InfoQ 2023-01-25 20:27:28 阅读数:225
[[email protected] ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
[[email protected] ~]# yum -y install epel-release
[[email protected] ~]# yum install -y gcc pcre pcre-devel zlib zlib-devel openssl openssl-devel
[[email protected] ~]# useradd -s /sbin/nologin -M nginx
[[email protected] ~]# wget http://nginx.org/download/nginx-1.13.12.tar.gz
[[email protected] ~]# tar -xzvf nginx-1.13.12.tar.gz
[[email protected] ~]# cd nginx-1.13.12/
[[email protected] ~]# ./configure --prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_stub_status_module
[[email protected] ~]# make && make install
[[email protected] ~]# /usr/local/nginx/sbin/nginx -t #检测配置文件正确性
[[email protected] ~]# /usr/local/nginx/sbin/nginx #启动Nginx
[[email protected] ~]# kill -QUIT $(cat /usr/local/nginx/logs/nginx.pid) #关闭Nginx
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid) #重启Nginx
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
41 #access_log logs/host.access.log main;
42
43 location / { #对根站点,设置密码认证
44 root html; #主页位置,相对路径
45 index index.html index.htm; #主页执行顺序
* auth_basic "welcome to admin"; #提示信息(自定义)
* auth_basic_user_file /usr/local/nginx/html/login.pad; #生成的密码文件
46 }
47
48 #error_page 404 /404.html;
49
50 # redirect server error pages to the static page /50x.html
[[email protected] ~]# yum install -y httpd
[[email protected] ~]# htpasswd -c /usr/local/nginx/html/login.pad lyshark #创建认证用户(覆盖)
[[email protected] ~]# htpasswd -m /usr/local/nginx/html/login.pad lyshark #写入认证用户(追加)
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
41 #access_log logs/host.access.log main;
42
43 location / {
44 root html;
45 index index.html index.htm;
* allow 192.168.1.10; #允许单个IP访问
* deny 192.168.1.10; #拒绝单个IP访问
* allow 0.0.0.0/0; #允许所有网段
* deny 0.0.0.0/0; #拒绝所有网段
46 }
47
48 #error_page 404 /404.html;
49
50 # redirect server error pages to the static page /50x.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# ifconfig
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.10 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 fe80::20c:29ff:fe1e:14e2 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:1e:14:e2 txqueuelen 1000 (Ethernet)
RX packets 40292 bytes 4129804 (3.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8962 bytes 1557264 (1.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eno16777728:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.20 netmask 255.255.255.0 broadcast 192.168.1.255
ether 00:0c:29:1e:14:e2 txqueuelen 1000 (Ethernet)
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
35 server {
* listen 192.168.1.10:80; #指定区域1的IP地址
37 server_name localhost;
38
39 location / {
* root html/vhost1; #指定区域1的文件目录
41 index index.html index.htm;
42 }
43
44 error_page 500 502 503 504 /50x.html;
45 location = /50x.html {
46 root html;
47 }
48 }
49 server {
* listen 192.168.1.20:80; #指定区域2的IP地址
51 server_name localhost;
52
53 location / {
* root html/vhost2; #指定区域2的文件目录
55 index index.html index.htm;
56 }
57
58 error_page 500 502 503 504 /50x.html;
59 location = /50x.html {
60 root html;
61 }
62 }
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost1/
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost2/
[[email protected] ~]# echo "ip 1 server" > /usr/local/nginx/html/vhost1/index.html
[[email protected] ~]# echo "ip 2 server" > /usr/local/nginx/html/vhost2/index.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
35 server { #主机区域1(server1)
* listen 80; #主机1端口
* server_name localhost; #主机1服务器名(域名1)
38
39 location / {
* root html/lyshark-80; #域名1网页存放位置
41 index index.html index.htm;
42 }
43 error_page 500 502 503 504 /50x.html;
44 location = /50x.html {
45 root html;
46 }
47 }
48 server { #主机区域2(server2)
* listen 8080; #主机区域2端口
* server_name localhost; #主机2服务器名(域名2)
51
52 location / {
* root html/lyshark-8080; #域名2网页存放位置
54 index index.html index.htm;
55 }
56
57 error_page 500 502 503 504 /50x.html;
58 location = /50x.html {
59 root html;
60 }
61 }
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost-80/
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost-8080/
[[email protected] ~]# echo "80 server zone" > /usr/local/nginx/html/vhost-80/index.html
[[email protected] ~]# echo "8080 server zone" > /usr/local/nginx/html/vhost-8080/index.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# yum install -y bind bind-chroot
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager.
Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version
Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version
Nothing to do
[[email protected] ~]# vim /etc/named.conf
12 options {
13 listen-on port 53 { any; };
14 listen-on-v6 port 53 { ::1; };
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 allow-query { any; };
[[email protected] ~]# vim /etc/named.rfc1912.zones
43 zone "vhost1.com" IN {
44 type master;
45 file "vhost1.com.zone";
46 allow-update { none; };
47 };
48 zone "vhost2.com" IN {
49 type master;
50 file "vhost2.com.zone";
51 allow-update { none; };
52 };
[[email protected] ~]# cp -a /var/named/named.localhost /var/named/vhost1.com.zone
[[email protected] ~]# cp -a /var/named/named.localhost /var/named/vhost2.com.zone
[[email protected] ~]# vim /var/named/vhost1.com.zone
$TTL 1D
@ IN SOA dns.vhost1.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost1.com.
dns A 127.0.0.1
www A 192.168.1.10
[[email protected] ~]# vim /var/named/vhost2.com.zone
$TTL 1D
@ IN SOA dns.vhost2.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost2.com.
dns A 127.0.0.1
www A 192.168.1.10
[[email protected] ~]# systemctl restart named
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
35 server { #主机区域1(server1)
36 listen 80;
* server_name www.vhost1.com; #主机1服务器名(域名1)
38
39 location / {
* root html/vhost1; #域名1网页存放位置
41 index index.html index.htm;
42 }
43 error_page 500 502 503 504 /50x.html;
44 location = /50x.html {
45 root html;
46 }
47 }
48 server { #主机区域2(server2)
49 listen 80;
* server_name www.vhost2.com; #主机2服务器名(域名2)
51
52 location / {
* root html/vhost2; #域名2网页存放位置
54 index index.html index.htm;
55 }
56
57 error_page 500 502 503 504 /50x.html;
58 location = /50x.html {
59 root html;
60 }
61 }
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost1/
[[email protected] ~]# mkdir /usr/local/nginx/html/vhost2/
[[email protected] ~]# echo "vhost1 server zone" > /usr/local/nginx/html/vhost1/index.html
[[email protected] ~]# echo "vhost2 server zone" > /usr/local/nginx/html/vhost2/index.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
41 #access_log logs/host.access.log main;
42
43 location / {
44 root html; #注释掉
45 index index.html index.htm; #注释掉
* proxy_pass http://192.168.1.100; #反向代理,当有人访问根时,自动转到100上
46 }
47
48 #error_page 404 /404.html;
49
50 # redirect server error pages to the static page /50x.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[实验环境]
[IP地址] [主机作用]
192.168.1.100 Nginx负载均衡
192.168.1.10 Apache主机1
192.168.1.20 Apache主机2
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
17 http {
18 include mime.types;
19 default_type application/octet-stream;
20 sendfile on;
21 keepalive_timeout 65;
22
---------------------------------------------------------------------------------------
*在下处填写负载均衡语句 <语句应写在http语句内并且是在server语句外填写>
* upstream lyshark.com { #自定义区域名
*
* server 192.168.1.10:80 weight 1; #负载均衡主机web1
* server 192.168.1.20:80 weight 2; #负载均衡主机web2
*
* server 192.168.1.30:80 weight 1 backup;
* #backup表示机器处于热备状态,weight代表权重,权重越高使用越多!
