CentOS7安装PHP开发环境1-源码安装Nginx
OS：CentOS 7
Nginx：1.16.0
目录
- 安装后的脚本
- 重启nginx、PHP脚本
- 开机启动脚本
- 安装前的准备
- 1.安装Nginx所需的pcre库
- 2.安装Nginx所需的openssl库
- 3.安装zlib
- 安装Nginx
- 检查安装结果并启动
- Nginx相关命令
- 开机启动
- 非root用户启动（本节作废）
- 添加虚拟主机
- 关闭sendfile ，Linux中的“零拷贝”
- 关闭防火墙：
- Nginx支持HTTPS
- http强制跳转到HTTPS
- 隐藏响应头部的X-Powered-By
- 隐藏/修改 响应头部的Server
- 错误日志error_log配置
- 访问日志access_log配置
- 不记录不需要的访问日志
- 访问日志的权限设置
- Nginx访问控制
- 根据扩展名限制程序和文件访问
- 禁止访问指定目录下的所有文件和目录
- 限制网站来源IP访问
- 配置Nginx，禁止非法域名解析访问企业网站
- 参考文献
安装后的脚本
重启nginx、PHP脚本
cat /auto.sh
# /bin/bash
#Nginx
NGINXPID_PATH='/application/nginx/logs/nginx.pid'
if [ -e ${NGINXPID_PATH} ];then/application/nginx/sbin/nginx -s reload
else/application/nginx/sbin/nginx
fi#php-fpm
PHPPID_PATH="/application/php/var/run/php-fpm.pid"
if [ -e ${PHPPID_PATH} ];thenkill -USR2 `cat ${PHPPID_PATH}`
else/application/php/sbin/php-fpm
fi#/application/nginx/sbin/nginx -s reload
#kill -USR2 `cat /application/php5.6.32/var/run/php-fpm.pid`
#kill -USR2 `cat /application/php7.2.1/var/run/php-fpm.pid`
#/application/nginx/sbin/nginx -s stop
#killall php-fpm
#sleep 0.5
#umount -f /wwwroot
#mount -t vboxsf wwwroot /wwwroot
#sleep 0.1
#/application/php5.6.32/sbin/php-fpm
#/application/php7.2.1/sbin/nginx
#/application/nginx/sbin/nginx
#echo 'OK'
开机启动脚本
cat /etc/rc.local
#!/bin/bash
touch /var/lock/subsys/localmount -t vboxsf wwwroot /wwwroot
#开机启动redis服务 3.2.9
#/application/redis/src/redis-server &
/application/redis/src/redis-server /application/redis/redis.conf
#开机启动memcached服务
/usr/bin/memcached -d -l 127.0.0.1 -p 11211 -m 256 -u root
#开机启动php-fpm 7.1.6
###/application/php/bin/php-cgi -b 127.0.0.1:9000 -c /application/php/etc/php.ini
/application/php/sbin/php-fpm
#开机启动Nginx服务器 1.16.0
###/application/nginx/sbin/nginx -c /application/nginx/conf/nginx.conf
/application/nginx/sbin/nginx
安装前的准备
yum卸载
# yum remove 包名
yum -y update
yum install -y g++ gcc gcc-c++ vim wget psmisc net-tools zip unzip m4 autoconf automake libzip*
yum install -y bzip2* curl curl-devel libicu-devel make
yum install -y bison-devel ncurses-devel libaio libaio-devel perl-Data-Dumper
说明
#psmisc # killall
#net-tools # ifconfig
#m4 autoconf # php/bin/phpize 安装扩展
#zip unzip #
#bzip2* # 增强工具用的是bzip2压缩
yum -y install make kernel-* # 主要是在安装增强工具提示没有安装这些软件
yum -y install libevent # 为了安装memcached
yum install -y libxml2*
yum install -y openssl openssl-devel
yum install -y re2c freetype* libwebp* libjpeg* libpng* libXpm* libacl* icu cmake bison zlib* pcre* systemtap-sdt*
1.安装Nginx所需的pcre库
pcre的全称为perl compatible regular expressions，中文译为“perl兼容正则表达式”，官方站点为 http://www.pcre.org/ ，安装pcre库是为了使Nginx支持具备URI重写功能的rewrite模块，如果不安装pcre库，则Nginx无法使用rewrite模块功能，Nginx的rewrite模块功能几乎是企业应用必须的。安装pcre库的过程如下。
[root@sy-pc ~]# yum install pcre pcre-devel -y
[root@sy-pc ~]# rpm -qa pcre pcre-devel
pcre-devel-8.32-17.el7.x86_64
pcre-8.32-17.el7.x86_64
2.安装Nginx所需的openssl库
[root@sy-pc ~]# yum install openssl openssl-devel -y
[root@sy-pc ~]# rpm -qa openssl openssl-devel
openssl-devel-1.0.2k-16.el7_6.1.x86_64
openssl-1.0.2k-16.el7_6.1.x86_64
3.安装zlib
[root@sy-pc ~]# yum install zlib zlib-devel -y
[root@sy-pc ~]# rpm -qa zlib zlib-devel
zlib-1.2.7-18.el7.x86_64
zlib-devel-1.2.7-18.el7.x86_64
安装Nginx
创建nginx用户
# useradd nginx -s /sbin/nologin -M
下载：http://nginx.org/download/nginx-1.16.0.tar.gz
[root@sy-pc ~]# mkdir /tools
[root@sy-pc ~]# cd /tools
[root@sy-pc tools]# wget http://nginx.org/download/nginx-1.16.0.tar.gz
[root@sy-pc tools]# ll
total 1012
-rw-r--r--. 1 root root 1032345 Apr 23 21:58 nginx-1.16.0.tar.gz
解压
[root@sy-pc tools]# tar -zxvf nginx-1.16.0.tar.gz
