Nginx安全相关配置-防盗链

　　　　　　　　　　　　　　Nginx安全相关配置-防盗链

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　作者：尹正杰

版权声明：原创作品，谢绝转载！否则将追究法律责任。

一.Nginx盗链与防盗链概述

1>.盗链与防盗链

　　防盗链基于客户端携带的referer实现，referer是记录打开一个页面之前记录是从哪个页面跳转过来的标记信息，如果别人只链接了自己网站图片或某个单独的资源，而不是打开了网站的整个页面，这就是盗链。

2>.referer的值

　　referer就是之前的那个网站域名，正常的referer信息有以下几种：
　　　　none：
　　　　　　请求报文首部没有referer首部，比如用户直接在浏览器输入域名访问web网站，就没有referer信息。
　　　　blocked：
　　　　　　请求报文有referer首部，但无有效值，比如为空。
　　　　server_names：
　　　　　　referer首部中包含本主机名及即nginx监听的server_name。
　　　　arbitrary_string：
　　　　　　自定义指定字符串，但可使用*作通配符。
　　　　regular expression：
　　　　　　被指定的正则表达式模式匹配到的字符串,要使用~开头，例如："~.*.yinzhengjie.org.cn"

3>.百度搜索“node101.yinzhengjie.org.cn”并点击链接会访问咱们本地自建的web服务器，观察日志中的referer信息，如下图所示。

二.搭建web服务器提供正常访问

1>.编辑主配置文件

[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/softwares/nginx/conf/nginx.conf
worker_processes  4;
worker_cpu_affinity 00000001 00000010 00000100 00001000; 
 
events {
   worker_connections  100000;
   use epoll;
   accept_mutex on;
   multi_accept on; 
}
   
   http {
     include       mime.types;
       
     default_type  text/html;
    
     server_tokens off; 
      
     charset utf-8;
   
     log_format my_access_json '{"@timestamp":"$time_iso8601",' '"host":"$server_addr",' '"clientip":"$remote_addr",' '"size":$body_bytes_sent,' '"responsetime":$request_ti
me,' '"upstreamtime":"$upstream_response_time",' '"upstreamhost":"$upstream_addr",' '"http_host":"$host",' '"uri":"$uri",' '"domain":"$host",' '"xff":"$http_x_forwarded_for",' '"referer":"$http_referer",' '"tcp_xff":"$proxy_protocol_addr",' '"http_user_agent":"$http_user_agent",' '"status":"$status"}';   
    access_log logs/access_json.log my_access_json;
 
    ssl_certificate /yinzhengjie/softwares/nginx/certs/www.yinzhengjie.org.cn.crt;
    ssl_certificate_key /yinzhengjie/softwares/nginx/certs/www.yinzhengjie.org.cn.key;
    ssl_session_cache shared:sslcache:20m;
    ssl_session_timeout 10m;
  
    include /yinzhengjie/softwares/nginx/conf.d/*.conf;
}
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -t
nginx: the configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf test is successful
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 

2>.编辑子配置文件

[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/softwares/nginx/conf.d/node101_yinzhengjie_org.cn.conf 
server {
    listen 80;
    listen 443 ssl;
    server_name node101.yinzhengjie.org.cn;
 
    access_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_org_cn_access.log my_access_json;
    error_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_org_cn_error.log;

    location / {
       root /yinzhengjie/data/web/nginx/static/cn;
       index index.html;
    }

    location = /favicon.ico {
       root /yinzhengjie/data/web/nginx/images/jd;
    }
}
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -t
nginx: the configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf test is successful
[root@node101.yinzhengjie.org.cn ~]# 

