十二周四次课

时间  2019-12-04
标签 十二周 12周 四次 繁體版
原文   原文链接

十二周四次课php

12.13Nginx防盗链css

12.14Nginx访问控制html

12.15Nginx解析php相关配置mysql

12.16Nginx代理linux

12.13Nginx防盗链nginx

Nginx防盗链目录概要web

  • 配置以下，能够和上面的配置结合起来

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$ajax

{sql

    expires 7d;数据库

    valid_referers none blocked server_names  *.test.com ;

    if ($invalid_referer) {

        return 403;

    }

    access_log off;

}

Nginx防盗链

  • Nginx防盗链配置须要和不记录日志和过时时间结合在一块儿，由于都用到了“location”

1.打开配置文件 vim /usr/local/nginx/conf/vhost/test.com.conf

  • 注释掉一些配置

[root@tianqi-01 local]# vim /usr/local/nginx/conf/vhost/test.com.conf

  • 注释掉一些配置

#    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
#   {
#          expires      7d;
#          access_log off;
#    }

  • 添加一些配置

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;    //过时时间7天
    valid_referers none blocked server_names  *.test.com ;    //定义一个白名单，referer就是指一些域名
    if ($invalid_referer) {    //若是不是白名单里的
        return 403;        //返回403
    }
    access_log off;
}

  • 最后结果以下

server
{
    listen 80;
    server_name test.com test2.com test3.com;
    index index.html index.htm index.php;
    root /data/wwwroot/test.com;
    if ($host != 'test.com' ) {
        rewrite  ^/(.*)$  http://test.com/$1  permanent;
    }

#    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
#   {
#          expires      7d;
#          access_log off;
#    }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    valid_referers none blocked server_names  *.test.com ;
    if ($invalid_referer) {
        return 403;
    }
    access_log off;
}

    location ~ .*\.(js|css)$
    {
#          expires      12h;
          access_log off;
    }
access_log /tmp/test.com.log combined_realip;
}

保存退出

2.添加的配置中的 ~* 表示不区分大小写，另外防盗链的配置里面server_names能够不写照样

3.检查配置文件语法错误，并从新加载配置文件

[root@tianqi-01 local]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 local]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 local]# 

4.测试

[root@tianqi-01 local]# curl -x127.0.0.1:80 -I test.com/2.gif
HTTP/1.1 404 Not Found
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 13:02:00 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

[root@tianqi-01 local]# 

[root@tianqi-01 local]# curl -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 12:29:06 GMT
Content-Type: image/gif
Content-Length: 10
Last-Modified: Tue, 13 Mar 2018 13:30:40 GMT
Connection: keep-alive
ETag: "5aa7d280-a"
Expires: Wed, 21 Mar 2018 12:29:06 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes

[root@tianqi-01 local]# 

5.测试防盗链，使用curl -e

[root@tianqi-01 local]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 12:29:46 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

[root@tianqi-01 local]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 12:29:55 GMT
Content-Type: image/gif
Content-Length: 10
Last-Modified: Tue, 13 Mar 2018 13:30:40 GMT
Connection: keep-alive
ETag: "5aa7d280-a"
Expires: Wed, 21 Mar 2018 12:29:55 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes

[root@tianqi-01 local]# 

//这说明防盗链配置成功了

6.查看日志文件

[root@tianqi-01 local]# cat /tmp/test.com.log
127.0.0.1 - [13/Mar/2018:21:33:52 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:35:19 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:36:51 +0800] test.com "/2.jsagasg" 404 "-" "curl/7.29.0"
[root@tianqi-01 local]# 

12.14Nginx访问控制

•需求：访问/admin/目录的请求，只容许某几个IP访问，配置以下：

location /admin/

{

    allow 192.168.133.1;

    allow 127.0.0.1;

    deny all;

}

• mkdir /data/wwwroot/test.com/admin/

• echo “test,test”>/data/wwwroot/test.com/admin/1.html

• -t && -s reload

• curl -x127.0.0.1:80 test.com/admin/1.html -I

• curl -x192.168.133.130:80 test.com/admin/1.html -I

• 能够匹配正则

location ~ .*(abc|image)/.*\.php$

{

        deny all;

}

•根据user_agent限制

if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')

{

      return 403;

}

• deny all和return 403效果同样

Nginx访问控制

  • Nginx访问控制，在平时运维网站的时候，常常会有一些请求不正常，或者故意的作一些限制，一些重要的内容禁止别人访问，就能够作一个白名单，只容许本身的公网IP或者本身公司内的公网IP去访问
  • 在作Nginx访问控制目录的时候，限制的这个目录下没有index.html文件或者index.php文件，就会默认403

1.编辑配置文件vim /usr/local/nginx/conf/vhost/test.com.conf

  • 增长访问控制的代码

location /admin/

{

    allow 192.168.133.1;

    allow 127.0.0.1;

    deny all;

}

  • 最后结果以下

//假设访问的目录是admin，作一个限制

server
{
    listen 80;
    server_name test.com test2.com test3.com;
    index index.html index.htm index.php;
    root /data/wwwroot/test.com;
    if ($host != 'test.com' ) {
        rewrite  ^/(.*)$  http://test.com/$1  permanent;
    }

#    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
#   {
#          expires      7d;
#          access_log off;
#    }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    valid_referers none blocked server_names  *.test.com ;
    if ($invalid_referer) {
        return 403;
    }
    access_log off;
}

    location ~ .*\.(js|css)$
    {
#          expires      12h;
          access_log off;
    }
    location /admin/
    {
    allow 127.0.0.1;

    allow 192.168.11.136;
    deny all;
    }

access_log /tmp/test.com.log combined_realip;
}

保存退出

//在Apache中定义allow和deny是有前后顺序的，例如上一个先allow再deny的话，全部的都不能过去；而Nginx的话，只有匹配了第一项，其余的就再也不匹配。因此，Nginx的设置的效果就是以上两个IP经过，其它的不经过。

2.检查配置文件是否存在语法错误，并从新加载配置文件

[root@tianqi-01 local]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 local]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 local]# 

3.测试

[root@tianqi-01 local]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/admin/ 
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 13:20:51 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Mon, 12 Mar 2018 13:43:21 GMT
Connection: keep-alive
ETag: "5aa683f9-13"
Accept-Ranges: bytes

[root@tianqi-01 local]# curl -x192.168.11.136:80 -I test.com/admin/
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 13:22:10 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Mon, 12 Mar 2018 13:43:21 GMT
Connection: keep-alive
ETag: "5aa683f9-13"
Accept-Ranges: bytes

[root@tianqi-01 local]# 

[root@tianqi-01 local]# curl -x192.168.11.139:80 -I test.com/admin/
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 13:23:03 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Mon, 12 Mar 2018 13:43:21 GMT
Connection: keep-alive
ETag: "5aa683f9-13"
Accept-Ranges: bytes

4.查看日志

[root@tianqi-01 local]# !cat
cat /tmp/test.com.log
127.0.0.1 - [13/Mar/2018:21:33:52 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:35:19 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:36:51 +0800] test.com "/2.jsagasg" 404 "-" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:21:20:51 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:22:10 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:23:03 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
[root@tianqi-01 local]# 

//查看日志文件之后，会看到访问的192.168.11.139的来源IP也是192.168.11.136，由于它是被容许的，在白名单以内，因此显示状态码为200

5.查看IP，而后给ens37网卡配置IP

  • 先查看ens37网卡是否链接，而后更改链接ens37网卡模式为仅主机链接模式

[root@tianqi-01 ~]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.11.136  netmask 255.255.255.0  broadcast 192.168.11.255
        inet6 fe80::1eb9:8f9e:264a:7159  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:08:64:43  txqueuelen 1000  (Ethernet)
        RX packets 1460  bytes 148872 (145.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1031  bytes 131035 (127.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.11.139  netmask 255.255.255.0  broadcast 192.168.11.255
        ether 00:0c:29:08:64:43  txqueuelen 1000  (Ethernet)

ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::8834:1ebf:d84b:7dc9  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:08:64:4d  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 21  bytes 3238 (3.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 120  bytes 11061 (10.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 120  bytes 11061 (10.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@tianqi-01 ~]# 

