Nginx´î½¨Ð§ÀÍÆ÷µÄ¸ßÇå¾²ÐÔÉèÖúͷÀ»ðǽսÂÔ
nginx´î½¨Ð§ÀÍÆ÷µÄ¸ßÇå¾²ÐÔÉèÖúͷÀ»ðǽսÂÔ
Ëæ×Å»¥ÁªÍøµÄ¿ìËÙÉú³¤£¬Ð§ÀÍÆ÷µÄÇå¾²ÐÔÔ½À´Ô½Êܵ½ÖØÊÓ¡£Nginx×÷Ϊһ¿î¸ßЧºÍÎȹ̵ÄWebЧÀÍÆ÷£¬ÆäÇå¾²ÐÔµÄÉèÖÃÒ²ÐèÒýÆðÎÒÃǵĹØ×¢¡£ÔÚ±¾ÎÄÖУ¬ÎÒÃǽ«Ì½ÌÖÔõÑùÉèÖÃNginxЧÀÍÆ÷ÒÔʵÏÖ¸ßÇå¾²ÐÔ£¬²¢ÏÈÈÝһЩ·À»ðǽսÂÔ¡£
ʹÓÃHTTPSÐÒé
HTTPSÊÇÒ»ÖÖ»ùÓÚTLS/SSLÐÒéµÄ¼ÓÃÜ´«ÊäÐÒ飬¿ÉÒÔÈ·±£Êý¾ÝÔÚ´«ÊäÀú³ÌÖеÄÇå¾²ÐÔ¡£ÒªÊ¹ÓÃHTTPSÐÒ飬Ê×ÏÈÐèÒª»ñÈ¡²¢×°ÖÃSSLÖ¤Êé¡£Äú¿ÉÒÔÔÚÖ¤Êé½ÒÏþ»ú¹¹£¨ÈçLet’s Encrypt£©ÉêÇëÃâ·ÑµÄSSLÖ¤Ê飬Ȼºó½«Ö¤ÊéÉèÖõ½NginxЧÀÍÆ÷ÖС£ÒÔÏÂÊÇÒ»¸öʾÀýÉèÖãº
server { listen 443 ssl; server_name example.com; ssl_certificate /path/to/certificate.pem; ssl_certificate_key /path/to/private_key.pem; # ÆäËûNginxÉèÖà ... }
µÇ¼ºó¸´ÖÆ
ʹÓÃÇ¿ÃÜÂëºÍÃÜÔ¿
ÔÚNginxЧÀÍÆ÷ÉÏÉèÖÃÇ¿ÃÜÂëºÍÃÜÔ¿ÊDZ£»¤Ð§ÀÍÆ÷µÄÖ÷Òª²½·¥¡£¿ÉÒÔʹÓÃhtpasswdÏÂÁîÌìÉúÒ»¸ö¼ÓÃܵÄÃÜÂëÎļþ£¬²¢ÔÚNginxÉèÖÃÎļþÖÐÒýÓøÃÎļþ¡£ÒÔÏÂÊÇÒ»¸öʾÀýÉèÖãº
server { listen 80; server_name example.com; location / { auth_basic "Restricted Access"; auth_basic_user_file /path/to/htpasswd; # ÆäËûNginxÉèÖà ... } }
µÇ¼ºó¸´ÖÆ
ÉèÖûá¼ûÏÞÖÆ
ÏÞÖƶÔЧÀÍÆ÷×ÊÔ´µÄ»á¼û¿ÉÒÔïÔ̶ñÒâ¹¥»÷µÄΣº¦¡£ÔÚNginxÉèÖÃÎļþÖУ¬¿ÉÒÔʹÓÃallowºÍdenyÖ¸ÁîÉèÖûá¼ûÏÞÖÆ¡£ÒÔÏÂÊÇÒ»¸öʾÀýÉèÖãº
server { listen 80; server_name example.com; location / { deny 192.168.1.0/24; deny 10.0.0.0/8; allow 192.168.1.100; allow 127.0.0.1; deny all; # ÆäËûNginxÉèÖà ... } }
µÇ¼ºó¸´ÖÆ
ÉÏÊöÉèÖý«¾Ü¾øIPµØµãΪ192.168.1.0/24ºÍ10.0.0.0/8Íø¶ÎµÄ»á¼û£¬²¢ÔÊÐíIPµØµãΪ192.168.1.100ºÍ127.0.0.1µÄ»á¼û¡£ÆäËûδƥÅäµÄIPµØµã½«±»¾Ü¾ø»á¼û¡£
ʹÓ÷À»ðǽսÂÔ
³ýÁËNginxµÄÉèÖÃÍ⣬»¹¿ÉÒÔʹÓ÷À»ðǽÀ´ÔöÌíЧÀÍÆ÷µÄÇå¾²ÐÔ¡£ÀýÈ磬¿ÉÒÔʹÓÃiptablesÏÂÁî»òfirewalldЧÀÍÀ´ÉèÖ÷À»ðǽ¹æÔò¡£ÒÔÏÂÊÇÒ»¸öʹÓÃiptablesÏÂÁîÉèÖ÷À»ðǽսÂÔµÄʾÀý£º
# ÔÊÐíSSH»á¼û sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ÔÊÐíHTTPºÍHTTPS»á¼û sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT # ÆäËû¹æÔò ... # ¾Ü¾øËùÓÐÆäËû»á¼û sudo iptables -A INPUT -j DROP
µÇ¼ºó¸´ÖÆ
ÉÏÊöÉèÖý«ÔÊÐíSSH¡¢HTTPºÍHTTPSµÄ»á¼û£¬²¢¾Ü¾øÆäËûËùÓлá¼û¡£
×ÛÉÏËùÊö£¬Í¨¹ýʹÓÃHTTPSÐÒé¡¢ÉèÖÃÇ¿ÃÜÂëºÍÃÜÔ¿¡¢ÏÞÖÆ»á¼ûºÍʹÓ÷À»ðǽսÂÔ£¬¿ÉÒÔ×ÊÖúÎÒÃÇÌá¸ßNginxЧÀÍÆ÷µÄÇå¾²ÐÔ¡£ËäÈ»£¬ÕâÖ»ÊÇһЩ»ù±¾µÄÉèÖúÍÕ½ÂÔ£¬ÏÖʵÉÏÉÐÓиü¶àµÄÇå¾²ÐÔ²½·¥¿ÉÒÔʵÑé¡£Òò´Ë£¬ÎÒÃÇÓ¦¸Ã¼á³Ö¶ÔЧÀÍÆ÷Çå¾²ÐÔµÄÒ»Á¬¹Ø×¢£¬ÊµÊ±¸üкÍÓÅ»¯Ïà¹ØµÄÉèÖúÍÕ½ÂÔ£¬ÒÔÈ·±£Ð§ÀÍÆ÷µÄÇå¾²ÐԺͿɿ¿ÐÔ¡£
ÒÔÉϾÍÊÇNginx´î½¨Ð§ÀÍÆ÷µÄ¸ßÇå¾²ÐÔÉèÖúͷÀ»ðǽսÂÔµÄÏêϸÄÚÈÝ£¬¸ü¶àÇë¹Ø×¢±¾ÍøÄÚÆäËüÏà¹ØÎÄÕ£¡