12.13 Nginx防盗链
12.14 Nginx访问控制
12.15 Nginx解析php相关配置(502的问题)
12.16 Nginx代理
扩展
502问题汇总 http://ask.apelearn.com/question/9109
location优先级 http://blog.lishiming.net/?p=100
12.13 Nginx防盗链:
配置如下,可以和上面的配置结合起来
vim /usr/local/nginx/conf/vhost/test.com.conf
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ 把之前配置的过期时间注释掉。在第二个location开始写(因为同样用到了location)
# {
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$ ~*不区分大小写
{
expires 7d; 过期时间是7天
valid_referers none blocked server_names *.test.com ; 关于防盗链的是这部分(意思是关于白名单的referer是什么)
if ($invalid_referer) { 意思是如果不是白名单的,就会返回403
return 403;
}
access_log off; 访问日志是不记录
}
实例:
[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# {
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
access_log /tmp/test.com.log;
}
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.php 测试防盗链,要指定referer
HTTP/1.1 403 Forbidden 指定referer为百度,跳转过来就是403
Server: nginx/1.8.0
Date: Wed, 15 Aug 2018 14:44:38 GMT
Content-Type: text/html
Content-Length: 168
Connection: keep-alive
HTTP/1.1 403 Forbidden
Server: nginx/1.8.0
Date: Tue, 23 Jul 2019 09:24:14 GMT
Content-Type: text/html
Content-Length: 168
Connection: keep-alive
[root@localhost ~]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.php
HTTP/1.1 200 OK 指定referer为test.com跳转过来就是200
Server: nginx/1.8.0
Date: Wed, 15 Aug 2018 14:43:29 GMT
Content-Type: image/gif
Content-Length: 19
Last-Modified: Tue, 14 Aug 2018 14:33:26 GMT
Connection: keep-alive
ETag: "5b72e836-13"
Expires: Wed, 22 Aug 2018 14:43:29 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12.14 Nginx访问控制:
平常在运维网站的时候,经常会有一些请求不正常或是故意的去做一些限制,比如有一些机密的不想让别人访问。就可以做一个白名单,只允许自己的公网IP或是公司的内部公网IP去访问
~~1.
需求:访问/admin/目录的请求,只允许某几个IP访问,配置如下:
~1.vim /usr/local/nginx/conf/vhost/test.com.conf
location /admin/
{
allow 192.168.133.1; 这个IP允许。跟apache有点区别,没有order。哪个在前哪个就优先生效。比如这个IP192.168.30.134访问过来,是allow(允许),就到此为止了,也就是允许的。不会再去执行下面的deny。而apache是谁在后最终执行的是哪一个
allow 127.0.0.1; 这个IP允许
deny all; 其他的全部deny(也就是以上两个IP是允许的,其他的都deny)
}
~2. mkdir /data/wwwroot/test.com/admin/
~3.echo “test,test”>/data/wwwroot/test.com/admin/1.html
~4.-t && -s reload
~5.curl -x127.0.0.1:80 test.com/admin/1.html -I
~6.curl -x192.168.133.130:80 test.com/admin/1.html -I
~~2.
可以匹配正则(也就是在能上传图片的目录里,禁止解析php):
~1.location ~ .*(upload|image)/.*\.php$ 只要是匹配upload的这个目录,以php结尾的
{
deny all; 满足以上条件的,全部deny
}
~~3.
根据user_agent限制(防止cc攻击。或是禁掉某些蜘蛛,不想被搜索掉,就可以把一些网站封掉,没有任何一个网站能爬到你的网站,就相当于你的网站被隐藏了一样)
~1.if ($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato') 匹配(~)后面加*代表忽略大小写
{
return 403;
}
~~4. deny all和return 403效果一样(根据~~2与~~3里的配置语句)
实例:
~~1.