6.给ens37网卡自动获取IP，而后再来查看ens36的网卡IP地址为192.168.233.128

[root@tianqi-01 ~]# dhclient ens37
[root@tianqi-01 ~]#

7.这时再来使用ens36网卡的IP来访问，会看到访问admin目录的状态码为403

[root@tianqi-01 ~]# curl -x192.168.233.128:80 test.com/admin/
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@tianqi-01 ~]# 

8.这时再来查看日志文件，会看到来源的IP为192.168.233.128，在配置文件中被没有被容许，因此为403

[root@tianqi-01 ~]# !cat
cat /tmp/test.com.log
127.0.0.1 - [13/Mar/2018:21:33:52 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:35:19 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:36:51 +0800] test.com "/2.jsagasg" 404 "-" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:21:20:51 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:22:10 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:23:03 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.233.128 - [14/Mar/2018:22:17:21 +0800] test.com "/admin/" 403 "-" "curl/7.29.0"
[root@tianqi-01 ~]# 

[root@tianqi-01 ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/admin/
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Wed, 14 Mar 2018 14:20:30 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Mon, 12 Mar 2018 13:43:21 GMT
Connection: keep-alive
ETag: "5aa683f9-13"
Accept-Ranges: bytes

[root@tianqi-01 ~]# 

//这里www.baidu.com是被容许的，由于来源IP是127.0.0.1

针对正则匹配

  • 例子
    • 网站被黑，数据库被盗窃，就是由于上传图片的目录没有作禁止解析php的操做，最终致使上传了一句话木马，php也能解析，因此网站就会被黑
  • 只要能上传的目录，都要禁掉，禁止解析PHP
  • 加如下代码，便可禁掉上传的目录解析PHP

location ~ .*(abc|image)/.*\.php$    //只要匹配upload，而后以php结尾的

{

        deny all;    //都禁掉

}

1.打开配置文件vim /usr/local/nginx/conf/vhost/test.com.conf

server
{
    listen 80;
    server_name test.com test2.com test3.com;
    index index.html index.htm index.php;
    root /data/wwwroot/test.com;
    if ($host != 'test.com' ) {
        rewrite  ^/(.*)$  http://test.com/$1  permanent;
    }   

#    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
#   {
#          expires      7d;
#          access_log off;
#    }     
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    valid_referers none blocked server_names  *.test.com ;
    if ($invalid_referer) {
        return 403;
    }   
    access_log off;
}   
 
    location ~ .*\.(js|css)$
    {
#          expires      12h;
          access_log off;
    }     
    location /admin/
    {
    allow 127.0.0.1;
    allow 192.168.11.136;
    deny all;
    }  
    
location ~ .*(upload|image)/.*\.php$
{
        deny all;
}       

access_log /tmp/test.com.log combined_realip;
}
2.检查配置文件语法错误，并从新加载配置文件

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

3.测试，首先是访问的那个目录，而后访问的php资源

4.建立一个upload目录，而后在建立一个php文件

[root@tianqi-01 ~]# mkdir /data/wwwroot/test.com/upload
[root@tianqi-01 ~]# echo "11111" > /data/wwwroot/test.com/upload/1.php
[root@tianqi-01 ~]# 

5.访问upload目录下的1.php文件，会看到是403状态码，被拒绝访问

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.php
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@tianqi-01 ~]# 

6.这时再upload目录下建立1.txt，再来测试访问

[root@tianqi-01 ~]# echo "dasdasdas" >/data/wwwroot/test.com/upload/1.txt
[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt
dasdasdas
[root@tianqi-01 ~]# 

7.查看访问日志cat /tmp/test.com.log

[root@tianqi-01 ~]# cat /tmp/test.com.log
127.0.0.1 - [13/Mar/2018:21:33:52 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:35:19 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [13/Mar/2018:21:36:51 +0800] test.com "/2.jsagasg" 404 "-" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:21:20:51 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:22:10 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.11.136 - [14/Mar/2018:21:23:03 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.233.128 - [14/Mar/2018:22:17:21 +0800] test.com "/admin/" 403 "-" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:22:20:30 +0800] test.com "/admin/" 200 "http://www.baidu.com/1.txt" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:22:30:14 +0800] test.com "/upload/1.php" 403 "-" "curl/7.29.0"
127.0.0.1 - [14/Mar/2018:22:30:49 +0800] test.com "/upload/1.txt" 200 "-" "curl/7.29.0"
[root@tianqi-01 ~]# 

