HA高可用与负载均衡入门到实战（四）---- 配置nginx防盗链和HTTPS

最新推荐文章于 2022-05-21 15:16:16 发布

普通Gopher

最新推荐文章于 2022-05-21 15:16:16 发布

阅读量1w

点赞数

分类专栏：高可用负载均衡文章标签： nginx https

本文链接：https://blog.csdn.net/qq_43442524/article/details/105409137

版权

高可用负载均衡专栏收录该内容

13 篇文章 1 订阅

订阅专栏

环境要求

vmware虚拟机双核2G内存以上
安装有CentOS7和docker

配置nginx图片防盗链

配置盗链网站

启动nginx容器，设置端口映射，并进入容器
docker run -d --privileged -p 80:80 -p 443:443 nginx /usr/sbin/init
在nginx容器中准备两个网站，配置文件

server {
   listen 80;
   server_name  site1.test.com;
   root  /var/www/html/site1;
   index  index.html;
}
server {
   listen 80;
   server_name  site2.test.com;
   root  /var/www/html/site2;
   index  index.html;
}

在主机编辑hosts文件

   虚拟机的IP地址    site1.test.com
   虚拟机的IP地址    site2.test.com

创建/var/www/html/site1/index.html，展示自己的图片

<h1>welcome to site1</h1>
<img src=”1.jpg”>

从网上随便下载一张图片作为1.jpg
wget https://www.heuet.edu.cn/images/18/03/07/2tf9v0vlbb/20150415094513422.jpg
5) 创建/var/www/html/site2/index.html，盗用site1的图片

<h1>welcome to site2</h1>
<img src=”http://site1.test.com/1.jpg”>

[root@5ef46ce6b610 /]# mkdir -p /var/www/html/site1
[root@5ef46ce6b610 /]# mkdir -p /var/www/html/site2
[root@5ef46ce6b610 /]# vim /var/www/html/site1/index.html
[root@5ef46ce6b610 /]# vim /var/www/html/site2/index.html
[root@5ef46ce6b610 /]# cat /var/www/html/site1/index.html
<h1>welcome to site1</h1>
<img src="1.jpg">
[root@5ef46ce6b610 /]# cat /var/www/html/site2/index.html
<h1>welcome to site2</h1>
<img src="http://site1.test.com/1.jpg">
[root@5ef46ce6b610 /]#

重启nginx服务
systemctl restart nginx
6) 在主机浏览器访问site1.test.com
在这里插入图片描述
7) 在主机浏览器访问site2.test.com

配置site1.test.com防盗链

在nginx容器中编辑/etc/nginx/nginx.conf文件，配置防盗链
配置两台虚拟主机

    server {
    listen       80; 
    server_name  site1.test.com;
        
    location / { 
    root   /var/www/html/site1;
    index  index.html index.htm;
    }   
    
    location ~  \.(jpg|png|gif)$ {
    valid_referers  site1.test.com;
    if ($invalid_referer) {
    return 403; 
    }           
    }   
    }       

    server {                                                         
    listen       80;                                                     
    server_name  site2.test.com;                                             
    location / {                                                                 
    root   /var/www/html/site2;                                                          
    index  index.html index.htm;                                                                 
    }
  }

说明：
判断referer的值，来判断当前图片的引用是否合法，一旦检测到来源不是本站，就立即阻止图片的发送，或换成一张禁止防盗链提示的图片

location ~  \.(jpg|png|gif)$ {
    valid_referers  site1.test.com;
    if ($invalid_referer) {
    return 403; 
    }           
    }

第1行配置，用于匹配文件扩展名为gif、jpg、png、swf、flv的资源
第2行中的valid_referers指令用于设置允许访问资源的网站列表（即白名单）。当请求消息头中的referer符合白名单时，内置变量$invalid_referer的值为空字符串，否则为1
第3~5行的配置，可以禁止白名单之外的网站访问资源，并返回403状态码

