nginx(多实例)安装部署操作参考(linux)

企业开发 2020-11-26 17:04:40 阅读次数: 0

1. 安装环境准备

1.1 主机环境准备

1.1.1. 关闭selinux

sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
setenforce 0

1.1.2. 部署规划

实例1安装规划

软件安装路径：/usr/local/nginx/

软件日志路径：/usr/local/nginx/logs/

软件二进制路径：/usr/local/nginx/sbin/

软件缓存代理等路径：/usr/local/nginx/{client_body,proxy,fastcgi,uwsgi,scgi}

软件主配置文件路径：/usr/local/nginx/conf

软件子配置文件路径：/usr/local/nginx/conf/conf.d/

Pidfile路径：/usr/local/nginx/logs/nginx.pid

Lockfile路径：/var/lock/nginx.lock

sbin-path路径：/usr/local/nginx/sbin/nginx

端口规划：80

实例2安装规划

软件安装路径：/usr/local/nginx2/

软件日志路径：/usr/local/nginx2/logs/

软件二进制路径：/usr/local/nginx2/sbin/

软件缓存代理等路径：/usr/local/nginx2/{client_body,proxy,fastcgi,uwsgi,scgi}

软件主配置文件路径：/usr/local/nginx2/conf

软件子配置文件路径：/usr/local/nginx2/conf/conf.d/

Pidfile路径：/usr/local/nginx2/logs/nginx2.pid

Lockfile路径：/var/lock/nginx2.lock

sbin-path路径：/usr/local/nginx2/sbin/nginx2

端口规划 ：8080

1.1.3. 系统主机时间、时区、系统语言

l 本节视实际情况需要操作

l  修改时区
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
l  修改系统语言环境
echo 'LANG="en_US.UTF-8"' >> /etc/profile && source /etc/profile
l  配置主机NTP时间同步
yum -y install ntp
systemctl enable ntpd && systemctl start ntpd
echo 'server ntp1.aliyun.com' >> /etc/ntp.conf
echo 'server ntp2.aliyun.com' >> /etc/ntp.conf

2. Nginx安装部署

备注：2.2章节、2.3章节与2.4章节的依赖包可使用yum直接安装，安装指令如下：

yum install -y pcre-devel zlib-devel openssl-devel

也可按本文档使用源码安装。如果使用yum安装，要注意nginx的安装参数要删除如下三行

--with-pcre=../pcre-8.44 \
--with-zlib=../zlib-1.2.11 \
--with-openssl=../openssl-1.1.1g \

2.1 Nginx依赖安装与环境准备

l 添加用户与用户组（用户名请自行定义）

groupadd -r nginx && useradd -s /sbin/nologin -r -g nginx nginx

l CentOS平台安装依赖

yum -y install gcc gcc-c++ automake autoconf libtool make wget net-tools
yum install -y libxslt* libxml2* gd-devel perl-devel perl-ExtUtils-Embed GeoIP GeoIP-devel GeoIP-data

l 下载nginx-1.19.1.tar.gz安装包，并解压

cd /opt
wget http://nginx.org/download/nginx-1.19.1.tar.gz
tar -zxvf nginx-1.19.1.tar.gz

l 从根源上隐藏nginx版本号

(1)修改nginx.h文件如下三行配置信息变更，举例如下

vi /opt/nginx-1.19.1/src/core/nginx.h
修改前
#define nginx_version      1019001
#define NGINX_VERSION      "1.19.1"
#define NGINX_VER          "nginx/" NGINX_VERSION
修改后
#define nginx_version      1010001
#define NGINX_VERSION      "618"
#define NGINX_VER          "WEB/" NGINX_VERSION

(2)修改ngx_http_header_filter_module.c文件的ngx_http_server_string显示名称与步骤1中的NGINX_VER名称一致

vi /opt/nginx-1.19.1/src/http/ngx_http_header_filter_module.c
修改前
static u_char ngx_http_server_string[] = "Server: nginx" CRLF;
static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;
static u_char ngx_http_server_build_string[] = "Server: " NGINX_VER_BUILD CRLF;
修改后
static u_char ngx_http_server_string[] = "Server: WEB" CRLF;
static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;
static u_char ngx_http_server_build_string[] = "Server: " NGINX_VER_BUILD CRLF;

