11月28日
12.13 Nginx防盗链
Nginx防盗链
· 配置如下,可以和上面的配置结合起来
vim /usr/local/nginx/conf/vhost/test.com.conf 增加
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com; 白名单referers
If($invalid_referer) {
return 403;
}
access_log off;
}
/usr/local/nginx/sbin/nginx -t 检查脚本
/usr/local/nginx/sbin/nginx -s reload 重新加载服务
curl -e“http://www.baid.co/1.txt” -x127.0.0.1:80 -I test.com/1.gif 403
curl -e “http://www.test.com/1.txt” -x127.0.0.1:80 -I test.com/1.gif 200说明防盗链配置成功
12.14 Nginx访问控制
· 需求:访问/admin/目录的请求,只允许某几个IP访问,配置如下:
vim /usr/local/nginx/conf/vhost/test.com.conf 增加 针对目录的
location /admin/
{
allow 192.168.133.130; 允许
allow 127.0.0.1; 允许
dengy all;
}
· mkdir /data/wwwroot/test.com/admin/
· echo “test,test”>/data/wwwroot/test.com/admin/1.html
· /usr/local/nginx/sbin/nginx -t && -s reload 检查脚本并重新加载
· curl -x127.0.0.1:80 test.com/admin/1.html -I
· curl -x192.168.133.130:80 test.com/admin/1.html -I
· 可以匹配正则
location ~.*(upload|image)/.*\.php$
{
deny all;
}
/usr/local/nginx/sbin/nginx -t && -s reload
测试
mkdir /data/wwwroot/test.com/upload 创建upload目录
echo “1111” > /data/wwwroot/test.com/upload/1.php 写入到1.php
curl -x127.0.0.1:80 test.com/upload/1.php 访问1.php 状态码403
· 根据user_agent限制
If($http_user_agent ~* ‘spider/3.0|YoudaoBot|Tomato’) 忽略大小写,不让这些网站收入,相当于隐藏网站,除非告诉网址
{
return 403;
}
/usr/local/nginx/sbin/nginx -t && -s reload
curl -x127.0.0.1:80 test.com/upload/1.txt
curl -A “tomatoalsdkflsd” -x127.0.0.1:80 test.com/upload/1.txt
-I 状态码403
· deny all和return 403效果一样
12.15 Ngin解析php相关配置
Nginx解析php的配置
配置如下:
vim /usr/local/nginx/conf/vhost/test.com.conf
location ~ \.php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_pass 127.0.0.1:9000; 或监听ip或端口
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
/usr/local/nginx/sbin/nginx -t && -s reload 检查脚本并重新加载
vi /data/wwwroot/test.com/3.php 写入phpinfo
phpinfo();
curl -x127.0.0.1:80 test.com/3.php
· fastcgi_pass 用来指定php-fpm监听的地址或者socket
12.16 Nginx代理
Nginx代理
用户<——>代理服务器<——>web服务器
· cd /usr/local/nginx/conf/vhost
· vim proxy.conf 加入如下内容
server
{
listen 80;
server_name ask.apelearn.com; 定域名
location/
{
proxy_pass http://121.201.9.155/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Foewaedea-For $proxy_add_x_forwaerded for;
}
}
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload 检查脚本并重新加载
curl ask.apelearn.com/robots.txt robots.txt索引的列表
curl -x127.0.0.1:80 ask.apelearn.com/robots.txt 访问ask.apelearn论坛