LNMP架构之防盗链、访问控制、php解析、代理的设置

本文索引：

• Ningx防盗链
• Ningx访问控制
  • 针对目录的访问控制
  • 针对文件的访问控制
  • 针对user_agent
• Nginx解析php相关配置
  • 访问报502错误分析
• Nginx代理

---

Nginx防盗链

• 修改虚拟主机配置文件

# 能够配合过时时间和静态文件不记录的代码使用
[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf 
...
# ~*表示忽略大小写的匹配
    location ~* .*\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
    {
        expires 7d;
        
        # 设置白名单，server_names能够不写
        # 白名单能够是多个域名，域名键使用空格间隔开
        valid_referers none blocked server_names *.test.com;
        
        # 条件判断，非白名单域名返回403状态码即禁止访问forbidden；
        if ($invalid_referer) {
            return 403;
        }
        access_log off;
    }
...

• 验证效果

1. 使用不在白名单内的referer访问，返回的状态码为403，forbidden！

[root@localhost vhost]# curl -e "http://www.baudi.com" -x 127.0.0.1:80 test.com/1.gif -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.2
Date: Wed, 03 Jan 2018 12:25:35 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

2. 指定白名单的referer访问，成功访问

[root@localhost vhost]# curl -e "http://www.test.com" -x 127.0.0.1:80 test.com/1.gif -I
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Wed, 03 Jan 2018 12:26:43 GMT
Content-Type: image/gif
Content-Length: 12
Last-Modified: Wed, 03 Jan 2018 11:35:29 GMT
Connection: keep-alive
ETag: "5a4cc001-c"
Expires: Wed, 10 Jan 2018 12:26:43 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes

---

nginx访问控制

针对目录的访问控制

• 修改虚拟主机配置文件

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf 
...
# 这里以简单目录为例
location /admin/
{
    # nginx中没有apache里的order命令，按代码前后顺序执行
    # nginx中只要有一条规则匹配，后续规则就不会进行匹配
    
    # 容许本机
    allow 127.0.0.1;
    
    allow 192.168.65.133;
    
    # 禁止其余全部ip
    deny all;
}
...

• 重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

• 测试

# 使用allow容许的ip访问，成功访问
[root@localhost ~]# curl -x 192.168.65.133:80 test.com/admin/1.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 12:36:48 GMT
Content-Type: application/octet-stream
Content-Length: 19
Last-Modified: Wed, 03 Jan 2018 13:15:00 GMT
Connection: keep-alive
ETag: "5a4cd754-13"
Accept-Ranges: bytes

# 使用非allow容许的ip访问，403 forbidden
[root@localhost ~]# curl -x 192.168.65.137:80 test.com/admin/1.php -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 12:44:54 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

---

针对文件的访问控制

location还可使用 ~/~* + 正则的方式对某类文件或目录进行访问控制

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf 
# 禁止upload、admin目录下的php文件解析
location ~ .*(upload|admin)/.*\.php$
{
    deny all
}

• 重启并测试

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

[root@localhost ~]# curl -x 192.168.65.133:80 test.com/upload/1.php -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 12:59:07 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

---

针对user_agent

1. 修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
# 还能够根据user_agent来作限制
# 这里限制网站被爬虫爬取
location / 
{
    if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
    {
        return 403; //等价于deny all;
    }
}

2. 重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

3. 效果测试

# 不指定user_agent
[root@localhost ~]# curl -x 127.0.0.1:80 test.com -I
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 11:44:35 GMT
Content-Type: text/html
Content-Length: 9
Last-Modified: Wed, 03 Jan 2018 10:42:12 GMT
Connection: keep-alive
ETag: "5a4cb384-9"
Accept-Ranges: bytes

# 指定user_agent
[root@localhost ~]# curl -A "Tomato" -x 127.0.0.1:80 test.com -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 11:44:54 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

---

Nginx解析php相关配置

• 修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
...
	location ~ \.php$
	{
	    include fastcgi_params;
            # fastcgi_pass后接的sock在php-fpm.conf内的pool块内定义的，选择哪一个进程池就写哪一个socket
	    fastcgi_pass unix:/tmp/php-fcgi.sock;
	    fastcgi_index index.php;
	    fastcgi_param SCRIPT_FILENAME /data/www/test.com$fastcgi_script_name;
	}
...