(2)修改ngx_http_special_response.c文件的ngx_http_error_tail显示名称与步骤1中的NGINX_VER名称一致

vi /opt/nginx-1.19.1/src/http/ngx_http_special_response.c
修改前
static u_char ngx_http_error_tail[] =
"<hr><center>nginx</center>" CRLF
"</body>" CRLF
"</html>" CRLF
;
修改后
static u_char ngx_http_error_tail[] =
"<hr><center>WEB</center>" CRLF
"</body>" CRLF
"</html>" CRLF
;

注：修改完成后注意保存配置文件

l Nginx部署环境准备

mkdir -pv /usr/local/nginx/{logs,client_body,proxy,fastcgi,uwsgi,scgi}
chown -R nginx:nginx /usr/local/nginx

2.2 Pcre安装

cd /opt
wget https://ftp.pcre.org/pub/pcre/pcre-8.44.tar.gz
tar -zxvf pcre-8.44.tar.gz
cd pcre-8.44/
./configure
make && make install

2.3 Zlib安装

cd /opt
wget http://www.zlib.net/fossils/zlib-1.2.11.tar.gz
tar -zxvf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure
make && make install

2.4 Openssl安装

cd /opt
wget https://ftp.openssl.org/source/old/1.1.1/openssl-1.1.1g.tar.gz
tar -zxvf openssl-1.1.1g.tar.gz
cd openssl-1.1.1g
./config
make && make install
openssl version
OpenSSL 1.1.1g  31 Mar 2020

l 备注：如果openssl版本输入不对应，需要重装，建议使用如下方法

cd openssl-OpenSSL_1_1_1g
./config  --prefix=/usr/local/openssl
make
make install
ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/local/lib/
ln -s /usr/local/openssl/lib/libcrypto.so.1.1  /usr/local/lib/
ln -s /usr/local/lib/libssl.so.1.1  /usr/lib/
ln -s /usr/local/lib/libcrypto.so.1.1  /usr/lib/
ln -s /usr/local/lib/libssl.so.1.1  /usr/lib64/
ln -s /usr/local/lib/libcrypto.so.1.1  /usr/lib64/
/usr/local/openssl/bin/openssl version
ldd /usr/local/openssl/bin/openssl
ldconfig -v
mv /usr/bin/openssl /usr/bin/openssl.old
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
openssl version
OpenSSL 1.1.1f  31 Mar 2020

l nginx安装时则需要指定openssl路径

--with-openssl=../openssl-1.1.1g \

2.5 Nginx安装

cd /opt/nginx-1.19.1
./configure \
--prefix=/usr/local/nginx \
--pid-path=/usr/local/nginx/logs/nginx.pid  \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_xslt_module \
--with-http_stub_status_module \
--with-http_sub_module \
--with-http_random_index_module \
--with-http_degradation_module \
--with-http_secure_link_module \
--with-http_gzip_static_module \
--with-http_perl_module \
--with-pcre=../pcre-8.44 \
--with-zlib=../zlib-1.2.11 \
--with-openssl=../openssl-1.1.1g \
--with-debug \
--with-file-aio \
--with-mail \
--with-mail_ssl_module \
--http-client-body-temp-path=/usr/local/nginx/client_body \
--http-proxy-temp-path=/usr/local/nginx/proxy \
--http-fastcgi-temp-path=/usr/local/nginx/fastcgi \
--http-uwsgi-temp-path=/usr/local/nginx/uwsgi \
--http-scgi-temp-path=/usr/local/nginx/scgi \
--with-stream \
--with-ld-opt="-Wl,-E"
make && make install

