nginx模块
模块
nginx状态模块：
nginx状态模块： --with-http_stub_status_module
功能：查看当前nginx服务器的并发量和总的请求数（客户端基本访问状态信息）
显示信息解释：
Active connections #Nginx 当前活跃连接数
server #Nginx 处理接收握⼿总次数(TCP总连接数)
accepts #Nginx 处理接收总连接数
handled requests #总共处理请求次数
Reading #Nginx读取数据
Writing #Nginx写的情况
Waiting #Nginx 开启keep-alive⻓连接情况下,既没有读也没有写,建⽴连接情况
长连接状态的一次TCP的连接，可以发起多次http的请求
keepalive_timeout 0; # 类似于关闭长连接
keepalive_timeout 65; # 65s没有活动则断开连接
状态模块配置文件:
vim /etc/nginx/conf.d/status.conf
server {
listen 80;
server_name status.test.com;
stub_status on;
access_log off;
}
检测语法：
nginx -t
重启：
systemctl restart nginx
获取nginx连接状态
curl status.test.com
nginx常用模块
使用nginx作为简易的文件下载服务器
Syntax: autoindex on | off;
Default: autoindex off;
Context: http, server, location
# autoindex 常用参数
autoindex_exact_size off;
默认为 on， 显示出文件的确切大小，单位是 bytes。
修改为 off，显示出文件的大概大小，单位是 kB 或者 MB 或者 GB。
autoindex_localtime on;
默认为 off，显示的文件时间为 GMT 时间。
修改为 on， 显示的文件时间为文件的服务器时间。
charset utf-8,gbk;
默认中文目录乱码，添加上解决乱码
配置文件：
server{
listen 172.19.79.193:80;
server_name download.test.com;
location / {
root /usr/share/nginx/html/download;
charset utf-8,gbk;
autoindex on;
autoindex_localtime on;
autoindex_exact_size off;
}
}
访问控制
基于IP的访问控制：
#允许配置语法
Syntax: allow address | CIDR | unix: | all;
Default: —
Context: http, server, location, limit_except
#拒绝配置语法
Syntax: deny address | CIDR | unix: | all;
Default: —
Context: http, server, location, limit_except
案例
配置案例1：拒绝单个客户端访问站点
server {
listen 80;
server_name www.test.com;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
deny 172.19.79.191;
allow all;
}
}
配置案例2：拒绝某个网段所有客户端访问站点
server {
listen 80;
server_name www.test.com;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
deny 172.19.79.0/24;
allow all;
}
}
配置案例1：允许单个客户端访问站点
server {
listen 80;
server_name www.test.com;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
allow 172.19.79.193;
deny all;
}
}
配置案例3：允许某个网段所有客户端访问站点
server {
listen 80;
server_name www.test.com;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
allow 172.19.79.190/24;
deny all;
}
}
基于用户认证的访问控制
#访问提示字符串
Syntax: auth_basic string| off;
Default: auth_basic off;
Context: http, server, location, limit_except
#账户密码文件
Syntax: auth_basic_user_file file;
Default: -
Context: http, server, location, limit_except
案例
案例一：
yum install httpd-tools -y #需要安装 httpd-tools，该包中携带了 htpasswd 命令
htpasswd -b -c /etc/nginx/auth_conf testpassd 123 #创建新的密码文件, -c 创建新文件 -b 允许命令行输入密码
server{
listen 80;
server_name download.test.com;
location / {
auth_basic "Auth access Blog Input your Passwd!";
auth_basic_user_file auth_conf;
root /usr/share/nginx/html/download;
deny 172.19.79.0/24;
allow all;
charset utf-8,gbk;
autoindex on;
autoindex_localtime on;
autoindex_exact_size off;
}
}
案例二：
server{
listen 80;
server_name download.test.com;
location / {
auth_basic "Auth access Blog Input your Passwd!";
auth_basic_user_file auth_conf;
root /usr/share/nginx/html/download;
deny 172.19.79.191;
deny all;
charset utf-8,gbk;
autoindex on;
autoindex_localtime on;
autoindex_exact_size off;
}
}
访问限制
Nginx自带的模块支持对并发请求数进行限制, 还有对请求来源进行限制。可以用来防止DDOS攻击。
经常会遇到这种情况，服务器流量异常，负载过大等等。对于大流量恶意的攻击访问， 会带来带宽的浪费，服务器压力，影响业务，往往考虑对同一个 ip 的连接数，请求数、进行限制。
