nginx认识、LNMP架构论坛搭建以及nginx安全优化设置
一、nginx认识
Nginx是当前最流行的HTTP Server之一,与Apache相比,Nginx在高并发情况下具有巨大的性能优势。
Apache工作方式:每个请求会独占一个工作线程,当并发数上到几千时,就同时有几千的线程在处理请求了。这对操作系统来说,是个不小的挑战,线程带来的内存占用非常大,线程的上下文切换带来的cpu开销很大,自然性能就上不去了,而这些开销完全是没有意义的。
Nginx工作模式:nginx在启动后,会有一个master进程和多个worker进程。master进程主要用来管理worker进程,work进程是用来工作的进程。模型如下图所示(借鉴):
master进程会向worker进程发送各种信号,监控worker进程的运行状态,当worker进程异常退出后,会自动重启新的worker进程。
多个worker进程之间是对等的,他们同等竞争来自客户端的请求,各进程相互之间是独立的。一个请求,只可能放在一个worker进程中处理,一个worker进程,不可能处理其它进程的请求。worker进程的个数是可以设置的,通常会设置于机器cpu核数一致。
Nginx进程模型的好处:首先,独立的进程,不需要加锁,所以省掉了锁带来的开销;其次,采用独立的进程,可以让互相之间不会影响,一个进程退出后,其他进程还在工作,服务不会中断,master进程很快会启动新的worker进程。
Nginx如何处理高并发:nginx采用异步非阻塞的方式来处理请求,可以同时处理成千上万个请求。具体到系统调用就是像select/poll/epoll/kqueue这样的系统调用。它们提供一种机制,让你可以同时监控多个事件,调用它们是阻塞的,但可以设置超时时间,在超时时间之内,如果有事情准备好了,就返回。以epoll为例,当事件没准备好时,放到epoll里面,事件准备好了,就去读写,当读写返回EAGAIN时,将它再次加入到epoll里面。这样,只要有事件准备好了,我们就去处理它,只有当所有事件都没准备好时,才在epoll里面等着。
这样我们就可以并发处理大量的并发,当然这里的并发请求,是指未处理完的请求,线程只有一个,所以同时能处理的请求只有一个,只是在请求间进行不断切换而已,切换也是因为异步事件为准备好,而主动让出的,这里的切换是没有任何代价的,可以理解为循环处理多个准备好的事件。
二、部署nginx虚拟主机
【1】基于域名虚拟主机
(1)nginx手工编译安装
cd nginx/
tar zxvf nginx-1.12.2.tar.gz
yum install -y gcc gcc-c++ pcre-devel zlib-devel
cd /opt/nginx/nginx-1.12.2/
useradd -M -s /sbin/nologin nginx
./configure --prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_stub_status_module
make && make install
ln -s /usr/local/nginx/sbin/* /usr/local/sbin/
ln -s /usr/local/nginx/conf/nginx.conf /etc/
nginx -t //测试配置是否正确
(2)service管理设置
vim /etc/init.d/nginx
#!/bin/bash
#chkconfig: - 99 20
prog="/usr/local/sbin/nginx"
pidf="/usr/local/nginx/logs/nginx.pid"
case "$1" in
start)
$prog
;;
stop)
kill -s QUIT $(cat $pidf)
;;
restart)
$0 stop
$0 start
;;
*)
exit 1
esac
exit 0
chmod +x /etc/init.d/nginx
chkconfig --add nginx
(3)DNS域名解析配置
mkdir -p /var/www/html/kgc
mkdir -p /var/www/html/benet
vim /var/www/html/kgc/index.html
<h1>this is kgc web</h1>
vim /var/www/html/benet/index.html
<h1>this is benet web</h1>
yum install -y bind
vim /etc/named.conf
.......................
options {
listen-on port 53 { any; };
........................
allow-query { any; };
.......................
