首页 Linux网维 LNMP的搭建及URL重写测试

LNMP的搭建及URL重写测试

内容:1、LNMP的搭建2、搭建基于LNMP的discuz论坛(www.hill.com)3、实现https4、实现访问http时自动跳转至https以及防盗链设置、URL重写测试…

内容:1、LNMP的搭建2、搭建基于LNMP的discuz论坛(www.hill.com)3、实现https4、实现访问http时自动跳转至https以及防盗链设置、URL重写测试一、LNMP的搭建我们知道,在apache与php的结合方式有三种,而nginx与php的结合目前只有一种是行之有效的:php-fpm

1、yum直接安装快速搭建LNMP,官方下载nginx的预安装包(rpm包),当然也可以编译安装#yum install -y prce-devel zlib-devel openssl-devel php-fpm php-mysql mariadb-server

# yum install nginx-1.10.0-1.el7.ngx.x86_64.rpm 2、添加ngixn虚拟主机[root@localhost pma]# cat /etc/nginx/conf.d/hill.conf server { listen 80; server_name www.hill.com; root /var/www/html/hill; location / { index index.php index.html; } location ~ .*\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /var/www/html/hill$fastcgi_script_name; include fastcgi_params; } }

3、启动相关服务,添加host文件测试[root@localhost hill]# curl -I www.hill.com HTTP/1.1 200 OK Server: nginx/1.10.0 Date: Mon, 24 Oct 2016 22:17:52 GMT Content-Type: text/html Connection: keep-alive X-Powered-By: PHP/5.4.16

LNMP的搭建及URL重写测试插图

4、测试phpMyAdmin成功

LNMP的搭建及URL重写测试插图1

5、安装论坛测试访问发帖成功:

LNMP的搭建及URL重写测试插图2

二、nginx的https实现1、搭建根CA服务器(这里在同一台机子上)[root@localhost hill]# (umask 066 ; openssl genrsa -out /etc/pki/CA/) certs/ crl/ newcerts/ private/ [root@localhost hill]# (umask 066 ; openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus …+++ ……………………………………………………………………+++ e is 65537 (0x10001) [root@localhost hill]# openssl req -new -x509 -days 365 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/ certs/ crl/ newcerts/ private/ [root@localhost hill]# openssl req -new -x509 -days 365 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. —– Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BEIJING Locality Name (eg, city) [Default City]:BEIJING Organization Name (eg, company) [Default Company Ltd]:hill.com Organizational Unit Name (eg, section) []:ca Common Name (eg, your name or your servers hostname) []:ca.hill.com Email Address []: [root@localhost hill]#

2、nginx申请证书签署[root@localhost hill]# mkdir -p /etc/nginx/ssl [root@localhost hill]# (umask 066 ; openssl genrsa -out /etc/nginx/ssl/nginx.key 2048) Generating RSA private key, 2048 bit long modulus ….+++ ………………….+++ e is 65537 (0x10001) [root@localhost hill]# openssl req -new -days 365 -key /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. —– Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BEIJIN Locality Name (eg, city) [Default City]:^C [root@localhost hill]# openssl req -new -days 365 -key /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. —– Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BEIJING Locality Name (eg, city) [Default City]:BEIJING Organization Name (eg, company) [Default Company Ltd]:hill.com Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your servers hostname) []:www.hill.com Email Address []: Please enter the following extra attributes to be sent with your certificate request A challenge password []: An optional company name []:

3、根CA签署证书[root@localhost CA]# openssl ca -in /etc/nginx/ssl/nginx.csr -out /etc/nginx/ssl/nginx.crt Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Oct 24 22:55:33 2016 GMT Not After : Oct 24 22:55:33 2017 GMT Subject: countryName = CN stateOrProvinceName = BEIJING organizationName = hill.com organizationalUnitName = ops commonName = www.hill.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 06:98:EC:97:95:A6:7A:29:D4:DE:F4:C7:98:ED:D1:01:F9:16:07:8A X509v3 Authority Key Identifier: keyid:F4:2C:6B:72:C4:D0:B5:CF:6F:B8:4E:A5:E1:A6:73:27:6D:6E:88:D3 Certificate is to be certified until Oct 24 22:55:33 2017 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@localhost CA]# [root@localhost CA]# [root@localhost CA]# ll /etc/nginx/ssl/ total 16 -rw-r–r–. 1 root root 4457 Oct 25 06:55 nginx.crt -rw-r–r–. 1 root root 1005 Oct 25 06:54 nginx.csr -rw——-. 1 root root 1679 Oct 25 06:53 nginx.key

4、编辑nginx虚拟主机的配置文件[root@localhost CA]# cat /etc/nginx/conf.d/hill.conf server { listen 443 ssl; server_name www.hill.com; root /var/www/html/hill; location / { index index.php index.html; } location ~ .*\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /var/www/html/hill$fastcgi_script_name; include fastcgi_params; } ssl on; ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; ssl_session_cache shared:sslcache:20m; } [root@localhost CA]# nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful [root@localhost CA]# nginx -s reload [root@localhost CA]# ss -tanl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:9000 *:* LISTEN 0 128 *:47112 *:* LISTEN 0 50 *:3306 *:* LISTEN 0 128 *:111 *:* LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 *:443 *:* LISTEN 0 128 :::111 :::* LISTEN 0 128 :::22 :::* LISTEN 0 100 ::1:25 :::* LISTEN 0 128 :::56155

