Nginx搭建Web服务器实战

1.1 Nginx安装部署

1.1.1 下载并解压安装包

[root@Rocky8-node1 ~]# wget -c https://nginx.org/download/nginx-1.24.0.tar.gz
[root@Rocky8-node1 ~]# tar xf nginx-1.24.0.tar.gz -C /usr/local/src/

1.1.2 安装依赖

[root@Rocky8-node1 ~]# yum install gcc gcc-c++ make pcre-devel openssl-devel -y

1.1.3 编译前环境配置

[root@Rocky8-node1 ~]# mkdir -p /var/log/nginx  #创建配置目录
[root@Rocky8-node1 ~]# cd /usr/local/src/nginx-1.24.0/
[root@Rocky8-node1 nginx-1.24.0]# ./configure --prefix=/usr/local/nginx \
> --sbin-path=/usr/sbin/nginx \
> --http-log-path=/var/log/nginx/access.log \
> --error-log-path=/var/log/nginx/error.log \
> --pid-path=/run/nginx.pid

• --prefix=/usr/local/nginx：设置Nginx的安装路径为/usr/local/nginx。

• --sbin-path=/usr/sbin/nginx：设置Nginx二进制文件的路径为/usr/sbin/nginx。

• --http-log-path=/var/log/nginx/access.log：设置HTTP请求日志文件的路径为/var/log/nginx/access.log。

• --error-log-path=/var/log/nginx/error.log：设置错误日志文件的路径为/var/log/nginx/error.log。

• --pid-path=/run/nginx.pid：设置Nginx主进程ID文件的路径为/run/nginx.pid。

注意：获取这些内容可以在测试环境使用RPM安装Nginx，通过nginx -V命令获取

1.1.4 编译并安装

[root@Rocky8-node1 nginx-1.24.0]# make && make install
[root@Rocky8-node1 nginx-1.24.0]# nginx -v
nginx version: nginx/1.24.0

1.1.5 配置系统服务脚本

[root@Rocky8-node1 nginx-1.24.0]# vim /usr/lib/systemd/system/nginx.service
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target
​
[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID                                                                                           
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true
​
[Install]
WantedBy=multi-user.target
​
[root@Rocky8-node1 nginx-1.24.0]# systemctl daemon-reload   #重新加载systemd管理器的配置

1.1.6 启动停止测试

[root@Rocky8-node1 nginx-1.24.0]# systemctl start nginx  #正常启动
[root@Rocky8-node1 nginx-1.24.0]# systemctl is-active nginx.service 
active
[root@Rocky8-node1 nginx-1.24.0]# ps -ef | grep nginx
root       10947       1  0 16:25 ?        00:00:00 nginx: master process /usr/sbin/nginx
nobody     10948   10947  0 16:25 ?        00:00:00 nginx: worker process
root       10950    1613  0 16:25 pts/0    00:00:00 grep --color=auto nginx
​
[root@Rocky8-node1 nginx-1.24.0]# systemctl stop nginx.service 
[root@Rocky8-node1 nginx-1.24.0]# systemctl is-active nginx.service 
inactive
[root@Rocky8-node1 nginx-1.24.0]# ps -ef | grep nginx
root       10977    1613  0 16:25 pts/0    00:00:00 grep --color=auto nginx

2.2 虚拟主机实战

2.2.1 搭建web服务器要求如下

• web服务器的主机ip：192.168.110.31

• web服务器的默认访问目录为/var/www/html默认发布内容为defaults page

• 站点news.timinglee.org默认发布目录为/var/www/virtual/timinglee.org/news默认发布内容为 news.timinglee.org

• 站点login.timinglee.org在被访问时必须强制走加密协议，其默认发布目录为/var/www/virtual/timinglee.org/login 默认发布内容为login.timinglee.org

