HelloWorld
登录

12.13 Nginx防盗链 12.14 Nginx访问控制 12.15 Nginx解析php相关配置 12.16 Nginx代理

可莉

2021-10-11

1474 0 0

12.13 Nginx防盗链

因为该配置也使用location板块，所以本节可结合日志管理（不记录和过期时间）一起配置：

1[root@cham002 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
2
3location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
4{
5    expires 7d;
6    valid_referers none blocked server_names  *.test.com ;
7#定义referer白名单
8    if ($invalid_referer) {
9        return 403;
10#if函数的意思是：如果不是白名单内的域名，返回值：403
11    }
12    access_log off;
13}

说明： “location ~* ^.+”在此0“ * ”的作用是后面匹配的内容不区分大小写。

检测及测试

1[root@cham002 ~]# /usr/local/nginx/sbin/nginx -t
2nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
3nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
4[root@cham002 ~]# /usr/local/nginx/sbin/nginx -s reload
5[root@cham002 ~]# ls /data/wwwroot/test.com/
61.gif  2.js  admin  index.html
7[root@cham002 ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
8HTTP/1.1 403 Forbidden
9Server: nginx/1.12.1
10Date: Wed, 03 Jan 2018 13:54:39 GMT
11Content-Type: text/html
12Content-Length: 169
13Connection: keep-alive
14
15[root@cham002 ~]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
16HTTP/1.1 200 OK
17Server: nginx/1.12.1
18Date: Wed, 03 Jan 2018 13:55:14 GMT
19Content-Type: image/gif
20Content-Length: 32
21Last-Modified: Wed, 03 Jan 2018 13:34:18 GMT
22Connection: keep-alive
23ETag: "5a4cdbda-20"
24Expires: Wed, 10 Jan 2018 13:55:14 GMT
25Cache-Control: max-age=604800
26Accept-Ranges: bytes

即，使用非白名单内的referer进行访问，被拒绝！！！

12.14 Nginx访问控制

需求：访问/admin/目录的请求，只允许几个指定IP通过，配置如下：

1[root@cham002 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
2server
3{
4    listen 80;
5    server_name test.com test2.com test3.com;
6    index index.html index.htm index.php;
7    root /data/wwwroot/test.com;
8    if ($host != 'test.com' ) {
9        rewrite  ^/(.*)$  http://test.com/$1  permanent;
10    }
11   # location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
12   # {
13   #       expires      7d;
14   #       access_log off;
15   # }
16location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
17{
18    expires 7d;
19    valid_referers none blocked server_names  *.test.com ;
20    if ($invalid_referer) {
21        return 403;
22    }
23    access_log off;
24}
25
26
27    location ~ .*\.(js|css)$
28    {
29          expires      12h;
30          access_log off;
31    }
32    location /admin/
33    {
34       allow 127.0.0.1;
35       allow 192.168.230.135;
36       deny all;
37#设置IP白名单
38    }
39
40    access_log /tmp/test.com.log cham;
41}
42
43
44[root@cham002 ~]# /usr/local/nginx/sbin/nginx -t
45nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
46nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
47
48[root@cham002 ~]# /usr/local/nginx/sbin/nginx -s reload

测试(针对目录的)

