本文索引：

Ningx防盗链
Ningx访问控制
- 针对目录的访问控制
- 针对文件的访问控制
- 针对user_agent
Nginx解析php相关配置
- 访问报502错误分析
Nginx代理

Nginx防盗链

修改虚拟主机配置文件

可以配合过期时间和静态文件不记录的代码使用

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf ...

~*表示忽略大小写的匹配

1location ~* .*\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
2{
3    expires 7d;
4    
5    # 设置白名单，server_names可以不写
6    # 白名单可以是多个域名，域名键使用空格间隔开
7    valid_referers none blocked server_names *.test.com;
8    
9    # 条件判断，非白名单域名返回403状态码即禁止访问forbidden；
10    if ($invalid_referer) {
11        return 403;
12    }
13    access_log off;
14}

...

验证效果

使用不在白名单内的referer访问，返回的状态码为403，forbidden！

[root@localhost vhost]# curl -e "http://www.baudi.com" -x 127.0.0.1:80 test.com/1.gif -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Wed, 03 Jan 2018 12:25:35 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive
指定白名单的referer访问，成功访问

[root@localhost vhost]# curl -e "http://www.test.com" -x 127.0.0.1:80 test.com/1.gif -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Wed, 03 Jan 2018 12:26:43 GMT Content-Type: image/gif Content-Length: 12 Last-Modified: Wed, 03 Jan 2018 11:35:29 GMT Connection: keep-alive ETag: "5a4cc001-c" Expires: Wed, 10 Jan 2018 12:26:43 GMT Cache-Control: max-age=604800 Accept-Ranges: bytes

nginx访问控制

针对目录的访问控制

修改虚拟主机配置文件

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf ...

这里以简单目录为例

location /admin/ { # nginx中没有apache里的order命令，按代码先后顺序执行 # nginx中只要有一条规则匹配，后续规则就不会进行匹配
```
1# 允许本机
2allow 127.0.0.1;
3
4allow 192.168.65.133;
5
6# 禁止其他所有ip
7deny all;
```
} ...
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
测试

使用allow允许的ip访问，成功访问

[root@localhost ~]# curl -x 192.168.65.133:80 test.com/admin/1.php -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:36:48 GMT Content-Type: application/octet-stream Content-Length: 19 Last-Modified: Wed, 03 Jan 2018 13:15:00 GMT Connection: keep-alive ETag: "5a4cd754-13" Accept-Ranges: bytes

使用非allow允许的ip访问，403 forbidden

[root@localhost ~]# curl -x 192.168.65.137:80 test.com/admin/1.php -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

针对文件的访问控制

location还可以使用 /* + 正则的方式对某类文件或目录进行访问控制

1[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf 
2# 禁止upload、admin目录下的php文件解析
3location ~ .*(upload|admin)/.*\.php$
4{
5    deny all
6}

重启并测试

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

[root@localhost ~]# curl -x 192.168.65.133:80 test.com/upload/1.php -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:59:07 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

针对user_agent

修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

还可以根据user_agent来做限制

这里限制网站被爬虫爬取

location / { if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato') { return 403; //等价于deny all; } }
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
效果测试

不指定user_agent

[root@localhost ~]# curl -x 127.0.0.1:80 test.com -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 11:44:35 GMT Content-Type: text/html Content-Length: 9 Last-Modified: Wed, 03 Jan 2018 10:42:12 GMT Connection: keep-alive ETag: "5a4cb384-9" Accept-Ranges: bytes

指定user_agent

[root@localhost ~]# curl -A "Tomato" -x 127.0.0.1:80 test.com -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 11:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

Nginx解析php相关配置

修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf ... location ~ .php$ { include fastcgi_params; # fastcgi_pass后接的sock在php-fpm.conf内的pool块内定义的，选择哪个进程池就写哪个socket fastcgi_pass unix:/tmp/php-fcgi.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /data/www/test.com$fastcgi_script_name; } ...
先测试为设置前是否能解析PHP