2.2.1 创建默认主页

[root@Rocky8-node1 ~]# mkdir -p /var/www/html
[root@Rocky8-node1 ~]# echo 'defaults page' > /var/www/html/index.html
[root@Rocky8-node1 ~]# mkdir -p /var/www/virtual/timinglee.org/news
[root@Rocky8-node1 ~]# echo 'news.timinglee.org' > /var/www/virtual/timinglee.org/news/index.html
[root@Rocky8-node1 ~]# mkdir -p /var/www/virtual/timinglee.org/login
[root@Rocky8-node1 ~]# echo 'login.timinglee.org' > /var/www/virtual/timinglee.org/login/index.html

2.2.2 SSL加密证书配置

2.2.2.1 生成密钥

[root@Rocky8-node1 ~]# openssl genrsa -des3 -out server.key 2048  #密码为1234
Generating RSA private key, 2048 bit long modulus (2 primes)
.............................................................................................+++++
......................................................+++++
e is 65537 (0x010001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

2.2.2.2 生成证书

[root@Rocky8-node1 ~]# openssl req -new -key server.key -out server.crt
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SN
Locality Name (eg, city) [Default City]:XI'AN
Organization Name (eg, company) [Default Company Ltd]:YOOZOO
Organizational Unit Name (eg, section) []:SRE
Common Name (eg, your name or your server's hostname) []:SERVER
Email Address []:
​
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

2.2.2.3 备份原始的私钥文件

[root@Rocky8-node1 ~]# cp server.key server.key.copy

2.2.2.4 读取私钥并

[root@Rocky8-node1 ~]# openssl rsa -in server.key.copy -out server.key
Enter pass phrase for server.key.copy:
writing RSA key

2.2.2.5 生成新的X.509 证书

[root@Rocky8-node1 ~]# echo subjectAltName=IP:192.168.110.31,DNS:192.168.110.31 > cert_extensions
[root@Rocky8-node1 ~]# openssl x509 -req -sha256 -days 3650 -in server.crt -signkey server.key -extfile cert_extensions -out server.crt
Signature ok
subject=C = CN, ST = SN, L = XI'AN, O = IT, OU = SERVER, CN = ROCKY
Getting Private key
[root@Rocky8-node1 ~]# cp server.crt server.key /etc/nginx  #证书和密钥要在/etc/nginx下

2.2.2.6 虚拟主机配置

[root@Rocky8-node1 ~]# vim /etc/nginx/conf.d/VirtualHost.conf
server {
    listen 192.168.110.31:80;
    server_name login.timinglee.org;
    return 301 https://$host$request_uri;
    #配置访问login.timinglee.org自动重定向到https
}
​
server {
    listen 192.168.110.31:80;
    server_name defaults.timinglee.page;
​
    location / {
        root /var/www/html;
        index index.html;
    }
}
​
server {
    listen 192.168.110.31:80;
    server_name news.timinglee.org;
​
    location / {
        root /var/www/virtual/timinglee.org/news;
        index index.html;
    }
}
​
server {
        listen                  192.168.110.31:443 ssl;
        server_name             login.timinglee.org;
        ssl_certificate         server.crt;
        ssl_certificate_key     server.key;
        ssl_protocols           TLSv1.2 TLSv1.3;
        ssl_ciphers             HIGH:!aNULL:!MD5;
       
        location / {
                root /var/www/virtual/timinglee.org/login;
                index index.html;
        }
}
​
[root@Rocky8-node1 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@Rocky8-node1 ~]# nginx -s reload

2.3 访问测试

2.3.1 客户端访问

[root@Rocky8-node2 ~]# echo '192.168.110.31 defaults.timinglee.page news.timinglee.org login.timinglee.org' >> /etc/hosts   #添加hosts解析
[root@Rocky8-node2 ~]# curl http://defaults.timinglee.page
defaults page
[root@Rocky8-node2 ~]# curl http://news.timinglee.org
news.timinglee.org
[root@Rocky8-node2 ~]# curl http://login.timinglee.org   #自动重定向到了https
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.14.1</center>
</body>
</html>
[root@Rocky8-node2 ~]# curl -k https://login.timinglee.org
login.timinglee.org

2.3.2 Windows访问

hosts: C:\Windows\System32\drivers\etc\hosts