1.通路控制
vim /usr/local/nginx/conf/nginx.conf
location / {
root html;
index index.html index.htm;
allow 192.168.56.1; //添加此行
deny all; //添加此行
}
deny 192.168.56.1; //修改此行
allow all; //修改此行
2.基于使用者認證
[root@hyj ~]# yum provides htpasswd
[root@hyj ~]# yum install httpd-tools -y
[root@hyj ~]# cd /usr/local/nginx/
[root@hyj nginx]# mkdir auth
這裡的密碼為加密後的密碼串，建議用htpasswd來建立此檔案
[root@hyj ~]# htpasswd -c -m /usr/local/nginx/auth/.user_auth_file ranran
New password:
Re-type new password:
user_auth_file内容格式為：username:password
[root@hyj ~]# cat /usr/local/nginx/auth/.user_auth_file
ranran:$apr1$U4iGIk.V$/OqSCBKpXLLOG39cZvQwy.
auth_basic "歡迎資訊";
auth_basic_user_file "/path/to/user_auth_file"
編輯配置檔案：
[root@hyj ~]# vim /usr/local/nginx/conf/nginx.conf
auth_basic "i love you,ran"; //添加此行
auth_basic_user_file /usr/local/nginx/auth/.user_auth_file; //添加此行
輸入ip192.168.56.12通路
//用設定的使用者名，密碼登入
3.https配置
openssl實作私有CA
CA的配置檔案：/etc/pki/tls/openssl.cnf
a)CA生成一對密鑰
[root@hyj ~]# cd /etc/pki/CA
[root@hyj CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) //生成密鑰，括号必須要
Generating RSA private key, 2048 bit long modulus
................................................................................................................+++
..................+++
e is 65537 (0x10001)
[root@hyj CA]# openssl rsa -in private/cakey.pem -pubout //提取公鑰
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz89y+Qh4cK+YSCZJd7Mc
LnLkBgHGy4HKdwMHHoCfBi+EE9LEMF3WqQp8Q0BEsqNDknUVyK2Owg+sVFvdwgBF
nCz2zRN9Hp8r29ysZ6EUVCiVWj1ka5byMUxwEPJA1dt8F+o6qaYaBXe5JAzA9OoK
OdtN6oc1yLGwdpxSNpJkCGZnam9Xl/PTuhLt0z1LCsz+wGhVMX8kEg1tSXbUEMMK
Bfd7kaNKMUHh7lohNMZ25+4YxOJIjrvB3sc+hFuZMTI93ip4qPHoqaNkSQIq/cvJ
e08XYbjrwz1Y414g+LbbFzYtcC1asNreCUTHWiX3IivTuL/ScqKrAH5VxWCALwVn
dQIDAQAB
-----END PUBLIC KEY-----
b)CA生成自簽署證書
//生成證書
[root@hyj CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
//讀驗證書内容
[root@hyj CA]# openssl x509 -text -in cacert.pem
[root@hyj CA]# mkdir certs newcerts crl
[root@hyj CA]# touch index.txt && echo 01 > serial
c)用戶端（例如nginx伺服器）生成密鑰
[root@hyj ~]# cd /usr/local/nginx && mkdir ssl && cd ssl
[root@hyj ssl]# (umask 077;openssl genrsa -out nginx.key 2048)
d)用戶端生成證書簽署請求
[root@hyj ssl]# openssl req -new -key nginx.key -days 365 -out nginx.csr
[root@hyj ssl]# openssl ca -in ./nginx.csr -out nginx.crt -days 365
Certificate is to be certified until Sep 2 18:20:40 2019 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
//編輯配置檔案
[root@hyj ~]# vi /usr/local/nginx/conf/nginx.conf
server {
listen 443 ssl;
server_name www.ranran520.com; //編輯此處，用域名
[root@hyj ~]# nginx -t //檢查是否有文法錯誤
[root@hyj ~]# nginx -s reload //重新加載配置檔案
修改C:\Windows\System32\drivers\etc下面的hosts檔案，添加域名映射,可實作域名通路
192.168.56.12 www.ranran520.com
4.開啟狀态界面‘
開啟status
location /status {
stub_status on;
allow 192.168.56.1;
deny all;
5.rewrite
[root@hyj nginx]# cd html/
[root@hyj html]# mkdir images
//傳張圖檔到images目錄下，用于驗證
[root@hyj images]# ls
1.jpg
//修改配置檔案，
//添加以下内容
location /images {
index index.html;
//通路
//将images目錄重命名
[root@hyj html]# ls
50x.html images index.html
[root@hyj html]# mv images imgs
50x.html imgs index.html
//修改配置檔案
rewrite ^/images/(.*.jpg)$ /imgs/$1 break; //添加此行，将原先images的内容賦予imgs
//用原先的url通路
rewrite ^/images/(.*.jpg)$ http://www.baidu.com;
//将原先的images連結到百度，用192.168.56.12/images/1.jpg通路