:Nginx web应用深入
1)Nginx功能模块化:
耦合度更低,易于管理。工作中做事学会低耦合。
SQA架构。RPC服务都属于低耦合的技术模式。
2)虚拟主机分类介绍(省略,看书)
3)实践基于域名的虚拟主机
[root@web02 ~]# cd /application/nginx/conf/
[root@web02 /application/nginx/conf]# egrep -v "^$|#" nginx.conf.default >nginx.conf
[root@web02 /application/nginx/conf]# cat -n nginx.conf
1 worker_processes 1;
2 events {
3 worker_connections 1024;
4 }
5 http {
6 include mime.types;
7 default_type application/octet-stream;
8 sendfile on;
9 keepalive_timeout 65;
10 server {
11 listen 80;
12 server_name localhost;
13 location / {
14 root html;
15 index index.html index.htm;
16 }
17 error_page 500 502 503 504 /50x.html;
18 location = /50x.html {
19 root html;
20 }
21 }
22 }
[root@web02 /application/nginx/conf]# cat -n nginx.conf
1 worker_processes 1;
2 events {
3 worker_connections 1024;
4 }
5 http {
6 include mime.types;
7 default_type application/octet-stream;
8 sendfile on;
9 keepalive_timeout 65;
10 server {
11 listen 80;
12 server_name www.etiantian.org;
13 location / {
14 root html/www;
15 index index.html index.htm;
16 }
17 }
18 }
[root@web02 /application/nginx/conf]# mkdir ../html/www
[root@web02 /application/nginx/conf]# echo "www.etiantian.org" >../html/www/index.html
[root@web02 /application/nginx/conf]# cat ../html/www/index.html
www.etiantian.org
[root@web02 /application/nginx/conf]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.1.5 lb01
172.16.1.6 lb02
172.16.1.7 web01
172.16.1.8 web02
172.16.1.9 web03
172.16.1.31 nfs01
172.16.1.41 backup
172.16.1.51 db01 db01.etiantian.org
172.16.1.61 m01
[root@web02 /application/nginx/conf]# echo "10.0.0.8 www.etiantian.org" >>/etc/hosts
[root@web02 /application/nginx/conf]# tail -1 /etc/hosts
10.0.0.8 www.etiantian.org
[root@web02 /application/nginx/conf]# ping www.etiantian.org
PING www.etiantian.org (10.0.0.8) 56(84) bytes of data.
64 bytes from www.etiantian.org (10.0.0.8): icmp_seq=1 ttl=64 time=0.050 ms
[root@web02 /application/nginx/conf]# echo 'PATH="/application/nginx/sbin:$PATH"'
>>/etc/profile
[root@web02 /application/nginx/conf]# . /etc/profile
[root@web02 /application/nginx/conf]# echo $PATH
/application/nginx/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@web02 /application/nginx/conf]# /application/nginx/sbin/nginx ^C
[root@web02 /application/nginx/conf]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf]# nginx -s reload
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# curl www.etiantian.org
www.etiantian.org
WINDOWS下测试:
C:\Windows\System32\drivers\etc\hosts
10.0.0.8 www.etiantian.org
[root@web02 /application/nginx/conf]# cat -n nginx.conf
1 worker_processes 1;
2 events {
3 worker_connections 1024;
4 }
5 http {
6 include mime.types;
7 default_type application/octet-stream;
8 sendfile on;
9 keepalive_timeout 65;
10 server {
11 listen 80;
12 server_name www.etiantian.org;
13 location / {
14 root html/www;
15 index index.html index.htm;
16 }
17 }
18 server {
19 listen 80;
20 server_name bbs.etiantian.org;
21 location / {
22 root html/bbs;
23 index index.html index.htm;
24 }
25 }
26 server {
27 listen 80;
28 server_name blog.etiantian.org;
▽ 29 location / {
30 root html/blog;
31 index index.html index.htm;
32 }
33 }
34 }
[root@web02 /application/nginx/conf]# mkdir ../html/{bbs,blog}
[root@web02 /application/nginx/conf]# echo "bbs.etiantian.org" >../html/bbs/index.html
[root@web02 /application/nginx/conf]# echo "blog.etiantian.org" >../html/blog/index.html
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# cat ../html/blog/index.html
blog.etiantian.org
[root@web02 /application/nginx/conf]# cat ../html/bbs/index.html
bbs.etiantian.org
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf]# nginx -s reload
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.1.5 lb01
172.16.1.6 lb02
172.16.1.7 web01
172.16.1.8 web02
172.16.1.9 web03
172.16.1.31 nfs01
172.16.1.41 backup
172.16.1.51 db01 db01.etiantian.org
172.16.1.61 m01
10.0.0.8 www.etiantian.org bbs.etiantian.org blog.etiantian.org
~
~
~
~
~
~
~
~
~
~
~
"/etc/hosts" 12L, 396C 已写入
[root@web02 /application/nginx/conf]# ping bbs.etiantian.org
PING www.etiantian.org (10.0.0.8) 56(84) bytes of data.
