nginx访问控制、用户认证、https

时迁10

于 2024-08-28 14:58:48 发布

阅读量166

点赞数 4

文章标签： nginx https 数据库

本文链接：https://blog.csdn.net/q911326/article/details/141607175

版权

环境

rockylinux9虚拟机，时钟同步已完成，基本工具，命令已安装
192.168.100.111 nginx服务器
192.168.100.112 客户端访问
192.168.100.114 客户端访问

nginx已经配置完成做了平滑升级

一、nginx访问控制

默认允许所有主机访问

stub_status模块

stub_status模块主要作用于查看nginx的一些状态信息

[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /status {
                echo "shiqian";
                stub_status on;
        }
[root@nginx ~]# nginx -s reload

//112访问
[root@php ~]# curl http://192.168.100.111/status
Active connections: 1 
server accepts handled requests
 13 13 13 
Reading: 0 Writing: 1 Waiting: 0 


//114访问
[root@node4 ~]# curl http://192.168.100.111/status
Active connections: 1 
server accepts handled requests
 14 14 14 
Reading: 0 Writing: 1 Waiting: 0

Active connections： 当前nginx正在处理的活动连接数

Server accepts handled requests： nginx总共处理了14个连接，成功创建14次握手，总共处理了14个请求

Reading： nginx读取到客户端的Header信息数

Writing： nginx返回给客户端的Header信息数

Waiting： 开启keep-alive的情况下，这个值等于active-（reading+writing），意思就是nginx已经处理完成，正在等候下一次请求指令的驻留连接。所以，在访问效率高、请求很快就被处理完毕的情况下，waiting数比较多是正常的。如果reading+writing数较多，则说明并发访问量非常大，正在处理过程中。

用于location段

Allow：设定允许哪台或哪些主机访问，多个参数间用空格隔开
Deny：设定禁止那台或哪些主机访问，多个参数间用空格隔开

1、拒绝某台主机访问

[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
         location /status {
                echo "chenyu";
                deny 192.168.100.112;
[root@nginx ~]# nginx -s reload


//验证
//112主机访问
[root@php ~]# curl http://192.168.100.111/status
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>


//114主机访问
[root@node4 ~]# curl http://192.168.100.111/status
shiqian

2、当allow和deny同时存在时

仅允许112主机进行访问

[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
   server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /status {
                echo "shiqian";
                allow 192.168.100.112;
                deny all;
        }

[root@nginx ~]# nginx -s reload

//112进行访问
[root@php ~]# curl http://192.168.100.111/status
shiqian

//114进行访问
[root@node4 ~]# curl http://192.168.100.111/status
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>

拒绝所有主机访问

        location /status {
                echo "shiqian";
                deny all;
                allow 192.168.100.112;

1、只允许指定得ip访问，禁止其他ip访问

        location /status {
                echo "shiqian";
                deny all;
                allow 192.168.100.111;
                allow 192.168.100.112;
                deny all;

2、只禁止指定的ip访问，允许其他ip访问

        location /status {
                echo "shiqian";
                deny 192.168.100.111;
  				deny 192.168.100.112;
  				allow all;

二、用户认证

1、创建授权用户

[root@nginx ~]#  yum -y install httpd-tools

//创建一个nginx的网站验证用户
[root@nginx ~]# htpasswd -c -m /path/to/.user_auth_file shiqian
htpasswd: cannot create file /path/to/.user_auth_file
[root@nginx ~]# htpasswd -c -m /usr/local/nginx/conf/.user_auth_file shiqian
New password: 
Re-type new password: 
Adding password for user shiqian

[root@nginx ~]# cat /usr/local/nginx/conf/.user_auth_file 
shiqian:$apr1$Cdq4vJW9$wn3zSLjS6euETPiSDEQrk/

2、修改nginx配置文件

[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
 server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /status {
                stub_status on;
                auth_basic "welcome to hyedu";
                auth_basic_user_file "/usr/local/nginx/conf/.user_auth_file";

        }


[root@nginx ~]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@nginx ~]# nginx -s reload