[root@sy-pc tools]# cd nginx-1.16.0
tar xf nginx-1.16.0.tar.gz ，则不显示解压过程。
使用./configure --help查看相关参数。
# ./configure --help--help print this message--prefix=PATH set installation prefix--sbin-path=PATH set nginx binary pathname--modules-path=PATH set modules path--conf-path=PATH set nginx.conf pathname--error-log-path=PATH set error log pathname--pid-path=PATH set nginx.pid pathname--lock-path=PATH set nginx.lock pathname--user=USER set non-privileged user forworker processes--group=GROUP set non-privileged group forworker processes--build=NAME set build name--builddir=DIR set build directory--with-select_module enable select module--without-select_module disable select module--with-poll_module enable poll module--without-poll_module disable poll module--with-threads enable thread pool support--with-file-aio enable file AIO support--with-http_ssl_module enable ngx_http_ssl_module--with-http_v2_module enable ngx_http_v2_module--with-http_realip_module enable ngx_http_realip_module--with-http_addition_module enable ngx_http_addition_module--with-http_xslt_module enable ngx_http_xslt_module--with-http_xslt_module=dynamic enable dynamic ngx_http_xslt_module--with-http_image_filter_module enable ngx_http_image_filter_module--with-http_image_filter_module=dynamicenable dynamic ngx_http_image_filter_module--with-http_geoip_module enable ngx_http_geoip_module--with-http_geoip_module=dynamic enable dynamic ngx_http_geoip_module--with-http_sub_module enable ngx_http_sub_module--with-http_dav_module enable ngx_http_dav_module--with-http_flv_module enable ngx_http_flv_module--with-http_mp4_module enable ngx_http_mp4_module--with-http_gunzip_module enable ngx_http_gunzip_module--with-http_gzip_static_module enable ngx_http_gzip_static_module--with-http_auth_request_module enable ngx_http_auth_request_module--with-http_random_index_module enable ngx_http_random_index_module--with-http_secure_link_module enable ngx_http_secure_link_module--with-http_degradation_module enable ngx_http_degradation_module--with-http_slice_module enable ngx_http_slice_module--with-http_stub_status_module enable ngx_http_stub_status_module--without-http_charset_module disable ngx_http_charset_module--without-http_gzip_module disable ngx_http_gzip_module--without-http_ssi_module disable ngx_http_ssi_module--without-http_userid_module disable ngx_http_userid_module--without-http_access_module disable ngx_http_access_module--without-http_auth_basic_module disable ngx_http_auth_basic_module--without-http_mirror_module disable ngx_http_mirror_module--without-http_autoindex_module disable ngx_http_autoindex_module--without-http_geo_module disable ngx_http_geo_module--without-http_map_module disable ngx_http_map_module--without-http_split_clients_module disable ngx_http_split_clients_module--without-http_referer_module disable ngx_http_referer_module--without-http_rewrite_module disable ngx_http_rewrite_module--without-http_proxy_module disable ngx_http_proxy_module--without-http_fastcgi_module disable ngx_http_fastcgi_module--without-http_uwsgi_module disable ngx_http_uwsgi_module--without-http_scgi_module disable ngx_http_scgi_module--without-http_grpc_module disable ngx_http_grpc_module--without-http_memcached_module disable ngx_http_memcached_module--without-http_limit_conn_module disable ngx_http_limit_conn_module--without-http_limit_req_module disable ngx_http_limit_req_module--without-http_empty_gif_module disable ngx_http_empty_gif_module--without-http_browser_module disable ngx_http_browser_module--without-http_upstream_hash_moduledisable ngx_http_upstream_hash_module--without-http_upstream_ip_hash_moduledisable ngx_http_upstream_ip_hash_module--without-http_upstream_least_conn_moduledisable ngx_http_upstream_least_conn_module--without-http_upstream_random_moduledisable ngx_http_upstream_random_module--without-http_upstream_keepalive_moduledisable ngx_http_upstream_keepalive_module--without-http_upstream_zone_moduledisable ngx_http_upstream_zone_module--with-http_perl_module enable ngx_http_perl_module--with-http_perl_module=dynamic enable dynamic ngx_http_perl_module--with-perl_modules_path=PATH set Perl modules path--with-perl=PATH set perl binary pathname--http-log-path=PATH set http access log pathname--http-client-body-temp-path=PATH set path to storehttp client request body temporary files--http-proxy-temp-path=PATH set path to storehttp proxy temporary files--http-fastcgi-temp-path=PATH set path to storehttp fastcgi temporary files--http-uwsgi-temp-path=PATH set path to storehttp uwsgi temporary files--http-scgi-temp-path=PATH set path to storehttp scgi temporary files--without-http disable HTTP server--without-http-cache disable HTTP cache--with-mail enable POP3/IMAP4/SMTP proxy module--with-mail=dynamic enable dynamic POP3/IMAP4/SMTP proxy module--with-mail_ssl_module enable ngx_mail_ssl_module--without-mail_pop3_module disable ngx_mail_pop3_module--without-mail_imap_module disable ngx_mail_imap_module--without-mail_smtp_module disable ngx_mail_smtp_module--with-stream enable TCP/UDP proxy module--with-stream=dynamic enable dynamic TCP/UDP proxy module--with-stream_ssl_module enable ngx_stream_ssl_module--with-stream_realip_module enable ngx_stream_realip_module--with-stream_geoip_module enable ngx_stream_geoip_module--with-stream_geoip_module=dynamic enable dynamic ngx_stream_geoip_module--with-stream_ssl_preread_module enable ngx_stream_ssl_preread_module--without-stream_limit_conn_module disable ngx_stream_limit_conn_module--without-stream_access_module disable ngx_stream_access_module--without-stream_geo_module disable ngx_stream_geo_module--without-stream_map_module disable ngx_stream_map_module--without-stream_split_clients_moduledisable ngx_stream_split_clients_module--without-stream_return_module disable ngx_stream_return_module--without-stream_upstream_hash_moduledisable ngx_stream_upstream_hash_module--without-stream_upstream_least_conn_moduledisable ngx_stream_upstream_least_conn_module--without-stream_upstream_random_moduledisable ngx_stream_upstream_random_module--without-stream_upstream_zone_moduledisable ngx_stream_upstream_zone_module--with-google_perftools_module enable ngx_google_perftools_module--with-cpp_test_module enable ngx_cpp_test_module--add-module=PATH enable external module--add-dynamic-module=PATH enable dynamic external module--with-compat dynamic modules compatibility--with-cc=PATH set C compiler pathname--with-cpp=PATH set C preprocessor pathname--with-cc-opt=OPTIONS set additional C compiler options--with-ld-opt=OPTIONS set additional linker options--with-cpu-opt=CPU build for the specified CPU, valid values:pentium, pentiumpro, pentium3, pentium4,athlon, opteron, sparc32, sparc64, ppc64--without-pcre disable PCRE library usage--with-pcre force PCRE library usage--with-pcre=DIR set path to PCRE library sources--with-pcre-opt=OPTIONS set additional build options for PCRE--with-pcre-jit build PCRE with JIT compilation support--with-zlib=DIR set path to zlib library sources--with-zlib-opt=OPTIONS set additional build options for zlib--with-zlib-asm=CPU use zlib assembler sources optimizedfor the specified CPU, valid values:pentium, pentiumpro--with-libatomic force libatomic_ops library usage--with-libatomic=DIR set path to libatomic_ops library sources--with-openssl=DIR set path to OpenSSL library sources--with-openssl-opt=OPTIONS set additional build options for OpenSSL--with-debug enable debug logging
部分参数说明：
--prefix=PATH set installation prefix#设置安装路径
--user=USER set non-privileged user for worker processes#进程用户权限
--group=GROUP set non-privileged group for worker processes#进程用户组权限
--with-http_stub_status_module enable ngx_http_stub_status_module#激活状态信息
--with-http_ssl_module enable ngx_http_ssl_module#激活SSL功能
配置命令：./configure --user=nginx --group=nginx --prefix=/application/nginx-1.16.0 --with-http_stub_status_module --with-http_ssl_module
[root@sy-pc nginx-1.16.0]# ./configure --user=nginx --group=nginx --prefix=/application/nginx-1.16.0 --with-http_stub_status_module --with-http_ssl_module
屏幕将输出以下内容：
checking for OS+ Linux 3.10.0-514.el7.x86_64 x86_64
checking for C compiler ... found+ using GNU C compiler+ gcc version: 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... not found
checking for O_PATH ... found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... not found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for OpenSSL library ... found
checking for zlib library ... found
creating objs/MakefileConfiguration summary+ using system PCRE library+ using system OpenSSL library+ using system zlib librarynginx path prefix: "/application/nginx-1.16.0"nginx binary file: "/application/nginx-1.16.0/sbin/nginx"nginx modules path: "/application/nginx-1.16.0/modules"nginx configuration prefix: "/application/nginx-1.16.0/conf"nginx configuration file: "/application/nginx-1.16.0/conf/nginx.conf"nginx pid file: "/application/nginx-1.16.0/logs/nginx.pid"nginx error log file: "/application/nginx-1.16.0/logs/error.log"nginx http access log file: "/application/nginx-1.16.0/logs/access.log"nginx http client request body temporary files: "client_body_temp"nginx http proxy temporary files: "proxy_temp"nginx http fastcgi temporary files: "fastcgi_temp"nginx http uwsgi temporary files: "uwsgi_temp"nginx http scgi temporary files: "scgi_temp"
[root@sy-pc nginx-1.16.0]# make && make install
# ln -s /application/nginx-1.16.0 /application/nginx
查看软连接
# ll /application | grep nginx
lrwxrwxrwx. 1 root root 26 Aug 5 17:57 nginx -> /application/nginx-1.16.0/
drwxr-xr-x. 6 root root 54 Aug 5 17:57 nginx-1.16.0
检查安装结果并启动
（1）启动前检查配置文件语法
[root@sy-pc ~]# /application/nginx/sbin/nginx -t
nginx: the configuration file /application/nginx-1.16.0/conf/nginx.conf syntax is ok
nginx: configuration file /application/nginx-1.16.0/conf/nginx.conf test is successful
（2）启动Nginx服务
/application/nginx/sbin/nginx
（3）查看Nginx服务对应的端口是否成功启动
三个命令任意使用一个。
# netstat -lntup|grep nginx
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 13924/nginx: master
# lsof -i:80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 13924 root 6u IPv4 29420 0t0 TCP *:http (LISTEN)
nginx 13925 nginx 6u IPv4 29420 0t0 TCP *:http (LISTEN)
# ps -ef|grep nginx|grep -v grep
root 13924 1 0 18:13 ? 00:00:00 nginx: master process /application/nginx/sbin/nginx
nginx 13925 13924 0 18:13 ? 00:00:00 nginx: worker process
Nginx相关命令
/application/nginx/sbin/nginx -t检查配置文件语法
/application/nginx/sbin/nginx -s stop|quit|reopen|reload
/application/nginx/sbin/nginx启动
/application/nginx/sbin/nginx -s stop停止
/application/nginx/sbin/nginx -s reload平滑重启
查看编译时的参数配置
