12.13 Nginx防盗链
防盗链，就是禁止其他网址链接到本网站图片文本等资源；
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
----------------------------------------------------------------------------------
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d; //过期时间7天
valid_referers none blocked server_names *.test.com; //防盗链部分，referer域名，none blocked白名单
if ($invalid_referer) { //如果非域名
return 403;
}
access_log off;
}
-----------------------------------------------------------------------------------
~*表示后面括号中的字符串不区分大小写；
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
ls /data/wwwroot/test.com/ //查看目录里有哪些可以访问的文件
curl -x127.0.0.1:80 -I test.com/2.js //状态码200，正常访问；
curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/2.js //403禁止
12.14 Nginx访问控制
访问控制，允许指定IP访问，其他不可访问；
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
---------------------------------------------------------
location /admin/
{
allow 192.168.133.1;
allow 127.0.0.1;
deny all;
}
----------------------------------------------------------
mkdir /data/wwwroot/test.com/admin/
echo "test,test" > /data/wwwroot/test.com/admin/1.html
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/admin/1.html -I
curl -x192.168.133.130:80 test.com/admin/1.html -I
cat /tmp/test.com.log //查看访问日志
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
---------------------------------------------------------
location ~.* (abc|jmage)/.*\.php$
{
deny all;
}
----------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
mkdir /data/wwwroot/test.com/upload
echo "1111" > /data/wwwroot/test.com/upload/1.php
curl -x127.0.0.1:80 test.com/upload/1.php //403禁止
echo "1111" > /data/wwwroot/test.com/upload/1.txt
curl -x127.0.0.1:80 test.com/upload/1.txt //正常访问
cat /tmp/test.com.log //查看访问日志
//根据user_agent限制
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
-------------------------------------------------------------------
if($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
-------------------------------------------------------------------
//deny all和return 403效果一样
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/upload/1.php //403禁止
curl -x127.0.0.1:80 test.com/upload/1.txt -I //200正常访问
curl -A "Tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
curl -A "tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //200正常访问
//如果想忽略大小写，禁止
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
-------------------------------------------------------------------
if($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
-------------------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -A "Tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
curl -A "tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
12.15 Nginx解析php相关配置
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
-------------------------------------------------------------------
location ~ \.php$
{
include fastcgi_parems;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_parem SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
-------------------------------------------------------------------
//fastcgi_pass用来指定php-fpm监听的地址或者socket
//若打错了写入内容，最终测试会报502错误；
vim /data/wwwroot/test.com/3.php //写入以下内容
-------------------------------------------------------------------
<?php
phpinfo();
-------------------------------------------------------------------
curl -x127.0.0.1:80 test.com/upload/3.php //不能解析，直接把源码（写入的内容）显示出来
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/upload/3.php //正常解析
tail /usr/local/nginx/logs/error.log //查看错误日志
12.16 Nginx代理
cd /usr/local/nginx/conf/vhost
vim proxy.conf //加入如下内容
-------------------------------------------------------------------
server
{
listen 80;
server_name ask.apelearn.com; //定义域名
location /
{
proxy_pass http://121.201.9.155/; //WEB服务器IP
proxy_set_header Host $host; //$host其实就是server_name域名
proxy_set_header X-Real-IP $remote_addr;
proxy-set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
-------------------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl ask.apelearn.com/robots.txt
curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
扩展
502问题汇总 http://ask.apelearn.com/question/9109
location优先级 http://blog.lishiming.net/?p=100
原文地址：http://blog.51cto.com/12059818/2109027