1[root@cham002 ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/admin/
2HTTP/1.1 200 OK
3Server: nginx/1.12.1
4Date: Thu, 04 Jan 2018 07:59:16 GMT
5Content-Type: text/html
6Content-Length: 20
7Last-Modified: Wed, 03 Jan 2018 08:50:53 GMT
8Connection: keep-alive
9ETag: "5a4c996d-14"
10Accept-Ranges: bytes
11
12[root@cham002 ~]# curl -x192.168.230.150:80 -I test.com/admin/
13HTTP/1.1 200 OK
14Server: nginx/1.12.1
15Date: Thu, 04 Jan 2018 08:01:00 GMT
16Content-Type: text/html
17Content-Length: 20
18Last-Modified: Wed, 03 Jan 2018 08:50:53 GMT
19Connection: keep-alive
20ETag: "5a4c996d-14"
21Accept-Ranges: bytes
22
23[root@cham002 ~]# curl -x192.168.230.135:80 -I test.com/admin/
24HTTP/1.1 200 OK
25Server: nginx/1.12.1
26Date: Thu, 04 Jan 2018 08:01:14 GMT
27Content-Type: text/html
28Content-Length: 20
29Last-Modified: Wed, 03 Jan 2018 08:50:53 GMT
30Connection: keep-alive
31ETag: "5a4c996d-14"
32Accept-Ranges: bytes
33
34[root@cham002 ~]# cat /tmp/test.com.log
35127.0.0.1 - [03/Jan/2018:21:35:36 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
36127.0.0.1 - [04/Jan/2018:15:59:16 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
37192.168.230.135 - [04/Jan/2018:16:01:00 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
38192.168.230.135 - [04/Jan/2018:16:01:14 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
39[root@cham002 ~]# curl -x192.168.230.150:80 -I test.com/admin/
40HTTP/1.1 200 OK
41Server: nginx/1.12.1
42Date: Thu, 04 Jan 2018 08:01:37 GMT
43Content-Type: text/html
44Content-Length: 20
45Last-Modified: Wed, 03 Jan 2018 08:50:53 GMT
46Connection: keep-alive
47ETag: "5a4c996d-14"
48Accept-Ranges: bytes
49
50[root@cham002 ~]# cat /tmp/test.com.log
51127.0.0.1 - [03/Jan/2018:21:35:36 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
52127.0.0.1 - [04/Jan/2018:15:59:16 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
53192.168.230.135 - [04/Jan/2018:16:01:00 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
54192.168.230.135 - [04/Jan/2018:16:01:14 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
55192.168.230.135 - [04/Jan/2018:16:01:37 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
56
57[root@cham002 ~]# ifconfig
58ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
59        inet 192.168.230.135  netmask 255.255.255.0  broadcast 192.168.230.255
60        inet6 fe80::6f15:52d3:ebeb:e193  prefixlen 64  scopeid 0x20<link>
61        ether 00:0c:29:b6:9f:e3  txqueuelen 1000  (Ethernet)
62        RX packets 96831  bytes 41894507 (39.9 MiB)
63        RX errors 0  dropped 0  overruns 0  frame 0
64        TX packets 60974  bytes 20136998 (19.2 MiB)
65        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
66
67ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
68        inet 192.168.230.150  netmask 255.255.255.0  broadcast 192.168.230.255
69        ether 00:0c:29:b6:9f:e3  txqueuelen 1000  (Ethernet)
70
71ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
72        inet 192.168.100.1  netmask 255.255.255.0  broadcast 192.168.100.255
73        inet6 fe80::1801:cbbb:ebcc:89a3  prefixlen 64  scopeid 0x20<link>
74        ether 00:0c:29:b6:9f:ed  txqueuelen 1000  (Ethernet)
75        RX packets 3  bytes 746 (746.0 B)
76        RX errors 0  dropped 0  overruns 0  frame 0
77        TX packets 81  bytes 6462 (6.3 KiB)
78        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
79
80lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
81        inet 127.0.0.1  netmask 255.0.0.0
82        inet6 ::1  prefixlen 128  scopeid 0x10<host>
83        loop  txqueuelen 1  (Local Loopback)
84        RX packets 1363  bytes 1359483 (1.2 MiB)
85        RX errors 0  dropped 0  overruns 0  frame 0
86        TX packets 1363  bytes 1359483 (1.2 MiB)
87        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
88
89[root@cham002 ~]# curl -x192.168.100.1:80 test.com/admin/
90<html>
91<head><title>403 Forbidden</title></head>
92<body bgcolor="white">
93<center><h1>403 Forbidden</h1></center>
94<hr><center>nginx/1.12.1</center>
95</body>
96</html>
97
98[root@cham002 ~]# cat /tmp/test.com.log
99127.0.0.1 - [03/Jan/2018:21:35:36 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
100127.0.0.1 - [04/Jan/2018:15:59:16 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
101192.168.230.135 - [04/Jan/2018:16:01:00 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
102192.168.230.135 - [04/Jan/2018:16:01:14 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
103192.168.230.135 - [04/Jan/2018:16:01:37 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
104192.168.100.1 - [04/Jan/2018:16:05:14 +0800] test.com "/admin/" 403 "-" "curl/7.29.0