# /application/nginx/sbin/nginx -V
nginx version: nginx/1.16.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --user=nginx --group=nginx --prefix=/application/nginx-1.16.0 --with-http_stub_status_module --with-http_ssl_module
其他命令
[root@sy-pc ~]# /application/nginx/sbin/nginx -h
nginx version: nginx/1.16.0
Usage: nginx [-?hvVtTq] [-s signal] [-c filename] [-p prefix] [-g directives]Options:-?,-h : this help-v : show version and exit-V : show version and configure options then exit-t : test configuration and exit-T : test configuration, dump it and exit-q : suppress non-error messages during configuration testing-s signal : send signal to a master process: stop, quit, reopen, reload-p prefix : set prefix path (default: /application/nginx-1.16.0/)-c filename : set configuration file (default: conf/nginx.conf)-g directives : set global directives out of configuration file
开机启动
为 开机启动脚本 添加可执行权限。
[root@sy-pc ~]# ll /etc/rc.local
lrwxrwxrwx. 1 root root 13 Aug 5 16:55 /etc/rc.local -> rc.d/rc.local
[root@sy-pc ~]# ll /etc/rc.d/rc.local
-rw-r--r--. 1 root root 473 Nov 7 2016 /etc/rc.d/rc.local
[root@sy-pc ~]# chmod +x /etc/rc.d/rc.local
[root@sy-pc ~]# ll /etc/rc.d/rc.local
-rwxr-xr-x. 1 root root 473 Nov 7 2016 /etc/rc.d/rc.local
添加Nginx启动命令
[root@sy-pc ~]# cat >> /etc/rc.local << EOF
> #开机启动Nginx服务器 1.16.0
> #/application/nginx/sbin/nginx -c /application/nginx/conf/nginx.conf
> /application/nginx/sbin/nginx
> EOF
非root用户启动（本节作废）
修改nginx的二进制启动文件
# chown root:sy /application/nginx/sbin/nginx
# chmod +s /application/nginx/sbin/nginx$ ll /application/nginx/sbin/nginx
-rwsr-xr-x. 1 root sy 5586599 Jun 28 2017 /application/nginx/sbin/nginx
则nginx二进制文件的原属主sy、原属组sy，被改成属主root、属组sy。
则开机脚本/etc/rc.local可以写为：
#/application/nginx/sbin/nginx -c /application/nginx/conf/nginx.conf
su - sy << EOF
/application/nginx/sbin/nginx
EOF
查看进程，发现主进程是root，子进程是sy
# ps -ef|grep nginx|grep -v grep
root 3630 1 0 Aug03 ? 00:00:00 nginx: master process /application/nginx/sbin/nginx
sy 3631 3630 0 Aug03 ? 00:00:00 nginx: worker process
添加虚拟主机
可以修改vim /application/nginx/conf/nginx.conf，在http{}代码块中添加一句
include /wwwroot/nginx_vhost/*.conf;
然后在对应的/wwwroot/nginx_vhost/目录下新建一个文件 p7height.net.conf；内容如下：
server {listen 80;server_name p7height.net www.p7height.net;root /wwwroot/p7height.net;location / {index index.html index.htm default.html default.htm index.php default.php app.php u.php;include /wwwroot/p7height.net/up-*.conf;}autoindex off;#include advanced_settings.conf;#include expires.conf;location ~* .*\/(attachment|attachments|uploadfiles|avatar)\/.*\.(php|php5|phps|asp|aspx|jsp)$ {deny all;}location ~ ^.+\.php {fastcgi_pass 127.0.0.1:9000; # fastcgi_pass bakend;fastcgi_index index.php;fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;#fastcgi_param PATH_INFO $fastcgi_path_info;fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;include fastcgi.conf;}
}
fastcgi_param PATH_INFO $fastcgi_path_info; 和 fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;，任选其一。
关闭sendfile ，Linux中的“零拷贝”
如果开发环境使用了mount挂载目录，那么在修改了静态文件后，避免网页读取静态文件不完整（在浏览器中查看网页源代码，发现未加载编辑后的代码，且文件末尾有很多菱形字符），就需要关闭sendfile；
修改：vim /application/nginx/conf/nginx.conf
将 sendfile on;
改为 sendfile off;
关闭防火墙：
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动
firewall-cmd --state #查看默认防火墙状态（关闭后显示not running，开启后显示running）
Nginx支持HTTPS
http强制跳转到HTTPS
参考：http://blog.csdn.net/u013216667/article/details/53467319
参考：http://www.cnblogs.com/Tiago/p/6236595.html
生成证书
在服务器的命令行下进行如下操作
创建目录、并进入该目录
/application/nginx/ck/
①生成服务端的私钥，需要输入一个4~8191位的密码
openssl genrsa -des3 -out server.key 1024
