【10.18】nginx 访问控制
4.43-4.47 nginx访问控制
1、限制 IP 访问
将需要限制的 ip 写成以下字段并加入虚拟主机配置文件 /etc/nginx/conf.d/blog.ars4life.com
allow 127.0.0.1;
allow 192.168.1.0/24;
deny all;
[root@alexis-01 ~]# curl -x127.0.0.1:80 blog.ars4life.com -I
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 02:52:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Link: <http://blog.ars4life.com/index.php?rest_route=/>; rel="https://api.w.org/"
[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 02:53:48 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive
194网段的 ip 是无法访问的,
如果将白名单 allow 改为 194 网段,如下配置,那么 194 是可以访问的
allow 127.0.0.1;
allow 192.168.194.0/24;
deny all;
[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:19:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Link: <http://blog.ars4life.com/index.php?rest_route=/>; rel="https://api.w.org/"
deny 127.0.0.1;
deny 192.168.194.0/24;
不 deny 的就是 allow,所有 allow 不用写
将配置文件改为黑名单机制,再次访问
[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:25:54 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive
访问被拒绝。
2、限制目录
-
内部访问的资源目录,需要限制他人访问
-
虚拟主机配置文件中添加控制语句,白名单
location ~ /admin.php
{
allow 127.0.0.1;
allow 192.168.194.0/24;
deny all;
root /data/wwwroot/blog.ars4life.com;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/blog.ars4life.com$fastcgi_script_name;
include fastcgi_params;
}
root@alexis-01 ~]# curl -x192.168.194.128:80 bbs.ars4life.com/admin.php -I
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:45:32 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Set-Cookie: 94bw_2132_saltkey=bapqbsxZ; expires=Mon, 18-Nov-2019 03:45:32 GMT; Max-Age=2592000; path=/; HttpOnly
Set-Cookie: 94bw_2132_lastvisit=1571453132; expires=Mon, 18-Nov-2019 03:45:32 GMT; Max-Age=2592000; path=/
Set-Cookie: 94bw_2132_sid=aDQpIN