1.1 Nginx安装部署
1.1.1 下载并解压安装包
[root@Rocky8-node1 ~]# wget -c https://nginx.org/download/nginx-1.24.0.tar.gz
[root@Rocky8-node1 ~]# tar xf nginx-1.24.0.tar.gz -C /usr/local/src/
1.1.2 安装依赖
[root@Rocky8-node1 ~]# yum install gcc gcc-c++ make pcre-devel openssl-devel -y
1.1.3 编译前环境配置
[root@Rocky8-node1 ~]# mkdir -p /var/log/nginx #创建配置目录
[root@Rocky8-node1 ~]# cd /usr/local/src/nginx-1.24.0/
[root@Rocky8-node1 nginx-1.24.0]# ./configure --prefix=/usr/local/nginx \
> --sbin-path=/usr/sbin/nginx \
> --http-log-path=/var/log/nginx/access.log \
> --error-log-path=/var/log/nginx/error.log \
> --pid-path=/run/nginx.pid
--prefix=/usr/local/nginx:设置Nginx的安装路径为/usr/local/nginx。
--sbin-path=/usr/sbin/nginx:设置Nginx二进制文件的路径为/usr/sbin/nginx。
--http-log-path=/var/log/nginx/access.log:设置HTTP请求日志文件的路径为/var/log/nginx/access.log。
--error-log-path=/var/log/nginx/error.log:设置错误日志文件的路径为/var/log/nginx/error.log。
--pid-path=/run/nginx.pid:设置Nginx主进程ID文件的路径为/run/nginx.pid。
注意:获取这些内容可以在测试环境使用RPM安装Nginx,通过nginx -V命令获取
1.1.4 编译并安装
[root@Rocky8-node1 nginx-1.24.0]# make && make install
[root@Rocky8-node1 nginx-1.24.0]# nginx -v
nginx version: nginx/1.24.0
1.1.5 配置系统服务脚本
[root@Rocky8-node1 nginx-1.24.0]# vim /usr/lib/systemd/system/nginx.service
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true
[Install]
WantedBy=multi-user.target
[root@Rocky8-node1 nginx-1.24.0]# systemctl daemon-reload #重新加载systemd管理器的配置
1.1.6 启动停止测试
[root@Rocky8-node1 nginx-1.24.0]# systemctl start nginx #正常启动
[root@Rocky8-node1 nginx-1.24.0]# systemctl is-active nginx.service
active
[root@Rocky8-node1 nginx-1.24.0]# ps -ef | grep nginx
root 10947 1 0 16:25 ? 00:00:00 nginx: master process /usr/sbin/nginx
nobody 10948 10947 0 16:25 ? 00:00:00 nginx: worker process
root 10950 1613 0 16:25 pts/0 00:00:00 grep --color=auto nginx
[root@Rocky8-node1 nginx-1.24.0]# systemctl stop nginx.service
[root@Rocky8-node1 nginx-1.24.0]# systemctl is-active nginx.service
inactive
[root@Rocky8-node1 nginx-1.24.0]# ps -ef | grep nginx
root 10977 1613 0 16:25 pts/0 00:00:00 grep --color=auto nginx
2.2 虚拟主机实战
2.2.1 搭建web服务器要求如下
web服务器的主机ip:192.168.110.31
web服务器的默认访问目录为/var/www/html默认发布内容为defaults page
站点news.timinglee.org默认发布目录为/var/www/virtual/timinglee.org/news默认发布内容为 news.timinglee.org
站点login.timinglee.org在被访问时必须强制走加密协议,其默认发布目录为/var/www/virtual/timinglee.org/login 默认发布内容为login.timinglee.org
2.2.1 创建默认主页
[root@Rocky8-node1 ~]# mkdir -p /var/www/html
[root@Rocky8-node1 ~]# echo 'defaults page' > /var/www/html/index.html
[root@Rocky8-node1 ~]# mkdir -p /var/www/virtual/timinglee.org/news
[root@Rocky8-node1 ~]# echo 'news.timinglee.org' > /var/www/virtual/timinglee.org/news/index.html
[root@Rocky8-node1 ~]# mkdir -p /var/www/virtual/timinglee.org/login
[root@Rocky8-node1 ~]# echo 'login.timinglee.org' > /var/www/virtual/timinglee.org/login/index.html
2.2.2 SSL加密证书配置
2.2.2.1 生成密钥
[root@Rocky8-node1 ~]# openssl genrsa -des3 -out server.key 2048 #密码为1234
Generating RSA private key, 2048 bit long modulus (2 primes)
.............................................................................................+++++
......................................................+++++
e is 65537 (0x010001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
2.2.2.2 生成证书
[root@Rocky8-node1 ~]# openssl req -new -key server.key -out server.crt
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SN
Locality Name (eg, city) [Default City]:XI'AN
Organization Name (eg, company) [Default Company Ltd]:YOOZOO
Organizational Unit Name (eg, section) []:SRE
Common Name (eg, your name or your server's hostname) []:SERVER
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
2.2.2.3 备份原始的私钥文件
[root@Rocky8-node1 ~]# cp server.key server.key.copy
2.2.2.4 读取私钥并
[root@Rocky8-node1 ~]# openssl rsa -in server.key.copy -out server.key
Enter pass phrase for server.key.copy:
writing RSA key
2.2.2.5 生成新的X.509 证书
[root@Rocky8-node1 ~]# echo subjectAltName=IP:192.168.110.31,DNS:192.168.110.31 > cert_extensions
[root@Rocky8-node1 ~]# openssl x509 -req -sha256 -days 3650 -in server.crt -signkey server.key -extfile cert_extensions -out server.crt
Signature ok
subject=C = CN, ST = SN, L = XI'AN, O = IT, OU = SERVER, CN = ROCKY
Getting Private key
[root@Rocky8-node1 ~]# cp server.crt server.key /etc/nginx #证书和密钥要在/etc/nginx下
2.2.2.6 虚拟主机配置
[root@Rocky8-node1 ~]# vim /etc/nginx/conf.d/VirtualHost.conf
server {
listen 192.168.110.31:80;
server_name login.timinglee.org;
return 301 https://$host$request_uri;
#配置访问login.timinglee.org自动重定向到https
}
server {
listen 192.168.110.31:80;
server_name defaults.timinglee.page;
location / {
root /var/www/html;
index index.html;
}
}
server {
listen 192.168.110.31:80;
server_name news.timinglee.org;
location / {
root /var/www/virtual/timinglee.org/news;
index index.html;
}
}
server {
listen 192.168.110.31:443 ssl;
server_name login.timinglee.org;
ssl_certificate server.crt;
ssl_certificate_key server.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
root /var/www/virtual/timinglee.org/login;
index index.html;
}
}
[root@Rocky8-node1 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@Rocky8-node1 ~]# nginx -s reload
2.3 访问测试
2.3.1 客户端访问
[root@Rocky8-node2 ~]# echo '192.168.110.31 defaults.timinglee.page news.timinglee.org login.timinglee.org' >> /etc/hosts #添加hosts解析
[root@Rocky8-node2 ~]# curl http://defaults.timinglee.page
defaults page
[root@Rocky8-node2 ~]# curl http://news.timinglee.org
news.timinglee.org
[root@Rocky8-node2 ~]# curl http://login.timinglee.org #自动重定向到了https
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.14.1</center>
</body>
</html>
[root@Rocky8-node2 ~]# curl -k https://login.timinglee.org
login.timinglee.org
2.3.2 Windows访问
hosts: C:\Windows\System32\drivers\etc\hosts