nginx配置https以及监控nginx状态

nginx配置https

环境说明

系统ip安装服务
centos7192.168.30.130nginx

已关闭防火墙和selinux,并配置好了yum源,包括epel源

//生成证书
[root@localhost ~]# cd /etc/pki/CA 
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
..................................................+++
.............+++
e is 65537 (0x10001)
[root@localhost CA]# ll private/
total 4
-rw-------. 1 root root 1679 Aug 11 21:09 cakey.pem
[root@localhost CA]#  openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.a.com
Organizational Unit Name (eg, section) []:www.a.com
Common Name (eg, your name or your server's hostname) []:www.a.com
Email Address []:1@2.com
[root@localhost CA]# ls
cacert.pem  certs  crl  newcerts  private

[root@localhost ~]#  (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
...................................................................................................................+++
....................................+++
e is 65537 (0x10001)
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.key               v0.61.tar.gz
[root@localhost ~]#  openssl req -new -key httpd.key -days 365 -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.a.com
Organizational Unit Name (eg, section) []:www.a.com
Common Name (eg, your name or your server's hostname) []:www.a.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.csr               v0.61.tar.gz
httpd.key
[root@localhost ~]#  openssl ca -in /root/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Aug 12 01:20:53 2020 GMT
            Not After : Aug 12 01:20:53 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = www.a.com
            organizationalUnitName    = www.a.com
            commonName                = www.a.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                71:73:00:52:90:3E:4A:0E:3A:C9:38:AF:C2:97:97:6B:4A:6F:8B:71
            X509v3 Authority Key Identifier: 
                keyid:E6:5D:3A:CA:1D:72:44:88:0B:06:9E:15:6B:63:CC:6C:F0:2E:97:B2

Certificate is to be certified until Aug 12 01:20:53 2021 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@localhost ~]# ls
anaconda-ks.cfg         httpd.key
echo-nginx-module-0.61  nginx-1.14.2.tar.gz
httpd.crt               nginx-1.16.1.tar.gz
httpd.csr               v0.61.tar.gz

//创建证书存放目录

[root@localhost ~]# mkdir /usr/local/nginx/ssl
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.crt               v0.61.tar.gz
httpd.csr               www.example.com.pem
httpd.key
[root@localhost ~]# cp httpd.crt httpd.key /usr/local/nginx/ssl
[root@localhost ~]# cd /usr/local/nginx/ssl
[root@localhost ssl]# ls
httpd.crt  httpd.key

//修改配置文件
[root@localhost ~]# vim /usr/local/nginx/conf/nginx.conf
    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      /usr/local/nginx/ssl/httpd.crt;
        ssl_certificate_key  /usr/local/nginx/ssl/httpd.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }
[root@localhost ~]# nginx -s reload
[root@localhost ~]# ss -tanl
State       Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN      0      128     *:80                  *:*                  
LISTEN      0      128     *:22                  *:*                  
LISTEN      0      100    127.0.0.1:25                  *:*                  
LISTEN      0      128     *:443                 *:*                  
LISTEN      0      128    :::22                 :::*                  
LISTEN      0      100       ::1:25                 :::*                  


验证
在这里插入图片描述

zabbix监控naginx服务器状态

环境说明

系统ip服务
centos7192.168.30.150lnmp架构下 zabbix server agent

zabbix服务端安装

//安装依赖包
[root@localhost ~]# yum -y install net-snmp-devel libevent-devel

//下载zabbix
[root@localhost ~]# wget https://cdn.zabbix.com/zabbix/sources/stable/5.0/zabbix-5.0.2.tar.gz
[root@localhost ~]# ls
anaconda-ks.cfg
mysql-5.7.30-linux-glibc2.12-x86_64.tar.gz
nginx-1.18.0
nginx-1.18.0.tar.gz
php-7.4.7
php-7.4.7.tar.xz
remi-release-7.rpm
zabbix-5.0.2.tar.gz
[root@localhost ~]# tar xf zabbix-5.0.2.tar.gz -C /usr/src
[root@localhost src]# ls
debug  kernels  zabbix-5.0.2
[root@localhost ~]# cd /usr/src/zabbix-5.0.2/
[root@localhost zabbix-5.0.2]# ls
aclocal.m4  config.guess  include      misc
AUTHORS     config.sub    INSTALL      missing
bin         configure     install-sh   NEWS
build       configure.ac  m4           README
ChangeLog   COPYING       Makefile.am  sass
compile     database      Makefile.in  src
conf        depcomp       man          ui

