Nginx service-service foundation, access control and virtual host

Others 2021-01-19 18:43:01 views: null

Article Directory

Among various web server software, in addition to Apache HTTP Server, there is also a lightweight HTTP server software-Nginx, developed by Igor Sysoev of Russia. Its stable and efficient features are gradually being used by more and more users. Recognized

1. Nginx service basics

A high-performance, lightweight web service software

  • High stability
  • Low system resource consumption
  • High processing power for concurrent HTTP connections
  • A single physical server can support 30,000~50,000 concurrent requests

1. Compile and install Nginx service

Nginx software package Baidu Cloud Portal: https://pan.baidu.com/s/1ETO7npwA_BS06paIHdxt9A (Extraction code: gva5)

  1. Turn off the firewall, and upload the software packages required to install nginx to the /opt directory
systemctl stop firewalld
systemctl disable firewalld
setenforce 0

cd /opt
#Xshell中直接"拖"进去
nginx-1.12.2.tar.gz
  1. Install dependencies
yum -y install pcre-devel zlib-devel gcc gcc-c++ make
  1. Create running users and groups (Nginx service program runs as nobody by default. It is recommended to create a special user account for it to control its access permissions more accurately)
useradd -M -s /sbin/nologin nginx
  1. Compile and install Nginx
cd /opt
tar zxvf nginx-1.12.2.tar.gz 

./configure \
--prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_stub_status_module
#指定nginx安装路径
#指定用户名
#指定组名
#启用 httpd_stub_status_module 模块以支持状态统计

make -j 4 && make install

ln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/
#优化路径，让系统识别nginx的操作命令
  1. Check, start, restart, stop nginx service
nginx -t
#检查配置文件是否正确

nginx
##启动

##停止
cat /usr/local/nginx/logs/nginx.pid
#先查看nginx的PID号
kill -3 <PID号>
kill -s QUIT <PID号>
killall -3 nginx
killall -s QUIT nginx 

##重载
kill -1 <PID号>
kill -s HUP <PID号>
killall -1 nginx
killall -s HUP nginx

##日志分隔，重新打开日志文件
kill -USR1 <PID号>

##平滑升级
kill -USR2 <PID号>

mark
mark

Note: -9 will be forcibly stopped, which may cause data loss. This example uses -3
and every time you restart, the PID number will change

  1. Add Nginx system service

method one:


vim /etc/init.d/nginx

#!/bin/bash
# chkconfig: - 99 20
# description: Nginx Service Control Script

COM="/usr/local/nginx/sbin/nginx"
PID="/usr/local/nginx/logs/nginx.pid"

case "$1" in
start)
        $COM
        ;;
stop)
        kill -s QUIT $(cat $PID)
        ;;
restart)
        $0 stop
        $0 start
        ;;
reload)
        kill -s HUP $(cat $PID)
        ;;
*)
        echo "Usage: $0 {start|stop|restart|reload}"
        exit 1
esac
exit 0


chmod +x /etc/init.d/nginx
chkconfig --add nginx
systemctl stop nginx
systemctl start nginx

Method Two:

vim /lib/systemd/system/nginx.service

[Unit]
Description=nginx                           #描述
After=network.target                        #描述服务类别
[Service]
Type=forking                                #后台运行形势
PIDFile =/usr/local/nginx/logs/nginx.pid    #PID文件位置
ExecStart=/usr/local/nginx/sbin/nginx       #启动服务
ExecrReload=/bin/kill -s HUP $MAINPID       #根据PID重载配置
ExecrStop=/bin/kill -s QUIT $MAINPID        #根据PID终止进程
PrivateTmp=true
[Install]
WantedBy=multi-user.target

vim /lib/systemd/system/nginx.service

[Unit]
Description=nginx
After=network.target
[Service]
Type=£orking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStart=/usr/local/nginx/sbin/nginx
ExecrReload=/bin/kill -s HUP $MAINPID
ExecrStop=/bin/ki11 -s QUIT $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target

chmod 754 /lib/systemd/system/nginx.service
systemctl start nginx.service
systemctl enable nginx.service

mark

note! There may be a problem that cannot be started normally. Have you installed apache before? There is a conflict. You have to stop the nginx process and restart it.
killall -3 nginx
nginx

2. Configuration file nginx.conf

Identify the main configuration file of the Nginx service

  1. Global configuration
user nobody;
#运行用户，若编译时未指定则默认为nobody
worker_ processes 1;
#工作进程数量,可配置成服务器内核数 * 2，如果网站访问量不大，一般设为1就够用了
#eror_log logs/error.log;
#错误日志文件的位置
#pid logs/nginx.pid;
#PID文件的位置
  1. I/O event configuration
events {
    
    
    use epoll;
    #使用 epoll 模型，2.6及以上版本的系统内核，建议使用epoll模型以提高性能
    worker_connections 4096;
    #每个进程处理4096个连接
}
#如提高每个进程的连接数还需执行"ulimit -n 65535"命令临时修改本地每个进程可以同时打开的最大文件数
#在Linux平台上，在进行高并发TCP连接处理时，最高的并发数最都要受到系统对用户单一进程同时可打开文件数量的限制(这是因为系统为每个TCP连接都要创建一个socket句柄，每个socket句柄同时也是一个文件句柄)
#可使用ulimit -a命令查看系统允许当前用户进程打开的文件数限制
  1. HTTP configuration
http {
    