3>.准备测试数据

[root@node101.yinzhengjie.org.cn ~]# mkdir -pv /yinzhengjie/data/web/nginx/{static,images}
mkdir: created directory ‘/yinzhengjie/data/web/nginx’
mkdir: created directory ‘/yinzhengjie/data/web/nginx/static’
mkdir: created directory ‘/yinzhengjie/data/web/nginx/images’
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# mkdir -pv /yinzhengjie/data/web/nginx/static/cn/css
mkdir: created directory ‘/yinzhengjie/data/web/nginx/static/cn’
mkdir: created directory ‘/yinzhengjie/data/web/nginx/static/cn/css’
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# mkdir -pv /yinzhengjie/data/web/nginx/images/jd
mkdir: created directory ‘/yinzhengjie/data/web/nginx/images/jd’
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# ll /yinzhengjie/data/web/nginx/static/cn/css/
total 1004
-rw-r--r-- 1 root root 1025154 Dec 24 18:29 01.png
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/web/nginx/static/cn/index.html 
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title>node101.yinzhengjie.org.cn</title>
        <style type="text/css">
        
            /*清除所有标签的默认样式*/
            *{
                padding: 0;
                margin: 0;
            }
            .box1{
                width: 1215px;
                height: 700px;
                background-image: url(css/01.png);
            }
            
            p{
                color: red;
                font-size: 32px;
                font-weight: bold;
                font-family: "arial","华文彩云","微软雅黑",serif;
            }
        </style>
    </head>
    <body>
        <p>这是"node101.yinzhengjie.org.cn"的首页</p>
        <div class="box1"></div>
    </body>
</html>
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# wget https://www.jd.com/favicon.ico -O /yinzhengjie/data/web/nginx/images/jd/favicon.ico                  #此处我们从网上下载一张图片作为标签的logo
--2019-12-24 18:51:03--  https://www.jd.com/favicon.ico
Resolving www.jd.com (www.jd.com)... 220.194.105.131, 2408:8710:20:1140:8000::3
Connecting to www.jd.com (www.jd.com)|220.194.105.131|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 25214 (25K) [image/x-icon]
Saving to: ‘/yinzhengjie/data/web/nginx/images/jd/favicon.ico’

100%[==================================================================================================================================>] 25,214      --.-K/s   in 0s      

2019-12-24 18:51:09 (404 MB/s) - ‘/yinzhengjie/data/web/nginx/images/jd/favicon.ico’ saved [25214/25214]

[root@node101.yinzhengjie.org.cn ~]# 

4>.启动nginx服务

[root@node101.yinzhengjie.org.cn ~]# netstat -untalp | grep nginx
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx 
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# netstat -untalp | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      24954/nginx: master 
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      24954/nginx: master 
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 

5>.浏览器访问"https://node101.yinzhengjie.org.cn/",如下图所示

6>.查看nginx的日志信息

三.模拟web盗链(为了试验方便，我将node101.yinzhengjie.org.cn和node101.yinzhengjie.org.com部署在同一个nginx实例里)

1>.编辑模拟盗链网址的子配置文件

[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/softwares/nginx/conf.d/node101_yinzhengjie_com.conf 
server {
    listen 80;
    listen 443 ssl;
    server_name node101.yinzhengjie.com;
 
    access_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_com_access.log my_access_json;
    error_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_com_error.log;

    location / {
       root /yinzhengjie/data/web/nginx/static/com;
       index index.html;
    }

    location = /favicon.ico {
       root /yinzhengjie/data/web/nginx/images/jd;
    }
}
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -t
nginx: the configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf test is successful
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 

2>.创建测试数据

[root@node101.yinzhengjie.org.cn ~]# mkdir -pv /yinzhengjie/data/web/nginx/static/com
mkdir: created directory ‘/yinzhengjie/data/web/nginx/static/com’
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# vim /yinzhengjie/data/web/nginx/static/com/index.html
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/web/nginx/static/com/index.html
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title>node101.yinzhengjie.com</title>
        <style type="text/css">
        
