可以配合过期时间和静态文件不记录的代码使用

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf ...

~*表示忽略大小写的匹配

location ~* .*\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
    expires 7d;
    
    # 设置白名单，server_names可以不写
    # 白名单可以是多个域名，域名键使用空格间隔开
    valid_referers none blocked server_names *.test.com;
    
    # 条件判断，非白名单域名返回403状态码即禁止访问forbidden；
    if ($invalid_referer) {
        return 403;
    }
    access_log off;
}

...

验证效果

使用不在白名单内的referer访问，返回的状态码为403，forbidden！

[root@localhost vhost]# curl -e "http://www.baudi.com" -x 127.0.0.1:80 test.com/1.gif -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Wed, 03 Jan 2018 12:25:35 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive
指定白名单的referer访问，成功访问

[root@localhost vhost]# curl -e "http://www.test.com" -x 127.0.0.1:80 test.com/1.gif -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Wed, 03 Jan 2018 12:26:43 GMT Content-Type: image/gif Content-Length: 12 Last-Modified: Wed, 03 Jan 2018 11:35:29 GMT Connection: keep-alive ETag: "5a4cc001-c" Expires: Wed, 10 Jan 2018 12:26:43 GMT Cache-Control: max-age=604800 Accept-Ranges: bytes

nginx访问控制

针对目录的访问控制

修改虚拟主机配置文件

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf ...

这里以简单目录为例

location /admin/ { # nginx中没有apache里的order命令，按代码先后顺序执行 # nginx中只要有一条规则匹配，后续规则就不会进行匹配 # 允许本机 allow 127.0.0.1; allow 192.168.65.133; # 禁止其他所有ip deny all; } ...
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
测试

使用allow允许的ip访问，成功访问

[root@localhost ~]# curl -x 192.168.65.133:80 test.com/admin/1.php -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:36:48 GMT Content-Type: application/octet-stream Content-Length: 19 Last-Modified: Wed, 03 Jan 2018 13:15:00 GMT Connection: keep-alive ETag: "5a4cd754-13" Accept-Ranges: bytes

使用非allow允许的ip访问，403 forbidden

[root@localhost ~]# curl -x 192.168.65.137:80 test.com/admin/1.php -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

针对文件的访问控制

location还可以使用 /* + 正则的方式对某类文件或目录进行访问控制

[root@localhost vhost]# vim /usr/local/nginx/conf/vhost/test.com.conf 
# 禁止upload、admin目录下的php文件解析
location ~ .*(upload|admin)/.*\.php$
{
    deny all
}

重启并测试

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

[root@localhost ~]# curl -x 192.168.65.133:80 test.com/upload/1.php -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 12:59:07 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

针对user_agent

修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

还可以根据user_agent来做限制

这里限制网站被爬虫爬取

location / { if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato') { return 403; //等价于deny all; } }
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
效果测试

不指定user_agent

[root@localhost ~]# curl -x 127.0.0.1:80 test.com -I HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 11:44:35 GMT Content-Type: text/html Content-Length: 9 Last-Modified: Wed, 03 Jan 2018 10:42:12 GMT Connection: keep-alive ETag: "5a4cb384-9" Accept-Ranges: bytes

指定user_agent

[root@localhost ~]# curl -A "Tomato" -x 127.0.0.1:80 test.com -I HTTP/1.1 403 Forbidden Server: nginx/1.12.2 Date: Thu, 04 Jan 2018 11:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive

Nginx解析php相关配置

修改代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf ... location ~ .php$ { include fastcgi_params; # fastcgi_pass后接的sock在php-fpm.conf内的pool块内定义的，选择哪个进程池就写哪个socket fastcgi_pass unix:/tmp/php-fcgi.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /data/www/test.com$fastcgi_script_name; } ...
先测试为设置前是否能解析PHP

PHP不解析，直接显示代码

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload
验证效果

成功解析，返回网页html代码

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
...

