在生产环境中,需要隐藏Ngnx的版本号,以避免安全漏洞的泄漏
查看方法
使用fdde工具在 Windows客户端查看 Nginx版本号
在 Centos系统中使用“curl -l 网址”命令查看N
nginx隐藏版本号的方法
修改配置文件法
修改源码法
vim /usr/local/nginx/conf/nginx.conf
http {
include mime.types;
default_type application/octet-stream;
server_tokens off; '添加'
}
[root@localhost conf]# systemctl restart nginx
[root@localhost conf]# curl -I http://20.0.0.47
HTTP/1.1 200 OK
Server: nginx
1.若php配置文件中配置了 fastcgi_ param SERVER SOFTWARE选项
2.则编辑 php-fpm配置文件,将 fastcgi_param SERVER SOFTWARE对应的值修改为fastcgi_param SERVER_SOFTWARE nginx;
Nginx源码文件/usr/src/ nginx-1.12.2/src/ core/nginx. h包含了版本信息,可以随意设置
重新编译安装,隐藏版本信息
示例:
#define NGINX_VERSION “1.1.1″,修改版本号为1.1.1
#define NGINX_VER “IIS/",修改软件类型为lls
vim /opt/nginx-1.12.0/src/core/nginx.h
#define nginx version 1012000
#define NGINX VERSION "1.1.1" '修改版本号'
#define NGINX VER "IIS/" NGINX_VERSION
重新编译,make && make install
curl -I http://20.0.0.47/ ##查看版本号
[root@localhost ~]# iptables -F
[root@localhost ~]# setenforce 0
[root@localhost ~]# yum install gcc gcc-c++ pcre pcre-devel zlib-devel -y
tar
[root@localhost opt]# cd nginx-1.12.2/
[root@localhost nginx-1.12.2]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[root@localhost nginx-1.12.2]# useradd -M -s /sbin/nologin nginx
[root@localhost nginx-1.12.2]# ./configure \
--prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_stub_status_module
[root@localhost nginx-1.12.2]# make && make install
[root@localhost nginx-1.12.2]# vim /etc/init.d/nginx
#!/bin/bash
# chkconfig:- 99 20
# description:Nginx Service Control Script
PROG="/usr/local/nginx/sbin/nginx"
PIDF="/usr/local/nginx/logs/nginx.pid"
case "$1" in
start)
$PROG
;;
stop)
kill -s QUIT $(cat $PIDF)
;;
restart)
$0 stop
$0 start
;;
reload)
kill -s HUP $(cat $PIDF)
;;
*)
echo "Usage:$0 {start|stop|restart|reload}"
exit 1
esac
exit 0
[root@localhost nginx-1.12.2]# ln -s /usr/local/nginx/sbin/nginx /usr/local/bin
[root@localhost nginx-1.12.2]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost nginx-1.12.2]# chmod +x /etc/init.d/nginx
[root@localhost nginx-1.12.2]# chkconfig --add nginx
[root@localhost nginx-1.12.2]# service nginx start
[root@localhost nginx-1.12.2]# curl -I http://20.0.0.47
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Mon, 10 Aug 2020 07:07:05 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Mon, 10 Aug 2020 07:02:56 GMT
Connection: keep-alive
ETag: "5f30f120-264"
Accept-Ranges: bytes
方法一配置
[root@localhost nginx-1.12.2]# cd /usr/local/nginx/conf/
[root@localhost conf]# vim nginx.conf
http {
include mime.types;
default_type application/octet-stream;
server_tokens off; '添加这行,关闭版本号'
[root@localhost conf]# systemctl restart nginx
[root@localhost conf]# curl -I http://20.0.0.47
HTTP/1.1 200 OK
Server: nginx '版本号已被隐藏'
Date: Mon, 10 Aug 2020 07:12:03 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Mon, 10 Aug 2020 07:02:56 GMT
Connection: keep-alive
ETag: "5f30f120-264"
Accept-Ranges: bytes
Nginx运行时进程需要有用户与组的支持,以实现对网站文件读取时进行访问控制
Nginx默认使用 nobody用户账号与组账号,一般也要进行修改
修改的方法
编译安装时指定用户与组
修改配置文件时指定用户与组
vim /usr/local/nginx/conf/nginx.conf
user nginx nginx; '#注释掉,修改用户为nginx,组为nginx'
service nginx restart
