nginx service foundation and access control

1. Preliminary preparation

[root@localhost ~]# systemctl stop firewalld.service [root@localhost ~]# systemctl disable firewalld.service [root@localhost ~]# setenforce 0 setenforce: SELinux is disabled [root@localhost ~]# vim /etc/resolv.conf [root@localhost ~]# ping www.baidu.com PING www.a.shifen.com (180.101.49.11) 56(84) bytes of data. 64 bytes from 180.101.49.11 (180.101.49.11): icmp_seq=1 ttl=128 time=3.62 ms 64 bytes from 180.101.49.11 (180.101.49.11): icmp_seq=2 ttl=128 time=4.99 ms 64 bytes from 180.101.49.11 (180.101.49.11): icmp_seq=3 ttl=128 time=4.47 ms ^C --- www.a.shifen.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 3.627/4.366/4.995/0.569 ms [root@localhost ~]# ntpdate ntp1.aliyun.com 7 Oct 19:26:13 ntpdate[18515]: adjust time server 120.25.115.20 offset -0.001553 sec [root@localhost ~]# hostnamectl set-hostname kaka [root@localhost ~]# su [root@kaka ~]# yum -y install gcc gcc-c++ pcre-devel zlib-devel make

2. Prepare the compressed package and unzip the installation

[root@kaka ~]# rz -E rz waiting to receive. [root@kaka ~]# ls anaconda-ks.cfg original-ks.cfg Template picture download desktop nginx-1.12.2.tar.gz public Video document music [root@kaka ~]# tar zxf nginx-1.12.2.tar.gz -C /opt #Unpack to opt directory [root@kaka ~]# cd /opt/nginx-1.12.2/tar [root@kaka nginx-1.12.2]# ls auto CHANGES.ru configure html man src CHANGES conf contrib LICENSE README [root@kaka nginx-1.12.2]# ./configure \ > --prefix=/usr/local/nginx \ > --user=nginx \ > --group=nginx \ > --with-http_stub_status_module checking for OS + Linux 3.10.0-957.el7.x86_64 x86_64 checking for C compiler ... found ...... [root@kaka nginx-1.12.2]# make && make install

3. Create running users and optimize paths

[root@kaka nginx-1.12.2]# ln -s /usr/local/nginx/sbin/* /usr/local/sbin/ #Optimize profile path [root@kaka nginx-1.12.2]# useradd -M -s /sbin/nologin nginx

4. Check, enable and add system management

[root@kaka nginx-1.12.2]# nginx -t #Check whether the configuration file syntax is correct nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@kaka nginx-1.12.2]# nginx #Start service [root@kaka nginx-1.12.2]# ##stop it nginx service## cat /usr/local/nginx/logs/nginx.pid #First, check the PID number of nginx kill -3 <pid number> kill -s QUIT <pid number> killall -3 nginx killall -s QUIT nginx #-s option specifies the signal type, HUP signal indicates overload configuration, QUIT model indicates exit process ##heavy load nginx service## kill -1 <pid number> kill -s HUP <pid number> killall -1 nginx killall -s HUP nginx ##add to nginx System services( systemctl or service)## Method 1: in/etc/init.d Write script in directory for service Administration [root@kaka ~]# vim /etc/init.d/nginx #!/bin/bash # chkconfig: - 99 20 # chkcofig - "-" Indicates that startup management is not enabled (if not added)“#”, chkconfig add nginx will fail to load the configuration) # description: Nginx Service Control Script COM="/usr/local/nginx/sbin/nginx" #Command program file location (nginx) PID="/usr/local/nginx/logs/nginx.pid" #pid file case "$1" in start) $COM ;; stop) kill -s QUIT $(cat $PID) ;; restart) $0 stop $0 start ;; reload) kill -s HUP $(cat $PID) ;; *) echo "Usage: $0 " exit 1 esac exit 0 : wq [root@kaka ~]# chmod +x /etc/init.d/nginx [root@kaka ~]# chkconfig --add nginx #Add as system service [root@kaka ~]# systemctl stop nginx [root@kaka ~]# systemctl start nginx [root@kaka ~]# systemctl status nginx

