Nginx服务器

时间 2020-04-12

标签 nginx 服务器栏目 Nginx 繁體版

原文原文链接

搭建Nginx服务器（网站服务代理服务）php

rpm -q gcc gcc-c++html

yum -y groupinstall "开发工具" nginx

useradd nginxc++

yum -y install pcre-devel 依赖包web

yum -y install zlib-devel 依赖包vim

yum -y install openssl-devel 安全认证包后端

tar -zxvf nginx-1.8.0.tar.gz安全

cd nginx-1.8.0服务器

./configure --prefix=/usr/local/nginx --user=nginx --gourp=nginx session

\--with-http_stub_status_module --with-http_ssl_module（开启认证）

make && make install

ls /usr/local/nginx/ 成功显示如下文件证实安装成功

conf html logs sbin

conf 配置文件： nginx.conf 主配置文件 nginx.conf.default 模版

html 网页目录

logs 日志文件存放的目录

sbin 存放启动NGINX服务的启动命令 nginx

启动nginx服务(默认监听80)

[root@squid nginx]# netstat -utnalp | grep :80 有http先停掉

[root@squid nginx]# /usr/local/nginx/sbin/nginx

[root@squid nginx]# netstat -utnalp | grep :80

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 92

[root@squid nginx]# echo 123 > /usr/local/nginx/html/test.html 写网页文件

[root@squid nginx]# elinks --dump http://localhost/test.html 客户端测试

123

修改nginx服务端口：

mv nginx.conf nginx.conf.bak 备份配置文件

grep -v '^$\|#' nginx.conf.bak > nginx.conf 去除空行和注释行后到新配置文件

vim nginx.conf 修改 listen 8080;

/usr/local/nginx/sbin/nginx -s stop 停服务

/usr/local/nginx/sbin/nginx 启动服务

netstat -untlap | grep :8080

elinks --dump http://localhost:8080/test.html 指定端口测试

经常使用命令

[root@squid conf]# /usr/local/nginx/sbin/nginx -v 查看nginx版本

[root@squid conf]# /usr/local/nginx/sbin/nginx -V 查看nginx版本以及编安装详细信息

[root@squid conf]# /usr/local/nginx/sbin/nginx -t 测试配置文件是否正常

/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx2.conf 指定配置文件启动服务

中止服务的方法

/usr/local/nginx/sbin/nginx -s stop

killall -9 nginx

kill -信号 pid号

常见信号：

TERM, INT 快速关闭

QUIT 从容关闭，关闭主进程及子进程

HUP 重载配置文件

USR1 从新打开日志文件

USR2 平滑升级可执行程序

重启服务很方便

kill -HUP `cat /usr/local/nginx/logs/nginx.pid`

++++++++++++++++++++++++++++++++++

平滑升级（在线升级服务软件的版本）

tar -zxvf nginx-1.9.2.tar.gz

cd nginx-1.9.2

./configure --prefix=/usr/local/nginx --user=nginx --group=nginx

\--with-http_stub_status_module --with-http_ssl_module（开启认证）

make

cd /usr/local/nginx/sbin

mv nginx nginxold 备份旧的执行程序

cd nginx-1.9.2/objs

cp nginx /usr/local/nginx/sbin/ 拷贝新版本执行程序

cd nginx-1.9.2

make upgrade 执行升级

[root@squid conf]# /usr/local/nginx/sbin/nginx -v 查看nginx版本升级完成

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

虚拟主机（一台服务器提升多个网站）

基于域名虚拟主机（根据客户端访问的主机名区分访问）

基于端口虚拟主机

基于ip地址虚拟主机

++++++++++++++++++++++++++++++++++++++++++++++

基于域名虚拟主机

(服务器)

mkdir /wwwdir

mkdir /bbsdir

echo www > /wwwdir/a.html

echo bbs > /bbsdir/a.html

[root@A conf]# /usr/local/nginx/sbin/nginx -s stop 先中止服务

grep -v '^$' nginx.conf.default | grep -v '#' > nginx.conf

vim nginx.conf

worker_processes 1;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

server {

listen 80;

server_name www.tarena.com; 修改成指定域名

location / {

root /wwwdir; 指定网页目录

index a.html; 指定默认首页文件

}

server {

listen 80;

server_name bbs.tarena.com;

location / {

root /bbsdir;

index a.html;

}

./nginx -t 测试配置文件配置正确

./nginx 启动服务

(客户端)测试

vim /etc/hosts

172.25.254.151（服务端IP） www.tarena.com www

172.25.254.151（服务端IP） bbs.tarena.com bbs

:wq

ping www.tarena.com

ping bbs.tarena.com

elinks --dump ghtp://www.tarena.com

elinks --dump http://bbs.tarena.com

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

基于端口的虚拟主机（服务器根据客户端访问的端口区分访问）

实验需求

http://www.tarena.com -> /usr/local/nginx/html

http://www.tarena.com:8080 -> /wwwdir

http://www.tarena.com:8090 -> /bbsdir

vim nginx.conf

worker_processes 1;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

server {

listen 80;

server_name www.tarena.com;

location / {

root html;

index index.html;

}

server {

listen 8080; 指定不一样端口

#server_name www.tarena.com; 注销掉域名

location / {

root /wwwdir;

index a.html;

}

server {

listen 8090;

#server_name bbs.tarena.com;

location / {

root /bbsdir;

index a.html;

