2018-04-26 Linux Learning

12.13 Nginx anti-theft chain

The configuration is as follows and can be combined with the above configuration.

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)${    expires 7d;    valid_referers none blocked server_names  *.test.com ;    if ($invalid_referer) {        return 403;    }    access_log off;}

Operation Process

[Email protected] ~]# vim/usr/local/nginx/conf/vhost/test.com.conf
Server
{
Listen 80;
server_name test.com test2.com test3.com;
Index index.html index.htm index.php;
root/data/wwwroot/test.com;
if ($host! = ' test.com ') {
Rewrite ^/(. *) $ http://test.com/$1 permanent;
}

Location ~. *. (gif|jpg|jpeg|png|bmp|swf) ${expires 7d;access_log off;} Location ~. *. (JS|CSS) ${expires 12h;access_log off;}

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)${    expires 7d;    valid_referers none blocked server_names  *.test.com ;    if ($invalid_referer) {        return 403;    }    access_log off;}access_log /tmp/test.com.log combined_realip;

}

[Email protected] ~]# Touch/data/wwwroot/test.com/1.txt
[Email protected] ~]# Vim/data/wwwroot/test.com/1.txt
Test Fangdaolian

Nginx Test not restarted

[[email protected] ~]# curl -x127.0.0.1:80 -I test.com/1.gifHTTP/1.1 200 OKServer: nginx/1.14.0Date: Fri, 20 Apr 2018 10:37:00 GMTContent-Type: image/gifContent-Length: 0Last-Modified: Fri, 20 Apr 2018 09:54:31 GMTConnection: keep-aliveETag: "5ad9b8d7-0"Expires: Fri, 27 Apr 2018 10:37:00 GMTCache-Control: max-age=604800Accept-Ranges: bytes[[email protected] ~]# curl -e "http://www.baidu.com/1.txt"  -x127.0.0.1:80 -I test.com/1.gifHTTP/1.1 200 OKServer: nginx/1.14.0Date: Fri, 20 Apr 2018 10:37:40 GMTContent-Type: image/gifContent-Length: 0Last-Modified: Fri, 20 Apr 2018 09:54:31 GMTConnection: keep-aliveETag: "5ad9b8d7-0"Expires: Fri, 27 Apr 2018 10:37:40 GMTCache-Control: max-age=604800Accept-Ranges: bytes

Re-start Nginx

[[email protected] ~]# /usr/local/nginx/sbin/nginx -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

Restart Nginx test

 [[email protected] ~]# curl-x127.0.0.1:80-i test.com/1.gifhttp/1.1 Okserver:nginx/1.14.0date:fri, PR 2018 10:39:25 Gmtcontent-type:image/gifcontent-length:0last-modified:fri, APR 2018 09:54:31 Gmtconnection:keep-a Liveetag: "5ad9b8d7-0" Expires:fri, APR 2018 10:39:25 gmtcache-control:max-age=604800accept-ranges:bytes[[email& Nbsp;protected] ~]# curl-e "Http://www.baidu.com/1.txt"-x127.0.0.1:80-i test.com/1.gifhttp/1.1 403 forbiddenserver:n Ginx/1.14.0date:fri, APR 2018 10:39:38 gmtcontent-type:text/htmlcontent-length:169connection:keep-alive[[email& Nbsp;protected] ~]# curl-e "Http://www.test.com/1.txt"-x127.0.0.1:80-i test.com/1.gifhttp/1.1 4.0date:fri, Apr 2018 10:40:14 Gmtcontent-type:image/gifcontent-length:0last-modified:fri, Apr 2018 09:54:31 GMT Connection:keep-aliveetag: "5ad9b8d7-0" Expires:fri, APR 2018 10:40:14 gmtcache-control:max-age= 604800accept-ranges:bytes above two tests indicate that the anti-theft chain has succeeded 