64 bytes from www.etiantian.org (10.0.0.8): icmp_seq=1 ttl=64 time=0.022 ms
64 bytes from www.etiantian.org (10.0.0.8): icmp_seq=2 ttl=64 time=0.056 ms
^C
--- www.etiantian.org ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.022/0.039/0.056/0.017 ms
[root@web02 /application/nginx/conf]# ping blog.etiantian.org
PING www.etiantian.org (10.0.0.8) 56(84) bytes of data.
64 bytes from www.etiantian.org (10.0.0.8): icmp_seq=1 ttl=64 time=0.228 ms
64 bytes from www.etiantian.org (10.0.0.8): icmp_seq=2 ttl=64 time=0.029 ms
^C
--- www.etiantian.org ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.029/0.128/0.228/0.100 ms
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# curl www.etiantian.org
www.etiantian.org
[root@web02 /application/nginx/conf]# curl bbs.etiantian.org
bbs.etiantian.org
[root@web02 /application/nginx/conf]# curl blog.etiantian.org
blog.etiantian.org
基于端口虚拟主机实践:
[root@web02 ~]# cd /application/nginx/conf/
[root@web02 /application/nginx/conf]# cp nginx.conf{,_BaseName}
[root@web02 /application/nginx/conf]# ls
fastcgi.conf index.html mime.types.default scgi_params win-utf
fastcgi.conf.default koi-utf nginx.conf scgi_params.default
fastcgi_params koi-win nginx.conf_BaseName uwsgi_params
fastcgi_params.default mime.types nginx.conf.default uwsgi_params.default
[root@web02 /application/nginx/conf]# vim nginx.conf
[root@web02 /application/nginx/conf]# vim nginx.conf
keepalive_timeout 65;
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
}
server {
listen 81;
server_name bbs.etiantian.org;
location / {
root html/bbs;
index index.html index.htm;
}
}
server {
listen 82;
server_name blog.etiantian.org;
"nginx.conf" 34L, 753C 已写入
[root@web02 /application/nginx/conf]# netstat -lntup|grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 14322/nginx:
master
[root@web02 /application/nginx/conf]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf]# nginx -s reload
[root@web02 /application/nginx/conf]# netstat -lntup|grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 14322/nginx:
master
tcp 0 0 0.0.0.0:81 0.0.0.0:* LISTEN 14322/nginx:
master
tcp 0 0 0.0.0.0:82 0.0.0.0:* LISTEN 14322/nginx:
master
[root@web02 /application/nginx/conf]# curl www.etiantian.org
www.etiantian.org
[root@web02 /application/nginx/conf]# curl bbs.etiantian.org:81
bbs.etiantian.org
[root@web02 /application/nginx/conf]# curl bbs.etiantian.org
www.etiantian.org
[root@web02 /application/nginx/conf]# curl blog.etiantian.org:82
blog.etiantian.org
[root@web02 /application/nginx/conf]# curl blog.etiantian.org
www.etiantian.org
1)浏览器输入www.etiantian.org
2)找LDNS-授权DNS获取到IP。
3)请求服务器发起三次握手。
4)建立http请求。
(10.0.0.8 80)
5)发起HTTP请求报文。
(4)先匹配请求的端口。
(5)然后匹配Server标签域名
(6)把对应域名下面站点目录
下的首页文件发给客户端。
(7)如果没有匹配的域名,
就把第一个虚拟机
主机发给客户端
基于IP的虚拟主机:
[root@web02 ~]# ip addr add 10.0.0.9 dev eth0 label eth0:9
[root@web02 ~]# ip addr add 10.0.0.10 dev eth0 label eth0:10
[root@web02 ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.8 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::20c:29ff:fe12:170c prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:12:17:0c txqueuelen 1000 (Ethernet)
RX packets 21765 bytes 18029629 (17.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12171 bytes 1426129 (1.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0:9: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.9 netmask 255.255.255.255 broadcast 0.0.0.0
ether 00:0c:29:12:17:0c txqueuelen 1000 (Ethernet)
eth0:10: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.10 netmask 255.255.255.255 broadcast 0.0.0.0
[root@web02 /application/nginx/conf]# cat -n nginx.conf
1 worker_processes 1;
2 events {
3 worker_connections 1024;
4 }
5 http {
6 include mime.types;
7 default_type application/octet-stream;
8 sendfile on;
9 keepalive_timeout 65;
10 server {
11 listen 10.0.0.8:80;
12 server_name www.etiantian.org;
13 location / {
14 root html/www;
15 index index.html index.htm;
16 }
17 }
18 server {
19 listen 10.0.0.9:80;
20 server_name bbs.etiantian.org;
21 location / {
22 root html/bbs;
23 index index.html index.htm;
24 }
25 }
26 server {
27 listen 10.0.0.10:80;
28 server_name blog.etiantian.org;
29 location / {
30 root html/blog;
31 index index.html index.htm;
32 }
33 }
34 }
[root@web02 /application/nginx/conf]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf]# nginx -s reload
[root@web02 /application/nginx/conf]# netstat -lntup|grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 14322/nginx:
master
tcp 0 0 0.0.0.0:81 0.0.0.0:* LISTEN 14322/nginx:
