Linux基础(day51)
时间:2022-04-27
本文章向大家介绍Linux基础(day51),主要内容包括12.13 Nginx防盗链、Nginx防盗链、12.14 Nginx访问控制、Nginx访问控制、针对正则匹配、12.15 Nginx解析php相关配置、Nginx解析php相关配置、12.16 Nginx代理、Nginx代理、扩展、基本概念、基础应用、原理机制和需要注意的事项等,并结合实例形式分析了其使用技巧,希望通过本文能帮助到大家理解应用这部分内容。
12.13 Nginx防盗链
Nginx防盗链目录概要
- 配置如下,可以和上面的配置结合起来
location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
Nginx防盗链
- Nginx防盗链配置需要和不记录日志和过期时间结合在一起,因为都用到了“location”
- 打开配置文件 vim /usr/local/nginx/conf/vhost/test.com.conf
- 注释掉一些配置
#location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
#{
# expires 7d;
# access_log off;
#}
添加一些配置
location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d; //过期时间7天
valid_referers none blocked server_names *.test.com ; //定义一个白名单,referer就是指一些域名
if ($invalid_referer) { //如果不是白名单里的
return 403; //返回403
}
access_log off;
}
最后结果如下
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
#location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
#{
# expires 7d;
# access_log off;
#}
location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*.(js|css)$
{
expires 12h;
access_log off;
}
access_log /tmp/test.com.log combined_realip;
}
保存退出
- 添加的配置中的 ~* 表示不区分大小写,另外防盗链的配置里面server_names可以不写照样
- 检查配置文件语法错误,并重新加载配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 测试
[root@hf-01 ~]# curl -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 04 Jan 2018 22:50:02 GMT
Content-Type: image/gif
Content-Length: 8
Last-Modified: Thu, 04 Jan 2018 21:50:34 GMT
Connection: keep-alive
ETag: "5a4ea1aa-8"
Expires: Thu, 11 Jan 2018 22:50:02 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
[root@hf-01 ~]#
- 测试防盗链,使用curl -e
[root@hf-01 ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Thu, 04 Jan 2018 22:51:54 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
[root@hf-01 ~]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Thu, 04 Jan 2018 22:52:22 GMT
Content-Type: image/gif
Content-Length: 8
Last-Modified: Thu, 04 Jan 2018 21:50:34 GMT
Connection: keep-alive
ETag: "5a4ea1aa-8"
Expires: Thu, 11 Jan 2018 22:52:22 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
[root@hf-01 ~]#
- 再访问curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif显示403,而在访问curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.gif显示200,则表示防盗链配置成功
12.14 Nginx访问控制
Nginx访问控制目录概要
- 需求:访问/admin/目录的请求,只允许某几个IP访问,配置如下:
location /admin/
{
allow 192.168.74.129;
allow 127.0.0.1;
deny all;
}
- mkdir /data/wwwroot/test.com/admin/
- echo “test,test”>/data/wwwroot/test.com/admin/1.html
- -t && -s reload
- curl -x127.0.0.1:80 test.com/admin/1.html -I
- curl -x192.168.133.130:80 test.com/admin/1.html -I
- 可以匹配正则
location ~ .*(abc|image)/.*.php$
{
deny all;
}
- 根据user_agent限制
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
- deny all和return 403效果一样
Nginx访问控制
- Nginx访问控制,在平时运维网站的时候,经常会有一些请求不正常,或者故意的做一些限制,一些重要的内容禁止别人访问,就可以做一个白名单,只允许自己的公网IP或者自己公司内的公网IP去访问
- 在做Nginx访问控制目录的时候,限制的这个目录下没有index.html文件或者index.php文件,就会默认403
- 编辑配置文件vim /usr/local/nginx/conf/vhost/test.com.conf
- 增加访问控制的代码
location /admin/
{
allow 192.168.74.129; //白名单
allow 127.0.0.1; //白名单
deny all; //全部deny
}
最后结果如下
[root@hanfeng ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
假设访问的目录是admin,做一个限制
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
# location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
# {
# expires 7d;
# access_log off;
#}
location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.74.129;
allow 127.0.0.1;
deny all;
}
access_log /tmp/test.com.log combined_realip;