12.14 Nginx Access Control

Requirements: Access to the/admin/directory request, only a few IP access is allowed, configured as follows:
location/admin/
{
Allow 192.168.133.1;
Allow 127.0.0.1;
Deny all;
}

mkdir/data/wwwroot/test.com/admin/
echo "Test,test" >/data/wwwroot/test.com/admin/1.html
-T &&-S reload
Curl-x127.0.0.1:80 Test.com/admin/1.html-i
Curl-x192.168.133.130:80 Test.com/admin/1.html-i

Operation Process

[Email protected] test.com]# vim/usr/local/nginx/conf/vhost/test.com.conf
Server
{
Listen 80;
server_name test.com test2.com test3.com;
Index index.html index.htm index.php;
root/data/wwwroot/test.com;
if ($host! = ' test.com ') {
Rewrite ^/(. *) $ http://test.com/$1 permanent;
}

Location ~. *. (gif|jpg|jpeg|png|bmp|swf) ${expires 7d;access_log off;} Location ~. *. (JS|CSS) ${expires 12h;access_log off;}

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)${    expires 7d;    valid_referers none blocked server_names  *.test.com ;    if ($invalid_referer) {        return 403;    }    access_log off;}   location /admin/{    allow 127.0.0.1;    allow 192.168.106.160;    deny all;}   access_log /tmp/test.com.log combined_realip;

}

  [[email protected] test.com]#/usr/local/nginx/sbin/nginx-tnginx:the configuration file/usr/local/ nginx/conf/nginx.conf syntax is oknginx:configuration file/usr/local/nginx/conf/nginx.conf test is successful[[email& Nbsp;protected] test.com]#/usr/local/nginx/sbin/nginx-s reload[[email protected] test.com]# curl-e "/http/ Www.baidu.com/1.txt "-x127.0.0.1:80-i test.com/admin/http/1.1 okserver:nginx/1.12.2date:tue, 2018 19:32:41 Gmtcontent-type:text/htmlcontent-length:19last-modified:mon, 2018 21:02:38 Gmtconnection:keep-aliveetag: " 5ab95fee-13 "accept-ranges:bytes[[email protected] test.com]# curl-x192.168.106.160:80-i test.com/admin/HTTP/ 1.1 Okserver:nginx/1.12.2date:tue, Mar 2018 19:34:01 gmtcontent-type:text/htmlcontent-length:19last-modified:m On, Mar 2018 21:02:38 Gmtconnection:keep-aliveetag: "5ab95fee-13" Accept-ranges:bytes  

can match the regular
Location ~. (abc|image)/. php$
{
Deny all;
}
Restrictions according to User_agent
if ($http _user_agent ~ ' spider/3.0| Youdaobot| Tomato ')
{
return 403;
}
Deny all is the same as the return 403 effect

[Email protected] ~]# vim/usr/local/nginx/conf/vhost/test.com.conf

Continue adding in the configuration:
Location ~. (upload|image)/. php$
{
Deny all;
}

[[email protected] ~]# mkdir/data/wwwroot/test.com/upload[[email protected] ~]# echo "11111" >/data/ Wwwroot/test.com/upload/1.php[[email protected] ~]# curl-x127.0.0.1:80 test.com/upload/1.php11111[[email  protected] ~]#/usr/local/nginx/sbin/nginx-tnginx:the configuration file/usr/local/nginx/conf/nginx.conf Syntax is oknginx:configuration file/usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]#/ Usr/local/nginx/sbin/nginx-s reload[[email protected] ~]# curl-x127.0.0.1:80 test.com/upload/1.php

When added, matches the case

[[email protected] ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

Continue to add the following
if ($http _user_agent ~ ' spider/3.0| Youdaobot| Tomato ')
{
return 403;
}