[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# {
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
}
access_log /tmp/test.com.log;
}
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -e "http://www.baidu.com" -x127.0.0.1:80 test.com/admin/index.html -I
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Wed, 24 Jul 2019 10:15:14 GMT
Content-Type: text/html
Content-Length: 9
Last-Modified: Tue, 23 Jul 2019 06:24:06 GMT
Connection: keep-alive
ETag: "5d36a806-9"
Accept-Ranges: bytes
[root@localhost ~]# curl -e "http://www.baidu.com" -x192.168.30.134:80 test.com/admin/index.html -I
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Wed, 24 Jul 2019 10:18:43 GMT
Content-Type: text/html
Content-Length: 9
Last-Modified: Tue, 23 Jul 2019 06:24:06 GMT
Connection: keep-alive
ETag: "5d36a806-9"
Accept-Ranges: bytes
~~2.
[root@localhost~]# vim /usr/local/nginx/conf/vhost/test.com.conf
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
access_log off;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*\.php$
{
deny all;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
access_log /tmp/test.com.log;
}
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -x127.0.0.1:80 test.com/upload/1.php -I
HTTP/1.1 403 Forbidden
Server: nginx/1.8.0
Date: Tue, 23 Jul 2019 09:40:08 GMT
Content-Type: text/html
Content-Length: 168
Connection: keep-alive
[root@localhost ~]# curl -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK 访问1.txt就可以。代表设置成功
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Wed, 24 Jul 2019 10:31:15 GMT
Content-Type: text/plain
Content-Length: 3
Last-Modified: Wed, 24 Jul 2019 10:27:32 GMT
Connection: keep-alive
ETag: "5d383294-3"
Accept-Ranges: bytes
~~3.
[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# {
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*\.php$
{
deny all;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
access_log /tmp/test.com.log;
}
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK 现在是可以访问的
Server: nginx/1.8.0
Date: Wed, 15 Aug 2018 15:49:40 GMT
Content-Type: text/plain
Content-Length: 9
Last-Modified: Wed, 15 Aug 2018 15:36:44 GMT
Connection: keep-alive
ETag: "5b74488c-9"
Accept-Ranges: bytes
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Wed, 24 Jul 2019 10:31:15 GMT
Content-Type: text/plain
Content-Length: 3
Last-Modified: Wed, 24 Jul 2019 10:27:32 GMT
Connection: keep-alive
ETag: "5d383294-3"
Accept-Ranges: bytes
[root@localhost ~]# curl -A "Tomatojlknkljn" -x127.0.0.1:80 test.com/upload/1.php -I -A模仿一个user_agent (不明白)
HTTP/1.1 403 Forbidden
Server: nginx/1.8.0
Date: Tue, 23 Jul 2019 09:44:44 GMT
Content-Type: text/html
Content-Length: 168
Connection: keep-alive
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12.15 Nginx解析php相关配置:
!!!注意:php-fpm配置文件中sock的定义是什么,Nginx的sock就要是什么。不然会502
配置如下:
~1.
location ~ \.php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock; 这个地方需要注意!!在cat /usr/local/php-fpm/etc/php-fpm.conf里定义的“listen = /tmp/php-fcgi.sock”的路径写的是什么,在现在的这个地址里就要写什么,不然会502。也就是说,php-fpm定义的sock地址是什么,nginx的sock就要是什么,不然就会提示502
!还有一种可能会报502.是我们之前在定义php-fpm的时候sock的下面一行是不是定义了listen.mode=666权限
!除了以上两种,php-fpm的资源耗尽也会502。比如有个mysql查询的很慢,卡死了,就要去优化了
(~2的实例是为了证明php-fpm与Nginx的sock一致,此处与上面是整体的配置)
如果在php-fpm里的listen的sock是IP,那么这里就要写成 fastcgi_pass 192.168.30.134:9000
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
注意:这里的路径/data/wwwroot/test.com要和上面的root路径对应起来
}
~3.
fastcgi_pass 用来指定php-fpm监听的地址或者socket
实例:
~1.
