LNMP环境配置（2）

zoukankan html css js c++ java

LNMP环境配置（2）

php-fpm配置，Nginx配置

Nginx配置

默认虚拟主机

修改主配置文件

# vi /usr/local/nginx/conf/nginx.conf

在最后 } 符号上面写入 include vhost/*.conf；

设置默认虚拟主机

# mkdir /usr/local/nginx/conf/vhost

# cd /usr/local/nginx/conf/vhost

# vi default.conf

server
    {
        listen 80 default_server; 标记为默认虚拟主机
        server_name aaa.com;
        index index.html index.htm index.php;
        root /data/nginx/default;
    }

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

创建索引页

# mkdir -p /data/nginx/default/

# echo "default_server" > /data/nginx/default/index.html

测试

用户认证

创建一个新的虚拟主机

# cd /usr/local/nginx/conf/vhost/

# vi test.com.conf

server
{
        listen 80;
        server_name test.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
        location /
        {
                auth_basic      "Auth";    打开认证
                auth_basic_user_file    /usr/local/nginx/conf/htpasswd; 指定用户密码文件
        }
}

安装httpd

# yum install -y httpd

创建用户

# htpasswd -c /usr/local/nginx/conf/htpasswd tuitui

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# mkdir /data/nginx/test.com

# echo "test.com" > /data/nginx/test.com/index.html

# curl -I -x127.0.0.1:80 test.com

出现状态码401表示该网站需要认证

# systemctl stop firewalld 关闭防火墙

编辑Windows的hosts文件，最后一行加入 192.168.89.128 test.com

浏览器访问

如果要对某个目录做用户认证，修改location后面的路径

域名重定向

配置文件

# cd /usr/local/nginx/conf/vhost/
# vi test.com.conf
server
{
        listen 80;
        server_name test.com test1.com test2.com；
        index index.html index.htm index.php；
        root /data/nginx/test.com；
        if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent；永久重定向
        }
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

# curl -x127.0.0.1:80 test1.com/123.txt -I

Nginx的访问日志

查看日志格式

# grep -A2 log_format /usr/local/nginx/conf/nginx.conf

指定访问日志的路径

# vi test.com.conf
server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
        if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }
        access_log /tmp/1.log combined_realip;
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# curl -x127.0.0.1:80 test.com/111

# cat /tmp/1.log

日志切割脚本

# vi /usr/local/sbin/nginx_log_rotate.sh

写入以下内容

#! /bin/bash
d=`date -d "-1 day" +%Y%m%d`
logdir="/data/logs"
nginx_pid="/usr/local/nginx/logs/nginx.pid"
cd $logdir
for log in `ls *.log`
do
        mv $log $log-$d
done
/bin/kill -HUP `cat $nginx_pid`
0 0 * * * /bin/bash /usr/local/sbin/nginx_log_rotate.sh

配置静态文件不记录日志并添加过期时间

配置文件

# vi test.com.conf
server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
        if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }
        location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
        {
                expires         7d;
                access_log off;
        }
        location ~ .*.(js|css)$
        {
                expires         12h;
                access_log off;
        }
        access_log /tmp/1.log combined_realip;
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

测试过程

创建js文件

# echo "11111111" > /data/nginx/test.com/1.js

创建jpg文件

# echo "22222222" > /data/nginx/test.com/2.jpg

创建一个对比的文件

# touch /data/nginx/test.com/1.jss

访问js类型的文件，缓存过期时间为12小时

# curl -I -x127.0.0.1:80 test.com/1.js

访问jpg类型的文件，缓存过期时间为7小时

# curl -I -x127.0.0.1:80 test.com/2.jpg

对比Cache-control对应的时间大小

# curl -I -x127.0.0.1:80 test.com/1.jss

查看访问日志

# cat /tmp/1.log

Nginx防盗链

和日志部分合在一起配置文件

# vi test.com.conf

server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
        if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }
        location ~* ^.+.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
        {
                expires         7d;
                valid_referers none blocked server_names *.test.com;
                if ($invalid_referer)
                {
                        return 403;
                }
        }
        access_log off;
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# curl -x127.0.0.1:80 -I -e "http://aaa.com/1.txt" test.com/2.jpg

# curl -x127.0.0.1:80 -I -e "http://test.com/1.txt" test.com/2.jpg

同时有过期时间和防盗链功能

访问控制

配置文件

（使能访问admin目录的请求只允许192.168.89.1和127.0.0.1访问）

# vi test.com.conf

server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
  if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }
        location /admin/
        {
                allow 192.168.89.1;
                allow 127.0.0.1;
                deny all;
        }
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# mkdir /data/nginx/test.com/admin
# echo "123" > /data/nginx/test.com/admin/1.html
# curl -x127.0.0.1:80 test.com/admin/1.html

# curl -x192.168.89.128:80 test.com/admin/1.html

拒绝某几个IP

限制解析PHP

限制user_agent

# vi test.com.conf

server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
  if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }

        if ($http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
        {
                return 403;
        }
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

Nginx解析PHP

配置文件

# vi test.com.conf

server
{
        listen 80;
        server_name test.com test1.com test2.com;
        index index.html index.htm index.php;
        root /data/nginx/test.com;
  if ($host != 'test.com' )
        {
                rewrite ^/(.*)$ http://test.com/$1 permanent;
        }

   location ~ .php$
        {
                include fastcgi_params;
                fastcgi_pass unix:/tmp/php-fcgi.sock;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME /data/nginx/test.com$fastcgi_script_name;
        }
        access_log /tmp/1.log combined_realip;
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