* }
---------------------------------------------------------------------------------------
31
32 server {
33 listen 80;
34 server_name localhost;
35
---------------------------------------------------------------------------------------
36 location / {
* # root html; #注释掉
* # index index.html index.htm; #注释掉
* proxy_pass http://lyshark.com; #代理交给上面的自定义区域处理
40 }
---------------------------------------------------------------------------------------
41
42 error_page 500 502 503 504 /50x.html;
43 location = /50x.html {
44 root html;
45 }
46 }
47 }
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# yum install -y pcre-devel zlib-devel openssl openssl-devel
[[email protected] ~]# openssl genrsa -des3 -out server.key 1024
----------------------------------------------------------------------------
[参数解释]
Genrsa –des3 #加密类型
-out server.key #输出文件
-1024 #加密长度
----------------------------------------------------------------------------
[[email protected] ~]# openssl req -new -key server.key -out server.csr
----------------------------------------------------------------------------
[参数解释]
req -new #新建证书
-key server.key #私钥文件
-out server.csr #输出文件
#注：依次输入：国家 省 市 组织 机构 全称 EMAIL 是否要改变密码 是否改名称
----------------------------------------------------------------------------
[[email protected] ~]# openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt
[[email protected] ~]# cp -a server.key /usr/local/nginx/conf/server.key #复制密钥到conf目录下
[[email protected] ~]# cp -a servernew.crt /usr/local/nginx/conf/server.crt #复制证书到conf目录下
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
33 #gzip on;
34
35 server {
* listen 443; #修改端口为443
37 server_name localhost;
38
----------------------------------------------------------------------------
#添加以下内容,启用证书
* ssl on; #开启SSL加密
* ssl_certificate server.crt; #证书位置
* ssl_certificate_key server.key; #密钥位置
* ssl_session_timeout 5m; #会话操作时间
* ssl_protocols TLSv1; #协议版本
* ssl_ciphers HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM; #指定使用加密算法
* ssl_prefer_server_ciphers on; #缓存开启
----------------------------------------------------------------------------
46
47 location / {
48 root html;
49 index index.html index.htm;
50 }
51
52 #error_page 404 /404.html;
53
54 # redirect server error pages to the static page /50x.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# elinks https://127.0.0.1:443
[实验效果]
当用户访问: http://127.0.0.1/index.html
将地址跳转到: http://59.110.167.239/index.html
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
24 server {
25 listen 80;
26 server_name localhost;
27
28 #charset koi8-r;
29
30 #access_log logs/host.access.log main;
31
32 location / {
----------------------------------------------------------------------------
* #root html; #注释掉
* #index index.html index.htm; #注释掉
----------------------------------------------------------------------------
35
----------------------------------------------------------------------------
#添加以下内容
* rewrite ^(.*)$ http://59.110.167.239 permanent; #实现地址全跳转(访问本机跳转到59.110.167.239上)
* rewrite ^(.*)$ https://$host$1 permanent; #实现自身http到https的全跳转
----------------------------------------------------------------------------
37 }
38
39 #error_page 404 /404.html;
40
41 # redirect server error pages to the static page /50x.html
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# elinks http://127.0.0.1/index.html
[实验效果]
用户访问: http://127.0.0.1/index.html
会跳转到: https://127.0.0.1/index.html
[[email protected] ~]# yum install -y pcre-devel zlib-devel openssl openssl-devel
[[email protected] ~]# openssl genrsa -des3 -out server.key 1024
[[email protected] ~]# openssl req -new -key server.key -out server.csr
[[email protected] ~]# openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt
[[email protected] ~]# cp -a server.key /usr/local/nginx/conf/server.key #复制密钥到conf目录下
[[email protected] ~]# cp -a servernew.crt /usr/local/nginx/conf/server.crt #复制证书到conf目录下
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
17 http {
18 include mime.types;
19 default_type application/octet-stream;
20 sendfile on;
21 keepalive_timeout 65;
22
23 server {
24 listen 80;
25 server_name localhost;
26
27 location / {
----------------------------------------------------------------------------
#修改以下内容
* #root html; #注释掉
* #index index.html index.htm; #注释掉
