49.Nginx anti-theft chain, nginx access control, Nginx parsing PHP-related configuration, Nginx Proxy

First, nginx anti-theft chain

• The configuration is as follows and can be combined with the above configuration.

vim /usr/local/nginx/conf/vhost/test.com.conf

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$  //location后面的*是忽略大小写{    expires 7d;    valid_referers none blocked server_names  *.test.com ;    //白名单    if ($invalid_referer) {        return 403;    }    access_log off;}

/usr/local/nginx/sbin/nginx -t/usr/local/nginx/sbin/nginx -s reloadecho ‘121332132‘ >> /data/wwwroot/test.com/2.jpg curl -x127.0.0.1:80 test.com/2.jpg -I curl -e "http://www.baidu.com" -x127.0.0.1:80 test.com/2.jpg -I

Second, Nginx access control

• Requirements: Access to the/admin/directory request, only a few IP access is allowed, configured as follows:

vim /usr/local/nginx/conf/vhost/test.com.conf

location /admin/{    allow 192.168.127.1;    allow 127.0.0.1;    deny all;}

mkdir /data/wwwroot/test.com/admin/ echo “test,test”>/data/wwwroot/test.com/admin/1.html/usr/local/nginx/sbin/nginx -t/usr/local/nginx/sbin/nginx -s reload curl -x127.0.0.1:80 test.com/admin/1.html -I curl -x192.168.1.111:80 test.com/admin/1.html -I

• Before adding a ENS37 virtual network card, now change it to host mode, get the host IP for testing.
  

• Match regular limit

location ~ .*(upload|image)/.*\.php${        deny all;}

mkdir /data/wwwroot/test.com/uploadecho 12321 > /data/wwwroot/test.com/upload/1.phpcurl -x127.0.0.1:80 test.com/upload/1.php echo 12321 > /data/wwwroot/test.com/upload/1.txtcurl -x127.0.0.1:80 test.com/upload/1.txt

• Restrictions according to User_agent

if ($http_user_agent ~ ‘Spider/3.0|YoudaoBot|Tomato‘){      return 403;}

Deny all is the same as the return 403 effect

curl -x127.0.0.1:80 test.com -Icurl -A ‘Tomato‘ -x127.0.0.1:80 test.com -I

Three, Nginx parsing PHP configuration

vim /usr/local/nginx/conf/vhost/test.com.conf

location ~ \.php$    {        include fastcgi_params;        fastcgi_pass unix:/tmp/php-fcgi.sock;        fastcgi_index index.php;        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;    }

• Fastcgi_pass used to specify the address or socket of the PHP-FPM listener

• Fastcgi_pass 127.0.0.1 This format when you specify a listener address

vim /data/wwwroot/test.com/example.php

Write

<?phpphpinfo();

curl -x127.0.0.1:80 test.com/example.php

Four, nginx agent

cd /usr/local/nginx/conf/vhostdig   www.baidu.com    //查找一个网站的ip

If the dig command does not exist

yum   install   -y   

curl -x127.0.0.1:80 www.baidu.com/robots.txt

vim proxy.conf //加入如下内容server{    listen 80;    server_name www.baidu.com;    location /    {        proxy_pass      http://61.135.169.121/;        proxy_set_header Host   $host;        proxy_set_header X-Real-IP      $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }}

/usr/local/nginx/sbin/nginx -t/usr/local/nginx/sbin/nginx -s reloadcurl -x127.0.0.1:80 www.baidu.com/robots.txt

49.Nginx anti-theft chain, nginx access control, Nginx parsing PHP-related configuration, Nginx Proxy