SSL Certificate uninstallation and SSI advanced application
Http://netkiller.github.io/journal/ssi.htmlMr. Neo Chen (netkiller), Chen jingfeng (bg7nyt)
Xishan Meidi, Minzhi Street, Longhua new district, Shenzhen City, Guangdong Province, China
518131
+ 86 13113668890
+ 86 755 29812080
<[Email protected]>
Copyright©2014 http://netkiller.github.io
Copyright Notice
For reprinting, contact the author. During reprinting, be sure to indicate the original source, author information, and this statement.
|
Document Source: |
Http://netkiller.github.io |
Http://netkiller.sourceforge.net |
|
2014-09-17
Summary my documents
Netkiller impact ect shouzha |
Netkiller developer notebook |
Netkiller PHP notebook |
Netkiller Python notebook |
Netkiller testing shouzha |
Netkiller cryptography notebook |
Netkiller Linux shouzha |
Netkiller Debian shouzha |
Netkiller centos notebook |
Netkiller FreeBSD notebook |
Netkiller shell shouzha |
Netkiller security statement |
Netkiller web shouzha |
Netkiller monitoring shouzha |
Netkiller storage shouzha |
Netkiller mail shouzhi |
Netkiller docbook notebook |
Netkiller version |
Netkiller database shouzhi |
Netkiller PostgreSQL notebook |
Netkiller MySQL notebook |
Netkiller nosql notebook |
Netkiller LDAP notebook |
Netkiller network shouzha |
Netkiller Cisco IOS notebook |
Netkiller H3C notebook |
Netkiller multimedia notebook |
Netkiller Perl notebook |
Netkiller Amateur Radio shouzha |
Netkiller devops notebook |
Directory
- 1. What is SSI (Server Side Include)
- 2. Why ssi?
- 3. Who is responsible for SSI production?
- 4. How to Handle SSI inclusion
- 4.1. ssi directory Planning
- 4.2. www.example.com static Content Server
- 4.3. acc.example.com Dynamic Web Server
- 4.4. SSL uninstall Server
- 4.5./www/inc.example.com Public inclusion File
- 4.6. Reference an instance containing files
1. What is SSI (Server Side Include)
SSI is contained on the server page. ssi works on the Web server. The web server can contain another page on one page. in the user's view, there is only one page.
2. Why ssi?
We have many other sub-sites. The headers of all websites are the same as footer, and some block blocks are also shared. Therefore, we split the shared part and use SSI to include it as needed.
3. Who is responsible for SSI production?
Experienced artists can use SSI flexibly, and programmers can learn SSI in a short time.
4. How to Handle SSI inclusion 4.1. ssi directory Planning
/www/example.com |-- inc.example.com |-- www.example.com |-- images.example.com |-- acc.example.com
Inc.example.com is an SSI Shared File that stores SHTML files.
Www.example.com is the main site and will use the public module in inc.example.com.
Acc.example.com is similar to www.example.com.
Note:
/Www/inc.example.com is a public directory. You do not need to configure nginx and cannot access this directory through a browser.
Why do we need independent public files instead of under the/www/www.example.com directory? I want to facilitate code release. The advantage of separation is that I can publish code for inc.example.com without affecting other projects.
Because include acts on the $ document_root directory of the web server, for example, the current $ document_root is/www/example.com/www.example.com
<! -- # Include file = "/example.shtml" --> The/www/example.com/www.example.com/example.shtml file is referenced, instead of the operating system root directory.
Therefore, we cannot reference the public file "inc.example.com" at the same level as www.example.com. For example:
<! -- # Include file = "/www/example.com/inc.example.com/example.shtml" --> The/www/hosts file is referenced instead of the operating system root directory. <! -- # Include file = "../inc.example.com/example.shtml" --> references cannot work normally.