• 先测试为设置前是否能解析PHP

# PHP不解析，直接显示代码
[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<?php
phpinfo();

• 重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

• 验证效果

# 成功解析，返回网页html代码
[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/
xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<style type="text/css">
body {background-color: #fff; color: #222; font-family: sans-serif;}
pre {margin: 0; font-family: monospace;}
a:link {color: #009; text-decoration: none; background-color: #fff;}
a:hover {text-decoration: underline;}
table {border-collapse: collapse; border: 0; width: 934px; box-shado
w: 1px 2px 3px #ccc;}
.center {text-align: center;}
.center table {margin: 1em auto; text-align: left;}
.center th {text-align: center !important;}
td, th {border: 1px solid #666; font-size: 75%; vertical-align: base
line; padding: 4px 5px;}
h1 {font-size: 150%;}
h2 {font-size: 125%;}
.p {text-align: left;}
.e {background-color: #ccf; width: 300px; font-weight: bold;}
.h {background-color: #99c; font-weight: bold;}
.v {background-color: #ddd; max-width: 300px; overflow-x: auto;}
.v i {color: #999;}
img {float: right; border: 0;}
hr {width: 934px; background-color: #ccc; border: 0; height: 1px;}
</style>
...

访问报502错误分析

1. socket文件错误 为了测试，这里我故意将配置文件内的sock写错

# 本来为/tmp/php-fcgi.sock
fastcgi_pass unix:/tmp/php1-fcgi.sock;

重启服务后从新访问，返回信息以下：

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.2</center>
</body>
</html>

由于nginx没法找到sock文件，查看错误日志，经过错误日志进行错误排查。

[root@localhost ~]# cat /usr/local/nginx/logs/nginx_error.log 
2018/01/05 17:47:18 [crit] 2456#0: *22 connect() to unix:/tmp/php1-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/1.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php1-fcgi.sock:", host: "test.com"

这里的socket文件应该是在/usr/local/php-fpm/etc/php-fpm.conf内定义的。

[root@localhost ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
# 定义了sock必须定义mode，不然权限为440，执行后会报错
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024

2. 设置未对应设置 php-fpm.conf为监听ip/端口，nginx虚拟主机配置文件内为监听socket，没有对应。

• 修改配置代码

[root@localhost ~]# vim /usr/local/php-fpm/etc/php-fpm.conf
...
# listen = /tmp/php-fcgi.sock
listen = 127.0.0.1:9000
...

# 检测语法错误并重启php服务
[root@localhost ~]# /usr/local/php-fpm/sbin/php-fpm -t
[05-Jan-2018 18:03:27] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful
[root@localhost ~]# /etc/init.d/php-fpm reload
Reload service php-fpm  done

• 暂时不修改虚拟主机配置文件进行访问测试

# 报502错
[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.2</center>
</body>
</html>

• 修改对应代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 
...
    fastcgi_pass 127.0.0.1:9000;
...

• 重启服务后测试效果

# 重启服务
[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

# 这里能成功访问
[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/
xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<style type="text/css">
body {background-color: #fff; color: #222; font-family: sans-serif;}
pre {margin: 0; font-family: monospace;}
a:link {color: #009; text-decoration: none; background-color: #fff;}
a:hover {text-decoration: underline;}
table {border-collapse: collapse; border: 0; width: 934px; box-shado
w: 1px 2px 3px #ccc;}
.center {text-align: center;}
.center table {margin: 1em auto; text-align: left;}
.center th {text-align: center !important;}
td, th {border: 1px solid #666; font-size: 75%; vertical-align: base
line; padding: 4px 5px;}
h1 {font-size: 150%;}
h2 {font-size: 125%;}
.p {text-align: left;}
.e {background-color: #ccf; width: 300px; font-weight: bold;}
.h {background-color: #99c; font-weight: bold;}
.v {background-color: #ddd; max-width: 300px; overflow-x: auto;}
.v i {color: #999;}
img {float: right; border: 0;}
hr {width: 934px; background-color: #ccc; border: 0; height: 1px;}
</style>
...

其余出现502错误的缘由还有服务器资源耗尽，出现这种问题的解决方法是进行优化。

---

Nginx代理

• 什么是代理 用户访问国外web服务器的速率一般比较慢，致使出现卡顿甚至没法访问的状况！经过在中间搭建一个代理服务器实现快速访问的目的。这个代理服务器既能够与用户端快速链接，也能够高速访问远程web服务器。用户经过访问代理服务器，间接地访问web服务器，大大加快访问速度。

• 代码实现

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/proxy.conf
server
{
    listen 80;
    server_name ask.apelearn.com;
    
    location /
    {
        # proxy_pass指定远程服务器的ip
        proxy_pass http://121.201.9.155/;
        
        # $host即为server_name
        proxy_set_header Host               $host;
        
        
        proxy_set_header X-Real-IP          $remote_addr;
        
        
        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
    }
}

• 验证效果

# 正常状况下，没法直接经过本机访问远程服务器
[root@localhost ~]# curl -x127.0.0.1:80 ask.apelea#n.com/robots.txt
# robots.txt for MiWen
#

User-agent: *

Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/

关闭代理设置，从新测试

# 关闭代理功能
[root@localhost ~]# mv /usr/local/nginx/conf/vhost/proxy.conf /usr/local/nginx/conf/vhost/proxy.conf.bak

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

# 没法直接经过本机访问远程服务器了
[root@localhost ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt -I
HTTP/1.1 404 Not Found
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 13:42:52 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive