nginx访问控制与用户认证
访问控制
用于location段
allow：设定允许哪台或哪些主机访问，多个参数间用空格隔开
deny：设定禁止哪台或哪些主机访问，多个参数间用空格隔开
示例
只允许192.168.100.1访问
[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
······
server {
listen 80;
server_name localhost;
location /baozi {
echo "test location";
allow 192.168.100.1;
deny all;
}
······
[root@nginx ~]# nginx -s reload
验证
# 使用192.168.100.2来访问
[root@mysql ~]# curl 192.168.100.1/baozi
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.20.0</center>
</body>
</html>
# 使用192.168.100.1来访问
[root@nginx ~]# curl 192.168.100.1/baozi
test location
基于用户认证
auth_basic "欢迎信息";
auth_basic_user_file "/path/to/user_auth_file";
user_auth_file内容格式为：
username:password
这里的密码为加密后的密码串，建议用htpasswd来创建此文件：
htpasswd -c -m /path/to/.user_auth_file USERNAME
示例
# 安装httpd-tools
[root@nginx ~]# yum -y install httpd-tools
# 确保用户不存在
[root@nginx ~]# id baozi
id: ‘baozi’: no such user
# 生成用户认证文件
[root@nginx ~]# htpasswd -c -m /usr/local/nginx/conf/.user-auth-file baozi
New password:
Re-type new password:
Adding password for user baozi
[root@nginx ~]# cat /usr/local/nginx/conf/.user-auth-file
baozi:$apr1$GVrn6VgQ$zsa8woepbuSaIhojeADaG/
# 创建测试文件
[root@nginx ~]# mkdir /usr/local/nginx/html/baozi
[root@nginx ~]# echo 'Welcome,BaoZi!' > /usr/local/nginx/html/baozi/index.html
[root@nginx ~]# vim /usr/local/nginx/conf/nginx.conf
······
server {
listen 80;
server_name localhost;
location / {
root html;
index index.html;
}
location /baozi {
root html;
index index.html;
auth_basic "Hello BaoZi!";
auth_basic_user_file "/usr/local/nginx/conf/.user-auth-file";
}
······
[root@nginx ~]# nginx -s reload
访问测试
输入用户名密码授权
访问成功，用户认证成功