根据user_agent限制

  • 若是你的网站被cc攻击，或者禁掉某些蜘蛛，若是你的网站想作一个被隐藏的网站，不想被别人搜索到，那么就能够将百度、谷歌、有道等这些蜘蛛封掉，没有任何蜘蛛爬到你的网站，也不将网址告诉任何人，那别人就没法知道你的站点，由于你的网站是被隐藏的。
  • 只须要根据user_agent限制，添加如下代码

if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')

{

      return 403;

}

  • deny all和return 403效果同样

1.打开配置文件vim /usr/local/nginx/conf/vhost/test.com.conf

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

server
{
    listen 80;
    server_name test.com test2.com test3.com;
    index index.html index.htm index.php;
    root /data/wwwroot/test.com;
    if ($host != 'test.com' ) {
        rewrite  ^/(.*)$  http://test.com/$1  permanent;
    }

#    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
#   {
#          expires      7d;
#          access_log off;
#    }
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    valid_referers none blocked server_names  *.test.com ;
    if ($invalid_referer) {
        return 403;
    }
    access_log off;
}

    location ~ .*\.(js|css)$
    {
#          expires      12h;
          access_log off;
    }
    location /admin/
    {
    allow 127.0.0.1;
    allow 192.168.11.136;
    deny all;
    }

location ~ .*(upload|image)/.*\.php$
{
        deny all;
}
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
      return 403;
}

access_log /tmp/test.com.log combined_realip;
}

保存退出

2.检查配置文件语法错误，并从新加载配置文件

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

3.模拟user_agent，访问测试，会看到显示403

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 06:31:01 GMT
Content-Type: text/plain
Content-Length: 10
Last-Modified: Wed, 14 Mar 2018 14:30:43 GMT
Connection: keep-alive
ETag: "5aa93213-a"
Accept-Ranges: bytes

[root@tianqi-01 ~]# curl -A "Tomatoslfdfsdf"  -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 06:31:11 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

[root@tianqi-01 ~]# 

  • deny all和return 403效果同样

4.若是访问的时候，改为小写再访问，则状态码为200，由于这个是严格匹配的

[root@tianqi-01 ~]# curl -A "tomatoslfdfsdf"  -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 06:32:19 GMT
Content-Type: text/plain
Content-Length: 10
Last-Modified: Wed, 14 Mar 2018 14:30:43 GMT
Connection: keep-alive
ETag: "5aa93213-a"
Accept-Ranges: bytes

[root@tianqi-01 ~]# 

5.若是想忽略大小写，在配置文件中的匹配符号后加 * 号便可

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

if ($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato')
{
      return 403;
}

6.再检查配置文件，并从新加载

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

7.再来测试，会显示403

[root@tianqi-01 ~]# curl -A "tomatoslfdfsdf"  -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 06:35:25 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive

[root@tianqi-01 ~]# 

12.15Nginx解析php相关配置

Nginx解析php相关配置目录概要

• 配置以下：

location ~ \.php$

    {

        include fastcgi_params;

        fastcgi_pass unix:/tmp/php-fcgi.sock;

        fastcgi_index index.php;

        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;

    }

• fastcgi_pass 用来指定php-fpm监听的地址或者socket

Nginx解析php相关配置

  • 添加如下代码

location ~ \.php$

    {

        include fastcgi_params;

        fastcgi_pass unix:/tmp/php-fcgi.sock;

        fastcgi_index index.php;

        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;

    }

1.打开虚拟主机配置文件，由于如今test.com.conf还不能解析php，加代码添加到配置文件中

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

server
{
    listen 80;
    server_name test.com test2.com test3.com;
    index index.html index.htm index.php;
    root /data/wwwroot/test.com;
    if ($host != 'test.com' ) {
        rewrite  ^/(.*)$  http://test.com/$1  permanent;
    }