##add to nginx System services( systemctl or service)## Method 2: use systemctl Administration [root@kaka ~]# vim /usr/lib/systemd/system/nginx.service [Unit] Description=nginx #describe After=network.target #Describe service category [Service] Type=forking #Background run type PIDFile =/usr/local/nginx/logs/nginx.pid #PID file location ExecStart=/usr/local/nginx/sbin/nginx #Start service ExecrReload=/bin/kill -s HUP $MAINPID #According to PID overload configuration ExecrStop=/bin/kill -s QUIT $MAINPID #Terminate process according to PID PrivateTmp=true [Install] WantedBy=multi-user.target #Startup level [root@kaka ~]# chmod 754 /lib/systemd/system/nginx.service #Setting 754 permissions is a security priority [root@kaka ]# killall -3 nginx #Note: using a third-party tool systemctl will conflict with other startup methods. End the process first when using other tools [root@kaka ~]# systemctl start nginx.service [root@kaka ~]# systemctl enable nginx.service

       Note: make a backup of the configuration file before modifying the configuration file to form a habit.

[root@kaka ~]# cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bak

[root@kang nginx]# cd html/ #Site directory to store web page files [root@kang html]# ls 50x.html index.html [root@kang nginx]# cd conf/ [root@kang conf]# ls fastcgi.conf koi-utf nginx.conf uwsgi_params fastcgi.conf.default koi-win nginx.conf.default uwsgi_params.default fastcgi_params mime.types scgi_params win-utf fastcgi_params.default mime.types.default scgi_params.default [root@kang conf]# cat nginx.conf #user nobody; #When nginx does not specify the user to run, the nobody user is used by default, that is, other users worker_processes 1; #The maximum number of worker processes used by nginx and the maximum number of available processes is 1 #error_log logs/error.log; #Error log file path / level #error_log logs/error.log notice; #error_log logs/error.log info; #Storage location of different types of log files #pid logs/nginx.pid; #PID file location #PID is a dynamically allocated resource after the program is loaded into memory by the operating system and becomes a process. Each time the program executes, the operating system will reload, PID It is different each time it is loaded. PPID Process number events { worker_connections 1024; #Maximum number of connections per worker process } # To increase the number of connections per process, execute "ulimit - N 65535" (temporary adjustment) The command temporarily modifies the maximum number of files that each local process can open at the same time http { #Define some functions of http protocol include mime.types; default_type application/octet-stream; #File extension and file type mapping table #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' #Log format settings # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; #Access log location sendfile on; #Support file sending (downloading) #tcp_nopush on; #This option allows or prohibits the use of TcP_CORK of socket (cache data before sending data packets), This option is only available when sendfile When using #keepalive_timeout 0; #Connection hold timeout keepalive_timeout 65; #gzip on; #Whether to turn on the compression function. On means to turn on server { #Define the listening configuration of web services listen 80; #The default listening port is 80 server_name localhost; #Or define the domain name, site domain name #charset koi8-r; #Character set support, (modified to Chinese UTF-8) #access_log logs/host.access.log main; #Access logs for this web service location / { #The core module uses regular expressions here. The / matching location is: / usr/local/nginx/html; the matching site home page root html; #The default home page type is html, and the site root directory location is / usr/local/nginx/html (relative path) index index.html index.htm; #The supported type of index is index.html } #error_page 404 /404.html; #"/" indicates the root directory of the web page file, which is actually / nginx/html/404.html # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; #When sending errors, a predefined error page can be displayed location = /50x.html { #Note the location error page matching rule root html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 #Match the pages that the back-end processes dynamic requests. The following is the configuration that supports php and jump # #location ~ \.php$ { #nginx judges the dynamic request rules and matches the files ending in. PHP in order to hand over the static request to PHP for processing # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 #pass jump #location ~ \.php$ { # root html; # fastcgi_pass 127.0.0.1:9000; # fastcgi_index index.php; # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; # include fastcgi_params; #} # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} } # another virtual host using mix of IP-, name-, and port-based configuration #Virtual host virtual host #server { #Virtual host configuration # listen 8000; # listen somename:8080; # server_name somename alias another.alias; # location / { # root html; # index index.html index.htm; # } #} # HTTPS server #Encryption mode template # #server { # listen 443 ssl; # server_name localhost; # ssl_certificate cert.pem; #Certificate file # ssl_certificate_key cert.key; #Key file for certificate # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; # location / { # root html; # index index.html index.htm; # } #} } [root@kang conf]#