访问报502错误分析

socket文件错误为了测试，这里我故意将配置文件内的sock写错

原本为/tmp/php-fcgi.sock

fastcgi_pass unix:/tmp/php1-fcgi.sock;

重启服务后重新访问，返回信息如下：

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.12.2</center>
</body>
</html>

因为nginx无法找到sock文件，查看错误日志，通过错误日志进行错误排查。

[root@localhost ~]# cat /usr/local/nginx/logs/nginx_error.log 
2018/01/05 17:47:18 [crit] 2456#0: *22 connect() to unix:/tmp/php1-fcgi.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: test.com, request: "GET HTTP://test.com/1.php HTTP/1.1", upstream: "fastcgi://unix:/tmp/php1-fcgi.sock:", host: "test.com"

这里的socket文件应该是在/usr/local/php-fpm/etc/php-fpm.conf内定义的。

[root@localhost ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
[global]
pid = /usr/local/php-fpm/var/run/php-fpm.pid
error_log = /usr/local/php-fpm/var/log/php-fpm.log
[www]
listen = /tmp/php-fcgi.sock
# 定义了sock必须定义mode，否则权限为440，执行后会报错
listen.mode = 666
user = php-fpm
group = php-fpm
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
rlimit_files = 1024

设置未对应设置 php-fpm.conf为监听ip/端口，nginx虚拟主机配置文件内为监听socket，没有对应。

修改配置代码

[root@localhost ~]# vim /usr/local/php-fpm/etc/php-fpm.conf ...

listen = /tmp/php-fcgi.sock

listen = 127.0.0.1:9000 ...

检测语法错误并重启php服务

[root@localhost ~]# /usr/local/php-fpm/sbin/php-fpm -t [05-Jan-2018 18:03:27] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful [root@localhost ~]# /etc/init.d/php-fpm reload Reload service php-fpm done
暂时不修改虚拟主机配置文件进行访问测试

报502错

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
502 Bad Gateway
502 Bad Gateway

nginx/1.12.2
修改对应代码

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/test.com.conf ... fastcgi_pass 127.0.0.1:9000; ...
重启服务后测试效果

重启服务

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

这里能成功访问

[root@localhost ~]# curl -x 127.0.0.1:80 test.com/1.php
...

其他出现502错误的原因还有服务器资源耗尽，出现这种问题的解决方法是进行优化。

Nginx代理

什么是代理用户访问国外web服务器的速率通常比较慢，导致出现卡顿甚至无法访问的情况！通过在中间搭建一个代理服务器实现快速访问的目的。这个代理服务器既可以与用户端快速连接，也可以高速访问远程web服务器。用户通过访问代理服务器，间接地访问web服务器，大大加快访问速度。
代码实现

[root@localhost ~]# vim /usr/local/nginx/conf/vhost/proxy.conf server { listen 80; server_name ask.apelearn.com; location / { # proxy_pass指定远程服务器的ip proxy_pass http://121.201.9.155/;
# $host即为server_name proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }
验证效果

正常情况下，无法直接通过本机访问远程服务器

[root@localhost ~]# curl -x127.0.0.1:80 ask.apelea#n.com/robots.txt

robots.txt for MiWen

User-agent: *

Disallow: /?/admin/ Disallow: /?/people/ Disallow: /?/question/ Disallow: /account/ Disallow: /app/ Disallow: /cache/ Disallow: /install/ Disallow: /models/ Disallow: /crond/run/ Disallow: /search/ Disallow: /static/ Disallow: /setting/ Disallow: /system/ Disallow: /tmp/ Disallow: /themes/ Disallow: /uploads/ Disallow: /url-* Disallow: /views/ Disallow: /*/ajax/

关闭代理设置，重新测试

# 关闭代理功能
[root@localhost ~]# mv /usr/local/nginx/conf/vhost/proxy.conf /usr/local/nginx/conf/vhost/proxy.conf.bak

[root@localhost ~]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@localhost ~]# /usr/local/nginx/sbin/nginx -s reload

# 无法直接通过本机访问远程服务器了
[root@localhost ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt -I
HTTP/1.1 404 Not Found
Server: nginx/1.12.2
Date: Thu, 04 Jan 2018 13:42:52 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive