MeterSphere使用Nginx截断敏感URL

      针对MeterSphere中某些URL用户不希望保留或者对外提供给其他用户，比如API对接信息或者swagger文档，可以通过NGINX的方式对某些敏感URL进行阻断，使用户访问不了或者安全扫描通过；

获取API Keys的URL

 

方法一：启动nginx容器

1、在服务器起一个nginx容器配置如下：创建nginx目录并创建两个nginx容器使用文件

mkdir /data/nginx/
cd /data/nginx/
vi default.conf

2、文件内容如下：

server {
      listen 80;
      proxy_set_header Host               $host;
      proxy_set_header X-Real-IP          $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto  $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_http_version 1.1;
      proxy_read_timeout 180;
      location / {
          if ($request_uri ~* "/user/key") {
           return 404 "功能暂未开放";
          }
          proxy_pass http://10.1.240.130:8081;#本地服务器IP
          client_max_body_size 10000m;
          access_log off;
      }
  }

nginx.conf 文件内容：   

user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    #tcp_nopush     on;
    keepalive_timeout  65;
    #gzip  on;
    include /etc/nginx/conf.d/*.conf;
}

3、在服务器起一个nginx容器

docker run --name nginx -p 80:80 -v /data/nginx/nginx.conf:/etc/nginx/nginx.conf -v /data/nginx/default.conf:/etc/nginx/conf.d/default.conf --privileged=true -d nginx

访问API Keys

方法二：yum安装nginx服务

1、配置nginx用到的yum源

 vi /etc/yum/repos.d/nginx.repo

 

[nginx-stable]

name=nginx stable repo

baseurl=http://nginx.org/packages/centos/$releasever/$basearch/

gpgkey=https://nginx.org/keys/nginx_signing.key

gpgcheck=1

enabled=1

2. 安装nginx服务
 

yum -y insyall nginx

3. 在nginx.conf配置文件中添加以下内容：

  server {
      listen 80;
      proxy_set_header Host               $host;
      proxy_set_header X-Real-IP          $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto  $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_http_version 1.1;
      proxy_read_timeout 180;
      location / {
            
          if ( $request_uri ~* "/user/key/" ) {
              return  400 "此功能暂未开放";
          }
     
          proxy_pass http://10.1.12.146:8081;#该IP为本地服务器IP
          client_max_body_size 10000m;
          access_log off;
      }
}}

4.重启nginx服务

 systemctl restart nginx

5.访问API Keys