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    valid_referers none blocked server_names  *.test.com ;
    if ($invalid_referer) {
        return 403;
    }
    access_log off;
}

    location ~ .*\.(js|css)$
    {
#          expires      12h;
          access_log off;
    }
    location /admin/
    {
    allow 127.0.0.1;
    allow 192.168.11.136;
    deny all;
    }

location ~ .*(upload|image)/.*\.php$
{
        deny all;
}
if ($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato')
{
      return 403;
}

location ~ \.php$
    {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/php-fcgi.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
    }

access_log /tmp/test.com.log combined_realip;
}

保存退出

2.生成作一个php文件，在/data/wwwroot/test.com/目录下生成3.php

[root@tianqi-01 ~]# vim /data/wwwroot/test.com/3.php

<?php
phpinfo();

保存退出

3.测试访问3.php，会看到没法解析3.php文件，显示出了源码

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<?php
phpinfo();
[root@tianqi-01 ~]# 

4.这时候检查配置文件语法错误，并从新加载配置文件

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

5.这时候再来访问3.php，会看到能够正常解析了（会看到网页的源码，不少行代码）

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php

6.如果解析php相关配置的 fastcgi_pass unix:/tmp/php-fcgi.sock; 这个路径被写错，会直接显示502，由于sock文件没有被找到

7.将配置文件改错后，从新加载后，再来访问3.php，会看到显示502状态码

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf 

//将tmp故意改为tmpd
[root@tianqi-01 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@tianqi-01 ~]# 

//这里的状态码是502，由于找不到socket文件

8.查看访问日志cat /usr/local/nginx/logs/nginx_error.log，会看到日志文件中会说没有这样的文件或目录

[root@tianqi-01 ~]# cat /usr/local/nginx/logs/nginx_error.log
2018/03/15 15:51:23 [crit] 2135#0: *8 connect() to unix:/tmd/php-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmd/php-fcgi.sock:", host: "test.com"
[root@tianqi-01 ~]# 

9.在遇到502的问题时，须要查看你配置的地址是否正确，首先查看错误日志，而后根据错误日志中提示，查看这个文件是否存在，在查看cat /usr/local/php-fpm/etc/php-fpm.conf你定义的sock是什么，那么在nginx的配置文件中写什么

[root@tianqi-01 ~]# ls /tmd/php-afcgi.sock
ls: cannot access /tmd/php-afcgi.sock: No such file or directory
[root@tianqi-01 ~]# cat /usr/local/php-fpm/etc/php-fpm.conf

[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
[root@tianqi-01 ~]# 

10.这时再去配置文件中更改回来便可，因此只要配置文件中的 fastcgi_pass unix:/tmp/php-fcgi.sock; 地址错误，就会显示502

502的另外一种状况

1.假设这时不监听sock，而去监听IP端口

2.首先更改配置vim /usr/local/php-fpm/etc/php-fpm.conf

  • 将#listen = /tmp/php-fcgi.sock注释掉，增长listen = 127.0.0.1:9000

[root@tianqi-01 ~]# vim /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
#listen = /tmp/php-fcgi.sock
listen = 127.0.0.1:9000
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024

保存退出

3.重启php 命令为/etc/init.d/php-fpm restart，php重启也支持reload

[root@tianqi-01 ~]# /etc/init.d/php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm  done
[root@tianqi-01 ~]# 

4.检查php文件是否存在语法错误，从新加载下nginx的配置文件

[root@tianqi-01 ~]# /usr/local/php-fpm/sbin/php-fpm -t
[15-Mar-2018 16:06:52] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

5.查看监听端口是否为127.0.0.1:9000

[root@tianqi-01 ~]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      821/nginx: master p 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      804/sshd            
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      933/master          
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      2188/php-fpm: maste 
tcp6       0      0 :::22                   :::*                    LISTEN      804/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      933/master          
tcp6       0      0 :::3306                 :::*                    LISTEN      1053/mysqld         
[root@tianqi-01 ~]# 

6.这时在来访问3.php，会看到显示为502

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@tianqi-01 ~]# 

7.查看配置文件会提示说文件不存在

8.这时候只须要在配置文件中作一个更改，在php配置那一块，注释掉unix，添加ip和端口

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

//在php配置那一块，注释掉unix，添加ip和端口

#fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_pass 127.0.0.1:9000;