}

[root@A conf]# ../sbin/nginx -s stop

[root@A conf]# ../sbin/nginx

[root@A conf]# netstat -anptu |grep nginx

tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 51193/nginx

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 51193/nginx

tcp 0 0 0.0.0.0:8090 0.0.0.0:* LISTEN 51193/nginx

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

基于ip地址的虚拟主机

ifconfig eth0:1 1.0.0.200

vim nginx.conf

worker_processes 1;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

server {

listen 1.0.0.100:8090;

#server_name www.tarena.com;

location / {

root /wwwdir;

index a.html;

}

server {

listen 1.0.0.200:80;

#server_name bbs.tarena.com;

location / {

root /bbsdir;

index a.html;

}

[root@A conf]# ../sbin/nginx -s stop

[root@A conf]# ../sbin/nginx

[root@A conf]# netstat -anptu |grep nginx

tcp 0 0 1.0.0.200:80 0.0.0.0:* LISTEN 60910/nginx

tcp 0 0 1.0.0.100:8090 0.0.0.0:* LISTEN 60910/nginx

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

访问控制

访问控制 (默认容许全部客户端访问)

location / {

....

allow ip地址1；容许的访问

allow ip地址2；

#allow 172.40.1.0/14;

deny all;拒绝全部访问

}

elinks http://172.25.254.151:8090 客户端测试

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

用户验证(访问网站页面时，要提交正确用户和密码才能够访问)

location / {

.....

auth_basic "please input username and password";

auth_basic_user_file "/usr/local/nginx/conf/authuser.txt";

}

[root@squid conf]# kill -HUP `cat /usr/local/nginx/logs/nginx.pid` 重启nginx服务

rpm -q httpd-tools 查询有包没

[root@squid conf]# htpasswd -c /usr/local/nginx/conf/user.txt tom 生成验证文件，用户名为tom

New password: #输入密码

Re-type new password: #再次输入密码

Adding password for user webadmin #OK

[root@squid conf]# cat /usr/local/nginx/conf/user.txt

tom:VziCsLM3LWwXY

[root@squid conf]# htpasswd /usr/local/nginx/conf/user.txt tom2 建立第二个帐号为tom2

New password:

Re-type new password:

Adding password for user tom2

[root@squid conf]# cat /usr/local/nginx/conf/user.txt 查看帐号文件加密文件

tom:VziCsLM3LWwXY

tom2:gw4brc6MjcAqA

改为基于域名的服务客户端测试firefox http://www.tarena.com 提示输入用户名密码，配置成功

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

配置SSL，安全认证

（支持客户端使用https协议访问）https 数据加密传输

80 http:// 443https://

服务器配置

1生成私钥

2生成证书文件

3在服务的主配置文件里调用私钥和证书

cd /usr/local/nginx/conf/

[root@squid conf]#openssl genrsa -out cert.key 2048 //生成私钥

[root@squid conf]# openssl req -new -x509 -key cert.key -out cert.pem //生成证书

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN 中国代码

State or Province Name (full name) []:beijing 州或者省

Locality Name (eg, city) [Default City]:beijing 城市

Organization Name (eg, company) [Default Company Ltd]:tarena 公司名

Organizational Unit Name (eg, section) []:mis 部门

Common Name (eg, your name or your server's hostname) []:www.tarena.com 域名

Email Address []:plj@tarena.com 邮箱

[root@squid conf]#

server {

......

#listen 80;

listen 443 ssl;

server_name www.tarena.com;

ssl_certificate cert.pem;

ssl_certificate_key cert.key;

ssl_session_cache shared:SSL:1m;

ssl_session_timeout 5m;

ssl_ciphers HIGH:!aNULL:!MD5;

ssl_prefer_server_ciphers on;

......

}

重启nginx服务

客户端配置firefox https://tarena.com 注意http后面加s

+++++++++++++++++++++++++++++++++++++++++++++++++++++

反向代理

worker_processes 1;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

upstream "webgroup" { #定义源服务组

server 192.168.1.1:80 ;

server 192.168.1.2:8080 ;

}

server {

listen 80;

server_name localhost;

location / {

proxy_pass http://webgroup; 调用服务组

#proxy_pass http://192.168.1.1;

#root html;

#index index.html index.htm;

}

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

客户端测试.....................

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

nginx目前支持4种分配方式

轮询（默认的）：逐一循环调度（weight=1）

Weight：指定轮询概率，权重值和访问比率成正比

ip_hash：根据客户端IP分配固定的后端服务器

Fair：按后端服务器响应时间短的优先分配

设置服务器组中服务器的状态

down：表示当前server暂时不参与负载

max_fails：容许请求失败的次数（默认为1）

fail_timeout ：max_fails次失败后，暂停提供服务的时间

backup：备份服务器

举例：

.............

upstream sergrp {

#ip_hash;

serer 1.0.0.100:80 weight=2; 轮训权重为2，不设默认为1

server 1.0.0.200:80 down; 200不参与负载

server 1.0.0.201:80;

server 1.0.0.202:80 backup; 202为备份服务器

server 1.0.0.203:80 max_fails=2 fail_timeout=30; 容许失败2次，失败后暂停服务时间30秒

}

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

访问不一样网页格式

upstream "webgroup" {

server 192.168.1.1:80 max_fails=3 fail_timeout=30s;

server 192.168.1.2:8080;

}

upstream "htmlweb" {

server 192.168.1.1:80;

server 192.168.1.2:80;

}

upstream "phpweb" {

server 192.168.1.30:80;

server 192.168.1.40:80;

}

server {

listen 80;

location ~ \.html$ {

proxy_pass http://htmlweb;

}

location ~ \.php$ {

proxy_pass http://phpweb;

}

http://nginx_ip/a.html

http://nginx_ip/a.php