在主机使用浏览器访问site1.test.com
在主机使用浏览器访问site2.test.com

如果测试仍然显示图片，是因为浏览器还有上次访问的缓存
建议更换浏览器，或者清理缓存
在这里插入图片描述

配置nginx的HTTPS网站

颁发网站认证证书

在nginx容器中检查系统安装了openssl

[root@5ef46ce6b610 site1]# rpm -qa | grep ssl
openssl-libs-1.1.1c-2.el8.x86_64
openssl-1.1.1c-2.el8.x86_64
[root@5ef46ce6b610 site1]#

建立/etc/nginx/ssl目录，并生成服务器RSA私钥
openssl genrsa -out server.key 2048

[root@5ef46ce6b610 site1]# mkdir /etc/nginx/ssl
[root@5ef46ce6b610 site1]# cd /etc/nginx/ssl/
[root@5ef46ce6b610 ssl]# 
[root@5ef46ce6b610 ssl]# ls
[root@5ef46ce6b610 ssl]# openssl genrsa  -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............+++++
.....................................................................................................................................................................................+++++
e is 65537 (0x010001)
[root@5ef46ce6b610 ssl]# ls
server.key
[root@5ef46ce6b610 ssl]# cat server.key 
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAmfzZmG91slq8a5CNaNF28QFSyBxh4AO6ztTCzKpPXoxCNANm
8BnmWLd3EIwBZCYWh6JUrfc8HxTATbWyHw0KqE6rEDlui15bg9crtu1xrD8XIbpg
/uzfDDemg9evxdXqQ4PjcbojxRkkuKF8OSyaG38Z8K0Fd9ZXbbX4Hy0rGhDrPIby
WcZBfOH4V6MpPEM703p7yfGOd/TAxz9j9TgTj8hzsTL1qGHz/g8x75Ok+Sukmln6
c3m9Vq2W5EiN0oo/uFJGvs3QmiF7wbWAdFFOTnjJ7C6XYFmzizI6oNCShegQMgoK
Z2G4fTnidnNKD9gKn8Qz3HWTf7Y6VMflqY3Y2QIDAQABAoIBAEo6wQnicPIRG1Me
04v7rUJwSN9+DxBVu++IUH8oeioxophAK5cCZS/PAO5RDzqfwayQbBGQZML21dyg
AcVGHCUWBxBDHy6/xY3AY6pCu9E0eIohtjAtLzhMe1CC4JCVleAF69YezK9ud20p
KyDEh2VJ189VGJW0FWElnv4oX+aoEcirH+nTgxtYLh1AOE5Ts9MExSokl+g4u8CY
3k/qNXz+0RfqUAoUgue8BPAo3xqY1EXiL0kAkch73ipAW++Nd8y53M7Pcjxh+xSl
BSBBr1xE4dEQyZiYwMUxwdYVwChTr28T2hFIbc2SO1J5h0KsG5+HxiPJgPjNAsMC
gjL5PIECgYEAymcXhZOfOXHTl8CANGM981Pp/i1QtjDpTehCOFidlucL2WKSfx9O
kwClI0oR5DnAt9nieQrjRIVNpAhsqc8DaFEDCqDj6snUEu4lTMHmUNhiEeYgl01X
UYP+xUf68b4VSWqZL9Lnf50Mo9ztTEcRaJPITYBKUV0IoXpgfpSwVP0CgYEAwsOy
pTKk8wx0qWlRU8P7/t2fdtBYe1eR/xR/i50Nkzmna4M9BP0UDTMZcKFgLcIC4yr9
Q/3zBYw5UrAMVK7aFX1WSdrIohqPNnejcOpO28SfxxR9amDpaeOGo4E5ijyLeB9B
EUCBv9xaCE0/gsY4atmWE4PpGMHoj3QABuY6KA0CgYEAwLYdiDpBDRHatA8+QiMH
til8jl0ZDw9M47ezbTC6gxZjisw2zcDCMGcZ1JrOpC1019glsLf0IaaGgRrgU2He
TbFsou8DcuZN/OQwMYAgyXLtFTu2ZjjmXZ++sJnTTd59KBTN2+IENtYSVeahLdIw
uhCTU29F02gwModxXrQ1nAUCgYBHSDyv/ZMlaV+hSWx8jfRC2XYtlB9uNSS4CRaN
UJPRWH6P+N5yXvXhxtv+vvFmjeVkoy1Cn0U8uI+aVdiNfdlPmCnmqe5YdgQIWU02
XGs0QAiCYltsfb+wA5gZa4hVsccR1c6Is+VJBSrmcu9Vu5qWcMBesB618vJc3oXM
AKM0WQKBgHqQX7HKA3g2UarzwBLpPugQobmU8ku4cvUF2n1ZkL6mq4BuXwKf3UPT
wjVkFLFG+OcI+NmPB1NzU0szXYExBVSIYHHizQ8sX1ILUYOzLzJVGtWL221kiPhk
ldheBAdeoRY7yfo0OcaHxPFmgQJPqqgISTFSlTRy+r1AFsqPr1D0
-----END RSA PRIVATE KEY-----