    
    ##文件扩展名与文件类型映射表
    include     mime.types;
    ##默认文件类型
    default_type  application/octet-stream;
    ##日志格式设定
    #log_format  main   '$remote_ addr - $remote. user [stime_ local] "$request" '
    #                   '$status $body_ bytes_ sent "Shttp_ referer" '
    #                   "$http_user_agent" "$http_x_forwarded_for"';
    ##访问日志位置
    #access_Log logs/access.log main;
    #支持文件发送(下载) 
    sendfile    on;
    ##此选项允许或禁止使用socket的TCP_CORK的选项( 发送数据包前先缓存数据)，此选项仅在使用sendfile的时候使用
    #tcp_nopush        on;
    ##连接保持超时时间，单位是秒
    #keepalive_timeout  0;
    keepalive.timeout  65;
    ##gzip模块设置，设置是否开启gzip压缩输出
    #gzip   on; 

    #Web服务的监听配置
    ##Web服务的监听配置
    server (
        ##监听地址及端口
        listen 80;
        ##站点域名，可以有多个，用空格隔开
        server.name www.xcf.com;
        ##网页的默认字符集
        charset utf-8;
        ##根目录配置
        location / {
    
    
            ##网站根目录的位置/usr/local/nginx/html
            root html;
            ##默认首页文件名
            index index.html index.php;
        }
        ##内部错误的反馈页而
        error_page 500 502 503 504 /50x.html;
        #错误页而配置
        location = /50x.html {
    
    
            root html;
        }
    }
}
  1. Log format setting
日志格式设定：
$remote_addr与$http_x_forwarded_for用以记录客户端的ip地址;
$remote_user: 用来记录客户端用卢名称;
$time_local: 用来记录访问时间与时区;
$request: 用来记录请求的url与http协议;
$status: 用来记录请求状态,成功是200;
$body_bytes_sent: 记录发送给客户端文件主体内容大小;
$http_referer: 用来记录从那个页面链接访问过来的;
$http_user_agent: 记录客户浏览器的相关信息;

通常web服务器放在反向代理的后面，这样就不能获取到客户的IP地址了，通过$remote_add拿到的IP地址是反向代理服务器的IP地址。反问代理服务器在转发请求的http头信息中，可以增加x_forwarded_for信息，用以记录原有客户端的IP地址和原来客户端的请求的服务器地址。

##location常见配置指令，root、alias、proxy_pass

root（根路径配置): 请求www.kgc.com/test71.jpg，会返回文件/usr/local/nginx/html/test/1.jpg
alias（别名配置): 请求ww . kgc.com/test/1.jpg，会返回文件/usr/local/nginx/html/1.jpg
proxy_pass（反向代理配置>;
proxy_pass http://127.0.0.1:8080/;    会转发请求到http://127.0.0.1:8080/1.jpg
proxy_pass http://127.0.0.1:8080;
  • Set up temporary domain name resolution
echo "192.168.126.15 www.xcf.com" >> /etc/hosts

mark

[root@localhost ~]# cd /usr/local/nginx/html
[root@localhost html]# ls
50x.html  index.html
[root@localhost html]# mkdir test
[root@localhost html]# cd test/
[root@localhost test]# vim index.html
[root@localhost test]# systemctl restart nginx.service

mark

3. Access status statistics

  1. First use the command /usr/local/nginx/sbin/nginx -v to check whether the installed Nginx contains the HTTP_STUB_STATUS module
    mark
  2. Modify the nginx.conf configuration file, specify the access location and add the stub_status configuration
cd /usr/local/nginx/conf
cp nginx.conf{
    
    ,.bak}

vim /usr/local/nginx/conf/nginx.conf
.....
http {
    
    
.....
  server {
    
    
    listen 80;
    server_name www.xcf.com;
    charset utf-8;
    location / {
    
    
      root html;
      index index.html index.html;
    }
    ##添加stub_status 配置##
    location /status {
    
          #访问位置为/status
      stub_status on;       #打开状态统计功能
      access_log off;       #关闭此位置的日志记录
    }
  }
}

mark
mark

  1. Restart the service, access test
systemctl restart nginx

浏览器访问http://192.168.126.15/status

Active connections：表示当前的活动连接数
server accepts handled requests：表示已经处理的连接信息，三个数字依次表示已处理的连接数、成功的TCP握手次数、己处理的请求数

mark

Two, Nginx access control

1. Authorization-based access control

  1. Generate user password authentication file
yum install -y httpd-tools

htpasswd -c /usr/local/nginx/passwd.db zhangsan

chown nginx /usr/local/nginx/passwd.db
chmod 400 /usr/local/nginx/passwd.db
  1. Modify the corresponding directory of the main configuration file and add authentication configuration items
vim /usr/local/nginx/conf/nginx.conf
......
  server {
    
