nginx访问控制、用户认证、https配置、免费https证书申请、状态页面开启和监控

cy大马猴

已于 2022-10-14 16:03:36 修改

阅读量988

点赞数

文章标签： nginx https 服务器

于 2022-10-14 02:48:21 首次发布

本文链接：https://blog.youkuaiyun.com/m0_62469712/article/details/127311519

版权

本文详细介绍了如何进行nginx的访问控制，设置基于用户的认证，详述了https的配置步骤，包括创建密钥和证书，同时讲解了如何申请免费的https证书，以及如何开启和监控nginx的状态页面。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

nginx访问控制

用于location段
allow：设定允许哪台或哪些主机访问，多个参数间用空格隔开
deny：设定禁止哪台或哪些主机访问，多个参数间用空格隔开
示例：

        location ~* ^/abc$ {
            deny 192.168.64.129;
            echo "wawa";
        }

        location / {
            echo "haha";
<nx/conf/nginx.conf" 126L, 2752C written 
[root@nginx ~]# systemctl restart nginx.service

在这里插入图片描述

基于用户认证

先安装一下apache的工具安装包

[root@nginx ~]# which htpasswd
/usr/bin/which: no htpasswd in (/usr/local/nginx/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)
[root@nginx ~]# dnf provides *bin/htpasswd
Last metadata expiration check: 0:38:54 ago on Thu 13 Oct 2022 11:11:45 PM CST.
httpd-tools-2.4.37-41.module_el8.5.0+977+5653bbea.x86_64 : Tools for
     ...: use with the Apache HTTP Server
Repo        : AppStream
Matched from:
Other       : *bin/htpasswd

httpd-tools-2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64 : Tools for
     ...: use with the Apache HTTP Server
Repo        : AppStream
Matched from:
Other       : *bin/htpasswd

[root@nginx ~]# dnf -y install httpd-tools
过程省略。。。。。

生成加密文化

[root@nginx ~]# htpasswd -c -m /usr/local/nginx/conf/.htpasswd tom
New password: 
Re-type new password: 
Adding password for user tom
[root@nginx ~]# 
[root@nginx ~]# cd /usr/local/nginx/conf/
[root@nginx conf]# cat .htpasswd 
tom:$apr1$E9/TWbvk$4oH9zJd0fcW7R0/yi4tHA1
[root@nginx conf]#

这里的密码为加密后的密码串，建议用htpasswd来创建此文件：

location / {
            auth_basic "cys";
            auth_basic_user_file .htpasswd;
            echo "haha";
        }

[root@nginx conf]# systemctl restart nginx.service

在这里插入图片描述

https配置

创建密匙存放目录

[root@nginx conf]# mkdir -p /etc/pki/CA
[root@nginx conf]# cd /etc/pki/CA/
[root@nginx CA]# 
[root@nginx CA]# mkdir private
[root@nginx CA]# ls
private

生成密钥

[root@nginx CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
...................................+++++
........................+++++
e is 65537 (0x010001)
[root@nginx CA]# ls private/
cakey.pem
[root@nginx CA]#

CA生成自签署证书

[root@nginx CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
[root@nginx CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.cys.com
Organizational Unit Name (eg, section) []:www.cys.com
Common Name (eg, your name or your server's hostname) []:www.cys.com
Email Address []:1@2.com
[root@nginx CA]# 
[root@nginx CA]# mkdir certs newcerts crl
[root@nginx CA]# touch index.txt && echo 01 > serial
[root@nginx CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@nginx CA]#

客户端（例如httpd服务器）生成密钥

[root@nginx ~]# cd /usr/local/nginx/
[root@nginx nginx]# ls
client_body_temp  fastcgi_temp  logs        sbin       uwsgi_temp
conf              html          proxy_temp  scgi_temp
[root@nginx nginx]# cd conf/
[root@nginx conf]# mkdir ssl
[root@nginx conf]# cd ssl/
[root@nginx ssl]# (umask 077;openssl genrsa -out nginx.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..........................................................................................................................................+++++
.......................+++++
e is 65537 (0x010001)
[root@nginx ssl]#

客户端生成证书签署请求

[root@nginx ssl]# openssl req -new -key nginx.key -days 365 -out nginx.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB     
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.cys.com
Organizational Unit Name (eg, section) []:www.cys.com
Common Name (eg, your name or your server's hostname) []:www.cys.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@nginx ssl]#

