网站服务安全访问(HTTPS)

1. 实现双主配置

第一个历程: 编写keepalived服务配置文件

lb01
vrrp_instance oldboy {
    state MASTER
    interface eth0
    virtual_router_id 63
    priority 110
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
       10.0.0.3
    }
}
vrrp_instance oldgirl {
    state BACKUP
    interface eth0
    virtual_router_id 64
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
       10.0.0.4
    }
}

lb02
vrrp_instance oldboy {
    state BACKUP
    interface eth0
    virtual_router_id 63
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.3
    }
}
vrrp_instance oldgirl {
    state MASTER
    interface eth0
    virtual_router_id 64
    priority 110
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.4
    }
}

第二个历程: 修改负载均衡服务配置文件

方式一:
server {
  listen        10.0.0.3:80;
  server_name   www.oldboy.com;
  location / {
     proxy_pass  http://oldboy;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;
  }
}
server {
      listen        10.0.0.4:80;
      server_name   bbs.oldboy.com;
      location / {
         proxy_pass  http://oldboy;
             proxy_set_header Host $host;
             proxy_set_header X-Forwarded-For $remote_addr;
      }
}

方式二:
server {
  listen        10.0.0.3:80;
  listen        10.0.0.4:80;
  server_name   localhost;
  location / {
     proxy_pass  http://oldboy;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;
  }
}

2. 网站安全访问概念介绍 HTTPs(secure)

1. 数据的机密性    对称加密算法  私钥和公钥 保护好算法信息  发送方(私钥/公钥)  --- 接收方(私钥/公钥)  
2. 数据的完整性    对称加密算法  私钥和公钥 保护好特征码
3. 身份认证问题    非对称加密算法           私钥在服务器上保留好  公钥进行分发
   公钥 === 证书(身份证)
   CA证书颁发机构

3. 如何实现HTTPs安全访问网站

第一个历程: 创建私钥和公钥(证书)

cd /etc/nginx/
openssl genrsa -idea -out server.key 2048
genrsa   --- 创建什么类型私钥
idea     --- 需要给私钥文件设置密码
out      --- 创建生成一个私钥文件

openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
req   	--- 创建一个证书文件
days  	--- 证书文件有效期(默认 天)
x509  	--- 证书文件格式
sha256  --- 指定生成证书算法
nodes   --- 去除私钥的密码生成证书
keyout  --- 指定加载私钥文件
out     --- 生成的证书信息

第二个历程: 在nginx程序中,编写配置文件开启HTTPS功能,加载私钥和公钥信息

[root@web02 nginx]# cat /etc/nginx/conf.d/www.conf 
server {
   listen            443 ssl;
   server_name       www.oldboy.com www.jd.com;
   root              /html/www;
   index             index.html;
   ssl_certificate  	server.crt;
   ssl_certificate_key	server.key;
}

第三个历程: 进行HTTP访问跳转HTTPS功能配置

server {
   listen            80;
   server_name       www.oldboy.com;
   rewrite  ^/(.*)$  https://$host/$1 redirect;
}
server {
   listen            443 ssl;
   server_name       www.oldboy.com www.jd.com;
   root              /html/www;
   index             index.html;
   ssl_certificate  	server.crt;
   ssl_certificate_key	server.key;
}

4. 利用负载均衡实现HTTPs访问过程

方式一: 全网服务器都配置证书和私钥信息
第一个历程: 编写lb负载均衡配置文件

upstream oldboy {
  #server 10.0.0.7:443;
  server 10.0.0.8:443;
  #server 10.0.0.9:80;
}	
server {
      listen        80;
      server_name   localhost;
      rewrite  ^/(.*)$  https://$host/$1 redirect;
}
server {
  listen        443 ssl;
  server_name   localhost;
      ssl_certificate  	server.crt;
      ssl_certificate_key	server.key;
  location / {
     proxy_pass  https://oldboy;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $remote_addr;	  
  }
}

第二个历程: web节点配置

server {
   listen            443 ssl;
   server_name       www.oldboy.com www.jd.com;
   root              /html/www;
   index             index.html;
   ssl_certificate  	server.crt;
   ssl_certificate_key	server.key;
}

方式二: 负载均衡服务器配置证书和私钥信息
第一个历程: 负载均衡配置信息

upstream oldboy {
  #server 10.0.0.7:443;
  server 10.0.0.8:80;
  #server 10.0.0.9:80;
}	
server {
      listen        80;
      server_name   localhost;
      rewrite  ^/(.*)$  https://$host/$1 redirect;
}
server {
  listen        443 ssl;
  server_name   localhost;
      ssl_certificate  	server.crt;
      ssl_certificate_key	server.key;
  location / {
     proxy_pass  http://oldboy;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $remote_addr;	  
  }
}

第二个历程: web节点配置信息

server {
   listen            80;
   server_name       www.oldboy.com www.jd.com;
   root              /html/www;
   index             index.html;
}

5. 利用HTTPs访问动态页面 wordpress

第一个历程: 修改配置文件信息

修改负载均衡配置文件:
upstream oldboy {
      #server 10.0.0.7:443;
      server 10.0.0.8:443;
      #server 10.0.0.9:80;
    }
server {
      listen        80;
      server_name   localhost;
      rewrite  ^/(.*)$  https://$host/$1 redirect;
}
server {
      listen        443 ssl;
      server_name   localhost;
      ssl_certificate       server.crt;
      ssl_certificate_key   server.key;
      location / {
         proxy_pass  https://oldboy;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;
      }
 }

web服务器配置过程	
server {
  listen       443 ssl;
  server_name   blog.oldboy.com blog.oldgirl.com;
  ssl_certificate       server.crt;
  ssl_certificate_key   server.key;
  location / {
      root         /html/blog;
      index        index.php index.html;
  }
  location ~ \.php$ {
      root /html/blog;
      fastcgi_pass  127.0.0.1:9000;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	  fastcgi_param HTTPS on;
      include fastcgi_params;
  }
}

第二个历程: 修改wordpress后台信息

修改地址为 https://blog.oldboy.com 

第三个历程: 重启nginx程序