Nginx代理

配置文件

# cd /usr/local/nginx/conf/vhost/

# ping ask.apelearn.com 获取proxy_pass

# vi proxy.conf

server
{
        listen 80;
        server_name ask.apelearn.com;
        location /
        {
                proxy_pass http://47.104.7.242/;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# curl -x127.0.0.1:80 ask.apelearn.com -I

# curl ask.apelearn.com -I

负载均衡

# yum install -y bind-utils 安装dig命令

# dig www.baidu.com 查看域名对应的IP

测试

# curl -x61.135.169.125:80 www.baidu.com -I

# curl -x61.135.169.121:80 www.baidu.com -I

配置文件

# vi /usr/local/nginx/conf/vhost/load.conf

upstream baidu_com
{
        ip_hash;
        server 61.135.169.125:80;
        server 61.135.169.121:80;
}
server
{
        listen 80;
        server_name www.baidu.com;
        location /
        {
                proxy_pass http://baidu_com;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

测试

# curl -x127.0.0.1:80 www.baidu.com -I

Nginx配置SSL

生成自定义的SSL证书

生成私钥

# openssl genrsa -des3 -out tmp.key 2048

删除密码

# openssl rsa -in tmp.key -out aminglinux.key

生成证书请求文件

# openssl req -new -key aminglinux.key -out aminglinux.csr

生成GRT证书文件

# openssl x509 -req -days 365 -in aminglinux.csr -signkey aminglinux.key -out aminglinux.crt

编译Nginx

# cd /usr/local/src/nginx-1.10.3

# ./configure --prefix=/usr/local/nginx/ --with-http_ssl_module

# make

# make install

配置文件

# vi /usr/local/nginx/conf/vhost/ssl.conf

server
{
        listen 443;
        server_name aming.com;
        index index.html index.php;
        root /data/nginx/aming.com;
        ssl on;
        ssl_certificate aminglinux.crt;
        ssl_certificate_key aminglinux.key;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        location ~ .php$
        {
                include fastcgi_params;
                fastcgi_pass unix:/tmp/php-fcgi.sock;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME /data/nginx/aming.com$fastcgi_script_name;
        }
        access_log /tmp/1.log combined_realip;
}

重新加载配置文件

# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s reload

创建对应的目录和测试文件

# mkdir /data/nginx/aming.com

# echo "<?php phpinfo(); ?>" > /data/nginx/aming.com/1.php

# /etc/init.d/nginx restart

测试

到真实电脑上修改hosts，把网站域名指向Linux机器

在最下面增加一行 192.168.89.128 aming.com

用浏览器访问https://aming.com/1.php

php-fpm配置

php-fpm的pool

修改配置文件

# vi /usr/local/php-fpm/etc/php-fpm.conf

创建配置文件目录和子配置文件

# mkdir /usr/local/php-fpm/etc/php-fpm.d

# cd /usr/local/php-fpm/etc/php-fpm.d

# vi www.conf

[www]
listen=/tmp/www.sock
listen.mode=666
user=php-fpm
group=php-fpm
pm=dynamic 定义php-fpm的子进程启动模式，dynamic为动态模式
pm.max_children=50
pm.start_servers=20 定义php-fpm服务在启动服务时产生的子进程数量
pm.min_spare_servers=5    定义在空闲时段子进程数的最少数量
pm.max_spare_servers=35   定义在空闲时段子进程数的最大值
pm.max_requests=500    定义一个子进程最多处理的请求数
rlimit_files=1024

# vi aming.conf

[aming]
listen=/tmp/aming.sock
listen.mode=666
user=php-fpm
group=php-fpm
pm=dynamic
pm.max_children=50
pm.start_servers=20
pm.min_spare_servers=5
pm.max_spare_servers=35
pm.max_requests=500
rlimit_files=1024

两个pool互不影响

检验配置

# /usr/local/php-fpm/sbin/php-fpm -t
[20-Dec-2019 09:19:12] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful

重启服务

# /etc/init.d/php-fpm restart

查看sock文件

# ls /tmp/*.sock

php-fpm的慢执行日志

编辑配置文件

# vi /usr/local/php-fpm/etc/php-fpm.d/www.conf

在最后加

request_slowlog_timeout=1
slowlog=/usr/local/php-fpm/var/log/www-slow.log

检验配置

# /usr/local/php-fpm/sbin/php-fpm -t
[20-Dec-2019 09:19:12] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful

php-fpm定义open_basedir

编辑配置文件

# vi /usr/local/php-fpm/etc/php-fpm.d/www.conf

在最后加

php_admin_value[open_basedir]=/data/www/:/tmp/

检验配置

# /usr/local/php-fpm/sbin/php-fpm -t
[20-Dec-2019 09:19:12] NOTICE: configuration file /usr/local/php-fpm/etc/php-fpm.conf test is successful

查看全文

相关阅读:
调试JavaScript/VB Script脚本程序（ASP篇）
成功接收来自Internet的邮件必须要做到的条件
 (转）Ext与.NET超完美整合 .NET开发者的超级优势
 如何防垃圾邮件用你的邮件服务器转发
 记录书籍名称
 GRE网站
 JAVA线程的缺陷
 【让这些电影给你“治病”】
zoj题目分类
 Oracle to_char格式化函数

原文地址：https://www.cnblogs.com/tui463/p/12159482.html

LNMP环境配置（2）

Nginx配置

默认虚拟主机

用户认证

域名重定向

Nginx的访问日志

配置静态文件不记录日志并添加过期时间

Nginx防盗链

访问控制

Nginx解析PHP

Nginx代理

Nginx配置SSL

php-fpm配置

php-fpm的pool

php-fpm的慢执行日志

php-fpm定义open_basedir