[root@sy-pc ck]# openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
................++++++
......................................................................................++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
②生成csr文件，这一步需要输入多种信息，可以全部按回车跳过
openssl req -new -key server.key -out server.csr
[root@sy-pc ck]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
③生成crt文件，这一步中的-days后为有效期，可以写长一点
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
[root@sy-pc ck]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CN/ST=Shanghai/L=Shanghai/O=Shanghai Information/OU=Shanghai Unit Information/CN=*.zhousuyang.com/emailAddress=1633307645@qq.com
Getting Private key
Enter pass phrase for server.key:
④Nginx配置SSL安全证书避免启动输入Enter PEM pass phrase 参考：http://wangye.org/blog/archives/243/
[root@sy-pc ck]# openssl rsa -in server.key -out server.key.unsecure
Enter pass phrase for server.key:
writing RSA key
不要理下面这句：
这句是干嘛用的？为什么要合并？
[root@sy-pc ck]# cat server.crt server.key > server.pem
http强制跳转到HTTPS
Nginx的虚拟机配置。
注意fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
server{listen 80; server_name p7height.net;return 301 https://p7height.net$request_uri;
}
server {listen 443 default_server ssl ; #default_server ssl 不需要server_name p7height.net;ssl on; #nginx-1.16版，则不需要这句。ssl_certificate /application/nginx/ck/server.crt;#ssl_certificate_key /application/nginx/ck/server.key; #但是每次重启nginx时都要输入密码 Enter PEM pass phrase:ssl_certificate_key /application/nginx/ck/server.key.unsecure; #重启nginx时不需要输入密码root /wwwroot/p7height.net;location / { index index.html index.htm index.php;} #error_page 500 502 503 504 /50x.html;#location = /50x.html {#} location ~ .php$ {fastcgi_pass 127.0.0.1:9000;fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;include fastcgi_params;} location ~ /\.ht {deny all;}
}
1.13.1版本
server{******listen 443;ssl on;******
}
1.16.0版本
server{******listen 443 ssl; #或者省略 ssl******
}
隐藏响应头部的X-Powered-By
Response Headers
Connection:keep-alive
Content-Encoding:gzip
Content-Type:text/html; charset=UTF-8
Date:Wed, 12 Jul 2017 12:48:17 GMT
Server:nginx/1.13.1
Transfer-Encoding:chunked
Vary:Accept-Encoding
X-Powered-By:PHP/7.2.1
一、如果是Nginx服务器，则可以在http、server、location区段中添加如下。在server中添加即可。
proxy_hide_header X-Powered-By; #在proxy模式下起作用
fastcgi_hide_header X-Powered-By; #在fastcgi模式下起作用
二、修改php.ini文件，如下。
expose_php=Off
隐藏/修改 响应头部的Server
一、Nginx配置文件的http段、或server段添加
server_tokens off; #off隐藏server版本号 on显示server版本号
二、源文件修改后重新编译安装
修改Nginx源文件/src/http/ngx_http_header_filter_module.c
static u_char ngx_http_server_string[] = "Server: nginx" CRLF;
static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;
static u_char ngx_http_server_build_string[] = "Server: " NGINX_VER_BUILD CRLF;
改为：
static u_char ngx_http_server_string[] = "Server: gws" CRLF;
static u_char ngx_http_server_full_string[] = "Server: gws" CRLF;
static u_char ngx_http_server_build_string[] = "Server: gws" CRLF;
错误日志error_log配置
error_log，可以放在Main区块中全局配置，也可以放置不同的虚拟主机中单独记录。
[root@sy-pc ~]# head -8 /application/nginx/conf/nginx.conf #user nobody;
worker_processes 1;#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
error_log的语法格式及参数语法说明如下：
error_log 日志文件 级别
其中，关键字error_log不能改变，日志文件可以指定任意存放日志的目录，错误日志级别常见的有［debug|info|notice|warn|error|crit|alert|emerg］，级别越高，记录的信息越少，生产场景一般是warn|error|crit这三个级别之一，注意不要配置info等较低级别，会带来巨大磁盘I/O消耗。
可以放置的标签段为：
#context： main, http, mail, stream, server, location
Syntax: error_log file [level];
Default: error_log logs/error.log error;
Context: main, http, mail, stream, server, location
参考资料：http://nginx.org/en/docs/ngx_core_module.html#error_log 。