}
然后保存退出
- 然后检查配置文件语法错误,然后重新加载配置文件
[root@hanfeng ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hanfeng ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hanfeng ~]#
- 测试
[root@hf-01 ~]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/admin/
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 21:04:13 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Wed, 03 Jan 2018 21:43:17 GMT
Connection: keep-alive
ETag: "5a4d4e75-13"
Accept-Ranges: bytes
[root@hf-01 ~]# curl -x192.168.74.150:80 -I test.com/admin/
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 21:06:56 GMT
Content-Type: text/html
Content-Length: 19
Last-Modified: Wed, 03 Jan 2018 21:43:17 GMT
Connection: keep-alive
ETag: "5a4d4e75-13"
Accept-Ranges: bytes
[root@hf-01 ~]#
- 查看日志文件,会看到访问的192.168.74.150的来源IP也是192.168.74.129,因为它是被允许的,在白名单之内,所以显示状态码为200
[root@hf-01 ~]# cat /tmp/test.com.log
127.0.0.1 - [05/Jan/2018:05:51:37 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [08/Jan/2018:05:04:13 +0800] test.com "/admin/" 200 "http://www.test.com/1.txt" "curl/7.29.0"
192.168.74.129 - [08/Jan/2018:05:06:56 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
[root@hf-01 ~]#
- 查看IP,然后给ens36网卡配置IP
- 先查看ens36网卡是否连接,然后更改连接ens36网卡模式为仅主机连接模式
[root@hf-01 ~]# ifconfig
eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.74.129 netmask 255.255.255.0 broadcast 192.168.74.255
inet6 fe80::20c:29ff:feff:fe93 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:ff:fe:93 txqueuelen 1000 (Ethernet)
RX packets 453 bytes 42359 (41.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 308 bytes 39999 (39.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eno16777736:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.74.150 netmask 255.255.255.0 broadcast 192.168.74.255
ether 00:0c:29:ff:fe:93 txqueuelen 1000 (Ethernet)
ens36: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::20c:29ff:feff:fe9d prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:ff:fe:9d txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 13 bytes 2334 (2.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@hf-01 ~]#
- 给ens36网卡自动获取IP,然后再来查看ens36的网卡IP地址为192.168.204.128
[root@hf-01 ~]# dhclient ens36
[root@hf-01 ~]#
- 这时再来使用ens36网卡的IP来访问,会看到访问的admin目录为403
[root@hf-01 ~]# curl -x192.168.204.128:80 -I test.com/admin/
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 21:17:39 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
[root@hf-01 ~]#
- 这时再来查看日志文件,会看到来源的IP为192.168.204.128,在配置文件中被没有被允许,所以为403
[root@hf-01 ~]# !cat
cat /tmp/test.com.log
127.0.0.1 - [05/Jan/2018:05:51:37 +0800] test.com "/index.html" 200 "-" "curl/7.29.0"
127.0.0.1 - [08/Jan/2018:05:04:13 +0800] test.com "/admin/" 200 "http://www.test.com/1.txt" "curl/7.29.0"
192.168.74.129 - [08/Jan/2018:05:06:56 +0800] test.com "/admin/" 200 "-" "curl/7.29.0"
192.168.204.128 - [08/Jan/2018:05:17:39 +0800] test.com "/admin/" 403 "-" "curl/7.29.0"
[root@hf-01 ~]#
针对正则匹配
- 例子
- 网站被黑,数据库被盗窃,就是因为上传图片的目录没有做禁止解析php的操作,最终导致上传了一句话木马,php也能解析,所以网站就会被黑
- 只要能上传的目录,都要禁掉,禁止解析PHP
- 加以下代码,即可禁掉上传的目录解析PHP
location ~ .*(upload|image)/.*.php$ //只要匹配upload,然后以php结尾的
{
deny all; //都禁掉
}
- 打开配置文件vim /usr/local/nginx/conf/vhost/test.com.conf
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
#location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
#{
# expires 7d;
# access_log off; #}
location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.74.129;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*.php$
{
deny all;
}
access_log /tmp/test.com.log combined_realip;
}
保存退出
- 检查配置文件语法错误,并重新加载配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 测试,首先是访问的那个目录,然后访问的php资源
- 创建一个upload目录,然后在创建一个php文件
[root@hf-01 ~]# mkdir /data/wwwroot/test.com/upload
[root@hf-01 ~]# echo "11111" > /data/wwwroot/test.com/upload/1.php
[root@hf-01 ~]#
- 访问upload目录下的1.php文件,会看到是403状态码,被拒绝访问
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.php
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@hf-01 ~]#
- 这时再upload目录下创建1.txt,再来测试访问
[root@hf-01 ~]# echo "dasdasdas" >/data/wwwroot/test.com/upload/1.txt
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt
dasdasdas
[root@hf-01 ~]#
- 查看访问日志cat /tmp/test.com.log
[root@hf-01 ~]# cat /tmp/test.com.log
根据user_agent限制
- 如果你的网站被cc攻击,或者禁掉某些蜘蛛,如果你的网站想做一个被隐藏的网站,不想被别人搜索到,那么就可以将百度、谷歌、有道等这些蜘蛛封掉,没有任何蜘蛛爬到你的网站,也不将网址告诉任何人,那别人就无法知道你的站点,因为你的网站是被隐藏的。
- 只需要根据user_agent限制,添加以下代码
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
- deny all和return 403效果一样
- 打开配置文件vim /usr/local/nginx/conf/vhost/test.com.conf
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
#location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
#{ # expires 7d; # access_log off; #} location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.74.129;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*.php$
{
deny all;
}
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
access_log /tmp/test.com.log combined_realip;
}
保存退出
- 检查配置文件语法错误,并重新加载配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 模拟user_agent,访问测试,会看到显示403
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 22:04:06 GMT
Content-Type: text/plain
Content-Length: 10
Last-Modified: Sun, 07 Jan 2018 21:45:54 GMT
Connection: keep-alive
ETag: "5a529512-a"
Accept-Ranges: bytes
[root@hf-01 ~]# curl -A "Tomatoslfdfsdf" -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 22:05:21 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
[root@hf-01 ~]#
- deny all和return 403效果一样
- 如果访问的时候,改成小写再访问,则状态码为200,因为这个是严格匹配的
[root@hf-01 ~]# curl -A "tomatoslfdfsdf" -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 22:09:10 GMT
Content-Type: text/plain
Content-Length: 10
Last-Modified: Sun, 07 Jan 2018 21:45:54 GMT
Connection: keep-alive
ETag: "5a529512-a"
Accept-Ranges: bytes
[root@hf-01 ~]#
- 如果想忽略大小写,在配置文件中的匹配符号后加 * 号即可
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
if ($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
- 在检查配置文件,并重新加载
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]#
- 再来测试,会显示403
[root@hf-01 ~]# curl -A "tomatoslfdfsdf" -x127.0.0.1:80 test.com/upload/1.txt -I
HTTP/1.1 403 Forbidden
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 22:11:06 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
[root@hf-01 ~]#
12.15 Nginx解析php相关配置
Nginx解析php相关配置目录概要
- 配置如下:
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
- fastcgi_pass 用来指定php-fpm监听的地址或者socket
Nginx解析php相关配置
- 添加以下代码
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock; //写错这个路径,就会显示502
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
- 打开虚拟主机配置文件,因为现在test.com.conf还不能解析php,加代码添加到配置文件中
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
server
{
listen 80;
server_name test.com test1.com test2.com;
index index.html index.htm index.php;
root /data/wwwroot/test.com;
if ($host != 'test.com' ) {
rewrite ^/(.*)$ http://test.com/$1 permanent;
}
#location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
#{ # expires 7d; # access_log off; #} location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d;
valid_referers none blocked server_names *.test.com ;
if ($invalid_referer) {
return 403;
}
access_log off;
}
location ~ .*.(js|css)$
{
expires 12h;
access_log off;
}
location /admin/
{
allow 192.168.74.129;
allow 127.0.0.1;
deny all;
}
location ~ .*(upload|image)/.*.php$
{
deny all;
}
if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
location ~ .php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
access_log /tmp/test.com.log combined_realip;
}
保存退出
- 生成做一个php文件,在/data/wwwroot/test.com/目录下生成3.php
[root@hf-01 ~]# vim /data/wwwroot/test.com/3.php
<?php
phpinfo();
保存退出
- 测试访问3.php,会看到无法解析3.php文件,显示出了源码
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<?php
phpinfo();
[root@hf-01 ~]#
- 这时候检查配置文件语法错误,并重新加载配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 这时候再来访问3.php,会看到可以正常解析了
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php
- 若是解析php相关配置的 fastcgi_pass unix:/tmp/php-fcgi.sock; 这个路径被写错,会直接显示502,因为sock文件没有被找到
- 将配置文件改错后,重新加载后,再来访问3.php,会看到显示502状态码
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
[root@hf-01 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@hf-01 ~]#
- 查看访问日志cat /usr/local/nginx/logs/nginx_error.log,会看到日志文件中会说没有这样的文件或目录
[root@hf-01 ~]# cat /usr/local/nginx/logs/nginx_error.log
2018/01/08 06:42:21 [crit] 3392#0: *22 connect() to unix:/tmp/php-afcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-afcgi.sock:", host: "test.com"
[root@hf-01 ~]#
- 在遇到502的问题时,需要查看你配置的地址是否正确,首先查看错误日志,然后根据错误日志中提示,查看这个文件是否存在,在查看cat /usr/local/php-fpm/etc/php-fpm.conf你定义的sock是什么,那么在nginx的配置文件中写什么
[root@hf-01 ~]#
[root@hf-01 ~]# ls /tmp/php-afcgi.sock
ls: 无法访问/tmp/php-afcgi.sock: 没有那个文件或目录
[root@hf-01 ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
[root@hf-01 ~]#
- 这时再去配置文件中更改回来即可,所以只要配置文件中的 fastcgi_pass unix:/tmp/php-fcgi.sock; 地址错误,就会显示502
502的另一种情况
- 假设这时不监听sock,而去监听IP端口
- 首先更改配置vim /usr/local/php-fpm/etc/php-fpm.conf
- 将#listen = /tmp/php-fcgi.sock注释掉,增加listen = 127.0.0.1:9000
[root@hf-01 ~]# vim /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
#listen = /tmp/php-fcgi.sock
listen = 127.0.0.1:9000
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
保存退出
- 重启php 命令为/etc/init.d/php-fpm restart,php重启也支持reload
[root@hf-01 ~]# /etc/init.d/php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm done
[root@hf-01 ~]#
- 检查php文件是否存在语法错误,重新加载下nginx的配置文件
[root@hf-01 ~]# /usr/local/php-fpm/sbin/php-fpm -t
[08-Jan-2018 07:10:32] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 查看监听端口是否为127.0.0.1:9000
[root@hf-01 ~]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1539/master
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 3528/php-fpm: maste
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1218/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1191/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1539/master
tcp6 0 0 :::3306 :::* LISTEN 1566/mysqld
tcp6 0 0 :::22 :::* LISTEN 1191/sshd
[root@hf-01 ~]#
- 这时在来访问3.php,会看到显示为502
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
[root@hf-01 ~]#
- 查看配置文件会提示说文件不存在
- 这时候只需要在配置文件中做一个更改,在php配置那一块,注释掉unix,添加ip和端口
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
在php配置那一块,注释掉unix,添加ip和端口
#fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_pass 127.0.0.1:9000;
保存退出
- 检查语法错误,并重新加载配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
[root@hf-01 ~]#
- 再来访问3.php文件,会看到正常访问
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 23:23:11 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
[root@hf-01 ~]#
- 若是出现502,要检查下配置文件中的fastcgi_pass 这块是否nginx与php-fpm中所配置的地址是相匹配的
- PHP下的listen = /tmp/php-fcgi.sock这段配置很重要,决定了nginx是否能正确解析而不是502
- 当PHP配置文件 listen 使用sock时,那么对应的nginx配置文件下就必须使用 fastcgi_pass unix:/tmp/php-fcgi.sock;
- 当PHP配置文件listen 使用 IP加端口“127.0.0.1:9000”的时候,那么对应的nginx就要改成fastcgi_pass 127.0.0.1:9000;
- 配置文件中的 fastcgi_param SCRIPT_FILENAME 中的地址路径/data/wwwroot/test.com$fastcgi_script_name;与配置文件最上方的 root /data/wwwroot/test.com; 相对应起来
502的其他情况
- 在php5.4及以后的其他版本,有一个特点
- 更改监听为sock,取消监听IP和端口,注释掉listen.mode
- 更改php-fpm的配置文件,取消注释listen = /tmp/php-fcgi.sock,注释掉#listen = 127.0.0.1:9000和#listen.mode = 666
[root@hf-01 ~]# vi /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
#listen = 127.0.0.1:9000
#listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024
保存退出
- 重新加载php
[root@hf-01 ~]# /etc/init.d/php-fpm reload
Reload service php-fpm done
- 查看sock文件的权限为660,属主和属组为root
[root@hf-01 ~]# ls -l /tmp/php-fcgi.sock
srw-rw---- 1 root root 0 1月 8 07:47 /tmp/php-fcgi.sock
- 更改nginx虚拟主机配置文件,取消 fastcgi_pass unix:/tmp/php-fcgi.sock; 的注释,注释掉#fastcgi_pass 127.0.0.1:9000;
- fastcgi_pass unix:/tmp/php-fcgi.sock;这一行的配置是为了nginx去读sock文件
[root@hf-01 ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
- 重新加载nginx配置文件
[root@hf-01 ~]# /usr/local/nginx/sbin/nginx -s reload
- 这时候再来访问3.php,依然还是显示502
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 502 Bad Gateway
Server: nginx/1.12.1
Date: Sun, 07 Jan 2018 23:54:07 GMT
Content-Type: text/html
Content-Length: 173
Connection: keep-alive
- 查看访问日志文件,显示访问文件,权限被拒绝
[root@hf-01 ~]# !tail
tail /usr/local/nginx/logs/nginx_error.log
2018/01/08 06:42:21 [crit] 3392#0: *22 connect() to unix:/tmp/php-afcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-afcgi.sock:", host: "test.com"
2018/01/08 07:13:39 [crit] 3518#0: *24 connect() to unix:/tmp/php-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-fcgi.sock:", host: "test.com"
2018/01/08 07:54:07 [crit] 3790#0: *32 connect() to unix:/tmp/php-fcgi.sock failed (13: Permission denied) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "HEAD HTTP://test.com/3.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-fcgi.sock:", host: "test.com"
[root@hf-01 ~]#
- sock文件默认权限使660,root用户可以读,root用户组也是可读的,唯独其他用户不能去读
- 看到是由nobody的身份去读nginx的
[root@hf-01 ~]# ps aux |grep nginx
root 1218 0.0 0.1 21784 1692 ? Ss 00:11 0:00 nginx: master process /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
nobody 3929 0.0 0.3 23664 3692 ? S 08:18 0:00 nginx: worker process
nobody 3930 0.0 0.3 23664 3692 ? S 08:18 0:00 nginx: worker process
root 3932 0.0 0.0 112676 984 pts/0 R+ 08:18 0:00 grep --color=auto nginx
[root@hf-01 ~]#
- 这时临时改变权限为nobody
[root@hf-01 ~]# chown nobody /tmp/php-fcgi.sock
[root@hf-01 ~]#
- 这时再去访问3.php会看到正常访问
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Mon, 08 Jan 2018 00:22:43 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
[root@hf-01 ~]#
- 这就是因为nobody用户有读的权限,所以可以正常访问
- 在php-fpm的配置文件中定义listen.mode,就是为了让任何用户可以读
- 再去配置文件中取消listen.mode的注释
[root@hf-01 ~]# vi /usr/local/php-fpm/etc/php-fpm.conf
listen.mode = 666
- 然后重启php-fpm的配置文件
[root@hf-01 ~]# /etc/init.d/php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm done
[root@hf-01 ~]#
- 查看文件的权限
[root@hf-01 ~]# !ls
ls -l /tmp/php-fcgi.sock
srw-rw-rw- 1 root root 0 1月 8 08:28 /tmp/php-fcgi.sock
[root@hf-01 ~]#
- 访问3.php会看到正常访问
[root@hf-01 ~]# curl -x127.0.0.1:80 test.com/3.php -I
HTTP/1.1 200 OK
Server: nginx/1.12.1
Date: Mon, 08 Jan 2018 00:30:04 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
[root@hf-01 ~]#
502的另外情况
- 就是php-fpm服务,资源耗尽,也会显示502,这时候就需要去优化了
12.16 Nginx代理
Nginx代理目录概要
- cd /usr/local/nginx/conf/vhost
- vim proxy.conf //加入如下内容
server
{
listen 80;
server_name ask.apelearn.com;
location /
{
proxy_pass http://121.201.9.155/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Nginx代理
- 需求:
- 用户需要访问web服务器,但用户因为各种原因没办法访问或者访问很慢(私网无访问、境内访问国外服务器),所以,就需要一个能访问web服务器的代理者,让用户通过代理服务器访问
- 解决方法
- 创建代理服务器
- 首先切换目录cd /usr/local/nginx/conf/vhost
[root@hanfeng ~]# cd /usr/local/nginx/conf/vhost
[root@hanfeng vhost]#
- 新建一个配置文件vim proxy.conf
[root@hanfeng vhost]# vim proxy.conf
加入以下内容
server
{
listen 80;
server_name ask.apelearn.com; //定义域名,论坛的网站
location /
{
proxy_pass http://121.201.9.155/; //定义域名,论坛的IP
proxy_set_header Host $host; //定义访问的域名 为 $host =server_name ask.apelearn.com
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
保存退出
- 配置文件中,没有了root,因为这是一个代理服务器,它不需要访问本地服务器上的任何文件
- 在配置完成后,这台虚拟机就可以访问ask.apelearn.com论坛了
- 检查配置文件语法错误,并重新加载配置文件
[root@hanfeng vhost]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hanfeng vhost]# /usr/local/nginx/sbin/nginx -s reload
[root@hanfeng vhost]#
- robots是针对蜘蛛的索引的一个列表,一般网站都会有robots
[root@hanfeng vhost]# curl ask.apelearn.com/robots.txt
#
# robots.txt for MiWen
#
User-agent: *
Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/[root@hanfeng vhost]#
[root@hanfeng vhost]#
- 测试代理是否成功,指定本机的IP,也能去访问
[root@hanfeng vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
#
# robots.txt for MiWen
#
User-agent: *
Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/[root@hanfeng vhost]#
- 正常情况下,不去配置这个代理,是不可能通过本地访问到远程的站点的
扩展
- python基础-字符串与编码
- Codeforces 708A Letters Cyclic Shift
- Codeforce 712A Memory and Crow
- 每日一水之strcmp用法
- HDU 3782 xxx定律
- HDU 2566 统计硬币
- HDU 2561 第二小整数
- python基础-数据类型与变量
- HDU 2520 我是菜鸟,我怕谁
- HUST 1586 数字排列
- next_permutation(全排列算法)
- Hadoop数据分析平台实战——100HBase和MapReduce整合离线数据分析平台实战——100HBase和MapReduce整合
- Hadoop数据分析平台实战——120Hive Shell命令介绍 01(熟悉Hive略过)离线数据分析平台实战——120Hive Shell命令介绍 01(熟悉Hive略过)
- HUST 1588 辗转数对
- JavaScript 教程
- JavaScript 编辑工具
- JavaScript 与HTML
- JavaScript 与Java
- JavaScript 数据结构
- JavaScript 基本数据类型
- JavaScript 特殊数据类型
- JavaScript 运算符
- JavaScript typeof 运算符
- JavaScript 表达式
- JavaScript 类型转换
- JavaScript 基本语法
- JavaScript 注释
- Javascript 基本处理流程
- Javascript 选择结构
- Javascript if 语句
- Javascript if 语句的嵌套
- Javascript switch 语句
- Javascript 循环结构
- Javascript 循环结构实例
- Javascript 跳转语句
- Javascript 控制语句总结
- Javascript 函数介绍
- Javascript 函数的定义
- Javascript 函数调用
- Javascript 几种特殊的函数
- JavaScript 内置函数简介
- Javascript eval() 函数
- Javascript isFinite() 函数
- Javascript isNaN() 函数
- parseInt() 与 parseFloat()
- escape() 与 unescape()
- Javascript 字符串介绍
- Javascript length属性
- javascript 字符串函数
- Javascript 日期对象简介
- Javascript 日期对象用途
- Date 对象属性和方法
- Javascript 数组是什么
- Javascript 创建数组
- Javascript 数组赋值与取值
- Javascript 数组属性和方法
- 从ThinkPHP3.2.3过渡到ThinkPHP5.0学习笔记图文详解
- keras实现VGG16 CIFAR10数据集方式
- PyTorch: Softmax多分类实战操作
- 为什么称python为胶水语言
- opencv 图像礼帽和图像黑帽的实现
- python文件及目录操作代码汇总
- 使用pyplot.matshow()函数添加绘图标题
- 如何卸载python插件
- Keras实现支持masking的Flatten层代码
- 用opencv给图片换背景色的示例代码
- 解决Keras 自定义层时遇到版本的问题
- Laravel框架运行出错提示RuntimeException No application encryption key has been specified.解决方法
- Laravel访问出错提示:`Warning: require(/vendor/autoload.php): failed to open stream: No such file or di解决方法
- python实现PDF中表格转化为Excel的方法
- php实现算术验证码功能