备漏洞靶场
#nginx靶场配置
##准备靶场配置文件
vim /usr/local/nginx/conf/conf.d/bug.conf
server {
listen 6657;
server_name bug.dms.com;
root /html/bug;
index index.html index.php;
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
##准备代码
mkdir /html/bug
vim /html/bug/login.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> SQL 注入演示场景 </title>
</head>
<body>
<form action="login.php" method="get">
<table>
<tr>
<td> 用户:</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td> 密码:</td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td><input type="submit" value="submit"></td>
<td><input type="reset" value="reset"></td>
</tr>
</table>
</form>
</body>
vim /html/bug/login.php
<?php
$conn = mysqli_connect('localhost','root','123') or die("数据库连接失败!");
mysqli_select_db($conn,'info') or die("数据库不存在!");
$name=$_GET['username'];
$pwd=$_GET['password'];
$sql="select * from user where username='$name' and password='$pwd'";
mysqli_query("set names 'utf8'");
$query=mysqli_query($conn,$sql);
$arr=mysqli_fetch_array($query);
if($arr){
echo "login successed!<br/>";
echo $arr[1];
echo $arr[3]."<br/><br />";
}else{
echo "login failed!";
}
echo "SQL: '$sql' ";
mysqli_close($conn);
?>
##数据库配置
mysql -uroot -p123
mysql> create database info;
mysql> use info;
Database changed
mysql> create table info.user (id int(11),username varchar(64),password varchar(64),email varchar(64));
mysql> insert into user (id,username,password,email) values(1,'michael','123456','');
##验证sql注入漏洞
' or 0=0 #
3.Nginx集成waf防护工具
#安装docker
##配置安装源
yum install yum-utils
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
##安装docker
yum install -y docker-ce
# 安装雷池
bash -c "$(curl -fsSLk https://waf-ce.chaitin.cn/release/latest/setup.sh)"
# 官方文档
https://waf-ce.chaitin.cn/docs/practice/IpIntelligence
#打开雷池网站
[SafeLine] Initial username:admin
[SafeLine] Initial password:zHzW9He9
https://10.0.0.5:9443/
登录账户密码
#添加防护站点
添加站点后,通过雷池站点访问数据库
再次使用万能钥匙访问数据库,被拒绝
在雷池中可以找到万能钥匙攻击记录