保存退出

9.检查语法错误，并从新加载配置文件

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

10.再来访问3.php文件，会看到正常访问

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 08:49:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30

[root@tianqi-01 ~]# 

11.如果出现502，要检查下配置文件中的fastcgi_pass 这块是否nginx与php-fpm中所配置的地址是相匹配的

  • PHP下的listen = /tmp/php-fcgi.sock这段配置很重要，决定了nginx是否能正确解析而不是502
    • 当PHP配置文件 listen 使用sock时，那么对应的nginx配置文件下就必须使用 fastcgi_pass unix:/tmp/php-fcgi.sock；
    • 当PHP配置文件listen 使用 IP加端口“127.0.0.1：9000”的时候，那么对应的nginx就要改为fastcgi_pass 127.0.0.1：9000；

12.配置文件中的 fastcgi_param SCRIPT_FILENAME 中的地址路径/data/wwwroot/test.com$fastcgi_script_name;与配置文件最上方的 root /data/wwwroot/test.com; 相对应起来

502的其余状况

  • 在php5.4及之后的其余版本，有一个特色
  • 更改监听为sock，取消监听IP和端口，注释掉listen.mode

1.更改php-fpm的配置文件，取消注释listen = /tmp/php-fcgi.sock，注释掉#listen = 127.0.0.1:9000和#listen.mode = 666

[root@tianqi-01 ~]# vim /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
#listen = 127.0.0.1:9000
#listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024

2.从新加载php

[root@tianqi-01 ~]# /etc/init.d/php-fpm reload
Reload service php-fpm  done
[root@tianqi-01 ~]# 

3.查看sock文件的权限为660，属主和属组为root

[root@tianqi-01 ~]# ls -l /tmp/php-fcgi.sock 
srw-rw---- 1 root root 0 Mar 15 16:52 /tmp/php-fcgi.sock
[root@tianqi-01 ~]# 

4.更改nginx虚拟主机配置文件，取消 fastcgi_pass unix:/tmp/php-fcgi.sock; 的注释，注释掉#fastcgi_pass 127.0.0.1:9000;

  • fastcgi_pass unix:/tmp/php-fcgi.sock;这一行的配置是为了nginx去读sock文件

[root@tianqi-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

location ~ \.php$
    {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/php-fcgi.sock;
       #fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
    } 

5.从新加载nginx配置文件

[root@tianqi-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 ~]# 

6.这时候再来访问3.php，依然仍是显示502

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 502 Bad Gateway
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 08:55:48 GMT
Content-Type: text/html
Content-Length: 173
Connection: keep-alive

[root@tianqi-01 ~]# 

7.查看访问日志文件，显示访问文件，权限被拒绝

[root@tianqi-01 ~]# tail /usr/local/nginx/logs/nginx_error.log
2018/03/15 15:51:23 [crit] 2135#0: *8 connect() to unix:/tmd/php-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmd/php-fcgi.sock:", host: "test.com"
2018/03/15 16:33:01 [crit] 2212#0: *10 connect() to unix:/tmp/php-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-fcgi.sock:", host: "test.com"
2018/03/15 16:55:48 [crit] 2334#0: *14 connect() to unix:/tmp/php-fcgi.sock failed (13: Permission denied) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "HEAD HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-fcgi.sock:", host: "test.com"
[root@tianqi-01 ~]# 

8.sock文件默认权限使660，root用户能够读，root用户组也是可读的，惟独其余用户不能去读

9.看到是由nobody的身份去读nginx的

[root@tianqi-01 ~]# ps aux |grep nginx
root        821  0.0  0.1  21280  1684 ?        Ss   08:24   0:00 nginx: master process /usr/local/nginx/sbin/nginx -c /usr/local/nginx/confnginx.conf
nobody     2333  0.0  0.3  23160  3448 ?        S    16:55   0:00 nginx: worker process
nobody     2334  0.0  0.3  23160  3948 ?        S    16:55   0:00 nginx: worker process
root       2338  0.0  0.0 112660   984 pts/0    R+   16:57   0:00 grep --color=auto nginx
[root@tianqi-01 ~]# 

10.这时临时改变权限为nobody

[root@tianqi-01 ~]# chown nobody /tmp/php-fcgi.sock 
[root@tianqi-01 ~]# 

11.这时再去访问3.php会看到正常访问

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 09:00:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30

[root@tianqi-01 ~]# 

12.这就是由于nobody用户有读的权限，因此能够正常访问

13.在php-fpm的配置文件中定义listen.mode，就是为了让任何用户能够读

14.再去配置文件中取消listen.mode的注释

[root@tianqi-01 ~]# vim  /usr/local/php-fpm/etc/php-fpm.conf

listen.mode = 666

15.而后重启php-fpm的配置文件

[root@tianqi-01 ~]# /etc/init.d/php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm  done
[root@tianqi-01 ~]# 

16.查看文件的权限

[root@tianqi-01 ~]# ls -l /tmp/php-fcgi.sock 
srw-rw-rw- 1 root root 0 Mar 15 17:02 /tmp/php-fcgi.sock
[root@tianqi-01 ~]# 

17.访问3.php会看到正常访问

[root@tianqi-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 15 Mar 2018 09:03:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30

[root@tianqi-01 ~]# 

502的另外状况

  • 就是php-fpm服务，资源耗尽，也会显示502，这时候就须要去优化了

12.16Nginx代理

Nginx代理目录概要

输入图片说明

  • cd /usr/local/nginx/conf/vhost
  • vim proxy.conf //加入以下内容

• cd /usr/local/nginx/conf/vhost

• vim proxy.conf //加入以下内容

server

{

    listen 80;

    server_name ask.apelearn.com;

 

    location /

    {

        proxy_pass      http://121.201.9.155/;

        proxy_set_header Host   $host;

        proxy_set_header X-Real-IP      $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

Nginx代理

输入图片说明

  • 需求：
    • 用户须要访问web服务器，但用户由于各类缘由没办法直接访问或者访问很慢（私网无访问、境内访问国外服务器），因此，就须要一个能访问web服务器的代理者，让用户经过代理服务器访问，访问事后，再把结果反馈给用户
    • 中间者能够和WEB服务器互通，也能和用户互通
  • 解决方法
    • 建立代理服务器

1.首先切换目录cd /usr/local/nginx/conf/vhost

[root@tianqi-01 ~]# cd /usr/local/nginx/conf/vhost
[root@tianqi-01 vhost]# 

2.新建一个配置文件vim proxy.conf

//加入如下内容

server
{
    listen 80;
    server_name ask.apelearn.com;    //定义域名，论坛的网站

    location /
    {
        proxy_pass      http://121.201.9.155/;    //定义域名，论坛的IP
        proxy_set_header Host   $host;    //定义访问的域名为$host =server_name ask.apelearn.com
        proxy_set_header X-Real-IP      $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

保存退出

3.配置文件中，没有了root，由于这是一个代理服务器，它不须要访问本地服务器上的任何文件

4.在配置完成后，这台虚拟机就能够访问ask.apelearn.com论坛了

5.检查配置文件语法错误，并从新加载配置文件

[root@tianqi-01 vhost]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@tianqi-01 vhost]# /usr/local/nginx/sbin/nginx -s reload
[root@tianqi-01 vhost]# 

6.robots是针对蜘蛛的索引的一个列表，通常网站都会有robots

[root@tianqi-01 vhost]# curl ask.apelearn.com/robots.txt
#
# robots.txt for MiWen
#

User-agent: *

Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/[root@tianqi-01 vhost]# 

//robots是针对蜘蛛的索引列表，通常网站都会有这个东西

7.测试代理是否成功，指定本机的IP，也能去访问

[root@tianqi-01 vhost]# curl -x127.0.0.1:80  ask.apelearn.com/robots.txt
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@tianqi-01 vhost]# 

8.正常状况下，不去配置这个代理，是不可能经过本地访问到远程的站点的

9.这里代理服务器就是咱们的虚拟机，WEB服务器就是论坛

友情连接：阿铭linux

相关文章
相关标签/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公众号
   欢迎关注本站公众号,获取更多信息
联系我们 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程