nginx防盗链，访问控制，解析php相关配置，nginx代理

发布时间：2023-09-06 02:00责任编辑：傅花花关键词：配置 nginx

nginx防盗链

配置如下，可以和不记录静态文件配置结合起来

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)${expires 7d;valid_referers none blocked server_names ?*.test.com ; #设置白名单if ($invalid_referer) { ???return 403; ?????????#不过不是白名单的refer就403}access_log off;}

测试

[root@akuilinux01 test.com]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 test.com/1.gif -IHTTP/1.1 403 ForbiddenServer: nginx/1.14.0Date: Sat, 16 Jun 2018 03:27:15 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-alive[root@akuilinux01 test.com]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 test.com/1.gif -IHTTP/1.1 200 OKServer: nginx/1.14.0Date: Sat, 16 Jun 2018 03:27:23 GMTContent-Type: image/gifContent-Length: 9Last-Modified: Sat, 16 Jun 2018 03:04:17 GMTConnection: keep-aliveETag: "5b247e31-9"Expires: Sat, 23 Jun 2018 03:27:23 GMTCache-Control: max-age=604800Accept-Ranges: bytes

nginx的访问控制

控制访问目录/admin/，只允许某几个ip访问，配置如下

location /admin/{allow 192.168.21.128;allow 127.0.0.1;deny all;}这里的allow和deny没有先执行后执行的顺序，执行完allow匹配后，就不会执行下面的

测试

[root@akuilinux01 test.com]# mkdir /data/wwwroot/test.com/admin[root@akuilinux01 test.com]# echo "admin" >/data/wwwroot/test.com/admin/1.html[root@akuilinux01 test.com]# curl -x127.0.0.1:80 test.com/admin/1.html -IHTTP/1.1 200 OKServer: nginx/1.14.0Date: Sat, 16 Jun 2018 03:59:22 GMTContent-Type: text/htmlContent-Length: 6Last-Modified: Sat, 16 Jun 2018 03:58:46 GMTConnection: keep-aliveETag: "5b248af6-6"Accept-Ranges: bytes[root@akuilinux01 test.com]# curl -x192.168.21.128:80 test.com/admin/1.html -IHTTP/1.1 200 OKServer: nginx/1.14.0Date: Sat, 16 Jun 2018 04:01:33 GMTContent-Type: text/htmlContent-Length: 6Last-Modified: Sat, 16 Jun 2018 03:58:46 GMTConnection: keep-aliveETag: "5b248af6-6"Accept-Ranges: bytes[root@akuilinux01 test.com]# dhclient ens37[root@akuilinux01 test.com]# ifconfig ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> ?mtu 1500 ???inet 192.168.110.128 ?netmask 255.255.255.0 ?broadcast 192.168.110.255 ???inet6 fe80::c559:4a92:72f1:b448 ?prefixlen 64 ?scopeid 0x20<link>[root@akuilinux01 test.com]# curl -x192.168.110.128:80 test.com/admin/1.html -IHTTP/1.1 403 ForbiddenServer: nginx/1.14.0Date: Sat, 16 Jun 2018 04:05:10 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-alive

匹配正则，限制php解析

location ~ .*(upload|image)/.*\.php${deny all;}

测试

[root@akuilinux01 test.com]# mkdir /data/wwwroot/test.com/upload[root@akuilinux01 test.com]# echo "11111" >/data/wwwroot/test.com/upload/1.php[root@akuilinux01 test.com]# echo "11111" >/data/wwwroot/test.com/upload/1.txt[root@akuilinux01 test.com]# curl -x127.0.0.1:80 test.com/upload/1.txt11111[root@akuilinux01 test.com]# curl -x127.0.0.1:80 test.com/upload/1.php<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.14.0</center></body></html>

根据user_agent限制

if ($http_user_agent ~ ‘Spider/3.0|YoudaoBot|Tomato‘){return 403;}#deny all和return 403效果一样,~*匹配可以忽略大小写

测试

[root@akuilinux01 test.com]# curl -A "Tomato" -x127.0.0.1:80 test.com/upload/1.txt<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.14.0</center></body></html>[root@akuilinux01 test.com]# curl -A "tomato" -x127.0.0.1:80 test.com/upload/1.txt11111

解析php相关配置

nginx解析php配置如下

location ~ \.php${ ???include fastcgi_params; ???fastcgi_pass unix:/tmp/php-fcgi.sock; ????#这个路径要与php里对应 ??#fastcgi_pass 127.0.0.1:9000 ???fastcgi_index index.php; ???fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name; ???#这里的要与上面的root对应}

这里的fastcgi_pass也有两种模式要和php里面的对应，不然会导致502

[root@akuilinux01 ~]# vim /usr/local/php-fpm/etc/php-fpm.conf[global]pid = /usr/local/php-fpm/var/run/php-fpm.piderror_log = /usr/local/php-fpm/var/log/php-fpm.log[www]listen = /tmp/php-fcgi.sock#listen = 127.0.0.1:9000listen.mode = 666 #这里的权限必须是666，不然socket文件不能读取写入也会导致502user = php-fpmgroup = php-fpmpm = dynamicpm.max_children = 50pm.start_servers = 20pm.min_spare_servers = 5pm.max_spare_servers = 35pm.max_requests = 500rlimit_files = 1024

nginx代理

当一个web服务器只有私网Ip时，和它想通的具有外网ip的服务器就可以是代理服务器。为了快速访问美国的服务器，可以在香港设置一个代理服务器

这里可以设置一个虚拟机为代理服务器，配置如下

server{listen 80;server_name ask.apelearn.com;location /{ ???proxy_pass ?????http://121.201.9.155/; ???proxy_set_header Host ??$host; ???proxy_set_header X-Real-IP ?????$remote_addr; ???proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}}#定义的域名一般和被代理ip的域名保持一致#这里已知的猿课的web服务器地址#$host就是前面定义的域名

设置代理前后，可以看到效果

[root@akuilinux01 vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt -IHTTP/1.1 301 Moved PermanentlyServer: nginx/1.14.0Date: Mon, 18 Jun 2018 13:07:58 GMTContent-Type: text/htmlContent-Length: 185Connection: keep-aliveLocation: http://test.com/robots.txt[root@akuilinux01 vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt -IHTTP/1.1 302 FoundServer: nginx/1.14.0Date: Mon, 18 Jun 2018 13:13:06 GMTContent-Type: text/html; charset=UTF-8Connection: keep-aliveLocation: http://121.201.80.216:9000#后的302应该是web服务器设置的跳转

扩展

502问题汇总
location优先级

nginx防盗链，访问控制，解析php相关配置，nginx代理

原文地址：http://blog.51cto.com/akui2521/2130450

nginx防盗链，访问控制，解析php相关配置，nginx代理

nginx的访问控制

解析php相关配置

nginx代理

扩展

知识推荐