生成服务器CSR证书请求文件，注意站点名称要一致

openssl req -new -key server.key -out server.csr

[root@5ef46ce6b610 ssl]# openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Hebei
Locality Name (eg, city) [Default City]:Shijiazhuang     
Organization Name (eg, company) [Default Company Ltd]:It
Organizational Unit Name (eg, section) []:www.test.com
Common Name (eg, your name or your server's hostname) []:test@qq.com
Email Address []:test@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@5ef46ce6b610 ssl]# ls
server.csr  server.key
[root@5ef46ce6b610 ssl]# cat server.csr 
-----BEGIN CERTIFICATE REQUEST-----
MIIC0DCCAbgCAQAwgYoxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVIZWJlaTEVMBMG
A1UEBwwMU2hpamlhemh1YW5nMQswCQYDVQQKDAJJdDEVMBMGA1UECwwMd3d3LnRl
c3QuY29tMRQwEgYDVQQDDAt0ZXN0QHFxLmNvbTEaMBgGCSqGSIb3DQEJARYLdGVz
dEBxcS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ/NmYb3Wy
WrxrkI1o0XbxAVLIHGHgA7rO1MLMqk9ejEI0A2bwGeZYt3cQjAFkJhaHolSt9zwf
FMBNtbIfDQqoTqsQOW6LXluD1yu27XGsPxchumD+7N8MN6aD16/F1epDg+NxuiPF
GSS4oXw5LJobfxnwrQV31ldttfgfLSsaEOs8hvJZxkF84fhXoyk8QzvTenvJ8Y53
9MDHP2P1OBOPyHOxMvWoYfP+DzHvk6T5K6SaWfpzeb1WrZbkSI3Sij+4Uka+zdCa
IXvBtYB0UU5OeMnsLpdgWbOLMjqg0JKF6BAyCgpnYbh9OeJ2c0oP2AqfxDPcdZN/
tjpUx+WpjdjZAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAGTlfc6+S5ptsyJ47
lN8+neD6+9wX+5zomp3TUHbikSAdUvwNHnZJb2M3Mrg5q+Lde9MLj0W3rlVNx8Sr
4OMVvO/f/C/cUp0r6Qn2RRUtP9HRCthuQTP+61cXr8WUpOjcbnr6VE2tJ285KdU2
uR9ODTwfl5iP6hwyBlXLkDohhDuGAYlEL93yt3OzCTddeVFqklhD5cAlWX3s+pqm
Xzv70KUy68rCL1YDjgXX6u6QZ+63z+pmQoXv/Bk6JYUAqalKeeQH/VtHGwaJ6UuP
QF40i8ffeFuk8ZmgCB1jm57MPR1oyorgI72063wE6cvrf0OLFSCJfufyab5mvzV/
bNjXbQ==
-----END CERTIFICATE REQUEST-----