CA签署提交上来的证书

[root@nginx ssl]# openssl ca -in nginx.csr -out nginx.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct 13 16:19:51 2022 GMT
            Not After : Oct 13 16:19:51 2023 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = www.cys.com
            organizationalUnitName    = www.cys.com
            commonName                = www.cys.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                02:39:C2:56:17:49:42:BD:56:67:E4:12:1A:58:71:95:92:C6:CC:AF
            X509v3 Authority Key Identifier: 
                keyid:BE:18:8B:82:13:9F:7E:25:F1:17:AF:B3:F4:CE:4E:AF:C1:2B:77:BA

Certificate is to be certified until Oct 13 16:19:51 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@nginx ssl]# ls
nginx.crt  nginx.csr  nginx.key
[root@nginx ssl]# 
[root@nginx ssl]# rm -f *.csr
[root@nginx ssl]# ls
nginx.crt  nginx.key
[root@nginx ssl]#

生成私钥，生成证书签署请求并获得证书，然后在nginx.conf中配置如下内容:

[root@nginx ssl]# cd ..
[root@nginx conf]# ls
fastcgi.conf            mime.types           ssl
fastcgi.conf.default    mime.types.default   uwsgi_params
fastcgi_params          nginx.conf           uwsgi_params.default
fastcgi_params.default  nginx.conf.default   win-utf
koi-utf                 scgi_params
koi-win                 scgi_params.default
[root@nginx conf]# vim nginx.conf
#把注释都取消掉
# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  www.cys.com;

        ssl_certificate      ssl/nginx.crt;
        ssl_certificate_key  ssl/nginx.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }

}

重启

[root@nginx conf]# systemctl restart nginx.service 
[root@nginx conf]# ss -antl
State  Recv-Q Send-Q  Local Address:Port   Peer Address:Port Process 
LISTEN 0      128           0.0.0.0:443         0.0.0.0:*            
LISTEN 0      128           0.0.0.0:80          0.0.0.0:*            
LISTEN 0      128           0.0.0.0:22          0.0.0.0:*            
LISTEN 0      128              [::]:22             [::]:*            
[root@nginx conf]#

在这里插入图片描述

免费https证书申请

阿里云购买

https://promotion.aliyun.com/ntms/act/sslbuy.html?spm=5176.21213303.782131.6.38fa53c9fGENj0&scm=20140722.S_card@@%E4%BA%A7%E5%93%81@@233187.S_cardgbdt.ID_card@@%E4%BA%A7%E5%93%81@@233187-RL_%E8%AF%81%E4%B9%A6-OR_ser-V_2-P0_0

在这里插入图片描述

自己服务器使用点下载

申请成功了有这个文件，拉到虚拟机里

[root@nginx ~]# ls
'\'                                 nginx-1.20.2.tar.gz
 8613512_www.cys486.top_nginx.zip   nginx-1.22.0
 anaconda-ks.cfg                    nginx-1.22.0.tar.gz
 nginx-1.20.2                       nginx_module_echo
[root@nginx ~]# unzip 8618537_www.cys486.top_nginx.zip 
Archive:  8618537_www.cys486.top_nginx.zip
Aliyun Certificate Download
  inflating: 8618537_www.cys486.top.pem  
  inflating: 8618537_www.cys486.top.key  
[root@nginx ~]# 
[root@nginx ~]# mv 8618537_www.cys486.top.key nginx.key
[root@nginx ~]# mv 8618537_www.cys486.top.pem nginx.crt

配置域名

[root@nginx ~]# cd /usr/local/nginx/conf/ssl/
[root@nginx ssl]# ls
nginx.crt  nginx.key
[root@nginx ssl]# rm -rf *
[root@nginx ssl]# mv ~/nginx.key ~/nginx.crt .
[root@nginx ssl]# ls
nginx.crt  nginx.key

[root@nginx ssl]# cd ..
# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  www.cys486.top;			//改成自己有的域名

        ssl_certificate      ssl/nginx.crt;
        ssl_certificate_key  ssl/nginx.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

[root@nginx conf]# systemctl restart nginx.service

状态页面开启和监控

location = /status {						//添加
            stub_status;
        }

在这里插入图片描述

[root@nginx ~]# while :;do curl http://127.0.0.1;done

在这里插入图片描述

状态监控

[root@nginx ~]# curl -s http://192.168.64.129/status|awk 'NR==4{print $2}'
0
[root@nginx ~]# curl -s http://192.168.64.129/status|awk 'NR==4{print $4}'
1
[root@nginx ~]# curl -s http://192.168.64.129/status|awk 'NR==4{print $6}'
0