vim /etc/named.rfc1912.zones
zone "kgc.com" IN {
type master;
file "kgc.com.zone";
allow-update { none; };
};
zone "benet.com" IN {
type master;
file "benet.com.zone";
allow-update { none; };
};
cd /var/named/
cp -p named.localhost kgc.com.zone
vim kgc.com.zone
www IN A 192.168.60.60
cp -p kgc.com.zone benet.com.zone
systemctl start named
(4)站点声明
vim /etc/nginx.conf
server {
listen 80;
server_name www.kgc.com;
location / {
root /var/www/html/kgc;
index index.html index.htm; }
}
server {
listen 80;
server_name www.benet.com;
location / {
root /var/www/html/benet;
index index.html index.htm; }
}
service nginx restart
systemctl stop firewalld.service
setenforce 0
【2】基于端口虚拟主机
vim /etc/nginx.conf
server {
listen 192.168.60.60:80;
server_name www.kgc.com;
location / {
root /var/www/html/kgc;
index index.html index.htm; }
}
server {
listen 192.168.60.60:8080;
server_name www.kgc.com;
location / {
root /var/www/html/benet;
index index.html index.htm; }
}
【3】基于IP地址虚拟主机
(1)修改区域数据配置文件
cd /var/named/
vim kgc.com.zone
www IN A 192.168.60.60
vim benet.com.zone
www IN A 192.168.60.10
systemctl start named
(2)修改站点声明
vim /etc/nginx.conf
server {
listen 192.168.60.60:80;
server_name www.kgc.com;
location / {
root /var/www/html/kgc;
index index.html index.htm; }
}
server {
listen 192.168.60.10:80;
server_name www.benet.com;
location / {
root /var/www/html/benet;
index index.html index.htm; }
}
三、LNMP架构搭建
1、nginx安装
【1】nginx手工编译安装
cd nginx/
tar zxvf nginx-1.12.2.tar.gz
yum install -y gcc gcc-c++ pcre-devel zlib-devel
cd /opt/nginx/nginx-1.12.2/
useradd -M -s /sbin/nologin nginx
./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_stub_status_module
make && make install
ln -s /usr/local/nginx/sbin/* /usr/local/sbin/
ln -s /usr/local/nginx/conf/nginx.conf /etc/
nginx -t
【2】systemctl管理配置
vim /lib/systemd/system/nginx.service
[Unit]
Description=nginx
After=network.target
[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExeStart=/usr/local/nginx/sbin/nginx
ExeStop=/usr/bin/kill -s QUIT $MAINPID
ExeReload=/usr/bin/kill -s HUP $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target
chmod 754 /usr/local/systemd/system/nginx.service
【3】启动nginx服务
systemctl start nginx
2、MySQL数据库安装
【1】MySQL编译安装
cd mysql/
tar zxvf mysql-boost-5.7.20.tar.gz
tar zxvf ncurses-5.6.tar.gz
cd mysql-5.7.20/
yum install -y ncurses-devel ncurses bison cmake
useradd -s /sbin/nologin mysql
cmake \
-DCMAKE_INSTALL_PREFIX=/usr/local/mysql \
-DMYSQL_UNIX_ADDR=/usr/local/mysql/mysql.sock \
-DSYSCONFDIR=/etc \
-DSYSTEMD_PID_DIR=/usr/local/mysql \
-DDEFAULT_CHARSET=utf8 \
-DDEFAULT_COLLATION=utf8_general_ci \
-DWITH_INNOBASE_STORAGE_ENGINE=1 \
-DWITH_ARCHIVE_STORAGE_ENGINE=1 \
-DWITH_BLACKHOLE_STORAGE_ENGINE=1 \
-DWITH_PERFSCHEMA_STORAGE_ENGINE=1 \
-DMYSQL_DATADIR=/usr/local/mysql/data \
-DWITH_BOOST=boost \
-DWITH_SYSTEMD=1
make && make install
chown -R mysql:mysql /usr/local/mysql/
【2】设置数据库文件
vim /etc/my.cnf
[client]
port=3306
default-character-set=utf8
socket=/usr/local/mysql/mysql.sock
[mysql]
port=3306
default-character-set=utf8