生成服务器认证证书
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

[root@5ef46ce6b610 ssl]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=C = CN, ST = Hebei, L = Shijiazhuang, O = It, OU = www.test.com, CN = test@qq.com, emailAddress = test@qq.com
Getting Private key
[root@5ef46ce6b610 ssl]# ls
server.crt  server.csr	server.key
[root@5ef46ce6b610 ssl]# cat server.crt 
-----BEGIN CERTIFICATE-----
MIIDnTCCAoUCFDma9qKjZRh7KOsFlB/xS+FVG7xJMA0GCSqGSIb3DQEBCwUAMIGK
MQswCQYDVQQGEwJDTjEOMAwGA1UECAwFSGViZWkxFTATBgNVBAcMDFNoaWppYXpo
dWFuZzELMAkGA1UECgwCSXQxFTATBgNVBAsMDHd3dy50ZXN0LmNvbTEUMBIGA1UE
AwwLdGVzdEBxcS5jb20xGjAYBgkqhkiG9w0BCQEWC3Rlc3RAcXEuY29tMB4XDTIw
MDQwOTA3MTcxNloXDTIxMDQwOTA3MTcxNlowgYoxCzAJBgNVBAYTAkNOMQ4wDAYD
VQQIDAVIZWJlaTEVMBMGA1UEBwwMU2hpamlhemh1YW5nMQswCQYDVQQKDAJJdDEV
MBMGA1UECwwMd3d3LnRlc3QuY29tMRQwEgYDVQQDDAt0ZXN0QHFxLmNvbTEaMBgG
CSqGSIb3DQEJARYLdGVzdEBxcS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCZ/NmYb3WyWrxrkI1o0XbxAVLIHGHgA7rO1MLMqk9ejEI0A2bwGeZY
t3cQjAFkJhaHolSt9zwfFMBNtbIfDQqoTqsQOW6LXluD1yu27XGsPxchumD+7N8M
N6aD16/F1epDg+NxuiPFGSS4oXw5LJobfxnwrQV31ldttfgfLSsaEOs8hvJZxkF8
4fhXoyk8QzvTenvJ8Y539MDHP2P1OBOPyHOxMvWoYfP+DzHvk6T5K6SaWfpzeb1W
rZbkSI3Sij+4Uka+zdCaIXvBtYB0UU5OeMnsLpdgWbOLMjqg0JKF6BAyCgpnYbh9
OeJ2c0oP2AqfxDPcdZN/tjpUx+WpjdjZAgMBAAEwDQYJKoZIhvcNAQELBQADggEB
AFrdSAQ4MM6sHUZWKJ2YzcXUjt/kG+h23itQ0uF4OqW05U0pSFCf6iG/SVtC9TIh
z76uih7Nk2NwJ5IPfyYJfM+CXLf2vxv8y9QuA8D9dWQqMcliOl1XI3E36mK9mMfj
+x7TCaNbq02AvlYVyp9Ex7SwI8zfn54i34uM9+OhJGWWeGDKDzNtjQSQzlM0NAuP
i/WzDgNbl+ve27WHI9pXWAytLoEoh7NND5fKBLoqqK3Urky1vaL1YPv+MSIQ56Nr
uLQ8Yxqz3TH0y/wNJVE3BSZvayTeP5bvLWVU8jHLWZSRQelx++UpNFEtD/nALJAJ
e1BLIz/apbR6z4cmpvZoGLQ=
-----END CERTIFICATE-----

配置HTTPS网站

在主机编辑hosts文件，并使用ping命令检查
虚拟机的IP地址 www.test.com
编辑/etc/nginx/nginx.conf文件，配置HTTPS站点

server {
   listen 443;
   server_name  www.test.com;
   root /var/www/html;
   ssl on;
   ssl_certificate /etc/nginx/ssl/server.crt;
   ssl_certificate_key /etc/nginx/ssl/server.key;
   location / {
   index index.html;
   }
}

编辑 /var/www/html/index.html，重载nginx

   <h1>this is https site!!</h1>

systemctl restart nginx

重载nginx，在主机使用浏览器访问 https://www.test.com
在浏览器中查看网站证书，

普通Gopher

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
HA高可用与负载均衡入门到实战（四）---- 配置nginx防盗链和HTTPS

环境要求vmware虚拟机双核2G内存以上安装有CentOS7和docker配置nginx图片防盗链配置盗链网站启动nginx容器，设置端口映射，并进入容器docker run -d --privileged -p 80:80 -p 443:443 nginx /usr/sbin/init在nginx容器中准备两个网站，配置文件server { listen 80...
复制链接

扫一扫