验证
在这里插入图片描述

三、https配置

Nginx：192.168.100.111
CA：192.168.100.114

1、基本配置

[root@ca ~]# mount /dev/cdrom /mnt/
mount: /mnt: WARNING: source write-protected, mounted read-only.
[root@ca ~]# yum -y install chrony

[root@ca ~]# systemctl restart chronyd ;systemctl enable chronyd ;hwclock -w

2、在CA服务器中生成一对密钥

[root@ca ~]# mkdir -p /etc/pki/CA/private
[root@ca ~]# cd /etc/pki/CA/
[root@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@ca CA]# ll private/cakey.pem 
-rw------- 1 root root 1704 Aug 28 14:18 private/cakey.pem

//可以查看其中内容
[root@ca CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt1Han/HagVkNbXeTC7LY
4Bb4hQn+u+zi/hcWoBGziSp4J33MlN80/ykdZxo+cUO3whrzXBzV8o4yDe0zjEfI
C6F0USKzhsIpl749nXl+OH6+WS+hay+eZ05RXgITanSb01FAV+GFUL0jZIfTt8Iz
e8GxbuJ5G0PQTaU/5X8z0x5zi1Dva4cjZSaziu2ocrEbtpk1PO8Yt+j4pwnx5LX3
Y2s2ExJSaiQGQzTAfmIRc+H6fhxVtedfoN+wGischt/r3vHR6g/xNGk8WRCrLNbc
XP9COn+Gafh7ZHW+x+9r3y8ajuiJ6ggI+lVmaLhMm4Vnu00htfUD70RlEIcQcWuV
DwIDAQAB
-----END PUBLIC KEY-----


[root@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 1024
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:huayu
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:shiqian
Email Address []:sq@example.com

3、在nginix中生成证书签署请求，发送给CA

[root@nginx conf]# openssl req -new -key httpd.key -days 1024 -out httpd.csr
Ignoring -days without -x509; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:huayu
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:shiqian
Email Address []:sq@example.com
//这里输入的内容要和在CA中输入的一样

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
//这里直接回车跳过就行

4、将证书传输给CA

[root@nginx conf]# ls
fastcgi.conf          fastcgi_params.default  koi-utf     mime.types.default  scgi_params          uwsgi_params.default
fastcgi.conf.default  httpd.csr               koi-win     nginx.conf          scgi_params.default  win-utf
fastcgi_params        httpd.key               mime.types  nginx.conf.default  uwsgi_params

[root@nginx conf]# scp httpd.csr root@192.168.100.114:/root/

5、CA签署证书并发送给NGINX

[root@ca CA]# cd
[root@ca ~]# ls
anaconda-ks.cfg  httpd.csr
[root@ca ~]# mkdir /etc/pki/CA/newcerts
[root@ca ~]# touch /etc/pki/CA/index.txt   
[root@ca ~]# echo "01" > /etc/pki/CA/serial
[root@ca ~]# openssl ca -in httpd.csr -out httpd.crt -days 1024
[root@ca ~]# ls
anaconda-ks.cfg  httpd.crt  httpd.csr

6、将CA签署的证书发送给nginx

[root@ca ~]# scp httpd.crt root@192.168.100.111:/usr/local/nginx/conf/
[root@ca ~]# scp /etc/pki/CA/cacert.pem root@192.168.100.111:/usr/local/nginx/conf/

7、nginx配置https

[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
    server {
        listen       443;
        server_name  localhost;
        ssl_certificate httpd.crt;
        ssl_certificate_key httpd.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
                root    html;
                index   index.html index.htm;
        }

[root@nginx ~]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@nginx ~]# nginx -s reload

8、编辑测试网页，重载服务，验证

[root@nginx ~]# cd /usr/local/nginx/html/
[root@nginx html]# echo "shiqian" > index.html
[root@nginx html]# nginx -s reload

时迁10

关注

4
点赞
踩
7

收藏

觉得还不错? 一键收藏
0
评论
nginx访问控制、用户认证、https

rockylinux9虚拟机，时钟同步已完成，基本工具，命令已安装192.168.100.111 nginx服务器192.168.100.112 客户端访问192.168.100.114 客户端访问。
复制链接

扫一扫