ngx_http_limit_conn_module 模块可以根据定义的 key 来限制每个键值的连接数，如同一个 IP 来源的连接数。
limit_conn_module 连接频率限制
limit_req_module 请求频率限制
连接限制
基于TCP连接次数的限制
配置语法:
#模块名 ngx_http_limit_conn_module
Syntax: limit_conn_zone key zone=name:size;
Default: —
Context: http
Syntax: limit_conn zone number;
Default: —
Context: http, server, location
配置文件:
# http 标签段定义连接限制
vim /etc/nginx/nginx.conf
http{
limit_conn_zone $binary_remote_addr zone=conn_zone:10m;
}
# server标签里引用条件
cat /etc/nginx/conf.d/www.conf
server {
listen 80;
server_name www.test.com;
# 同一时刻只允许一个客户端连接
limit_conn conn_zone 1;
access_log /var/log/nginx/www.access.log main;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
}
}
缺陷：
HTTP 是建立在 TCP 基础之上, 在完成 HTTP 请求需要先建立TCP 三次握手（称为 TCP 连接） ,在连接的基础上在完成 HTTP 的请求。
所以多个 HTTP 请求可以建立在一次 TCP 连接之上，这样我们就无法对请求进行精度的限制
HTTP 的请求限制：
#模块名 ngx_http_limit_req_module
Syntax: limit_req_zone key zone=name:size rate=rate;
Default: —
Context: http
Syntax: limit_conn zone number [burst=number] [nodelay];
Default: —
Context: http, server, location
配置文件
vim /etc/nginx/nginx.conf
http {
limit_req_zone $binary_remote_addr zone=req_zone:10m rate=1r/s;
}
cat /etc/nginx/conf.d/www2.conf
server {
listen 80;
server_name www.test.com;
limit_req zone=req_zone burst=3 nodelay;
access_log /var/log/nginx/www.access.log main;
location / {
root /usr/share/nginx/html/www;
index index.html index.htm;
}
}
优势：
同一时刻只允许一个 TCP 连接进入, 但是同一时刻多个 HTTP 请求可以通过一个 TCP 连接进入，从而达到我们对请求的精度限制，因此比对一个连接的限制会更加的有效
Nginx压力测试功能：
安装ab命令-------yum -y install httpd-tools
使用ab压测命令：
ab -kc 1000 -n 100000 http://172.19.79.193/
参数：
-n requests #执行的请求数，即一共发起多少请求。
-c concurrency #请求并发数。
-k #启用HTTP KeepAlive功能，即在一个HTTP会话中执行多个请求。
nginx的状态模块功能,检查请求连接数
上述访问限制的log文件
tail -f /var/log/nginx/error.log
020/04/14 04:55:36 [error] 12320#12320: *21 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *22 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *23 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *24 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *25 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *26 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *27 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *28 limiting requests, excess: 3.997 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *29 limiting requests, excess: 3.996 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
2020/04/14 04:55:36 [error] 12320#12320: *30 limiting requests, excess: 3.996 by zone "req_zone", client: 172.19.79.191, server: www.test.com, request: "GET / HTTP/1.0", host: "www.test.com"
tail -f /var/log/nginx/www.access.log
基于tcp连接数
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:49:51 -0400] "GET / HTTP/1.0" 200 29 "-" "ApacheBench/2.3" "-"
基于http请求限制：
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 200 97 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 200 97 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 200 97 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 200 97 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"
172.19.79.191 - - [14/Apr/2020:04:55:36 -0400] "GET / HTTP/1.0" 503 197 "-" "ApacheBench/2.3" "-"