[root@localhost ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock 首先查看sock的路径
#listen = 127.0.0.1:9000
listen.mode = 666
user = php-fpm
group = php-fpm
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
#listen = 127.0.0.1:9000
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
location ~ \.php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock; 跟上面的sock路径要是一样的
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# {
# expires 7d;
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*\.(js|css)$
{
location /admin/
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*\.php$
{
deny all;
}
location ~ .*\.(js|css)$
{
expires 12h;
location /admin/
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
location ~ .*(upload|image)/.*\.php$
{
deny all;
server
listen 80;
index index.html index.htm index.php;
rewrite ^/(.*)$ http://test.com/$1 permanent;
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
# {
# access_log off;
# }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
expires 7d;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
location /admin/
allow 192.168.30.134;
allow 127.0.0.1;
deny all;
location ~ .*(upload|image)/.*\.php$
{
deny all;
}
location ~ .*\.(js|css)$
{
expires 12h;
access_log off;
}
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
location ~ \.php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
access_log /tmp/test.com.log;
}
[root@localhost ~]# vim /data/wwwroot/test.com/1.php 先不reload,我们先vim一个php,做测试
[root@localhost ~]# curl -x192.168.30.134:80 test.com/1.php 发现并没有解析phpinfo()
<?php
phpinfo();
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t 这时候我们在-t / -s reload
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -x192.168.30.134:80 test.com/1.php 再curl发现可以解析了
test php scripts.
~2.
[root@localhost ~]# vim /usr/local/php-fpm/etc/php-fpm.conf 我们先更改php-fpm的sock监听为IP
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
#listen = /tmp/php-fcgi.sock 将之前的sock注释掉
listen = 127.0.0.1:9000 改为IP端口一般就为9000
[root@localhost ~]# /etc/init.d/php-fpm reload 把php-fpm重新加载(也支持reload)
[root@localhost ~]# /usr/local/php-fpm/sbin/php-fpm -t
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t 把Nginx也重新加载
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# curl -x192.168.159.128:80 test.com/1.php 再来测试.php,就不能解析了
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.8.0</center>
</body>
</html>
[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
location ~ \.php$
{
include fastcgi_params;
#fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_pass 127.0.0.1:9000; 记得加分号,阿鑫在做的时候忘加,-t的时候导致报错
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
[root@localhost ~]# /etc/init.d/php-fpm -t php-fpm测试和加载
Usage: /etc/init.d/php-fpm {start|stop|force-quit|restart|reload|status}
[root@localhost ~]# /etc/init.d/php-fpm reload
Reload service php-fpm done
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t Nginx测试和加载
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost ~]# !curl php-fpm和Nginx全部修改之后,测试成功。解析成功
curl -x192.168.159.128:80 test.com/1.php
test php scripts.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12.16 Nginx代理:
比如,像访问一个服务器但是这个服务器只有一个私网,这是不可能访问到的。如果想访问有一个办法,有一个中间者,这个中间者有一个特性,和web服务器能互通也能和用户互通。那么就能作为Web服务器和用户之间的一个代理者。那么这个就是代理服务器,如下图:
应用在用户与Web服务器不能互通,或者互通太慢(比如访问美国的网站)的场景
~1. cd /usr/local/nginx/conf/vhost 需要配置一个新的虚拟主机配置文件
~2.vim proxy.conf //加入如下内容 名字叫做 proxy.conf
server
{
listen 80;
server_name ask.apelearn.com; 定义域名
没有root,因为是代理的,所以不需要
location /
{
proxy_pass http://61.153.96.141/; 真正的web服务器IP(也就是远程服务端,Web服务器的IP)
proxy_set_header Host $host; 要访问的域名是上面定义的server_name。也就是这里的$host是上面的server_name
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
dig ask.apelearn.com
; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.1 <<>> ask.apelearn.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54835
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ask.apelearn.com. IN A
;; ANSWER SECTION:
ask.apelearn.com. 600 IN A 61.153.96.141
;; AUTHORITY SECTION:
apelearn.com. 5619 IN NS f1g1ns2.dnspod.net.
apelearn.com. 5619 IN NS f1g1ns1.dnspod.net.
;; Query time: 169 msec
;; SERVER: 202.106.0.20#53(202.106.0.20)
;; WHEN: 四 7月 25 14:50:00 CST 2019
;; MSG SIZE rcvd: 115
server
{
listen 80;
server_name ask.apelearn.com;
location /
{
proxy_pass http://61.153.96.141/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
[root@localhost vhost]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost vhost]# /usr/local/nginx/sbin/nginx -s reload
[root@localhost vhost]# curl -x127.0.0.1:80 ask.apelearn.com -I
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Thu, 25 Jul 2019 06:45:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: ape__Session=b51tdgniem3l580shh0rfsq8o1; path=/; domain=.apelearn.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache