使用NGINX搭建网站并进行优化
1、编译安装nginx
2、隐藏NGINX版本号
在编译安装之前，修改安装包nginx-1.18.0/src/http目录下的ngx_http_header_filter_module.c 和ngx_http_special_response.c 配置文件。并在编译安装完毕之后，修改主配置文件nginx.conf ，添加server_tokens off; 具体看以下配置
3、配置SSL访问及证书
4、限制流量访问
5、限制最大连接数
6、设置NGINX访问的黑名单
1、下载包并编译安装
[root@Linux]#wget http://nginx.org/download/nginx-1.18.0.tar.gz
[root@Linux]#tar -zxvf nginx-1.18.0.tar.gz
[root@Linux]#cd nginx-1.18.0 && ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[root@Linux]#cd /root/nginx1.18.0/src/http/ #编译之前， 隐藏nginx信息
[root@Linux]#vim ngx_http_header_filter_module.c 将此文件中的static u_char ngx_http_server_string[] = "Server: nginx" CRLF; 其中的nginx替换为其他内容如下
static u_char ngx_http_server_string[] = "Server: Tomcat" CRLF;
[root@Linux]#vim ngx_http_special_response.c #将此文件中第36行的"<hr><center>nginx</center>" CRLF 这里的nginx修改掉
"<hr><center>Tomcat</center>" CRLF
[root@Linux]#./configure --prefix=/usr/local/nginx-1.18.0 --with-http_ssl_module #编译安装到/usr/local/nginx-1.18.0这个目录下，并启用http_ssl模块
checking for OS
+ Linux 2.6.32-696.6.3.el6.x86_64 x86_64
checking for C compiler ... found
+ using GNU C compiler
+ gcc version: 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... not found
checking for O_PATH ... not found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for nobody group ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... not found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... not found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... not found
checking for clock_gettime(CLOCK_MONOTONIC) in librt ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for ioctl(FIONREAD) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for PCRE library ... not found
checking for PCRE library in /usr/local/ ... not found
checking for PCRE library in /usr/include/pcre/ ... not found
checking for PCRE library in /usr/pkg/ ... not found
checking for PCRE library in /opt/local/ ... not found
./configure: error: the HTTP rewrite module requires the PCRE library.
You can either disable the module by using --without-http_rewrite_module
option, or install the PCRE library into the system, or build the PCRE library
statically from the source with nginx by using --with-pcre=<path> option.
缺pcre安装包，安装PCRE后再重新编译安装
[root@Linux]#cd && wget https://ftp.pcre.org/pub/pcre/pcre-8.00.zip
[root@Linux]#unzip pcre-8.00.zip && cd pcre-8.00
[root@Linux]#./configure --prefix=/usr/local/pcre-8.00
[root@Linux]#make && make install
[root@Linux]#cd /root/nginx-1.18.0
[root@Linux]#./configure --prefix=/usr/local/nginx-1.18.0 --with-http_ssl_module --with-pcre=/root/pcre-8.00 #pcre是源码包目录，非安装目录
checking for OS
+ Linux 2.6.32-696.6.3.el6.x86_64 x86_64
checking for C compiler ... found
+ using GNU C compiler
+ gcc version: 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... not found
checking for O_PATH ... not found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for nobody group ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... not found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... not found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... not found
checking for clock_gettime(CLOCK_MONOTONIC) in librt ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for ioctl(FIONREAD) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for OpenSSL library ... found
checking for zlib library ... found
creating objs/Makefile
Configuration summary
+ using PCRE library: /usr/local/pcre-8.00
+ using system OpenSSL library
+ using system zlib library
nginx path prefix: "/usr/local/nginx-1.18.0"
nginx binary file: "/usr/local/nginx-1.18.0/sbin/nginx"
nginx modules path: "/usr/local/nginx-1.18.0/modules"
nginx configuration prefix: "/usr/local/nginx-1.18.0/conf"
nginx configuration file: "/usr/local/nginx-1.18.0/conf/nginx.conf"
nginx pid file: "/usr/local/nginx-1.18.0/logs/nginx.pid"
nginx error log file: "/usr/local/nginx-1.18.0/logs/error.log"
nginx http access log file: "/usr/local/nginx-1.18.0/logs/access.log"
nginx http client request body temporary files: "client_body_temp"
nginx http proxy temporary files: "proxy_temp"
nginx http fastcgi temporary files: "fastcgi_temp"
nginx http uwsgi temporary files: "uwsgi_temp"
nginx http scgi temporary files: "scgi_temp"
[root@Linux]#make
.
.
.
.