//创建zabbix用户
[root@localhost zabbix-5.0.2]# id zabbix
uid=994(zabbix) gid=992(zabbix) groups=992(zabbix)

//配置zabbix数据库
[root@localhost zabbix-5.0.2]# mysql -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.30 MySQL Community Server (GPL)
 
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
 
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database zabbix character set utf8 collate utf8_bin;
Query OK, 1 row affected (0.00 sec)
 
mysql> grant all privileges on zabbix.* to zabbix@localhost identified by 'zabbix123!';
Query OK, 0 rows affected, 2 warnings (0.00 sec)
 
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
 
mysql> quit
Bye
 
[root@localhost zabbix-5.0.2]# ls
aclocal.m4  build      conf          configure     database  INSTALL     Makefile.am  misc     README  ui
AUTHORS     ChangeLog  config.guess  configure.ac  depcomp   install-sh  Makefile.in  missing  sass
bin         compile    config.sub    COPYING       include   m4          man          NEWS     src
[root@localhost zabbix-5.0.2]# cd database/mysql/
[root@localhost mysql]# ls
data.sql  double.sql  images.sql  Makefile.am  Makefile.in  schema.sql
[root@localhost mysql]# mysql -uzabbix -pzabbix123! zabbix < schema.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
[root@localhost mysql]# mysql -uzabbix -pzabbix123! zabbix < images.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
[root@localhost mysql]# mysql -uzabbix -pzabbix123! zabbix < data.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
 
 
 
//编译安装zabbix
[root@localhost zabbix-5.0.2]# ./configure --enable-server  --enable-agent  --with-mysql  --with-net-snmp  --with-libcurl  --with-libxml2
[root@localhost zabbix-5.0.2]# make install 

[root@localhost ~]# vim /usr/local/etc/zabbix_server.conf

DBPassword=zabbix123!       //设置zabbix数据库连接密码

 
//启动zabbix_server和zabbix_agentd
[root@localhost zabbix-5.0.2]# zabbix_server 
[root@localhost zabbix-5.0.2]# zabbix_agentd 
[root@localhost zabbix-5.0.2]# ss -tanl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port              
LISTEN      0      100                     127.0.0.1:25                                          *:*                  
LISTEN      0      128                             *:443                                         *:*                  
LISTEN      0      128                             *:10050                                       *:*                  
LISTEN      0      128                             *:10051                                       *:*                  
LISTEN      0      128                     127.0.0.1:9000                                        *:*                  
LISTEN      0      128                             *:80                                          *:*                  
LISTEN      0      128                             *:22                                          *:*                  
LISTEN      0      100                         [::1]:25                                       [::]:*                  
LISTEN      0      80                           [::]:3306                                     [::]:*                  
LISTEN      0      128                          [::]:22                                       [::]:*           
 
 
 
//按zabbix部署要求修改/etc/php.ini的配置并重启php-fpm
[root@localhost ~]# sed -ri 's/(post_max_size =).*/\1 16M/g' /etc/php.ini
[root@loalhost ~]# sed -ri 's/(max_execution_time =).*/\1 300/g' /etc/php.ini
[root@localhost ~]# sed -ri 's/(max_input_time =).*/\1 300/g' /etc/php.ini
[root@localhost ~]# sed -i '/;date.timezone/a date.timezone = Asia/Shanghai' /etc/php.ini
[root@localhost ~]# service php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm  done
 
 
 