[root@kaka ~]# echo "192.168.60.138 www.kl.com" >> /etc/hosts #Configure local mapping [root@kaka ~]# cd /usr/local/nginx/conf/nginx.conf ...... http { include mime.types; ...... #gzip on; server { listen 192.168.60.138:80; server_name www.kl.com; ...... #access_log logs/host.access.log main ...... #Add stub_status configuration location / status { #Visit / status: www.kl.com/status stub_status on; #Turn on the status statistics function access_log off; #Turn off logging at this location } ...... : wq

Note: at this time, the host browser accesses the IP address as follows:

    However, the browser cannot access the domain name. Only the local virtual machine is configured for domain name resolution, so the verification results in the virtual machine are as follows:

  Alternatively, you can use the command to verify:

[root@kaka ~]# curl www.kl.com <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> ......

Visit the / status website of nginx server to view status statistics, as follows:

Active connections: indicates the current number of active connections;

service accepts handled requests: indicates the connection information that has been processed. The three numbers in turn indicate the number of connections processed, the number of successful ncR handshakes, and the number of requests processed

1. Authorization based access control

         That is, when the user is required to enter the user name and password, he can access normally.

Htpawwd: htpasswd is a tool for directory access authentication.

-c: Create a password file. If the file exists, the content will be cleared and rewritten

[root@kaka ~]# yum install httpd-tools #install [root@kaka ~]# htpasswd -c /usr/local/nginx/passwd.db lisi #Create and generate user password authentication files, New password: Re-type new password: Adding password for user lisi [root@kaka ~]# cat /usr/local/nginx/passwd.db lisi:$apr1$vc1T3E5t$JwOZfXmbd8W6dPoTNk59q/ #The passwd.db file will be generated in the / usr/local/nginx / directory, the user name is lisi, the password is entered twice, and the ciphertext of the user and password will be generated in passwd.db. [root@kaka ~]# chown nginx /usr/local/nginx/passwd.db #Add Inginx management and grant 400 permissions [root@kaka ~]# chmod 400 /usr/local/nginx/passwd.db [root@kaka ~]# ll -d /usr/local/nginx/passwd.db -r-------- 1 nginx root 43 10 August 10:38 /usr/local/nginx/passwd.db [root@kaka ~]# vim /usr/local/nginx/conf/nginx.conf #Modify profile ...... #access_log logs/host.access.log main; #Add the following two lines to the following location location / { auth_basic "secret"; #Add authentication in the home page configuration item auth_basic_user_file /usr/local/nginx/passwd.db; #Add authentication in the home page configuration item root html; index index.html index.htm; } [root@kaka ~]# systemctl restart nginx.service #Remember to restart the service [root@kaka ~]# ulimit -n 65530 #You can increase the connection limit here

The verification results are as follows: enter the user name and password to access

2,

The access control rules are as follows:

deny IP/IP segment: deny client access to an IP or IP segment.

allow IP/IP segment: allows the access of clients of an IP or IP segment

The rule is executed from top to bottom. If it matches, it will stop and no longer match from bottom to top.

The client based access control configuration steps are as follows:

[root@kaka ~]# vim /usr/local/nginx/conf/nginx.conf ...... #access_log logs/host.access.log main; location / { root html; index index.html index.htm; deny 192.168.60.155; #Add deny this client IP allow all; #Allow normal access by other IP clients } ...... : wq #Restart the service and test. At this time, the virtual machine access server 192.168.60.138 with IP 192.168.60.155 cannot be accessed.

There are three main types of virtual hosts supported by Nginx:

Domain name based virtual host; IP based virtual host; port based virtual host.

