web服务器nginx的基本使用与配置

yum -y install nginx 

## 日志目录
mkdir /data/log/nginx/ && chown -R nginx:nginx /data/log/nginx/

## 缓存目录
mkdir -p /var/cache/nginx/ && chown -R nginx:nginx /var/cache/nginx/

user nobody;
worker_processes auto;  #nginx对外提供web服务时的worker进程数
error_log /data/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;  #设置可由一个worker进程同时打开的最大连接数
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /data/log/nginx/access.log  main buffer=32k flush=30s;

    server_tokens       off; #关闭在错误页面中的nginx版本数字
    
    client_max_body_size 100m;

    sendfile            on;  #可以让sendfile函数发挥作用。sendfile函数可以在磁盘和TCP socket之间互相拷贝数据(或任意两个文件描述符)
    tcp_nopush          on;  #告诉nginx在一个数据包里发送所有头文件，而不一个接一个的发送
    tcp_nodelay         on;  #不缓存数据
    
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    #ssl 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
    ssl_ecdh_curve secp384r1;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    ssl_stapling on; 
    ssl_stapling_verify on;
    add_header Strict-Transport-Security "max-age=63072000; preload";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    #nginx缓存
    fastcgi_cache_path /var/cache/nginx/  levels=1:2 keys_zone=wordpress:10m inactive=30m use_temp_path=off;
    fastcgi_cache_key $request_method$scheme$host$request_uri;
    fastcgi_cache_use_stale error timeout invalid_header updating http_500;
    fastcgi_cache_valid 200 301 302 10h;
    fastcgi_cache_valid 404 10m;
    fastcgi_ignore_headers Expires Set-Cookie Vary;

    #启动gzip
    gzip on;
    gzip_min_length  1k;
    gzip_buffers     4 16k;
    gzip_comp_level 7;
    gzip_types
        text/css
        text/plain
        text/javascript
        application/javascript
        application/json
        application/x-javascript
        application/xml
        application/xml+rss
        application/xhtml+xml
        application/x-font-ttf
        application/x-font-opentype
        application/vnd.ms-fontobject
        image/svg+xml
        image/x-icon
        application/rss+xml
        application/atom_xml
        image/jpeg
        image/gif
        image/png
        image/icon
        image/bmp
        image/jpg;
    gzip_vary on;

    # for more information.
    include /etc/nginx/conf.d/*.conf;
}

systemctl enable --now nginx

server {
    listen 80;
    server_name *.chreagent.com;
    return 301 https://$http_host$request_uri;
}

        # 针对原始用户 IP 地址做限制
        ## 用户的 IP 地址 $binary_remote_addr 作为 Key，每个 IP 地址最多有 50 个并发连接
        ## 你想开 几千个连接 刷死我？ 超过 50 个连接，直接返回 503 错误给你，根本不处理你的请求了
        limit_conn_zone $binary_remote_addr  zone=TotalConnLimitZone:20m ;
        limit_conn  TotalConnLimitZone  50;
        limit_conn_log_level notice;


        ## 针对原始用户 IP 地址做限制
        ## 用户的 IP 地址 $binary_remote_addr 作为 Key，每个 IP 地址每秒处理 10 个请求
        ## 你想用程序每秒几百次的刷我，没戏，再快了就不处理了，直接返回 503 错误给你
        limit_req_zone $binary_remote_addr  zone=ConnLimitZone:20m  rate=10r/s;
        #limit_req zone=ConnLimitZone burst=10 nodelay; #如果开启此条规则，burst=10的限制将会在nginx全局生效
        limit_req_log_level notice;

## 具体服务器配置

server {

listen 80;

location ~ \.php$ {

## 最多 5 个排队， 由于每秒处理 10 个请求 + 5个排队，你一秒最多发送 15 个请求过来，再多就直接返回 503 错误给你了

limit_req zone=ConnLimitZone burst=5 nodelay;

fastcgi_pass 127.0.0.1:9000;

fastcgi_index index.php;

include fastcgi_params;

}

#每小时58分更新一次
58 * * * *  /usr/bin/sh  /opt/scripts/add_blackip_for_ddos.sh > /dev/null 2>&1

#没3分钟更新一次
*/3  * * * *  /usr/bin/sh  /opt/scripts/add_blackip_for_ddos_per_min.sh > /dev/null 2>&1

#!/bin/bash
h_time=`env LC_ALL=en_US.en date '+%e/%b/%G:%H'`
zjlog='/data/log/nginx/itbunan_access.log'
conf='/www/server/panel/vhost/nginx/blackip.conf'


#筛选攻击IP
tail -n  5000000 $zjlog  | grep "$h_time" |awk '{print  $1}'| sort -k 1 | uniq -c | sort -rnk 1 | grep -v '::' > /tmp/zj_blackip.txt
cat /tmp/zj_blackip.txt | awk '{if($1>400)print "deny "$2";"}' > $conf

#!/bin/bash
h_time=`env LC_ALL=en_US.en date '+%e/%b/%G:%H'`
zjlog='/data/log/nginx/itbunan_access.log'
conf='/www/server/panel/vhost/nginx/blackip.conf'


#筛选攻击IP
tail -n  5000000 $zjlog  | grep "$h_time" |awk '{print  $1}'| sort -k 1 | uniq -c | sort -rnk 1 | grep -v '::' > /tmp/zj_blackip.txt
cat /tmp/zj_blackip.txt | awk '{if($1>400)print "deny "$2";"}' > $conf

nginx  -s reload

rm -rf /var/cache/nginx/*