[[email protected] ~]# curl-a "Tomatosljlas"-x127.0.0.1:80 test.com/upload/1.txt-ihttp/1.1 1.14.0date:fri, Apr 2018 13:51:44 Gmtcontent-type:text/plaincontent-length:7last-modified:fri, Apr 2018 11:06:09 Gmtconnection:keep-aliveetag: "5ad9c9a1-7" accept-ranges:bytes[[email protected] ~]# curl-a "Tomatosljlas"- x127.0.0.1:80 test.com/upload/1.txt-ihttp/1.1 Okserver:nginx/1.14.0date:fri, APR 2018 13:52:18 GMTContent-Type: Text/plaincontent-length:7last-modified:fri, APR 2018 11:06:09 Gmtconnection:keep-aliveetag: "5ad9c9a1-7" Accept-ranges:bytes[[email protected] ~]#/usr/local/nginx/sbin/nginx-tnginx:the configuration file/usr/local /nginx/conf/nginx.conf syntax is oknginx:configuration file/usr/local/nginx/conf/nginx.conf test is Successful[[email  protected] ~]#/usr/local/nginx/sbin/nginx-s reload[[email protected] ~]# curl-a "Tomatosljlas"- X127.0.0.1:80 test.com/upload/1.txt-ihttp/1.1 403 ForbiddenserVer:nginx/1.14.0date:fri, APR 2018 13:53:02 gmtcontent-type:text/htmlcontent-length:169connection:keep-alive[[ Email protected] ~]# curl-a "Tomatosljlas"-x127.0.0.1:80 test.com/upload/1.txt-ihttp/1.1 1.14.0date:fri, Apr 2018 13:53:06 Gmtcontent-type:text/plaincontent-length:7last-modified:fri, Apr 2018 11:06:09 Gmtconnection:keep-aliveetag: "5ad9c9a1-7" accept-ranges:bytes

Modify if line, add * number, case is recognized

[Email protected] ~]# vim/usr/local/nginx/conf/vhost/test.com.conf
if ($http _user_agent ~* ' spider/3.0| Youdaobot| Tomato ')
{
return 403;
}

[[email protected] ~]# /usr/local/nginx/sbin/nginx -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload[[email protected] ~]# curl -A "tomatosljlas" -x127.0.0.1:80 test.com/upload/1.txt -IHTTP/1.1 403 ForbiddenServer: nginx/1.14.0Date: Fri, 20 Apr 2018 13:58:17 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-alive

12.15 Nginx parsing PHP related configuration

The configuration is as follows:
Location ~. php$
{
Include Fastcgi_params;
Fastcgi_pass Unix:/tmp/php-fcgi.sock;
Fastcgi_index index.php;
Fastcgi_param Script_filename/data/wwwroot/test.com$fastcgi_script_name;
}

Fastcgi_pass used to specify the address or socket of the PHP-FPM listener (requires checking when a 502 error occurs)

Operation Process

[[email protected] ~]# vim /data/wwwroot/test.com/3.php<?phpphpinfo();[[email protected] ~]# curl -x127.0.0.1:80 test.com/3.php<?phpphpinfo();[[email protected] ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

The configuration file continues to add the following content
Location ~. php$
{
Include Fastcgi_params;
Fastcgi_pass Unix:/tmp/php-fcgi.sock;
Fastcgi_index index.php;
Fastcgi_param Script_filename/data/wwwroot/test.com$fastcgi_script_name;
}

[[email protected] ~]# /usr/local/nginx/sbin/nginx -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload[root[email protected] ~]# curl -x127.0.0.1:80 test.com/3.php //显示phpinfo信息

12.16 Nginx Agent

Cd/usr/local/nginx/conf/vhost
Vim proxy.conf//Add the following:
Server
{
Listen 80;
server_name ask.apelearn.com;

location /{ proxy_pass http://121.201.9.155/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}

}

Operation Process

[[email protected] ~]# vim /usr/local/nginx/conf/vhost/proxy.conf

Write the following content
Server
{
Listen 80;
server_name ask.apelearn.com;

location /{ proxy_pass http://47.91.145.78/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}

}

[[email protected] ~]# /usr/local/nginx/sbin/nginx -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload以下两个结果显示一样，代理配置成功[[email protected] ~]# curl ask.apelearn.com/robots.txt[[email protected] ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt

2018-04-26 Linux Learning