Nginx负载均衡
12.17 Nginx负载均衡
代理一台机器是代理。多台机器就是负载均衡了
nginx不能代理https（443端口）。只能代理http（80端口），新版本的能代理tcp
• vim /usr/local/nginx/conf/vhost/load.conf // 写入如下内容
upstream qq_com #名字可以自定义
{
ip_hash; #使同一用户始终在同一服务器上。避免session失效
server 61.135.157.156:80;
server 125.39.240.113:80;
}
server
{
listen 80; #监听端口
server_name www.qq.com; #域名
location /
{
proxy_pass http://qq_com; #指定ip，这里是前面upstream配置的名字，这里不能定义多个ip
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}• upstream来指定多个web server
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 www.qq.com
腾讯的dns查找办法。dig命令，其实就是域名解析，如果没有需要安装yum install -y bind-utils
dig qq.com
12.18 ssl原理
1、浏览器发送一个https请求给服务端
2、服务器有一套数字证书加密解密（crt pricate 私钥，用来解密 和crt public 公钥，用来加密的）
3、先把公钥传递给客户端（公钥是给客户端的，私钥不能暴露）
4、客户端（浏览器）收到公钥后会先判断这个公钥是否合法有效。（机构颁发证书。证书先全部给浏览器厂商做一个沟通。浏览器先判断是否合法），证书是需要花钱申请的。如果验证证书无效则会收到告警提醒，有效则会生成一串随机数，并用收到的公钥加密。
5、客户端把加密的随机字符串传递给服务端。
6、、服务器收到随机字符串后先用私钥解密，拿到随机字符串再用随机字符串给网站的内容加密，
7、再把加密的网页传递给客户端
8、客户端拿到加密的网页在用他生成的随机字符串解密。随后得到数据
（随机字符串是随机生成的，每次都是不同的字符串，https就是每次反复执行这个过程）
12.19生成ssl秘钥对
• cd /usr/local/nginx/conf
[root@wwlinux701 conf]# rpm -qf which openssl #如果没有openssl需要安装一下这个包
openssl-1.0.2k-8.el7.x86_64
[root@wwlinux701 conf]#
• openssl genrsa -des3 -out tmp.key 2048 #key文件为私钥
[root@wwlinux701 conf]# openssl genrsa -des3 -out tmp.key 2048
Generating RSA private key, 2048 bit long modulus
……………………………..+++
…………………………+++
e is 65537 (0x10001)
Enter pass phrase for tmp.key:
Verifying - Enter pass phrase for tmp.key:
[root@wwlinux701 conf]#
• openssl rsa -in tmp.key -out aminglinux.key #转换key，取消密码（不可能每次输入网站还需要输入密码，所以需要取消密码，-in是指定哪个秘钥要被转换，-out是指定输出的名字）
[root@wwlinux701 conf]# openssl rsa -in tmp.key -out aminglinux.key
Enter pass phrase for tmp.key:
writing RSA key
[root@wwlinux701 conf]#
• rm -f tmp.key #tmp.key和aminglinux.ke是同一个秘钥，一个有密码一个没有密码
• openssl req -new -key aminglinux.key -out aminglinux.csr#生成证书请求文件，需要拿这个文件和私钥一起生产公钥文件
[root@wwlinux701 conf]# openssl req -new -key aminglinux.key -out aminglinux.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:china
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) [XX]:11
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:wwlinux
Organizational Unit Name (eg, section) []:123
Common Name (eg, your name or your server's hostname) []:wwlinux701
Email Address []:123
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:456
需要填写一些信息，密码写的123456
• openssl x509 -req -days 365 -in aminglinux.csr -signkey aminglinux.key -out aminglinux.crt
[root@wwlinux701 conf]# openssl x509 -req -days 365 -in aminglinux.csr -signkey aminglinux.key -out aminglinux.crt
Signature ok
subject=/C=11/ST=beijing/L=beijing/O=wwlinux/OU=123/CN=wwlinux701/emailAddress=123
Getting Private key
[root@wwlinux701 conf]# • 这里的aminglinux.crt为公钥
key是私钥
12.20 Nginx配置ssl
vim /usr/local/nginx/conf/vhost/ssl.conf
server
{
listen 443;
server_name aming.com;
index index.html index.php;
root /data/wwwroot/aming.com;
ssl on;
ssl_certificate aminglinux.crt;
ssl_certificate_key aminglinux.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
}
[root@wwlinux701 conf]# fg
vim /usr/local/nginx/conf/vhost/ssl.conf
[root@wwlinux701 conf]# /usr/local/nginx/sbin/nginx -t
nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/vhost/ssl.conf:7
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
[root@wwlinux701 conf]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.13.8
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
configure arguments: --prefix=/usr/local/nginx
[root@wwlinux701 conf]# 这里报错是因为nginx不指定ssl这个配置，查看版本信息，没有指定ssl。所以需要重新编译一下nginx
加上–with-http_ssl_module配置
[root@wwlinux701 conf]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.13.8
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
configure arguments: --prefix=/usr/local/nginx
[root@wwlinux701 conf]# cd /usr/local/src/nginx-1.13.8
[root@wwlinux701 nginx-1.13.8]# ./con
conf/ configure contrib/
[root@wwlinux701 nginx-1.13.8]# ./configure --help |grep -i ssl
--with-http_ssl_module enable ngx_http_ssl_module
--with-mail_ssl_module enable ngx_mail_ssl_module
--with-stream_ssl_module enable ngx_stream_ssl_module
--with-stream_ssl_preread_module enable ngx_stream_ssl_preread_module
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
[root@wwlinux701 nginx-1.13.8]# ./configure --prefix=/usr/local/nginx --with-http_ssl_modulemake && make install
重新编译完成以后就多了ssl——module
[root@wwlinux701 nginx-1.13.8]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.13.8
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module
[root@wwlinux701 nginx-1.13.8]#
[root@wwlinux701 nginx-1.13.8]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@wwlinux701 nginx-1.13.8]#
[root@wwlinux701 nginx-1.13.8]# /etc/init.d/nginx restart
Restarting nginx (via systemctl): [ 确定 ]
[root@wwlinux701 nginx-1.13.8]#
[root@wwlinux701 nginx-1.13.8]# netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5659/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 827/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1474/master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 5659/nginx: master
tcp6 0 0 :::3306 :::* LISTEN 1279/mysqld
tcp6 0 0 :::22 :::* LISTEN 827/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1474/master
[root@wwlinux701 nginx-1.13.8]# 创建测试页面
echo “ssl test page.”>/data/wwwroot/aming.com/index.html
• 编辑hosts，增加127.0.0.1 aming.com
vi /etc/hosts
• curl https://aming.com/
#提示这个信息是说证书不合法
[root@wwlinux701 aming.com]# vi /etc/hosts
[root@wwlinux701 aming.com]# curl https://aming.com/
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
[root@wwlinux701 aming.com]# 如果物理机访问不了，需要检查iptebles，配置了443访问。
ipteables -F暂时先全部清空规则
配置好本地host文件就能看到提示