PHP不解析，直接显示代码

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<?php phpinfo();
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
验证效果

成功解析，返回网页html代码

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/ xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><head> <style type="text/css"> body {background-color: #fff; color: #222; font-family: sans-serif;} pre {margin: 0; font-family: monospace;} a:link {color: #009; text-decoration: none; background-color: #fff;} a:hover {text-decoration: underline;} table {border-collapse: collapse; border: 0; width: 934px; box-shado w: 1px 2px 3px #ccc;} .center {text-align: center;} .center table {margin: 1em auto; text-align: left;} .center th {text-align: center !important;} td, th {border: 1px solid #666; font-size: 75%; vertical-align: base line; padding: 4px 5px;} h1 {font-size: 150%;} h2 {font-size: 125%;} .p {text-align: left;} .e {background-color: #ccf; width: 300px; font-weight: bold;} .h {background-color: #99c; font-weight: bold;} .v {background-color: #ddd; max-width: 300px; overflow-x: auto;} .v i {color: #999;} img {float: right; border: 0;} hr {width: 934px; background-color: #ccc; border: 0; height: 1px;} </style> ...

访问报502错误分析

socket文件错误为了测试，这里我故意将配置文件内的sock写错

原本为/tmp/php-fcgi.sock

fastcgi_pass unix:/tmp/php1-fcgi.sock;

重启服务后重新访问，返回信息如下：

1[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
2<html>
3<head><title>502 Bad Gateway</title></head>
4<body bgcolor="white">
5<center><h1>502 Bad Gateway</h1></center>
6<hr><center>nginx/1.12.2</center>
7</body>
8</html>

因为nginx无法找到sock文件，查看错误日志，通过错误日志进行错误排查。

1[root@localhost ~]# cat /usr/local/nginx/logs/nginx_error.log 
22018/01/05 17:47:18 [crit] 2456#0: *22 connect() to unix:/tmp/php1-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/1.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php1-fcgi.sock:", host: "test.com"

这里的socket文件应该是在/usr/local/php-fpm/etc/php-fpm.conf内定义的。

1[root@localhost ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
2[global]
3pid = /usr/local/php-fpm/var/run/php-fpm.pid
4error_log = /usr/local/php-fpm/var/log/php-fpm.log
5[www]
6listen = /tmp/php-fcgi.sock
7# 定义了sock必须定义mode，否则权限为440，执行后会报错
8listen.mode = 666
9user = php-fpm
10group = php-fpm
11pm = dynamic
12pm.max_children = 50
13pm.start_servers = 20
14pm.min_spare_servers = 5
15pm.max_spare_servers = 35
16pm.max_requests = 500
17rlimit_files = 1024

2. 设置未对应设置 php-fpm.conf为监听ip/端口，nginx虚拟主机配置文件内为监听socket，没有对应。

修改配置代码

[root@localhost ~]# vim /usr/local/php-fpm/etc/php-fpm.conf ...

listen = /tmp/php-fcgi.sock

listen = 127.0.0.1:9000 ...

检测语法错误并重启php服务

[root@localhost ~]# /usr/local/php-fpm/sbin/php-fpm -t [05-Jan-2018 18:03:27] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful [root@localhost ~]# /etc/init.d/php-fpm reload Reload service php-fpm done
暂时不修改虚拟主机配置文件进行访问测试

报502错

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<html> <head><title>502 Bad Gateway</title></head> <body bgcolor="white"> <center><h1>502 Bad Gateway</h1></center> <hr><center>nginx/1.12.2</center> </body> </html>
修改对应代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf ... fastcgi_pass 127.0.0.1:9000; ...
重启服务后测试效果