访问日志access_log配置
不记录不需要的访问日志
在实际工作中，对于负载均衡器健康节点检查或某些特定文件（比如图片、JS、CSS）的日志，一般不需要记录下来，因为在统计PV时是按照页面计算的，而且日志写入太频繁会消耗大量磁盘I/O，降低服务的性能。
具体配置方法如下：
location ~ .*\.(js|jpg|JPG|jpeg|JPEG|css|bmp|gif|GIF)$ {access_log off;
}
这里用location标签匹配不记录日志的元素扩展名，然后关掉日志。
访问日志的权限设置
假如日志目录为/app/logs，则授权方法如下：
chown -R root.root /app/logs
chmod -R 700 /app/logs
不需要在日志目录上给Nginx用户读或写许可，但很多网友都没注意这个问题，他们把该权限直接给了Nginx或Apache用户，这就成为安全隐患。
Nginx访问控制
根据扩展名限制程序和文件访问
Web 2.0时代，绝大多数网站都是以用户为中心的，例如：bbs、blog、sns产品，这几个产品都有一个共同特点，就是不但允许用户发布内容到服务器，还允许用户发图片甚至上传附件到服务器上，由于为用户开了上传的功能，因此给服务器带来了很大的安全风险。虽然很多程序在上传前会做一定的控制，例如：文件大小、类型等，但是，一不小心就会被黑客钻了空子，上传了木马程序。
下面将利用Nginx配置禁止访问上传资源目录下的PHP、Shell、Perl、Python程序文件，这样用户即使上传了木马文件也没法执行，从而加强了网站的安全。
范例1：配置Nginx，禁止解析指定目录下的指定程序。
location ~ ^/images/.*\.(php|php5|sh|pl|py)$
{deny all;
}
location ~ ^/static/.*\.(php|php5|sh|pl|py)$
{deny all;
}
location ~* ^/data/(attachment|avatar)/.*\.(php|php5)$
{deny all;
}
对上述目录的限制必须写在Nginx处理PHP服务配置的前面。
deny all; 导致浏览器页面显示 403 Forbidden。状态码403。
范例2：Nginx下配置禁止访问*.txt和*.doc文件。
location ~* \.(txt|doc)$ {if (-f $request_filename) {root /data/www/www;#rewrite ......可以重定向到某个URLbreak;}
}
location ~* \.(txt|doc)$ {root /data/www/www;deny all;
}
若{未换行，则{前面要有空格。
禁止访问指定目录下的所有文件和目录
范例1：配置禁止访问指定的单个或多个目录。
禁止访问单个目录的命令如下：
location ~ ^/(static)/ {deny all;
}
location ~ ^/static {deny all;
}
禁止访问多个目录的命令如下：
location ~ ^/(static|js) {deny all;
}
范例2：禁止访问目录并返回指定的HTTP状态码，命令如下：
server {listen 80;server_name www.test.org;root /data0/www/test;index index.html index.htm;access_log /app/logs/www_access.log commonlog;location /admin/ { return 404; }location /templates/ { return 403; }
}
作用：禁止访问目录下的指定文件，或者禁止访问指定目录下的所有内容。
最佳应用场景：对于集群的共享存储，一般是存放静态资源文件，所以可禁止执行指定扩展名的程序，例：.php、.sh、.pl、.py。
限制网站来源IP访问
下面介绍如何使用ngx_http_access_module限制网站来源IP访问。
案例环境：phpmyadmin数据库的Web客户端，内部开发人员用的。
范例1：禁止某目录让外界访问，但允许某IP访问该目录，且支持PHP解析，命令如下：
location ~ ^/phpmyadmin/ {allow 202.111.12.211; deny all;
}
location ~ .*\.(php|php5)$ {fastcgi_pass 127.0.0.1：9000;fastcgi_index index.php;include fastcgi_params;fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
范例2：限制指定IP或IP段访问，命令如下：
location / {deny 192.168.1.1;allow 192.168.1.0/24;allow 10.1.1.0/16;deny all;
}
参考：http://nginx.org/en/docs/http/ngx_http_access_module.html 。
企业问题案例：Nginx做反向代理的时候可以限制客户端IP吗？
解答：可以，具体方法如下。
方法1：使用if来控制，命令如下：
if ( $remote_addr = 192.168.55.1 ) {return 403;
}
if ( $remote_addr = 218.247.17.130 ) { #这句话失败了set $allow_access_root 'true';
}
参考：http://nginx.org/en/docs/varindex.html
方法2：利用deny和allow只允许IP访问，命令如下：
location / {allow 192.168.55.2;deny all;
}
方法3：只拒绝某些IP访问，命令如下：
location / {deny 192.168.55.1;allow all;
}
注意事项：
- deny一定要加一个IP，否则会直接跳转到403，不再往下执行了，如果403默认页是在同一域名下，会造成死循环访问。
- 对于allow的IP段，从允许访问的段位从小到大排列，如127.0.0.0/24的下面才能是10.10.0.0/16，其中：
- 24表示子网掩码：255.255.255.0
- 16表示子网掩码：255.255.0.0
- 8表示子网掩码：255.0.0.0
- 以deny all; 结尾，表示除了上面允许的，其他的都禁止。如：
deny 192.168.1.1;
allow 127.0.0.0/24;
allow 192.168.0.0/16;
allow 10.10.0.0/16;
deny all;
配置Nginx，禁止非法域名解析访问企业网站
这段内容配置失败。
问题：Nginx如何防止用户IP访问网站（恶意域名解析，也相当于是直接IP访问企业网站）？
方法1：让使用IP访问网站的用户，或者恶意解析域名的用户，收到501错误，命令如下：
server {listen 80 default_server;server_name _;return 501;
}
说明：直接报501错误，从用户体验上不是很好。
方法2：通过301跳转到主页，命令如下：
server {listen 80 default_server;server_name _;rewrite ^(.*) http://blog.etiantian.org/$1 permanent;
}
方法3：发现某域名恶意解析到公司的服务器IP，在server标签里添加以下代码即可，若有多个server则要多处添加。
if ($host !~ ^www/.eduoldboy/.com$) {rewrite ^(.*) http://www.eduoldboy.com$1 permanent;
}
上面代码的意思是如果header信息的host主机名字段非 www.eduoldboy.com，就301跳转到 www.eduoldboy.com。
参考文献
[1] Nginx官网[DB|OL]. http://nginx.org/en/docs/ .