master
tcp 0 0 0.0.0.0:82 0.0.0.0:* LISTEN 14322/nginx:
master
[root@web02 /application/nginx/conf]# nginx -s stop
[root@web02 /application/nginx/conf]# nginx
[root@web02 /application/nginx/conf]# netstat -lntup|grep nginx
tcp 0 0 10.0.0.10:80 0.0.0.0:* LISTEN 14967/nginx:
master
tcp 0 0 10.0.0.9:80 0.0.0.0:* LISTEN 14967/nginx:
master
tcp 0 0 10.0.0.8:80 0.0.0.0:* LISTEN 14967/nginx:
master
[root@web02 /application/nginx/conf]# curl 10.0.0.8
www.etiantian.org
[root@web02 /application/nginx/conf]# curl 10.0.0.9
bbs.etiantian.org
[root@web02 /application/nginx/conf]# curl 10.0.0.10
blog.etiantian.org
一:什么是恶意域名解析
一般情况下,要使域名能访问到网站需要两步,第一步,将域名解析到网站所在的主机,第二步
,在web服务器中将域名与相应的网站绑定。但是,如果通过主机IP能直接访问某网站,那么把域名解析到
这个IP也将能访问到该网站,而无需在主机上绑定,也就是说任何人将任何域名解析到这个IP就能访问到
这个网站。
二:恶意域名解析的危害
可能您并不介意通过别人的域名访问到您的网站,但是如果这个域名是未备案域名呢?
假如那域名是不友善的域名,比如曾经指向非法网站,容易引发搜索引擎惩罚,连带IP受到牵连
。即使域名没什么问题,但流量也会被劫持到别的域名,从而遭到广告联盟的封杀。
三;如何防止,配置里第一个标签如下配置
server{
listen 80;
server_name _default;
return 500;
}
优化nginx配置文件:
[root@web02 /application/nginx/conf]# mkdir extra
[root@web02 /application/nginx/conf]# sed -n '10,17p' nginx.conf
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf]# sed -n '10,17p' nginx.conf >extra/01_www.conf
[root@web02 /application/nginx/conf]# sed -n '18,25p' nginx.conf
server {
listen 80;
server_name bbs.etiantian.org;
location / {
root html/bbs;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf]# sed -n '18,25p' nginx.conf >extra/02_bbs.conf
[root@web02 /application/nginx/conf]# sed -n '26,33p' nginx.conf
server {
listen 80;
server_name blog.etiantian.org;
location / {
root html/blog;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf]# sed -n '26,33p' nginx.conf >extra/03_blog.conf
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# cd extra/
[root@web02 /application/nginx/conf/extra]# cat 01_www.conf
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf/extra]# cat 02_bbs.conf
server {
listen 80;
server_name bbs.etiantian.org;
location / {
root html/bbs;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf/extra]# cat 03_blog.conf
server {
listen 80;
server_name blog.etiantian.org;
location / {
root html/blog;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf/extra]#
[root@web02 /application/nginx/conf/extra]# cd ../
[root@web02 /application/nginx/conf]# sed -n '10,33p' nginx.conf
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
}
server {
listen 80;
server_name bbs.etiantian.org;
location / {
root html/bbs;
index index.html index.htm;
}
}
server {
listen 80;
server_name blog.etiantian.org;
location / {
root html/blog;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf]# sed -i '10,33d' nginx.conf
[root@web02 /application/nginx/conf]# sed -i '10 i include extra/01_www.conf;\ninclude
extra/02_bbs.conf;\ninclude extra/03_blog.conf;' nginx.conf
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# cat nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include extra/01_www.conf;
include extra/02_bbs.conf;
include extra/03_blog.conf;
}
[root@web02 /application/nginx/conf]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf]# nginx -s reload
[root@web02 /application/nginx/conf]# curl www.etiantian.org
www.etiantian.org
[root@web02 /application/nginx/conf]# curl bbs.etiantian.org
bbs.etiantian.org
[root@web02 /application/nginx/conf]# curl blog.etiantian.org
blog.etiantian.org
别名:一个名字以外的另一名字
张三、小张
www.etiantian.org
etiantian.org
[root@web02 /application/nginx/conf]# cat extra/01_www.conf
server {
listen 80;
server_name www.etiantian.org etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
}
[root@web02 /application/nginx/conf]# nginx -v
nginx version: nginx/1.16.0
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]#
[root@web02 /application/nginx/conf]# nginx -V
nginx version: nginx/1.16.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/application/nginx-1.16.0/ --with-
http_stub_status_module --with-http_ssl_module --with-pcre
[root@web02 /application/nginx/conf]# cat extra/04_status.conf
#status
server{
listen 80;
server_name status.etiantian.org;
location / {
stub_status on;
access_log off;
}
}
10.0.0.8 www.etiantian.org bbs.etiantian.org blog.etiantian.org status.etiantian.org
==================================================
location
双重验证技术
1.谷歌验证器
1.1 ssh服务 ssh root@192.168.1.128
1.2 yes 输入密码
123456
第二次输入密码
SSH+谷歌验证器实现 二步验证登录 Google Authenticator(Google身份验证器)
1.3 安全
|--->行为验证码
|---->防 "图灵" 12306 图(PC破解不了 机器学习)
|--->谷歌验证器
location使用的语法例子为:
location [ = | ~ | ~* | ^~ ] uri {
...