ps aux |grep nginx
root 130034 0.0 0.0 20220 620 ? Ss 19:41 0:00 nginx:master process
/usr/local/sbin/nginx '主进程由root创建'
nginx 130035 0.0 0.0 20664 1512? S 19:41 0:00 nginx:worker process '子进程由nginx创建'
cd /usr/local/nginx/conf
[root@localhost conf]# id nobody
uid=99(nobody) gid=99(nobody) 组=99(nobody)
[root@localhost conf]# vim nginx.conf
user nginx nginx; '#注释掉,将nobody改成nginx'
[root@localhost conf]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost conf]# systemctl restart nginx
[root@localhost conf]# ps aux | grep nginx
root 11947 0.0 0.0 20544 608 ? Ss 15:18 0:00 nginx: master process /usr/localnginx/sbin/nginx
nginx 11948 0.0 0.0 23072 1384 ? S 15:18 0:00 nginx: worker process
root 11950 0.0 0.0 112724 988 pts/1 S+ 15:18 0:00 grep --color=auto nginx
当Nginx将网页数据返回给客户端后,可设置缓存的时间,以方便在日后进行相同内容的请求时直接返回,避免重复请求,加快了访问速度
一般针对静态网页设置,对动态网页不设置缓存时间
可在 Windows客户端中使用 fiddler查看网页缓存时间
设置方法
可修改配置文件,在http段、或者 server段、或者 location段加入对特定内容的过期参数
示例
修改 Nginx的配置文件,在 location段加入 expires参数
[root@localhost conf]# vim nginx.conf
location ~\.(gif|jpg|jpeg|png|bmp|ico)$ { '加入新的location'
root html;
expires 1d; '指定缓存时间为一天'
}
[root@localhost conf]# vim nginx.conf
location ~\.(gif|jpg|jpeg|png|bmp|ico)$ {
root html;
expires 1d;
}
[root@localhost conf]# cd ..
[root@localhost nginx]# cd html/
[root@localhost html]# rz -E
rz waiting to receive.
[root@localhost html]# ls
50x.html chiji.jpg index.html
[root@localhost html]# vim index.html
<img src="chiji.jpg"\>
[root@localhost html]# systemctl restart nginx
[root@localhost html]# nginx
随着 Nginx运行时间增加,日志也会增加。为了方便掌握 Nginx运行状态,需要时刻关注Ngnx日志文件
太大的日志文件对监控是一个大灾难
定期进行日志文件的切割
Nginx自身不具备日志分割处理的功能,但可以通过Nginx信号控制功能的脚本实现日志的自动切割,并通过Lnux的计划任务周期性地进行日志切割
- 设置时间变量
- 设置保存日志路径
- 将目前的日志文件进行重命名
- 删除时间过长的日志文件
- 设置cron任务,定期执行脚本自动进行日志分割
[root@localhost html]# vim /opt/fenge.sh
#!/bin/bash
#Filename:fenge.sh
#'设置日期名称'
d=$(date -d "-1 day" "+%Y%m%d")
logs_path="/var/log/nginx"
pid_path="/usr/local/nginx/logs/nginx.pid"
#'自动创建日志目录'
[ -d $logs_path ] || mkdir -p $logs_path
#'分割日志'
mv /usr/local/nginx/logs/access.log ${logs_path}/test.com-access.log-$d
#'生成新日志'
kill -HUP $(cat $pid_path)
#'删除30天前的日志'
find $logs_path -mtime +30 | xargs rm -rf
chmod +x fenge.sh
crontab -e '//设置周期性任务'
0 1 * * * /opt/fenge.sh
----date -d +1(second minute hour day month year)--
--------kill -QUIT 5410 结束进程 -HUP 平滑重启 类似 reload -USRl 日志分隔 -USR2平滑升级-----
date -d "-1 day" "+%Y%m%d" '//##时间向前推进一天'
date -s 2020-08-11 '//##时间向后推移一天'
vim /usr/local/nginx/conf/nginx.conf
keepalive_timeout 100; '连接超时时间 100'
Client_header_timeout 80; '等待客户端发送请求的超时时间,超时会发送408错误'
Client_body_timeout 80; '设置客户端发送请求超时时间'
在高并发场景,需要启动更多的 Nginx进程以保证快速响应,以处理用户的请求,避免造成阻塞
可以使用 ps auxi命令查看Ngnx运行进程的个数
更改进程数的配置方法
修改配置文件,修改进程配置参数
修改配置文件的 worker_ processes参数
一般设为CPU的个数或者核数
在高并发情况下可设置为CPU个数或者核数的2倍
运行进程数多一些,响应访问请求时, Nginx就不会临时启动新的进程提供服务,减少了系统的开销,提升了服务速度
使用 ps aux查看运行进程数的变化情况
默认情况, Nginx的多个进程可能跑在一个cPU上,可以分配不同的进程给不同的CPU处理,充分利用硬件多核多CPU
在一台4核物理服务器,可进行以下配置,将进程进行分配
Worker_cpu_affinity 0001 0010 0100 1000 ‘//核心数的序列位置’
[root@localhost opt]# cat /proc/cpuinfo | grep -c "physical" cpu核数
8
[root@localhost opt]# vim /usr/local/nginx/conf/nginx.conf