5、浏览器打开测试成功

LNMP的搭建及URL重写测试插图3

三、实现访问http时自动跳转至https以及防盗链设置、URL重写测试1、http自动跳转https测试:[root@MiWiFi-R3-srv hill]# cat /etc/nginx/conf.d/hill.conf server { listen 443 ssl ; server_name www.hill.com; location / { index index.php index.html; root /var/www/html/hill; valid_referers none block server_names ~hill\.com; if ($invalid_referer) { return 111; } } location ~ .*\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /var/www/html/hill$fastcgi_script_name; include fastcgi_params; } ssl on; ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; ssl_session_cache shared:sslcache:20m; } server{ listen 80; server_name www.hill.com; rewrite ^(.*)$ https://$host$1 permanent ; }

2、防盗链测试: 添加配置:valid_referers none block server_names ~hill\.com; if ($invalid_referer) { return 111; }

测试正常[root@MiWiFi-R3-srv hill]# cat /etc/nginx/conf.d/hill.conf server { listen 443 ssl ; server_name www.hill.com; location / { index index.php index.html; root /var/www/html/hill; if ($http_user_agent ~* Edge ) { rewrite ^(.*)$ /test1.html break; } if ($http_user_agent ~* Mathon ) { rewrite ^(.*)$ /test2.html break; } if ($http_user_agent ~* firefox ) { rewrite ^(.*)$ /test3.html break; } valid_referers none block server_names ~hill\.com; if ($invalid_referer) { return 111; } } location ~ .*\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /var/www/html/hill$fastcgi_script_name; include fastcgi_params; } ssl on; ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; ssl_session_cache shared:sslcache:20m; } server{ listen 80; server_name www.hill.com; rewrite ^(.*)$ https://$host$1 permanent ; } [12:36 root@centos6.8~]# curl -I -k -e “www.baidu.com” https://www.hill.com HTTP/1.1 111 Server: nginx/1.10.0 Date: Tue, 25 Oct 2016 10:50:40 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive

3、URL重写测试:不同的代理实现不同的效果 添加配置:if ($http_user_agent ~* Edge ) { rewrite ^(.*)$ /test1.html break; } if ($http_user_agent ~* Mathon ) { rewrite ^(.*)$ /test2.html break; } if ($http_user_agent ~* firefox ) { rewrite ^(.*)$ /test3.html break; }

测试成功:[root@MiWiFi-R3-srv hill]# cat /etc/nginx/conf.d/hill.conf server { listen 443 ssl ; server_name www.hill.com; location / { index index.php index.html; root /var/www/html/hill; if ($http_user_agent ~* Edge ) { rewrite ^(.*)$ /test1.html break; } if ($http_user_agent ~* Mathon ) { rewrite ^(.*)$ /test2.html break; } if ($http_user_agent ~* firefox ) { rewrite ^(.*)$ /test3.html break; } valid_referers none block server_names ~hill\.com; if ($invalid_referer) { return 111; } } location ~ .*\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /var/www/html/hill$fastcgi_script_name; include fastcgi_params; } ssl on; ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; ssl_session_cache shared:sslcache:20m; } server{ listen 80; server_name www.hill.com; rewrite ^(.*)$ https://$host$1 permanent ; }

测试效果有效

LNMP的搭建及URL重写测试插图4LNMP的搭建及URL重写测试插图5

附:http核心模块的内置变量:$uri: 当前请求的uri,不带参数; $request_uri: 请求的uri,带完整参数; $host: http请求报文中host首部;如果请求中没有host首部,则以处理此请求的虚拟主机的主机名代替; $hostname: nginx服务运行在的主机的主机名; $remote_addr: 客户端IP $remote_port: 客户端Port $remote_user: 使用用户认证时客户端用户输入的用户名; $request_filename: 用户请求中的URI经过本地root或alias转换后映射的本地的文件路径; $request_method: 请求方法 $server_addr: 服务器地址 $server_name: 服务器名称 $server_port: 服务器端口 $server_protocol: 服务器向客户端发送响应时的协议,如http/1.1, http/1.0 $scheme: 在请求中使用scheme, 如https://www.domain.com/中的https; $http_HEADER: 匹配请求报文中指定的HEADER,$http_host匹配请求报文中的host首部 $sent_http_HEADER: 匹配响应报文中指定的HEADER,例如$http_content_type匹配响应报文中的content-type首部; $document_root:当前请求映射到的root配置;

免责声明:文章内容不代表本站立场,本站不对其内容的真实性、完整性、准确性给予任何担保、暗示和承诺,仅供读者参考,文章版权归原作者所有。如本文内容影响到您的合法权益(内容、图片等),请及时联系本站,我们会及时删除处理。

作者: 3182235786a

为您推荐

CentOS系统升级内核版本教程,centos内核版本升级

CentOS系统升级内核版本教程,centos内核版本升级

CentOS 系统升级系统内核版本  1、显示CentOS 系统内核版本:             [root@demo...
Linux下对 Nginx SSL 的性能进行调整

Linux下对 Nginx SSL 的性能进行调整

初始化服务器   这个web服务器运行在一个EC2 t1.micro 环境.我选择 Nginx + PHP5-FPM 来...
Linux Shell经典实例解析:Oracle启动脚本

Linux Shell经典实例解析:Oracle启动脚本

Oracle的启动脚本从功能上讲主要分为两个部分,第一部分是初始化各种环境变量,以确认当前Oracle服务器的版本,从而...
centOS6.4 64位下安装nfs文件共享系统

centOS6.4 64位下安装nfs文件共享系统

不知道谁装的服务器,默认自带,以下内容摘自互联网,配置部分按教程执行成功 一、环境介绍:   服务器:centos 19...
Linux下的Samba安装配置

Linux下的Samba安装配置

1 Samba 简介 Samba(SMB是其缩写) 是一个网络服务器,用于Linux和Windows共享文件之用;Sam...

发表回复

返回顶部