[root@localhost ~]# cd zabbix-5.0.2
[root@localhost zabbix-5.0.2]# ls
aclocal.m4  ChangeLog     config.log     configure.ac  include     Makefile     misc     sass
AUTHORS     compile       config.status  COPYING       INSTALL     Makefile.am  missing  src
bin         conf          config.sub     database      install-sh  Makefile.in  NEWS     ui
build       config.guess  configure      depcomp       m4          man          README
[root@localhost zabbix-5.0.2]# cd ui/
[root@localhost ui]# mkdir /usr/local/nginx/html/zabbix
[root@localhost ui]# cp -a . /usr/local/nginx/html/zabbix/
[root@localhost ui]# chown -R nginx.nginx /usr/local/nginx/html/zabbix/
[root@localhost ui]# ls  /usr/local/nginx/html/zabbix/
actionconf.php      conf                         httpconf.php     map.import.php     slides.php
api_jsonrpc.php     conf.import.php              httpdetails.php  map.php            srv_status.php
app                 correlation.php              image.php        modules            sysmap.php
applications.php    discoveryconf.php            imgstore.php     overview.php       sysmaps.php
assets              disc_prototypes.php          include          queue.php          templates.php
audio               favicon.ico                  index_http.php   report2.php        toptriggers.php
auditacts.php       graphs.php                   index.php        report4.php        tr_events.php
browserwarning.php  history.php                  index_sso.php    robots.txt         trigger_prototypes.php
chart2.php          host_discovery.php           items.php        screenconf.php     triggers.php
chart3.php          hostgroups.php               js               screenedit.php     vendor
chart4.php          hostinventoriesoverview.php  jsLoader.php     screen.import.php  zabbix.php
chart5.php          hostinventories.php          jsrpc.php        screens.php
chart6.php          host_prototypes.php          local            services.php
chart7.php          host_screen.php              locale           setup.php
chart.php           hosts.php                    maintenance.php  slideconf.php
 
 
 
//配置nginx

//配置模块

[root@localhost ~]# vim /usr/local/nginx/conf/nginx.conf
...
location / {
            root   html;
            index  index.html index.htm;
        }

//添加以下内容
        location /status {
            stub_status on; 
            allow 192.168.30.150/32;
            deny all;
        }
[root@localhost ~]# nginx -s reload
...     

[root@localhost ~]# nginx -V
nginx version: nginx/1.18.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --add-module=/root/echo-nginx-module-0.61


[root@localhost ~]# vim /usr/local/nginx/conf/nginx.conf
        location / {
            root   html/zabbix;
            index  index.php index.html index.htm ;
        }
    location /status {
             stub_status on; 
             allow 192.168.30.150/32;
            deny all;
        }
         location ~ \.php$ {
            root           html/zabbix;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            include        fastcgi_params;
        }
 
}
 

  
//设置zabbix/conf目录的权限,让zabbix有权限生成配置文件zabbix.conf.php
[root@localhost ~]# chmod 777 /usr/local/nginx/html/zabbix/conf
 
 //重读配置文件
[root@localhost ~]# nginx -s reload

配置自定义监控来监控nginx状态

//写脚本
[root@localhost ~]# mkdir /scripts
[root@localhost ~]# cd /scripts/
[root@localhost scripts]# ls
[root@localhost scripts]# vim requests_value.sh
[root@localhost scripts]# vim Reading_value.sh 
[root@localhost scripts]# vim Writing_value.sh 
[root@localhost scripts]#  cat requests_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==3{print $3}'`
echo $value
[root@localhost scripts]# cat Reading_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==4{print $2}'`
echo $value
[root@localhost scripts]# cat Writing_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==4{print $4}'`
echo $value


//修改配置文件,添加自定义key
[root@localhost scripts]# vim /usr/local/etc/zabbix_agentd.conf

Server=172.0.0.1   改为服务端ip也可不该监控本机
ServerActive=172.0.0.1 改为服务端ip也可不该监控本机

# Default:
 UnsafeUserParameters=1

### Option: UserParameter
#       User-defined parameter to monitor. There can be several user-defined parameters.
#       Format: UserParameter=<key>,<shell command>
#       See 'zabbix_agentd' directory for examples.
#
# Mandatory: no
# Default:
# UserParameter=
UserParameter=requests_value,/bin/bash /scripts/requests_value.sh
UserParameter=Reading_value,/bin/bash /scripts/Reading_value.sh
UserParameter=Writing_value,/bin/bash /scripts/Writing_value.sh


[root@localhost scripts]# service zabbix_agentd restart
Restarting zabbix_agentd (via systemctl):           [  OK  ]

配置监控项

在这里插入图片描述
在这里插入图片描述

在这里插入图片描述

在这里插入图片描述

验证

在这里插入图片描述

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值