Linux學習筆記十二周四次課（4月26日）
防盜鏈，就是禁止其他網址鏈接到本網站圖片文本等資源；
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
----------------------------------------------------------------------------------
location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
{
expires 7d; //過期時間7天
valid_referers none blocked server_names *.test.com; //防盜鏈部分，referer域名，none blocked白名單
if ($invalid_referer) { //如果非域名
return 403;
}
access_log off;
}
-----------------------------------------------------------------------------------
~*表示後面括號中的字符串不區分大小寫；
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
ls /data/wwwroot/test.com/ //查看目錄裏有哪些可以訪問的文件
curl -x127.0.0.1:80 -I test.com/2.js //狀態碼200，正常訪問；
curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I
12.14 Nginx訪問控制
訪問控制，允許指定IP訪問，其他不可訪問；
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
---------------------------------------------------------
location /admin/
{
allow 192.168.133.1;
allow 127.0.0.1;
deny all;
}
----------------------------------------------------------
mkdir /data/wwwroot/test.com/admin/
echo "test,test" > /data/wwwroot/test.com/admin/1.html
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/admin/1.html -I
curl -x192.168.133.130:80 test.com/admin/1.html -I
cat /tmp/test.com.log //查看訪問日誌
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
---------------------------------------------------------
location ~.* (abc|jmage)/.*\.php$
{
deny all;
}
----------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
mkdir /data/wwwroot/test.com/upload
echo "1111" > /data/wwwroot/test.com/upload/1.php
curl -x127.0.0.1:80 test.com/upload/1.php //403禁止
echo "1111" > /data/wwwroot/test.com/upload/1.txt
curl -x127.0.0.1:80 test.com/upload/1.txt //正常訪問
cat /tmp/test.com.log //查看訪問日誌
//根據user_agent限制
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
-------------------------------------------------------------------
if($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
-------------------------------------------------------------------
//deny all和return 403效果一樣
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/upload/1.php //403禁止
curl -x127.0.0.1:80 test.com/upload/1.txt -I //200正常訪問
curl -A "Tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
curl -A "tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //200正常訪問
//如果想忽略大小寫，禁止
vim /usr/local/nginx/conf/vhost/test.com.conf //server中添加以下信息
-------------------------------------------------------------------
if($http_user_agent ~* 'Spider/3.0|YoudaoBot|Tomato')
{
return 403;
}
-------------------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -A "Tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
curl -A "tomatoalskdflsd" -x127.0.0.1:80 test.com/upload/1.txt -I //403禁止
12.15 Nginx解析php相關配置
vim /usr/local/nginx/conf/vhost/test.com.conf//server中添加以下信息
-------------------------------------------------------------------
location ~ \.php$
{
include fastcgi_parems;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_parem SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;
}
-------------------------------------------------------------------
//fastcgi_pass用來指定php-fpm監聽的地址或者socket
//若打錯了寫入內容，最終測試會報502錯誤；
vim /data/wwwroot/test.com/3.php //寫入以下內容
-------------------------------------------------------------------
<?php
phpinfo();
-------------------------------------------------------------------
curl -x127.0.0.1:80 test.com/upload/3.php //不能解析，直接把源碼（寫入的內容）顯示出來
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 test.com/upload/3.php //正常解析
tail /usr/local/nginx/logs/error.log //查看錯誤日誌
12.16 Nginx代理
cd /usr/local/nginx/conf/vhost
vim proxy.conf //加入如下內容
-------------------------------------------------------------------
server
{
listen 80;
server_name ask.apelearn.com; //定義域名
location /
{
proxy_pass http://121.201.9.155/; //WEB服務器IP
proxy_set_header Host $host; //$host其實就是server_name域名
proxy_set_header X-Real-IP $remote_addr;
proxy-set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
-------------------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl ask.apelearn.com/robots.txt
curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
擴展
502問題匯總 http://ask.apelearn.com/question/9109
location優先級 http://blog.lishiming.net/?p=100
Linux學習筆記十二周四次課（4月26日）