[关闭]
@cdmonkey 2019-08-07T14:16:16.000000Z 字数 7069 阅读 1450

Nginx-HTTPS

Nginx

http://www.tuicool.com/articles/vuiQry
http://www.educity.cn/net/1617736.html
http://freeloda.blog.51cto.com/2033581/1288553
http://jicki.blog.51cto.com/1323993/1742270
https://www.nginx.com/resources/wiki/modules/healthcheck/

http://seanlook.com/2015/05/28/nginx-ssl

http://nginx.org/en/docs/http/ngx_http_upstream_module.html#health_check

http://tengine.taobao.org/nginx_docs/cn/docs/http/configuring_https_servers.html
http://www.blogways.net/blog/2013/10/22/nginx-3.html

http://havee.me/internet/2015-08/nginx-redirect-http-request-to-https.html

https://aotu.io/notes/2016/08/16/nginx-https
http://io.upyun.com/2015/03/10/strong-ssl-security

HTTPS-Proxy

Install

需要安装两个第三方模块：健康检查模块及

  1. yum install -y patch unzip
  2. # Extract Nginx upstream_check module:
  3. [root@test-ngx tools]# unzip nginx_upstream_check_module-master.zip
  4. # Extract Nginx sticky module:
  5. [root@test-ngx tools]# unzip nginx-goodies-nginx-sticky-module-ng-08a395c66e42.zip
  6. [root@test-ngx tools]# mv nginx-goodies-nginx-sticky-module-ng-08a395c66e42 nginx-sticky-module
  7. ------------------
  8. [root@test-ngx tools]# tar zxvf nginx-1.12.2.tar.gz
  9. [root@test-ngx tools]# cd nginx-1.12.2
  10. # Patch upstream_check module:
  11. patch -p1 < ../nginx_upstream_check_module-master/check_1.12.1+.patch  
  12. patching file src/http/modules/ngx_http_upstream_hash_module.c
  13. patching file src/http/modules/ngx_http_upstream_ip_hash_module.c
  14. patching file src/http/modules/ngx_http_upstream_least_conn_module.c
  15. patching file src/http/ngx_http_upstream_round_robin.c
  16. patching file src/http/ngx_http_upstream_round_robin.h
  17. # Patch
  18. [root@test-ngx nginx-1.11.5]# cd ../nginx-sticky-module/
  19. [root@test-ngx nginx-sticky-module]# patch -p0 < ../nginx_upstream_check_module-master/nginx-sticky-module.patch 
  20. patching file ngx_http_sticky_module.c
  21. Hunk #1 succeeded at 15 with fuzz 2 (offset 5 lines).
  22. Hunk #2 succeeded at 304 (offset 12 lines).
  23. Hunk #3 succeeded at 330 (offset 12 lines).
  24. Hunk #4 succeeded at 352 (offset 12 lines).
  1. [root@test-ngx ~]# yum install -y wget gcc gcc-c++ make openssl-devel
  2. [root@test-ngx ~]# useradd -s /sbin/nologin -M nginx

http://tianshili.blog.51cto.com/5050423/1709119
http://ju.outofmemory.cn/entry/219981

Support OpenSSL

编译安装 nginx 时，默认使用系统自带的 OpenSSL 库，但是一般版本相对老旧，不能够支持一些新功能。其实是能够指定使用 OpenSSL 的版本，但使用 --with-openssl 参数虽然可指定具体路径，但是只支持使用解压后的源代码，而不支持已编译安装好的 OpenSSL，这就有些麻烦了。

解决方案：https://www.sinosky.org/compile-nginx-with-a-custom-openssl-library.html

  1. [root@test-ngx tools]# tar zxvf pcre-8.39.tar.gz
  2. [root@test-ngx tools]# tar zxvf openssl-1.0.1t.tar.gz
  3. [root@test-ngx tools]# cd nginx-1.11.5
  4. [root@test-ngx nginx-1.11.5]# ./configure \
  5. --prefix=/usr/local/nginx \
  6. --user=nginx \
  7. --group=nginx \
  8. --with-http_ssl_module \
  9. --with-openssl=/root/tools/openssl-1.0.1t \
  10. --with-http_gunzip_module \
  11. --with-http_stub_status_module \
  12. --with-pcre=/root/tools/pcre-8.39 \
  13. --with-http_realip_module \
  14. --add-module=/root/tools/nginx_upstream_check_module-master \
  15. --add-module=/root/tools/nginx-sticky-module
  16. [root@test-ngx nginx-1.11.5]# make
  17. [root@test-ngx nginx-1.11.5]# make install
  18. # Create soft link:
  19. ln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/nginx

生产中的配置：

  1. ./configure \
  2. --prefix=/usr/local/nginx \
  3. --user=nginx \
  4. --group=nginx \
  5. --with-openssl=/root/tools/openssl-1.0.2l \
  6. --with-http_ssl_module \
  7. --with-http_gunzip_module \
  8. --with-http_gzip_static_module \
  9. --with-http_stub_status_module \
  10. --with-pcre=/root/tools/pcre-8.39 \
  11. --with-http_realip_module \
  12. --add-module=/root/tools/nginx_upstream_check_module-master \
  13. --add-module=/root/tools/nginx-sticky-module
  1. [root@test-ngx ~]# mkdir /usr/local/nginx/conf/extra
  2. [root@test-ngx ~]# vim /usr/local/nginx/conf/extra/upstream.conf
  3. upstream vbill {
  4.        server 172.16.135.115 weight=1 max_fails=3 fail_timeout=30s;
  5.     }
  6. server  {
  7.     listen       8080;
  8.     server_name  bbs.etiantian.org;
  9.     index  index.php index.html index.htm;
  10.     location / {
  11.         proxy_pass http://vbill;
  12.         proxy_set_header Host  $host;
  13.         proxy_set_header X-Forwarded-For  $remote_addr;
  14.         }
  15.     error_page   500 502 503 504  /50x.html;
  16.     location = /50x.html {
  17.         root  /data0/www/cms;
  18.         }
  19. }
  21. [root@test-ngx ~]# vim /usr/local/nginx/conf/nginx.conf
  22. include       extra/upstream.conf;
  23. # Check the configure file:
  24. [root@test-ngx ~]# /usr/local/nginx/sbin/nginx -t
  25. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
  26. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
  27. # 
  28. [root@test-ngx ~]# /usr/local/nginx/sbin/nginx
  29. #
  30. [root@test-ngx nginx-1.9.15]# /usr/local/nginx/sbin/nginx -s reload

示例：

  1. [root@test-ngx ~]# cat /usr/local/nginx/conf/extra/vbill.conf    
  2. upstream vbill {
  3.     server 172.16.136.115:8080;
  4.     check interval=5000 rise=1 fall=3 timeout=4000;
  5.     }
  6. server {
  7.     listen 8080;
  8.     return 301 https://$host$request_uri;
  9. }
  10. server {
  11.     listen 80;
  12.     return 301 https://$host$request_uri;
  13. }
  15. server  {
  16.     listen       443 ssl;
  17.     server_name  test.vbill.cn;
  18.     ssl     on;
  19.     #ssl_password_file    /root/key/test.vbill.cn.pass;
  20.     ssl_certificate      /root/key/test.vbill.cn_bundle.crt;
  21.     ssl_certificate_key  /root/key/test.vbill.cn.key;
  22.     ssl_session_cache    shared:SSL:1m;
  24.     index index.php index.html index.htm;
  25.     location / {
  26.         proxy_pass http://vbill;
  27.         proxy_set_header Host  $host;
  28.         proxy_set_header X-Forwarded-For  $remote_addr;
  29.         }
  30.     location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|js|css|html)$ {
  31.         proxy_pass http://vbill;
  32.         proxy_set_header Host  $host;
  33.         proxy_set_header X-Forwarded-For  $remote_addr;
  34.         proxy_cache my_cache;
  35.         proxy_cache_use_stale  error timeout http_500 http_502 http_503 http_504;
  36.         proxy_cache_valid 200 302 304 5m;
  38.         }
  39.     location /status {
  40.         check_status;
  41.         access_log   off;
  42.         allow 172.16.80.135;
  43.         deny all;
  44.         }
  45.     error_page   500 502 503 504  /50x.html;
  46.     #location = /50x.html {
  47.     #    root  /data0/www/cms;
  48.     #    }
  49. }

https://github.com/yaoweibin/nginx_upstream_check_module

Nginx 单IP下 配置多个server https 的问题
http://t.cn/R5agALy

比较全面的安全配置：http://rhyzx.im/2015-10-11-nginx-configuration-for-production

Connect Limit

http://www.cnblogs.com/chenpingzhao/p/4971308.html
http://tengine.taobao.org/nginx_docs/cn/docs/http/ngx_http_limit_conn_module.html#limit_conn
http://www.163py.com/pages/122/130/545/article_index.html
http://blog.chinaunix.net/uid-2330196-id-3289522.html

缓冲和缓存

http://itindex.net/blog/2015/01/16/1421343060000.html?utm_source=tuicool&utm_medium=referral

Buffer

Cache

http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache
https://linux.cn/article-5945-1.html

  1. # Create a cache directory:
  2. [root@test-ngx ~]# mkdir -p /data/proxy-cache

我们只需要两个命令就能够启用基本的缓存：

  1. [root@test-ngx ~]# vim /usr/local/nginx/conf/nginx.conf
  2. # 使用下面的指令来设置缓存的路径和配置：
  3. # Web cache:
  4. proxy_temp_path  /data/temp;
  5. proxy_cache_path /data/proxy-cache levels=1:2 keys_zone=my_cache:50m inactive=10m use_temp_path=off max_size=20g;
  1. server {
  2. ...
  3.     proxy_cache my_cache;         # 定义一个共享的内存区域用来缓存。
  4.     proxy_cache_revalidate on;
  5.     proxy_cache_min_uses 3;
  6.     proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
  7.     proxy_cache_lock on;
  8. }

那么如何将缓存的内容放至内存中呢？因为“Nginx”本身不提供缓存到内存的功能，不过可通过使用/dev/shm这个内存中的文件系统来实施该功能。

首先要创建相应的缓存目录：

  1. [root@PBSNGX01 ~]# mkdir /dev/shm/nginx_cache

F5+Nginx

http://www.qiansw.com/f5-nginx-proxy-user-ip.html
http://www.ttlsa.com/nginx/nginx-get-user-real-ip

最需要注意的就是如何能够获得客户端的真实地址。首先“F5”上要开启该功能，其次要于Nginx上进行设定。

安全加固

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
https://cipherli.st

  1. ./configure \
  2. --prefix=/usr/local/nginx \
  3. --user=nginx \
  4. --group=nginx \
  5. --with-http_ssl_module \
  6. --with-openssl=/root/tools/openssl-1.0.1t \
  7. --with-http_gunzip_module \
  8. --with-http_stub_status_module \
  9. --with-pcre=/root/tools/pcre-8.39 \
  10. --with-http_realip_module \
  11. --add-module=/root/tools/nginx_upstream_check_module-master

双向HTTPS

http://feisky.xyz/sdn/basic/tls/nginx.html

添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注