[2] 老男孩. 跟老男孩学Linux运维：Web集群实战[M]. 机械工业出版社，2016-03-01.
CentOS7安装PHP开发环境1-源码安装Nginx相关推荐
- linux编译安装的好处,Linux学习—源码安装
源码安装--可以按照自己的需求安装,这是源码安装的好处,而二进制安装无法选择 大部分的源码安装步骤大致相同,具体细节可以参考解压缩之后的README和INSTALL README: 介绍了软件包的功能 ...
- Centos 7环境下源码安装PostgreSQL数据库
马上就要去实习了,工作内容是搞数据仓库方面的,用的是postgresql关系型数据库,于是自己先来了解下这种数据的用法,之后说说这个数据库和MySQL的关系和区别. 1.Postgresql简介 看了 ...
- LNAMP服务器环境（源码安装）
在安装前先看下它们安装时所需要的依赖库:http://www.cnblogs.com/fps2tao/p/7699448.html 1.nginx源码安装 下载:http://nginx.org/en ...
- dockerfile源码安装mysql_docker容器详解五： dockerfile实现tomcat环境以及源码安装mysql...
tomcat 上一节讲到了dockerfile的基础,这一次咱们来作一个小的练习 首先要了解tomcat安装的整个过程 首先搭建 jdk环境: 下载jdk包,解压以后添加环境变量 而后搭建tomcat ...
- H323测试环境搭建--源码安装H32Plus与 PTLib
简介 H323Plus:用于开发使用 H.323 协议在基于分组的网络上进行多媒体通信的应用程序 PTLib:是一个库文件,提高平台的独立性,设计初衷是为了能让Openh323在Windows和Uni ...
- centos 源码安装mysql5.6_CentOS 7下源码安装MySQL 5.6
目录 准备工作 运行环境 确认你的安装版本 下载MySQL 安装MySQL 准备安装环境 编译和安装 配置MySQL 单实例配置 单实例配置方法 添加防火墙 启动MySQL 重启MySQL 多实例配置 ...
- centos 7 mysql 源码安装_centos7 mysql5.7.17源码安装
centos7 mysql5.7.17源码安装 **安装前准备 操作系统环境:Centos 7.2 1.解决依赖包并下载源码包至/home/soft/目录下[root@node03 ~]# yum - ...
- 最全解释：Linux操作系统下的软件安装与管理详解(源码安装、rpm/dpkg、yum/apt-get安装)
在linux上安装软件,安装方式和软件包获取的途径都远远比windows的丰富,那当然这就变得复杂很多,本文旨在理解linux下繁杂的软件安装.管理原理 ,学习软件的安装方式.源码包格式.远程软件 ...
- python2.7安装报错_python2.7源码安装方式
安装python2.7 下载Python 2.7, 下载地址 解压安装 tar -xzvf Python-2.7.15.tgz cd Python-2.7.15 ./configure --prefi ...
- ubuntu安装gcc-7,g++-7，源码安装python
安装gcc-7/g++-7 添加镜像 vim /etc/apt/sources.list #在sources.list中添加如下内容 deb [arch=amd64] http://archive.u ...
最新文章
- oracle11g分区表按时间自动创建
- linux系统文件介绍
- mongodb 复制集 维护小结
- STL源码剖析---list
- [密码学基础][每个信息安全博士生应该知道的52件事]52.先进的应用概念 系统的大致安全需求
- linux命令之有关关机和查看系统信息的命令
- mos管开关电路_【电路】MOS管开关电路图详解（一）
- 无心剑中译奥修《爱、婚姻与自由》
- 这次是真香了！iPhone 11一个月卖出1200万部 苹果加大产量
- php自动关机代码,vb下的恶搞关机程序
- eclipse安装包下载
- 关于可达矩阵的O(N*N)算法和强分图的O(E)算法
- iframe透明解决方案
- DSA数字签名原理及python实现
- 利用PS如何进行精细抠图
- Allegro在PCB中区域规则设置方法
- 一文看懂多模态大型语言模型GPT-4
- 设计分享|基于51单片机的数字时钟（汇编）
- android系统优化方向,Android开发的优化方向
- 计算机使用方法的书,是否知道飞鸽传书软件的详细使用方法？查看介绍