* rewrite ^(.*)$ https://$host$1 permanent; #实现自身http到https的跳转
----------------------------------------------------------------------------
31 }
32
33 error_page 500 502 503 504 /50x.html;
34 location = /50x.html {
35 root html;
36 }
37 }
38
39 server {
* listen 443;
41 server_name localhost;
42
----------------------------------------------------------------------------
#添加以下内容,启用证书
* ssl on; #开启SSL加密
* ssl_certificate server.crt; #证书位置
* ssl_certificate_key server.key; #密钥位置
* ssl_session_timeout 5m; #会话操作时间
* ssl_protocols TLSv1; #协议版本
* ssl_ciphers HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM; #指定使用加密算法
* ssl_prefer_server_ciphers on; #缓存开启
----------------------------------------------------------------------------
50
51 location / {
52 root html;
53 index index.html index.htm;
54
55 }
56
57 error_page 500 502 503 504 /50x.html;
58 location = /50x.html {
59 root html;
60 }
61 }
62 }
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# elinks http://127.0.0.1
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
return 301 https://$host;
add_header X-Frame-Options "DENY";
chrome://net-internals/
[实验环境]
[主机IP] [主机名称] [主机作用]
192.168.1.12 Nginx 反向代理+https认证
192.168.1.13 Web1 负载主机1
192.168.1.14 Web2 负载主机2
[实验过程]
1.生成SSL证书
2.配置一个DNS,实现本地解析,将192.168.1.12解析成 www.lyshark.com
3.配置好两台后台Apache服务器,12-13
4.安装并配置Nginx
5.Nginx能正常访问后
6.在做做http到https的跳转
7.紧接着跳转代理,做负载均衡
8.最后访问www.lyshark.com实现https跳转,和压力分摊
Nginx 192.168.1.12 解析成 www.lyshark.com
Apache Web1 192.168.1.13
Apache Web2 192.168.1.14
[[email protected] ~]# openssl genrsa -des3 -out server.key 1024
[[email protected] ~]# openssl req -new -key server.key -out server.csr
[[email protected] ~]# openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt
[[email protected] ~]# cp -a server.key /usr/local/nginx/conf/server.key
[[email protected] ~]# cp -a servernew.crt /usr/local/nginx/conf/server.crt
[[email protected] ~]# vim /usr/local/nginx/conf/nginx.conf
1 worker_processes 1;
2
3 events {
4 worker_connections 1024;
5 }
6
7
8 http {
9 include mime.types;
10 default_type application/octet-stream;
11 sendfile on;
12 keepalive_timeout 65;
13
----------------------------------------------------------------------------
#在此处填写负载均衡语句（在http语句内,server语句外填写）
* upstream lyshark.com { #自定义区域名
*
* server 192.168.1.13:80; #均衡主机1
* server 192.168.1.14:80; #均衡主机2
* }
----------------------------------------------------------------------------
19
20
21 server {
22 listen 80;
* server_name www.lyshark.com; #本机域名
24
25 location / {
----------------------------------------------------------------------------
#配置http到https的自身跳转
* #root html; #注释掉
* #index index.html index.htm; #注释掉
* rewrite ^(.*)$ https://$host$1 permanent; #将http请求跳转到https
----------------------------------------------------------------------------
29 }
30
31 error_page 500 502 503 504 /50x.html;
32 location = /50x.html {
33 root html;
34 }
35 }
36
37 server {
* listen 443; #修改端口
* server_name www.lyshark.com; #本机域名
40
----------------------------------------------------------------------------
#添加以下内容,启用证书
* ssl on; #开启SSL加密
* ssl_certificate server.crt; #证书位置
* ssl_certificate_key server.key; #密钥位置
* ssl_session_timeout 5m; #会话操作时间
* ssl_protocols TLSv1; #协议版本
* ssl_ciphers HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM; #指定使用加密算法
* ssl_prefer_server_ciphers on; #缓存开启
----------------------------------------------------------------------------
48
49 location / {
----------------------------------------------------------------------------
#地址跳转配置
* #root html; #注释掉
* #index index.html index.htm; #注释掉
* proxy_pass http://lyshark.com; #实现地址跳转,有80的请求转443
----------------------------------------------------------------------------
53 }
54
55 error_page 500 502 503 504 /50x.html;
56 location = /50x.html {
57 root html;
58 }
59 }
60 }
[[email protected] ~]# kill -HUP $(cat /usr/local/nginx/logs/nginx.pid)
[[email protected] ~]# elinks http://127.0.0.1/index.html
写入 (约在47行)
location /lyshark {
stub_status on;
}
#查看监控页面输入: http://127.0.0.1/lyshark
vim nginx-1.13.12/src/core/nginx.h
#define nginx_version 1013012
#define NGINX_VERSION "1.13.12"
#define NGINX_VER "nginx/" NGINX_VERSION
//修改完保存退出,编译即可
版权声明：本文为[InfoQ]所创，转载请带上原文链接，感谢。 https://qdmana.com/2023/025/202301252016176359.html