This is a server restriction. If SSI may contain files other than $ document_root, security issues may occur, such
<!--#include file="/etc/passwd"-->
How can we break through the limits? I have come up with an alias. I use the alias/include to reference the alias in the/www/example.com/inc.example.comdirectory, for example:
location /include/ { root /www/example.com/inc.example.com; }
Prompt
The SSI Implementation of Apache and nginx servers is slightly different from that of include file and include virtual.
4.2. www.example.com static Content Server
# cat /etc/nginx/conf.d/www.example.com.confserver { listen 80; server_name www.example.com; charset utf-8; access_log /var/log/nginx/www.example.com.access.log; error_log/var/log/nginx/www.example.com.error.log; location / { root /www/example.com/www.example.com; index index.html; } location /include/ { root /www/example.com/inc.example.com; } location /info/ {proxy_pass http://info.example.com/; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; }}
4.3. acc.example.com Dynamic Web Server
server { listen 80; server_name acc.example.com; charset utf-8; access_log /var/log/nginx/acc.example.com.access.log; error_log/var/log/nginx/acc.example.com.error.log; set $X_FORWARDED_FOR $http_x_forwarded_for; location / { root /www/example.com/acc.example.com/htdocs; index index.php; try_files $uri $uri/ /index.php?/$request_uri; } location /include/ { root /www/example.com/inc.example.com; } location ^~ /images/ { rewrite /images/(.+)$ /$1 break; proxy_pass http://images.example.com; break; } location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /www/example.com/acc.example.com/htdocs/$fastcgi_script_name; include fastcgi_params;fastcgi_param DOCUMENT_ROOT /www/example.com/acc.example.com/htdocs; }}
Note:
This server does not provide external servers. It only allows the following SSL server to be detached through reverse proxy connection.
4.4. SSL uninstall Server
Transfers the SSL Certificate processing, confidentiality, and decryption operations to this server, so that the business server is not allowed to process the certificate encryption and decryption operations. The preceding HTTP Intranet access and HTTPS external access, HTTPS uses reverse proxy to connect to the HTTP server for SSL Certificate uninstallation
upstream acc.example.com { server acc1.example.com; server acc2.example.com; server acc3.example.com;}server { listen 443; server_name acc.example.com; ssl on; ssl_certificate /etc/nginx/example.com/acc.example.com.pem; ssl_certificate_key /etc/nginx/example.com/acc.example.com.key; ssl_session_timeout 5m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location / {proxy_pass http://acc.example.com;proxy_http_version 1.1;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; break; }}
4.5./www/inc.example.com Public inclusion File
/Www/inc.example.com/include/cn/config.html
<!--#set var="HTML_HOST" value="http://www.example.com"--><!--#set var="INFO_HOST" value="http://info.example.com"--><!--#set var="NEWS_HOST" value="http://news.example.com"--><!--#set var="IMG_HOST" value="http://images.example.com"--><!--#set var="JS_HOST" value="http://images.example.com"--><!--#set var="CSS_HOST" value="http://images.example.com"--><!--#if expr="${X_FORWARDED_FOR}"--><!--#set var="ACC_HOST" value="https://myid.example.com"--><!--#set var="IMG_HOST" value="/images"--><!--#set var="JS_HOST" value="/images"--><!--#set var="CSS_HOST" value="/images"--><!--#else --><!--#set var="ACC_HOST" value="http://myid.example.com"--><!--#set var="IMG_HOST" value="http://images.example.com"--><!--#set var="JS_HOST" value="http://images.example.com"--><!--#set var="CSS_HOST" value="http://images.example.com"--><!--#endif -->
$ {X_forwarded_for} is used to determine whether the user enters through HTTP or HTTPS. Because images.example.com does not have an SSL certificate, a differentiated image loading address is required. /Images connects the http://images.exampe.com through reverse proxy.
4.6. Reference an instance containing files
<! -- # Include file = "/include/CN/config.html" --> <! Doctype> <HTML>
SSL Certificate uninstallation and SSI advanced application