2.6 Nginx2安装

l 添加用户与用户组（用户名请自行定义）

groupadd -r nginx2 && useradd -s /sbin/nologin -r -g nginx2 nginx2

l Nginx2部署环境准备

mkdir -pv /usr/local/nginx2/{logs,client_body,proxy,fastcgi,uwsgi,scgi}
chown -R nginx2:nginx2 /usr/local/nginx2

l Nginx2安装

cd /opt/nginx-1.19.1
./configure \
--prefix=/usr/local/nginx2 \
--pid-path=/usr/local/nginx2/logs/nginx2.pid  \
--sbin-path=/usr/local/nginx2/sbin/nginx2 \
--conf-path=/usr/local/nginx2/conf/nginx.conf \
--error-log-path=/usr/local/nginx2/logs/error.log \
--http-log-path=/usr/local/nginx2/logs/access.log \
--lock-path=/var/run/nginx2.lock \
--user=nginx2 \
--group=nginx2 \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_xslt_module \
--with-http_stub_status_module \
--with-http_sub_module \
--with-http_random_index_module \
--with-http_degradation_module \
--with-http_secure_link_module \
--with-http_gzip_static_module \
--with-http_perl_module \
--with-pcre=../pcre-8.44 \
--with-zlib=../zlib-1.2.11 \
--with-openssl=../openssl-1.1.1g \
--with-debug \
--with-file-aio \
--with-mail \
--with-mail_ssl_module \
--http-client-body-temp-path=/usr/local/nginx2/client_body \
--http-proxy-temp-path=/usr/local/nginx2/proxy \
--http-fastcgi-temp-path=/usr/local/nginx2/fastcgi \
--http-uwsgi-temp-path=/usr/local/nginx2/uwsgi \
--http-scgi-temp-path=/usr/local/nginx2/scgi \
--with-stream \
--with-ld-opt="-Wl,-E"
make && make install
cd /usr/local/nginx2/conf
vim nginx.conf  --修改监听端口，避免启动冲突

2.7 配置nginx系统服务

1、添加nginx系统服务启动脚本

vi /etc/init.d/nginx
#!/bin/bash
#
# nginx - this script starts and stops the nginx daemon
#
# chkconfig:   2345 85 15
# description:  Nginx is an HTTP(S) server, HTTP(S) reverse \
#               proxy and IMAP/POP3 proxy server
#
# processname: nginx
# config:      /usr/local/nginx/conf/nginx.conf
# pidfile:     /usr/local/nginx/logs/nginx.pid

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0

nginx="/usr/local/nginx/sbin/nginx"
prog=$(basename $nginx)

NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf"

[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx

lockfile=/var/lock/nginx.lock

start() {
    [ -x $nginx ] || exit 5
    [ -f $NGINX_CONF_FILE ] || exit 6
    echo -n "Starting $prog: "
    daemon $nginx -c $NGINX_CONF_FILE
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
}

stop() {
    echo -n "Stopping $prog: "
    killproc $prog -QUIT
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
    return $retval
}

restart() {
    configtest || return $?
    stop
    sleep 1
    start
}

rh_status() {
    status $prog
}

rh_status_q() {
    rh_status >/dev/null 2>&1
}

case "$1" in
    start)
        rh_status_q && exit 0
        $1
        ;;
    stop)
        rh_status_q || exit 0
        $1
        ;;
    restart)
        $1
        ;;
    status)
        rh_status
        ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart}"
        exit 2
        ;;
esac

2、配置nginx系统服务及自启动

chmod +x /etc/init.d/nginx
chkconfig --add nginx && chkconfig nginx on
chkconfig --list nginx

3、启动与停止nginx服务

service nginx start    或使用  systemctl start nginx
service nginx status    或使用  systemctl status nginx
ps -ef|grep nginx
service nginx stop    或使用  systemctl stop nginx

2.8 配置nginx2系统服务

1、添加nginx系统服务启动脚本

vi /etc/init.d/nginx2
#!/bin/bash
#
# nginx - this script starts and stops the nginx daemon
#
# chkconfig:   2345 88 12
# description:  Nginx is an HTTP(S) server, HTTP(S) reverse \
#               proxy and IMAP/POP3 proxy server
#
# processname: nginx
# config:      /usr/local/nginx2/conf/nginx.conf
# pidfile:     /usr/local/nginx2/logs/nginx2.pid

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0

nginx="/usr/local/nginx2/sbin/nginx2"
prog=$(basename $nginx)

NGINX_CONF_FILE="/usr/local/nginx2/conf/nginx.conf"