    
    location / {
    
    
      ......
      ##添加认证配置##
      auth_basic "secret" ;
      auth_basic_user_file /usr/local/nginx/passwd.db;
    }
  }

mark

  1. Restart the service, access test
nginx -t
systemctl restart nginx.service


浏览器访问http://www.xcf.com

mark

2. Client-based access control

Equivalent to whitelist and blacklist

访问控制规则如下:
deny IP/IP 段：拒绝某个 IP 或 IP 段的客户端访问
allow IP/IP 段：允许某个 IP 或 IP 段的客户端访问
规则从上往下执行，如匹配则停止，不再往下匹配

vim /usr/local/nginx/conf/nginx.conf
......
    server {
    
    
        location / {
    
    
        ......
        ##添加控制规则##
        deny 192.168.126.100;
        #拒绝访问的客户端IP
        allow all;
        #允许其它IP客户端访问
        }
    }
    
systemctl restart nginx

mark
mark

Three, Nginx virtual host

1. Domain-based virtual hosting

  1. Provide domain name resolution for virtual hosts
echo "192.168.126.15 www.xcf.com www.zxc.com" >> /etc/hosts
  1. Prepare web documents for virtual hosting
mkdir -p /var/www/html/xcf
mkdir -p /var/www/html/zxc
echo "<h1>www.xcf.com</h1>" > /var/www/html/xcf/index.html
echo "<h1>www.zxc.com</h1>" > /var/www/html/zxc/index.html
  1. Modify Nginx configuration file
vim /usr/local/nginx/conf/nginx.conf
......
http {
    
    
......
    server {
    
    
        listen 80;
        server_name www.xcf.com;
        #设置域名www.xcf.com
        charset utf-8;
        access_log logs/www.xcf.com.access.log;
        #设置日志名
        location / {
    
    
            root /var/www/html/xcf;
            #设置www.xcf.com的工作目录
            index index.html index.html;
        }
        error_page 500 502 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }

##以上模板完成后复制黏贴并进行简单修改即可
    server {
    
    
        listen 80;
        server_name www.zxc.com;
        #设置域名www.zxc.com
        charset utf-8;
        access_log logs/www.zxc.access.com.log;
        location / {
    
    
        root /var/www/html/zxc;
        index index.html index.html;
        }
        error_page 500 502 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }
}

nginx -t
systemctl restart nginx.service

mark
mark

2. IP-based virtual hosting

ifconfig ens33:0 192.168.126.65 netmask 255.255.255.0
ifconfig


vim /usr/local/nginx/conf/nginx.conf
......
http {
    
    
......
    server {
    
    
        listen 192.168.126.15:80;
        #设置监听地址192.168.126.15
        server_name www.xcf.com;
        charset utf-8;
        access_log logs/www.xcf.access.log;
        location / {
    
    
            root /var/www/html/xcf;
            index index.html index.php;
        }
        error_page 500 502 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }
    
    server {
    
    
        listen 192.168.126.65:80;
        #设置监听地址192.168.126.65
        server_name www.zxc.com;
        charset utf-8;
        access_log logs/www.zxc.access.log;
        location / {
    
    
            root /var/www/html/zxc;
            index index.html index.html;
        }
        error.page 500 502. 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }
}

nginx -t
systemctl restart nginx

浏览器访问
http://192.168.126.15
http://192.168.126.65

mark

mark
mark

3. Port-based virtual hosting

vim /usr/local/nginx/conf/nginx.conf
......
http {
    
    
......
    server {
    
    
        listen 192.168.126.15:8080;
        #设置监听8080 端口
        server_name www.xcf.com;
        charset utf-8;
        access_log logs/www.xcf.access.log;
        location / {
    
    
            root /var/www/html/xcf;
            index index.html index.html;
        }
        error_page 500 502. 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }

    server {
    
    
        listen 192.168.126.65:8888;
        #设置监听8888端口
        server_name www.zxc.com;
        charset utf-8;
        access_log logs/www.zxc.access.log;
        location / {
    
    
            root /var/www/html/benet;
            index index.html index.php; 
        }
        error_page 500 502 503 504 /50x.html;
        location = 50x.html{
    
    
            root html;
        }
    }
}

nginx -t
systemctl restart nginx.service


浏览器访问
http://192.168.126.15:8080
http://192.128.126.65:8888

mark

mark
mark

Guess you like

Origin blog.csdn.net/weixin_51486343/article/details/112390348
Recommended
Ranking
How to make the url of the picture have the download attribute and force the download. Jump browser to download automatically.
Lr CC 8.3 Installation Guide
MD5Utils (MD5 encryption tools! Unsalted)
Econ 325 (004)
Photo studio photography appointment app based on java SpringBoot and Vue uniapp
What is b
2017 Second Guangdong strong network Cup online game --Nonstandard
myeclipse8.5 add tomact7
mpeg1, mpeg2 and mpeg4 standard comparative analysis and summary
Tencent sub-sub-group 6-color program
Daily
More
2024-04-25(32)
2024-04-24(30)
2024-04-23(30)
2024-04-22(5)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)
2024-04-17(31)
2024-04-16(23)

Code World

© 2018 codetd.com