}
if uri then
{
...
}
server {
listen 80;
server_name www.etiantian.org etiantian.org;
root html/www;
location / {
return 401;
}
location = / {
return 402;
}
location /documents/ {
return 403;
}
location ^~ /images/ {
return 404;
#匹配任何以/images/开头的任何查询并且停止搜索。
任何正则表达式匹配将不会被检查。
#"^~" 这个前缀的作用:在常规的字符串匹配检查之后,不做正则表达式的检查,即如果最明确的那个字符
串匹配的location配置中有此前缀,那么不会做正则表达式的检查。
}
}
location ~* \.(gif|jpg|jpeg)$ {
#匹配任何以 gif、jpg 或 jpeg 结尾的请求。
return 500;
}
access_log logs/access_www.log main gzip buffer=32k flush=5s;
}
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n" http://www.etiantian.org
402
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n" http://www.etiantian.org/
402
location = / {
return 402;
}
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n"
http://www.etiantian.org/index.html
401
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n"
http://www.etiantian.org/index.html
401
location / {
return 401;
}
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n"
http://www.etiantian.org/documents/document.html
403
location /documents/ {
return 403;
}
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n"
http://www.etiantian.org/images/1.gif
404
location ^~ /images/ {
return 404;
#匹配任何以/images/开头的任何查询并且停止搜索。任何正则表达式匹配将不会被检查。
#"^~" 这个前缀的作用:在常规的字符串匹配检查之后,不做正则表达式的检查,即如果最明确的那个字符
串匹配的location配置中有此前缀,那么不会做正则表达式的检查。
}
}
[root@web02 ~]# curl -s -o /dev/null -I -w "%{http_code}\n"
http://www.etiantian.org/documents/1.jpg
500
301跳转:
[root@web02 /application/nginx/conf/extra]# cat 01_www.conf
server {
listen 80;
server_name etiantian.org;
rewrite ^/(.*) http://www.etiantian.org/$1 permanent;
}
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
access_log logs/access_www.log main;
}
[root@web02 /application/nginx/conf/extra]# cat 01_www.conf
server {
listen 80;
server_name etiantian.org;
rewrite ^/(.*) http://www.etiantian.org/$1 permanent;
}
server {
listen 80;
server_name www.etiantian.org;
location / {
root html/www;
index index.html index.htm;
}
auth_basic "oldboy training";
auth_basic_user_file /application/nginx/conf/htpasswd;
access_log logs/access_www.log main;
}
[root@web02 /application/nginx/conf/extra]# nginx -t
nginx: the configuration file /application/nginx-1.16.0//conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0//conf/nginx.conf test is successful
[root@web02 /application/nginx/conf/extra]# nginx -s reload
yum install httpd-tools -y
[root@web02 /application/nginx/conf/extra]# htpasswd -cb /application/nginx/conf/htpasswd
oldboy 123456
Adding password for user oldboy
[root@web02 /application/nginx/conf/extra]# cat /application/nginx/conf/htpasswd
oldboy:$apr1$ESr9xJ4M$ajbuh4wtRDyRskuXrCp7q/
chmod 400 /application/nginx/conf/htpasswd
chown www /application/nginx/conf/htpasswd
403:
1、没有首页文件,index.xxx
2、站点目录权限太低
3、显示的禁止
allow 10.0.0.0/24;
deny all;
http://oldboy.blog.51cto.com/2561410/581383。