socket=/usr/local/mysql/mysql.sock
[mysqld]
user=mysql
basedir=/usr/local/mysql
datadir=/usr/local/mysql/data
port=3306
character_set_server=utf8
pid-file=/usr/local/mysql/mysql.pid
socket=/usr/local/mysql/mysql.sock
server-id=1
sql_mode=NO_ENGINE_SUBSTITUTION,
STRICT_TRANS_TABLES,
NO_AUTO_CREATE_USER,
NO_AUTO_VALUE_ON_ZERO,
NO_ZERO_IN_DATE,
NO_ZERO_DATE,
ERROR_FOR_DIVISION_BY_ZERO,
PIPES_AS_CONCAT,
ANSI_QUOTES
【3】全局声明命令
echo "PATH=/usr/local/mysql/bin:/usr/local/mysql/lib:$PATH" >> /etc/profile
echo "export PATH" >> /etc/profile
source /etc/profile
【4】初始化数据库
/usr/local/mysql/bin/mysqld
--initialize-insecure --user=mysql
--basedir=/usr/local/mysql
--datadir=/usr/local/mysql/data
【5】启动MySQL服务
cp /usr/local/mysql/usr/lib/systemd/system/mysqld.service /lib/systemd/system/
systemctl start mysqld.service
netstat -natp |grep 3306
【6】MySQL密码设置
mysqladmin -u root -p password
Enter password: 空
New password: 123123
Confirm new password:123123
mysql -uroot -p
3、PHP安装
【1】PHP编译安装
yum install -y libjpeg \
libjpeg-devel \
libpng libpng-devel \
freetype freetype-devel \
libxml2 libxml2-devel \
zlib zlib-devel \
curl curl-devel \
openssl openssl-devel
tar jxvf php-7.1.10.tar.bz2
cd php-7.1.10/
./configure \
--prefix=/usr/local/php \
--with-mysql-sock=/usr/local/mysql/mysql.sock \
--with-mysqli \
--with-zlib \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-openssl \
--enable-fpm \
--enable-mbstring \
--enable-xml \
--enable-session \
--enable-ftp \
--enable-pdo \
--enable-tokenizer \
--enable-zip
make && make install
【2】配置文件优化
cp php.ini-development /usr/local/php/lib/php.ini
vim /usr/local/php/lib/php.ini
mysqli.default_socket = /usr/local/mysql/mysql.sock
date.timezone = Asia/Shanghai
/usr/local/php/bin/php -m //验证安装的模块
【3】配置MySQL5.7中fpm模块
cd /usr/local/php/etc/
cp php-fpm.conf.default php-fpm.conf
cd /usr/local/php/etc/php-fpm.d/
cp www.conf.default www.conf
vim /usr/local/php/etc/php-fpm.conf
pid = run/php-fpm.pid
/usr/local/php/sbin/php-fpm -c /usr/local/php/lib//php.ini //启动PHP服务
netstat -natp |grep 9000(php)
ln -s /usr/local/php/bin/* /usr/local/bin/
【4】配置nginx支持PHP服务
cd /usr/local/nginx/conf/
vim nginx.conf
location ~ \.php$ {
root html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/local/nginx/html$fastcgi_script_name;
include fastcgi_params;
}
vim /usr/local/nginx/html/index.php
<?php
phpinfo();
?>
【5】启动PHP服务和重启nginx服务
/usr/local/php/sbin/php-fpm -c /usr/local/php/lib//php.ini
service nginx restart
4、论坛安装
【1】数据库创建
mysql -uroot -p
Enter password:123123
create database bbs;
grant all on bbs.* to 'bbsuser'@'%' identified by 'admin123';
grant all on bbs.* to 'bbsuser'@'localhost' identified by 'admin123';
flush privileges;
show databases;
quit
【2】移动站点到数据库并配置属主属组
cd /opt
mkdir luntan
cd luntan/
unzip Discuz_X3.4_SC_UTF8.zip
cd dir_SC_UTF8/
cp -r upload/ /usr/local/nginx/html/bbs
cd /usr/local/nginx/html/bbs
chown -R root:nginx config/
chown -R root:nginx data/
chown -R root:nginx uc_client/
chown -R root:nginx uc_server/
chmod -R 777 config/
chmod -R 777 data/
chmod -R 777 uc_client/
chmod -R 777 uc_server/