It is implemented through the "server {}" configuration section. Each virtual web site has an independent configuration section, and the IP address, port and website name that they listen to can be specified separately.

1. Domain name based virtual host

#First, add domain name resolution [root@kaka ~]# echo "192.168.60.139 www.test1.com www.test2.com" >> /etc/hosts #Next, prepare the web page document of the virtual site [root@kaka ~]# mkdir -p /var/www/html/test1 [root@kaka ~]# mkdir -p /var/www/html/test2 [root@kaka ~]# echo "<h1> www.test1.com <h1>" > /var/www/html/test1/index.html [root@kaka ~]# echo "<h1> www.test2.com <h1>" > /var/www/html/test2/index.html [root@kaka ~]# cat /var/www/html/test1/index.html <h1> www.test1.com <h1> [root@kaka ~]# vim /usr/local/nginx/conf/nginx.conf #Add modify profile ...... server { listen 80; server_name www.test1.com; charset utf-8; access_log logs/test1.access.log ; location / { root /var/www/html/test1; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } server { listen 80; server_name www.test2.com; charset utf-8; access_log logs/test2.access.log ; location / { root /var/www/html/test2; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } [root@kaka ~]# systemctl restart nginx.service

The verification results are as follows:

  2. Port based virtual host

#First, add domain name resolution [root@kaka ~]# echo "192.168.60.139 www.test1.com " >> /etc/hosts #Next, prepare the web page document of the virtual site [root@kaka ~]# mkdir -p /var/www/html/test8080 [root@kaka ~]# echo "<h1>this is test8080<h1>" > /var/www/html/test8080/index.html [root@kaka ~]# vim /usr/local/nginx/conf/nginx.conf #Add modify profile ...... server { listen 192.168.60.139:80; server_name www.test1.com; charset utf-8; access_log logs/test1.access.log ; location / { root /var/www/html/test1; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } server { listen 192.168.60.139:8080; #Point to 8080 new port server_name www.test1.com; #Note that the same domain name, the same IP and different ports charset utf-8; access_log logs/test8080.access.log ; #Note the difference from port 80 location / { root /var/www/html/test8080; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } [root@kaka ~]# systemctl restart nginx.service

The verification results are as follows: note that you need to use an impassable port to access here. The default http port is 80

  3. IP address based virtual machine

#First, add the domain name resolution mapping [root@kaka ~]# echo "192.168.80.128 www.test1.com " >> /etc/hosts [root@kaka ~]# echo "192.168.80.155 www.test155.com " >> /etc/hosts #Next, prepare the web page document of the virtual site [root@kaka ~]# mkdir -p /var/www/html/test100 [root@kaka ~]# echo "<h1>this is test155<h1>" > /var/www/html/test155/index.html [root@kaka ~]# cat /var/www/html/test155/index.html <h1>this is test155<h1> [root@kaka test155]# ifconfig ens33:0 192.168.80.155 natmask 255.255.255.0 #Temporarily add virtual network card natmask: Unknown host ifconfig: `--help' gives usage information. [root@kaka ~]# vim /usr/local/nginx/conf/nginx.conf #Add modify profile ...... server { listen 192.168.80.128:80; server_name www.test1.com; charset utf-8; access_log logs/test1.access.log ; location / { root /var/www/html/test1; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } server { listen 192.168.80.155:80; server_name www.test155.com; #Note that the domain name here is different from the IP address and the same port charset utf-8; access_log logs/test155.access.log ; #Note the difference from test1 logs location / { root /var/www/html/test155; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } [root@kaka ~]# systemctl restart nginx.service

The verification results are as follows:

1. Supplementary command: systemctl status multiple services. You can view multiple service statuswatch - N 2 systemctl status nginx network   # Refresh the service status every 2 seconds for continuous monitoring

2. nginx source code compilation, installation and configuration file introduction

3. Access status statistics

4. Access state control. Authorization based and client IP address or IP address segment based

5. There are three types of virtual hosts supported by Nginx: domain name based virtual hosts; IP based virtual host; Port based virtual host.

Add new comment

0 comments