VPS部署网站前准备工作

buffcow

已于 2024-08-06 10:58:27 修改

阅读量445

点赞数 5

分类专栏： VPS 相关文章标签： css 前端 linux centos

于 2024-06-02 23:43:41 首次发布

本文链接：https://blog.csdn.net/qq_41923691/article/details/139397335

版权

VPS 相关专栏收录该内容

2 篇文章 0 订阅

订阅专栏

文章目录

前言
一、配置防火墙
二、禁止 IP 直接访问
- 1. 添加自签证书
- 2. Nginx 默认配置
三、 PhpMyAdmin

前言

基于宝塔面板

一、配置防火墙

1. Nginx免费防火墙

全局配置

403 页面：

<!doctype html>
<html>
    <head>
        <meta charset="utf-8">
        <title>403 Forbidden</title>
        <style>
            @import url("https://fonts.googleapis.com/css?family=Press+Start+2P");html, body {width: 100%;height: 100%;margin: 0;}* {font-family: 'Press Start 2P', cursive;box-sizing: border-box;}#app {padding: 1rem;background: black;display: flex;height: 100%;justify-content: center;align-items: center;color: #54FE55;text-shadow: 0px 0px 10px;font-size: 6rem;flex-direction: column;}#app .txt {font-size: 1.8rem;}@keyframes blink {0% {opacity: 0;}49% {opacity: 0;}50% {opacity: 1;}100% {opacity: 1;}}.blink {animation-name: blink;animation-duration: 1s;animation-iteration-count: infinite;}
        </style>
    </head>
    <body>
        <div id="app">
            <div>403</div>
            <div class="txt">
                Forbidden<span class="blink">_</span>
            </div>
        </div>
    </body>
</html>

404 页面：

<!doctype html>
<html>
    <head>
        <meta charset="utf-8">
        <title>404 Not Found</title>
        <style>
            body{display:flex;flex-flow:row wrap;align-content:center;justify-content:center}
            div{width:100%;text-align:center}
            .number{background:#fff;position:relative;font:900 30vmin "Consolas";letter-spacing:5vmin;text-shadow:2px -1px 0 #000,4px -2px 0 #0a0a0a,6px -3px 0 #0f0f0f,8px -4px 0 #141414,10px -5px 0 #1a1a1a,12px -6px 0 #1f1f1f,14px -7px 0 #242424,16px -8px 0 #292929}
            .number::before{background-color:#673ab7;background-image:radial-gradient(closest-side at 50% 50%,#ffc107 100%,rgba(0,0,0,0)),radial-gradient(closest-side at 50% 50%,#e91e63 100%,rgba(0,0,0,0));background-repeat:repeat-x;background-size:40vmin 40vmin;background-position:-100vmin 20vmin,100vmin -25vmin;width:100%;height:100%;mix-blend-mode:screen;-webkit-animation:moving 10s linear infinite both;animation:moving 10s linear infinite both;display:block;position:absolute;content:""}
            @-webkit-keyframes moving{to{background-position:100vmin 20vmin,-100vmin -25vmin}
            }@keyframes moving{to{background-position:100vmin 20vmin,-100vmin -25vmin}
            }.text{font:400 5vmin "Courgette"}
            .text span{font-size:10vmin}
        </style>
    </head>
    <body>
        <div id="app">
            <div class="number">404</div>
            <div class="text">
                <span>Ooops...</span>
                <br>page not found
            </div>
        </div>
    </body>
</html>

规则覆盖：
1.下载规则包，备份原规则 /www/server/free_waf/rule 到 /www/server/free_waf/rule.bak
2.将下载的规则包解压到 /www/server/free_waf/rule
拦截 Censys
1.将 Censys IP 添加到黑名单，或直接导入：
2.User-Agent 拦截添加 (censys|Censys)

附 Censys 的 IP 导入数据

206.168.34.0-206.168.34.255
199.45.155.0-199.45.155.255
199.45.154.0-199.45.154.255
167.248.133.0-167.248.133.255
167.94.146.0-167.94.146.255
167.94.145.0-167.94.145.255
167.94.138.0-167.94.138.255
162.142.125.0-162.142.125.255

站点配置

网站启用了 CDN 记得把 CDN 勾选
附启用 CDN 后获取真实 IP 的 nginx 配置：

server {
  ...
  #获取cdn真实ip
  set_real_ip_from 0.0.0.0/0;
  real_ip_header X-Forwarded-For;
  ...
}

2. 宝塔防火墙

将 Censys IP 添加到黑名单

二、禁止 IP 直接访问

1. 添加自签证书

添加一张自签证书，不能颁发给自己的域名

mkdir -p /www/server/panel/vhost/cert/default
vi /www/server/panel/vhost/cert/default/ban.pem

vi /www/server/panel/vhost/cert/default/ban.key

2. Nginx 默认配置

添加以下内容：

server
{
    listen 80;
    listen 443 ssl ;
    listen 443 quic;
    listen [::]:443 ssl;
    listen [::]:443 quic;
    listen [::]:80;
    server_name _;

    return 444;

    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
    #error_page 404/404.html;
    ssl_certificate    /www/server/panel/vhost/cert/default/ban.pem;
    ssl_certificate_key    /www/server/panel/vhost/cert/default/ban.key;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    add_header Strict-Transport-Security "max-age=31536000";
    add_header Alt-Svc 'quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"';
    error_page 497  https://$host$request_uri;
}

宝塔在添加任意站点后会自动生成一个 0.default.conf
位于 /www/server/panel/vhost/nginx/0.default.conf
可能会和上面的默认 nginx 配置冲突，解决方案有两种：

将 0.default.conf 文件内容全部注释
将 0.default.conf 里的内容替换成上面的配置，但要确保默认配置里包含
include /www/server/panel/vhost/nginx/*.conf;

重启 nginx