访问控制（针对正则匹配）

1[root@cham002 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
2server
3{
4    listen 80;
5    server_name test.com test2.com test3.com;
6    index index.html index.htm index.php;
7    root /data/wwwroot/test.com;
8    if ($host != 'test.com' ) {
9        rewrite  ^/(.*)$  http://test.com/$1  permanent;
10    }
11   # location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
12   # {
13   #       expires      7d;
14   #       access_log off;
15   # }
16location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
17{
18    expires 7d;
19    valid_referers none blocked server_names  *.test.com ;
20    if ($invalid_referer) {
21        return 403;
22    }
23    access_log off;
24}
25
26
27    location ~ .*\.(js|css)$
28    {
29          expires      12h;
30          access_log off;
31    }
32    location /admin/
33    {
34       allow 127.0.0.1;
35       allow 192.168.230.135;
36       deny all;
37    }
38
39    location ~ .*(upload|image)/.*\.php$
40    {
41        deny all;
42    }
43
44
45    access_log /tmp/test.com.log cham;
46}
47
48[root@cham002 ~]# /usr/local/nginx/sbin/nginx -t
49nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
50nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
51[root@cham002 ~]# /usr/local/nginx/sbin/nginx -s reload
52[root@cham002 ~]# mkdir /data/wwwroot/test.com/upload
53[root@cham002 ~]# echo "11111" > /data/wwwroot/test.com/upload/1.php
54

测试

1[root@cham002 ~]# curl -x127.0.0.1:80 test.com/upload/1.php
2<html>
3<head><title>403 Forbidden</title></head>
4<body bgcolor="white">
5<center><h1>403 Forbidden</h1></center>
6<hr><center>nginx/1.12.1</center>
7</body>
8</html>
9
10
11[root@cham002 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt
1211111
13看日志
14[root@cham002 ~]# cat /tmp/test.com.log
15127.0.0.1 - [03/Jan/2018:21:35:36 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
16127.0.0.1 - [04/Jan/2018:15:59:16 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
17192.168.230.135 - [04/Jan/2018:16:01:00 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
18192.168.230.135 - [04/Jan/2018:16:01:14 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
19192.168.230.135 - [04/Jan/2018:16:01:37 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
20192.168.100.1 - [04/Jan/2018:16:05:14 +0800] test.com "/admin/" 403 "-" "curl/7.29.0"
21127.0.0.1 - [04/Jan/2018:16:15:46 +0800] test.com "/upload/1.php" 403 "-" "curl/7.29.0"
22127.0.0.1 - [04/Jan/2018:16:16:46 +0800] test.com "/upload/1.txt" 200 "-" "curl/7.29.0"