[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx

lockfile=/var/lock/nginx2.lock

start() {
    [ -x $nginx ] || exit 5
    [ -f $NGINX_CONF_FILE ] || exit 6
    echo -n "Starting $prog: "
    daemon $nginx -c $NGINX_CONF_FILE
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
}

stop() {
    echo -n "Stopping $prog: "
    killproc $prog -QUIT
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
    return $retval
}

restart() {
    configtest || return $?
    stop
    sleep 1
    start
}

rh_status() {
    status $prog
}

rh_status_q() {
    rh_status >/dev/null 2>&1
}

case "$1" in
    start)
        rh_status_q && exit 0
        $1
        ;;
    stop)
        rh_status_q || exit 0
        $1
        ;;
    restart)
        $1
        ;;
    status)
        rh_status
        ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart}"
        exit 2
        ;;
esac

2、配置nginx2系统服务及自启动

chmod +x /etc/init.d/nginx2
chkconfig --add nginx2 && chkconfig nginx2 on
chkconfig --list nginx2

3、启动与停止nginx服务(启动时注意端口不可冲突)

service nginx2 start    或使用  systemctl start nginx2
service nginx2 status    或使用  systemctl status nginx2
ps -ef|grep nginx2
service nginx2 stop    或使用  systemctl stop nginx2

2.9 配置nginx环境变量

cat >>/etc/profile<<EOF
NGINX_HOME=/usr/local/nginx
PATH=\$NGINX_HOME/sbin:\$PATH

NGINX2_HOME=/usr/local/nginx2
PATH=\$NGINX2_HOME/sbin:\$PATH
EOF
source /etc/profile

2.10配置防火墙

配置操作系统防火墙（端口号根据实际添加）

针对CentOS6：

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT

service iptables save

针对CentOS7：

firewall-cmd --permanent --zone=public --add-port=80/tcp
firewall-cmd --permanent --zone=public --add-port=8080/tcp
firewall-cmd --reload

3. Nginx加固

3.1 安全审计

l 启用错误日志

#错误日志
error_log  logs/error.log;

l 启用访问日志

#访问日志
log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer"'
                      '"$http_user_agent" "$http_x_forwarded_for"'
                      '"$request_time" "$upstream_response_time"';
#日志缓存
 access_log  logs/access.log  main buffer=64k flush=60s;
  open_log_file_cache max=300 inactive=20s valid=1m min_uses=2;

3.2 隐藏nginx版本

l 在nginx.conf配置文件中添加隐藏nginx版本的参数

# hide nginx version
server_tokens off;

l 在fastcgi.conf配置文件中添加#注释如下配置隐藏php中nginx的版本信息

fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

3.3 数据保密性

l 配置防盗链，在nginx.conf对应的server中配置以下参数（根据实际环境需要配置）

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip)$ {
valid_referers none blocked 域名;
if ($invalid_referer) {
return 403;
break;
}
access_log off;
}

3.4 配置错误界面

l 把error.html放在nginx/html下。在nginx.conf的http中配置以下参数

error_page  404 500 502 503 504 505 /error.html;

3.5 Web前端安全

l 防止点击劫持，防止ie内容嗅探，防止xss，只能从本域名加载资源（外部脚本无法执行），在nginx.conf的server中配置以下参数（根据实际环境需要配置）

add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection 1;
#add_header Content-Security-Policy "default-src 'self'";

3.6 https安全

l 不使用SSL和TLS1.1以下，使用TLS1.2以上版本，在nginx.conf的server中配置以下参数（在启用https的场景中配置）

SSL_Protocols TLSv1.2;

3.7 访问控制

l 限制ip访问（因公网访问nginx，建议不设置。除非有恶意ip尝试cc***或暴力破解等非法操作）（根据实际环境需要配置）

location / {
deny 192.168.1.1; #拒绝IP
allow 192.168.1.0/24; #允许IP
allow 10.1.1.0/16; #允许IP
deny all; #拒绝其他所有IP
}

3.8 限制http请求方法

l 在nginx.conf的server中配置以下参数，只允许GET、POST两个http请求方式

    location / {
        if ($request_method !~* GET|POST) {
        return 403;
        }
}

l nginx禁用option方法，将下面语句添加到nginx.conf文件或者server模块中

if ($request_method ~* OPTIONS) {
return 404;
}

4. Nginx优化

4.1 Nginx工作进程数量

l 一般设置CPU的核心或者核心数x2（worker_processes最多开启8个）

grep ^processor /proc/cpuinfo | wc -l    //获取cpu核心数
worker_processes  4;