重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

这里能成功访问

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/ xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><head> <style type="text/css"> body {background-color: #fff; color: #222; font-family: sans-serif;} pre {margin: 0; font-family: monospace;} a:link {color: #009; text-decoration: none; background-color: #fff;} a:hover {text-decoration: underline;} table {border-collapse: collapse; border: 0; width: 934px; box-shado w: 1px 2px 3px #ccc;} .center {text-align: center;} .center table {margin: 1em auto; text-align: left;} .center th {text-align: center !important;} td, th {border: 1px solid #666; font-size: 75%; vertical-align: base line; padding: 4px 5px;} h1 {font-size: 150%;} h2 {font-size: 125%;} .p {text-align: left;} .e {background-color: #ccf; width: 300px; font-weight: bold;} .h {background-color: #99c; font-weight: bold;} .v {background-color: #ddd; max-width: 300px; overflow-x: auto;} .v i {color: #999;} img {float: right; border: 0;} hr {width: 934px; background-color: #ccc; border: 0; height: 1px;} </style> ...

其他出现502错误的原因还有服务器资源耗尽，出现这种问题的解决方法是进行优化。

Nginx代理

什么是代理用户访问国外web服务器的速率通常比较慢，导致出现卡顿甚至无法访问的情况！通过在中间搭建一个代理服务器实现快速访问的目的。这个代理服务器既可以与用户端快速连接，也可以高速访问远程web服务器。用户通过访问代理服务器，间接地访问web服务器，大大加快访问速度。

代码实现

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/proxy.conf server { listen 80; server_name ask.apelearn.com;

1location /
2{
3    # proxy_pass指定远程服务器的ip
4    proxy_pass http://121.201.9.155/;
5    
6    # $host即为server_name
7    proxy_set_header Host               $host;
8    
9    
10    proxy_set_header X-Real-IP          $remote_addr;
11    
12    
13    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
14}

}

验证效果

正常情况下，无法直接通过本机访问远程服务器

[root@localhost ~]# curl -x127.0.0.1:80 ask.apelea#n.com/robots.txt

robots.txt for MiWen

User-agent: *

Disallow: /?/admin/ Disallow: /?/people/ Disallow: /?/question/ Disallow: /account/ Disallow: /app/ Disallow: /cache/ Disallow: /install/ Disallow: /models/ Disallow: /crond/run/ Disallow: /search/ Disallow: /static/ Disallow: /setting/ Disallow: /system/ Disallow: /tmp/ Disallow: /themes/ Disallow: /uploads/ Disallow: /url-* Disallow: /views/ Disallow: /*/ajax/

关闭代理设置，重新测试

1# 关闭代理功能
2[root@localhost ~]# mv /usr/local/nginx/conf/vhost/proxy.conf /usr/local/nginx/conf/vhost/proxy.conf.bak
3
4[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
5nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
6nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
7[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
8
9# 无法直接通过本机访问远程服务器了
10[root@localhost ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt -I
11HTTP/1.1 404 Not Found
12Server: nginx/1.12.2
13Date: Thu, 04 Jan 2018 13:42:52 GMT
14Content-Type: text/html
15Content-Length: 169
16Connection: keep-alive

LNMP架构之防盗链、访问控制、php解析、代理的设置

Nginx防盗链

可以配合过期时间和静态文件不记录的代码使用

~*表示忽略大小写的匹配

nginx访问控制

针对目录的访问控制

这里以简单目录为例

使用allow允许的ip访问，成功访问

使用非allow允许的ip访问，403 forbidden

针对文件的访问控制

针对user_agent

还可以根据user_agent来做限制

这里限制网站被爬虫爬取

不指定user_agent

指定user_agent

Nginx解析php相关配置

PHP不解析，直接显示代码

成功解析，返回网页html代码

访问报502错误分析

原本为/tmp/php-fcgi.sock

listen = /tmp/php-fcgi.sock

检测语法错误并重启php服务

报502错

重启服务

这里能成功访问

Nginx代理

正常情况下，无法直接通过本机访问远程服务器

robots.txt for MiWen

评论区

相关推荐