针对user_agent限制

1server
2{
3    listen 80;
4    server_name test.com test2.com test3.com;
5    index index.html index.htm index.php;
6    root /data/wwwroot/test.com;
7    if ($host != 'test.com' ) {
8        rewrite  ^/(.*)$  http://test.com/$1  permanent;
9    }
10   # location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
11   # {
12   #       expires      7d;
13   #       access_log off;
14   # }
15location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
16{
17    expires 7d;
18    valid_referers none blocked server_names  *.test.com ;
19    if ($invalid_referer) {
20        return 403;
21    }
22    access_log off;
23}
24
25
26    location ~ .*\.(js|css)$
27    {
28          expires      12h;
29          access_log off;
30    }
31    location /admin/
32    {
33       allow 127.0.0.1;
34       allow 192.168.230.135;
35       deny all;
36    }
37
38    location ~ .*(upload|image)/.*\.php$
39    {
40        deny all;
41    }
42    
43    if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
44    {
45      return 403;
46    }
47
48
49
50    access_log /tmp/test.com.log cham;
51}
52[root@cham002 ~]# /usr/local/nginx/sbin/nginx -t
53nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
54nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
55[root@cham002 ~]# /usr/local/nginx/sbin/nginx -s reload
56[root@cham002 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt -I
57HTTP/1.1 200 OK
58Server: nginx/1.12.1
59Date: Thu, 04 Jan 2018 08:22:45 GMT
60Content-Type: text/plain
61Content-Length: 6
62Last-Modified: Thu, 04 Jan 2018 08:16:39 GMT
63Connection: keep-alive
64ETag: "5a4de2e7-6"
65Accept-Ranges: bytes
66
67[root@cham002 ~]# curl -A "Tomatodsfsdf" -x127.0.0.1:80 test.com/upload/1.txt -I
68HTTP/1.1 403 Forbidden
69Server: nginx/1.12.1
70Date: Thu, 04 Jan 2018 08:23:37 GMT
71Content-Type: text/html
72Content-Length: 169
73Connection: keep-alive

说明: deny all和return 403效果一样

12.15 Nginx解析PHP相关配置

1核心配置：
2[root@cham002 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
3
4 location ~ \.php$
5    {
6        include fastcgi_params;
7        #fastcgi_pass unix:/tmp/php-fcgi.sock;
8        fastcgi_pass 127.0.0.1:9000;
9##fastcgi_pass两种监听格式，但是要保证Nginx和php-fpm中格式一致
10        fastcgi_index index.php;
11        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
12    }
13
14[root@cham002 ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
15[global]
16pid = /usr/local/php-fpm/var/run/php-fpm.pid
17error_log = /usr/local/php-fpm/var/log/php-fpm.log
18[www]
19#listen = /tmp/php-fcgi.sock
20listen = 127.0.0.1:9000
21listen.mode = 666
22user = php-fpm
23group = php-fpm
24pm = dynamic
25pm.max_children = 50
26pm.start_servers = 20
27pm.min_spare_servers = 5
28pm.max_spare_servers = 35
29pm.max_requests = 500
30rlimit_files = 1024
31
32[root@cham002 ~]# /usr/local/nginx/sbin/nginx -t
33nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
34nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
35[root@cham002 ~]# /usr/local/nginx/sbin/nginx -s reload
36[root@cham002 ~]# /etc/init.d/php-fpm reload
37Reload service php-fpm  done
38
39[root@cham002 ~]# curl -x 127.0.0.1:80 test.com/3.php -I
40HTTP/1.1 200 OK
41Server: nginx/1.12.1
42Date: Thu, 04 Jan 2018 10:44:25 GMT
43Content-Type: text/html; charset=UTF-8
44Connection: keep-alive
45X-Powered-By: PHP/5.6.30
46

注： 在此注意两点，fastcgi_pass有两种格式，但是无论使用哪种格式都有保证Nginx和php-fpm中格式一致，否则会报错502；fastcgi _param SCRIPT _FILENAME所在行的路径要和root路径一致！

12.16 Nginx代理

Nginx代理是一种反向代理。反向代理（Reverse Proxy）方式是指以代理服务器来接受Internet上的连接请求，然后将请求转发给内部网络上的服务器；并将从服务器上得到的结果返回给Internet上请求连接的客户端，此时代理服务器对外就表现为一个服务器。

 