4.2 Nginx运行CPU亲和力

l  比如2核配置

worker_processes 2;
worker_cpu_affinity 01 10;

l  比如4核配置

worker_processes  4;
worker_cpu_affinity 0001 0010 0100 1000;

l  比如8核配置

worker_processes 8;
worker_cpu_affinity 00000001 00000010 00000100 0000100000010000 00100000 01000000 10000000;

4.3 优化内核参数与连接数

cat >>/etc/sysctl.conf<<EOF
fs.file-max = 6815744
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 10240 87380 12582912
net.ipv4.tcp_wmem = 10240 87380 12582912
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 40960
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 30
net.ipv4.ip_local_port_range = 1024 65000
EOF
sysctl -p
cat >>/etc/security/limits.conf<<EOF
*       soft    nofile      65535
*       hard    nofile      65535
*       soft    noproc      65535
*       hard    noproc      65535
EOF

4.4 Nginx事件处理

l 启用epoll模型以提高处理效率

events {
use epoll;
worker_connections 65535;
multi_accept on;
}

4.5 开启高效传输模式

sendfile  on;
tcp_nopush  on;

4.6 连接超时时间

l 保护服务器资源，CPU，内存与控制连接数

keepalive_timeout 60;
tcp_nodelay on;
client_header_buffer_size 4k;
open_file_cache max=102400 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 1;
client_header_timeout 60;
client_body_timeout 60;
reset_timedout_connection on;
send_timeout 20;
client_max_body_size 10m;

4.7 配置文件专属路径便携配置

不同的服务配置单独的conf文件，提高运维效率，以nginx.conf配置文件添加include参数

mkdir /usr/local/nginx/conf/conf.d
include /usr/local/nginx/conf/conf.d/*.conf;

4.8 Gzip调优

使用gzip压缩功能，可能为我们节约带宽，加快传输速度

gzip on;
gzip_min_length 2k;
gzip_buffers   4 32k;
gzip_http_version 1.1;
gzip_comp_level 6;
gzip_typestext/plain text/css text/javascriptapplication/json application/javascript application/x-javascriptapplication/xml;
gzip_vary on;
gzip_proxied any;

4.9 Expires缓存调优

缓存，主要针对于图片，css，js等元素更改机会比较少的情况下使用，特别是图片，占用带宽大，可以设置图片在浏览器本地缓存365d，css，js，html可以缓存个10来天。

location ~* \.(ico|jpe?g|gif|png|bmp|swf|flv)$ {
    expires 30d;
    #log_not_found off;
    access_log off;
}

location ~* \.(js|css)$ {
    expires 7d;
    log_not_found off;
    access_log off;
}

5. 结束

猜你喜欢

转载自blog.51cto.com/8355320/2554651
今日推荐
开放签电子签章：停止新增，优化体验，前进更进（五一假期前工作）
开源日报 | 中学生开源前端动画引擎；全球首个Llama3 8B中文版开源模型；联想电脑恐出局；Linus讽刺AI炒作
“百模大战”必有一战 | 2024中国“百模大战”竞争格局分析
最强开源大模型 Llama 3 上架 Gitee AI
虽然老乡鸡开源的不是代码，但背后的原因却让人很暖心
富文本编辑器 Quill 2.0 重磅发布，特性、可靠性与开发者体验大幅提升
周排行
使用Redis中间件解决商品秒杀活动中出现的超卖问题（使用Java多线程模拟高并发环境）
野指针及c++指针使用注意点
redis 3.0　新特性
(翻译)火狐操作系统javascript API
微信小程序开发入门
mysql数据查询之五子句(where、group by、having、order by和limit)
Codeforces Round #517 Div. 1翻车记
在caffe 中实现Generative Adversarial Nets（二）
企业级漏洞扫描工具
java byte数组与String互转
每日归档
更多
2024-04-23(26)
2024-04-22(39)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)
2024-04-17(5)
2024-04-16(70)
2024-04-15(42)
2024-04-14(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022