            /*清除所有标签的默认样式*/
            *{
                padding: 0;
                margin: 0;
            }
            .box1{
                width: 1215px;
                height: 700px;
            }
            
            p{
                color: deeppink;
                font-size: 50px;
                font-weight: bold;
                font-family: "curlz mt","微软雅黑",serif;
            }
        </style>
    </head>
    <body>
        <p>这是"node101.yinzhengjie.com"的首页</p>
        <div class="box1">
            <img src="https://node101.yinzhengjie.org.cn/css/01.png"  alt="运维工程师"/>
        </div>
    </body>
</html>
[root@node101.yinzhengjie.org.cn ~]# 

3>.重新加载nginx的配置文件

[root@node101.yinzhengjie.org.cn ~]# ps -ef | grep nginx | grep -v grep
root     24954     1  0 18:44 ?        00:00:00 nginx: master process nginx
nginx    24955 24954  0 18:44 ?        00:00:00 nginx: worker process
nginx    24956 24954  0 18:44 ?        00:00:00 nginx: worker process
nginx    24957 24954  0 18:44 ?        00:00:00 nginx: worker process
nginx    24958 24954  0 18:44 ?        00:00:00 nginx: worker process
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -s reload
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# ps -ef | grep nginx | grep -v grep
root     24954     1  0 18:44 ?        00:00:00 nginx: master process nginx
nginx    25418 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25419 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25420 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25421 24954  0 19:14 ?        00:00:00 nginx: worker process
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 

4>.浏览器访问"http://node101.yinzhengjie.com/"，我们发现可以正常访问

5>.观察node101.yinzhengjie.org.cn的日志，该站点并没有对用户提供服务，却为别的站点服务而正浪费着带宽呢，如下图所示。

6>.观察node101.yinzhengjie.org.cn的日志，如下图所示。

三.模拟防盗链

1>.在被盗链的站点上实现防盗链

[root@node101.yinzhengjie.org.cn ~]# cat /yinzhengjie/softwares/nginx/conf.d/node101_yinzhengjie_org.cn.conf 
server {
    listen 80;
    listen 443 ssl;
    server_name node101.yinzhengjie.org.cn;
 
    access_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_org_cn_access.log my_access_json;
    error_log /yinzhengjie/softwares/nginx/logs/node101_yinzhengjie_org_cn_error.log;

    location / {
       root /yinzhengjie/data/web/nginx/static/cn;
       index index.html;
       #定义有效的请求referer,用空格隔开即可
       valid_referers none blocked server_names *.baidu.com example.*  ~.google.;
       #如果没有在上面的有效链接定义那么均属于无效请求referer
       if ($invalid_referer) {
           return 403;
       }
    }

    location = /favicon.ico {
       root /yinzhengjie/data/web/nginx/images/jd;
    }
}
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -t
nginx: the configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /yinzhengjie/softwares/nginx/conf/nginx.conf test is successful
[root@node101.yinzhengjie.org.cn ~]# 

2>.重新加载配置文件

[root@node101.yinzhengjie.org.cn ~]# ps -ef | grep nginx | grep -v grep
root     24954     1  0 18:44 ?        00:00:00 nginx: master process nginx
nginx    25418 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25419 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25420 24954  0 19:14 ?        00:00:00 nginx: worker process
nginx    25421 24954  0 19:14 ?        00:00:00 nginx: worker process
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# nginx -s reload
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# ps -ef | grep nginx | grep -v grep
root     24954     1  0 18:44 ?        00:00:00 nginx: master process nginx
nginx    25710 24954  1 19:37 ?        00:00:00 nginx: worker process
nginx    25711 24954  1 19:37 ?        00:00:00 nginx: worker process
nginx    25712 24954  1 19:37 ?        00:00:00 nginx: worker process
nginx    25713 24954  0 19:37 ?        00:00:00 nginx: worker process
[root@node101.yinzhengjie.org.cn ~]# 
[root@node101.yinzhengjie.org.cn ~]# 

3>.浏览器访问"http://node101.yinzhengjie.com/"，我们发现无法正常访问，如下图所示

4>.查看"node101.yinzhengjie.org.cn"站点日志信息，如下图所示

5>.查看node101.yinzhengjie.org.cn的日志信息