.
objs/src/core/nginx.o: In function `ngx_show_version_info':
/root/nginx-1.18.0/src/core/nginx.c:431: undefined reference to `OpenSSL_version'
/root/nginx-1.18.0/src/core/nginx.c:436: undefined reference to `OpenSSL_version'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_get_client_v_remain':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:5016: undefined reference to `X509_get0_notAfter'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_get_client_v_end':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:4979: undefined reference to `X509_get0_notAfter'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_get_client_v_start':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:4935: undefined reference to `X509_get0_notBefore'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_check_host':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:4074: undefined reference to `X509_check_host'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_ecdh_curve':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:1388: undefined reference to `SSL_CTX_set1_groups_list'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_connection_certificate':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:571: undefined reference to `SSL_set0_chain'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_certificate':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:478: undefined reference to `SSL_CTX_set0_chain'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_create':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:352: undefined reference to `SSL_CTX_set_min_proto_version'
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:353: undefined reference to `SSL_CTX_set_max_proto_version'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_info_callback':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:1043: undefined reference to `SSL_is_server'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_init':
/root/nginx-1.18.0/src/event/ngx_event_openssl.c:144: undefined reference to `OPENSSL_init_ssl'
objs/src/event/ngx_event_openssl_stapling.o: In function `ngx_ssl_stapling_file':
/root/nginx-1.18.0/src/event/ngx_event_openssl_stapling.c:237: undefined reference to `d2i_OCSP_RESPONSE_bio'
objs/src/event/ngx_event_openssl_stapling.o: In function `ngx_ssl_stapling_issuer':
/root/nginx-1.18.0/src/event/ngx_event_openssl_stapling.c:317: undefined reference to `X509_up_ref'
objs/src/http/modules/ngx_http_ssl_module.o: In function `ngx_http_ssl_merge_srv_conf':
/root/nginx-1.18.0/src/http/modules/ngx_http_ssl_module.c:727: undefined reference to `SSL_CTX_set_alpn_select_cb'
collect2: ld returned 1 exit status
make[1]: *** [objs/nginx] Error 1
make[1]: Leaving directory `/root/nginx-1.18.0'
make: *** [build] Error 2
openssl问题，需要添加--with-openssl，下载openssl安装包
下载官网：https://www.openssl.org/source/
[root@Linux]#./configure --prefix=/usr/local/nginx-1.18.0 --with-http_ssl_module --with-pcre=/root/pcre-8.00 --with-openssl=/root/openssl-1.1.1j #注意，这里的pcre和OpenSSL目录都是源码包目录，并非安装目录
[root@Linux]#make && make install
[root@Linux]#ls /usr/local/nginx-1.18.0
conf html logs sbin
2、隐藏nginx版本号
[root@Linux]#
[root@Linux]#
[root@Linux]#
[root@Linux]#
[root@Linux]#
[root@Linux]#
[root@Linux]#
[root@Linux]#
3、配置SSL访问及证书，最大访问数量，黑名单，在server内添加一个include blacklist.conf ，然后在conf目录下创建此文件，在里面添加禁止访问的IP，如deny 172.10.101.10 ,保存，重启nginx即可。
[root@Linux]#ln -s /usr/local/nginx-1.18.0/sbin/nginx /usr/bin/nginx #可以做软连接，也可以在/etc/profile文件中添加PATH变量export PATH=$PATH:/usr/local/nginx-1.18.0/sbin/
[root@Linux]#vim /usr/local/nginx-1.18.0/conf/nginx.conf
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024; #最大访问数量为1024 ，nginx最大连接数量=work process * work connection
}
http {
server_tokens off; #隐藏nginx信息
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80;
server_name yourdomanin name.com;
rewrite ^(.*)$ https://$host$1 permanent; #将访问80端口的请求转发到443加密访问
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
alias /data/; #设置自己的nginx访问时的/目录
autoindex on; #因为此网站没有html文件，所以开启目录访问设置
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
server {
listen 443 ssl;
server_name yourdomainname.com; #你的域名
ssl on;
ssl_certificate /usr/local/nginx-1.18.0/cert/name.pem; #将domain name.pem替换成你自己证书的文件名，此处也可用相对路径
ssl_certificate_key /usr/local/nginx-1.18.0/cert/name.key; #将domain name.key替换成你自己证书的秘钥文件名，此处也可用相对路径
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
limit_conn one 3; #单用户最大可打开3个链接
limit_rate 640k; #单用户最大限制下载速度为640k
alias /data/;
autoindex on;
}
}
}
[root@Linux]#nginx -c /usr/local/nginx-1.18.0/conf/nginx.conf #启动NGINX
nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /usr/local/nginx-1.18.0/conf/nginx.conf:101 #注意，此处NGINX配置文件中已使用listen 443 ssl已经是ssl，所以需要把ssl on这一行内容去掉，然后再重启一下NGINX
[root@Linux]#cat nginx.conf
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
server_tokens off; #隐藏nginx信息
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80;
server_name yourdomanin name.com;
rewrite ^(.*)$ https://$host$1 permanent; #将访问80端口的请求转发到443加密访问
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
alias /data/;
autoindex on;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
server {
listen 443 ssl;
server_name yourdomainname.com; #你的域名
ssl_certificate /usr/local/nginx-1.18.0/cert/name.pem; #将domain name.pem替换成你自己证书的文件名，此处也可用相对路径
ssl_certificate_key /usr/local/nginx-1.18.0/cert/name.key; #将domain name.key替换成你自己证书的秘钥文件名，此处也可用相对路径
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
limit_conn one 3; #单用户最大可打开3个链接
limit_rate 640k; #单用户最大限制下载速度为640k
alias /data/;
autoindex on;
}
}
}
[root@Linux]#nginx -s reload