工作原理

Nginx代理是在一台代理服务器中自定义一个域名，该域名指向一个IP，然后将用户的请求通过这台代理服务器访问指定的IP所对应的web服务器。

1graph LR
2用户-->代理服务器
3代理服务器-->用户
4代理服务器-->web服务器
5web服务器-->代理服务器
6
7[root@cham002 ~]# cd /usr/local/nginx/conf/vhost
8[root@cham002 vhost]# vim proxy.conf 
9
10server
11{
12    listen 80;
13    server_name ask.apelearn.com;
14 #定义域名（一般和被代理ip的域名保持一致）
15
16    location /
17    {
18        proxy_pass      http://121.201.9.155/;
19#指定被代理（被访问）的IP（web服务器IP）
20        proxy_set_header Host   $host;
21#$host指的是代理服务器的servername（也是被代理IP的域名）
22        proxy_set_header X-Real-IP      $remote_addr;
23        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
24    }
25}

说明： 因为该虚拟主机只用作代理服务器，不需要访问本地文件，所以不需要设置根目录。

1没有设置代理前
2[root@cham002 vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
3<html>
4<head><title>404 Not Found</title></head>
5<body bgcolor="white">
6<center><h1>404 Not Found</h1></center>
7<hr><center>nginx/1.12.1</center>
8</body>
9</html>
10[root@cham002 vhost]# 
11
12[root@cham002 vhost]# /usr/local/nginx/sbin/nginx -t
13nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
14nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
15
16[root@cham002 vhost]# /usr/local/nginx/sbin/nginx -s reload
17设置代理后
18[root@cham002 vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
19#
20# robots.txt for MiWen
21#
22
23User-agent: *
24
25Disallow: /?/admin/
26Disallow: /?/people/
27Disallow: /?/question/
28Disallow: /account/
29Disallow: /app/
30Disallow: /cache/
31Disallow: /install/
32Disallow: /models/
33Disallow: /crond/run/
34Disallow: /search/
35Disallow: /static/
36Disallow: /setting/
37Disallow: /system/
38Disallow: /tmp/
39Disallow: /themes/
40Disallow: /uploads/
41Disallow: /url-*
42Disallow: /views/
43Disallow: /*/ajax/[root@cham002 vhost]#
点赞
收藏

评论区

加载中...

相关推荐

nginx 启动、停止、关闭

使用3A服务器搭建的centos系统安装nginx教程在我的往期博客中1，nginx指定配置文件/usr/local/nginx/sbin/nginxc/usr/local/nginx/conf/nginx.conf1c参数指定了要加载的nginx配置文件路径1,从容停止Nginx：killQUIT主进程号2,快速停止Nginx：kil

Nginx 配置静态文件 404 问题

使用Nginx做访问静态资源的时候，配置之后访问一直是 404。我的配置是location/dist{      root/usr/local/nginx/html/dist;      }原因：root配置的意思是，会在root配置的目录后跟上URL，组成对应的文件路径。即我的访问h

Nginx配置https

一、开启nginx的ssl模块1.未安装过nginx，编译安装配置参数如下：./configure\prefix/usr/local/nginx\withpcre\withhttp\_ssl\_modulessl模块\withhttp\_stub\_status\_module\wit

LNMP架构之虚拟主机配置、用户认证及域名重定向

本文索引：配置nginx虚拟主机nginx用户认证针对目录针对文件域名重定向配置nginx虚拟主机修改nginx主配置文件root@localhostnginx1.12.2vim/usr/local/nginx/conf/ngi

LNMP架构之访问日志、日志切割、静态文件不记录及过期时间设置

本文索引：Nginx访问日志Nginx日志切割静态文件不记录日志和过期时间Nginx访问日志修改nginx配置文件root@localhostvhostvim/usr/local/nginx/conf/nginx.conf搜索：/log_format

API网关【gateway 】

最近在公司进行API网关重写，公司内采用serverMesh进行服务注册，调用，这里结合之前学习对API网关服务进行简单的总结与分析。由于采用了大量的nginx相关的东西，所以在此记录一下：在nginx使用openresty加入nginx模块编辑nginx下conf配置文件nginx.confvinginx.c