worker_processes 8; '建议修改为核数相同,不要超过核数'
[root@localhost opt]# systemctl restart nginx
[root@localhost opt]# ps aux | grep nginx '一个主进程中包含一个子进程'
work_cpu_affinity 01 10; '设置每个进程由不同CPU处理'
[root@localhost opt]# vim /usr/local/nginx/conf/nginx.conf
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_types text/plain application/x-javascript text/css image/jpg image/jpeg image/png image/g if application/xml text/javascript application/x-httpd-php application/javascript application/json;
gzip_disable "MSIE[1-6]\.";
gzip_vary on;
[root@localhost opt]# systemctl restart nginx
源主机
tar zxvf nginx-1.12.2.tar.gz -C /opt
cd /opt/nginx-1.12.2
[root@localhost nginx-1.12.2]# yum install gcc gcc-c++ zlib-devel pcre pcre-devel -y
[root@localhost nginx-1.12.2]# useradd -M -s /sbin/nologin nginx
[root@localhost nginx-1.12.2]# id nginx
[root@localhost nginx-1.12.2]# ./configure \
--prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_stub_status_module
[root@localhost nginx-1.12.2]# make && make install
[root@yuan nginx-1.12.2]# vim /etc/init.d/nginx
[root@yuan nginx-1.12.2]# vim /etc/init.d/nginx
#!/bin/bash
# chkconfig:- 99 20
# description:Nginx Service Control Script
PROG="/usr/local/nginx/sbin/nginx"
PIDF="/usr/local/nginx/logs/nginx.pid"
case "$1" in
start)
$PROG
;;
stop)
kill -s QUIT $(cat $PIDF)
;;
restart)
$0 stop
$0 start
;;
reload)
kill -s HUP $(cat $PIDF)
;;
*)
echo "Usage:$0 {start|stop|restart|reload}"
exit 1
esac
exit 0
[root@localhost nginx-1.12.2]# ln -s /usr/local/nginx/sbin/nginx /usr/local/bin
[root@localhost nginx-1.12.2]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost nginx-1.12.2]# chmod +x /etc/init.d/nginx
[root@localhost nginx-1.12.2]# chkconfig --add nginx
[root@localhost nginx-1.12.2]# service nginx start
[root@yuan nginx-1.12.2]# cd /usr/local/nginx/html/
[root@yuan html]# vim index.html
<img src="chiji.jpg"\>
[root@yuan html]# service nginx stop
[root@yuan html]# service nginx start
盗链网站
[root@localhost ~]# iptables -F
[root@localhost ~]# setenforce 0
[root@localhost ~]# yum install httpd -y
[root@localhost yum.repos.d]# vim /etc/httpd/conf/httpd.conf
Listen 20.0.0.51:80
#Listen 80
ServerName www.test.com:80
[root@localhost yum.repos.d]# cd /var/www/html/
[root@localhost html]# ls
[root@localhost html]# vim index.html
<h1>this is test web</h1>
<img src="http://www.kevin.com/chiji.jpg"\>
[root@localhost html]# echo "nameserver 20.0.0.47" > /etc/resolv.conf
[root@localhost html]# systemctl start httpd.service
源主机
[root@yuan html]# vim /usr/local/nginx/conf/nginx.conf
location ~*\.(jpg|gif|swf)$ {
valid_referers none blocked *.kevin.com kevin.com;
if ( $invalid_referer ) {
rewrite ^/ http://www.kevin.com/error.png;
}
}
[root@yuan html]# service nginx stop
[root@yuan html]# service nginx start
Nginx的PHP解析功能实现如果是交由FPM处理的,为了提高PHP的处理速度,可对FPM模块进行参数的调整
FPM模块参数调整,要根据服务器的内存与服务负载进行调整
启动fpm进程方式
static:将产生固定数量的fpm进程
dynamic:将以动态的方式产生fpm进程
通过pm参数指定
优化原因:
优化参数调整
FPM启动时有5个进程,最小空闲2个进程,最大空闲8个进程,最多可以有20个进程存在
vim php.fpm.conf
pm=dynamic
pm.max_children=20
pm.start_servers = 5
pm.min_spare_servers = 2
pm.max_spare_servers = 8