标签：blank 用户 target
一 安装nginx
1 下载
1.1 解压
# tar xf nginx-1.4.7.tar.gz
1.2 建立用户（为系统用户）
# groupadd -r -g 110 nginx
# useradd -r -g 110 -u 110 nginx
1.3 解决依赖关系
编译安装nginx需要事先需要安装开发包组"Development Tools"和 "Development Libraries"。
同时，还需要专门安装pcre-devel包：
# yum install -y pcre-devel openssl-devel zlib-devel
2 安装
# ./configure \
--prefix=/usr/local/nginx \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--pid-path=/var/run/nginx/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_flv_module \
--with-http_stub_status_module \
--with-http_gzip_static_module \
--http-client-body-temp-path=/var/tmp/nginx/client/ \
--http-proxy-temp-path=/var/tmp/nginx/proxy/ \
--http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ \
--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi \
--http-scgi-temp-path=/var/tmp/nginx/scgi \
--with-pcre \
--with-file-aio
# make && make install
3 为nginx提供SysV init脚本:
#!/bin/sh
#
# nginx - this script starts and stops the nginx daemon
#
# chkconfig: - 85 15
# description: Nginx is an HTTP(S) server, HTTP(S) reverse \
# proxy and IMAP/POP3 proxy server
# processname: nginx
# config: /etc/nginx/nginx.conf
# config: /etc/sysconfig/nginx
# pidfile: /var/run/nginx/nginx.pid
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0
nginx="/usr/local/nginx/sbin/nginx"
prog=$(basename $nginx)
NGINX_CONF_FILE="/etc/nginx/nginx.conf"
[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx
lockfile=/var/lock/subsys/nginx
make_dirs() {
# make required directories
user=`nginx -V 2>&1 | grep "configure arguments:" | sed ‘s/[^*]*--user=\([^ ]*\).*/\1/g‘ -`
options=`$nginx -V 2>&1 | grep ‘configure arguments:‘`
for opt in $options; do
if [ `echo $opt | grep ‘.*-temp-path‘` ]; then
value=`echo $opt | cut -d "=" -f 2`
if [ ! -d "$value" ]; then
# echo "creating" $value
mkdir -p $value && chown -R $user $value
fi
fi
done
}
start() {
[ -x $nginx ] || exit 5
[ -f $NGINX_CONF_FILE ] || exit 6
make_dirs
echo -n $"Starting $prog: "
daemon $nginx -c $NGINX_CONF_FILE
retval=$?
echo
[ $retval -eq 0 ] && touch $lockfile
return $retval
}
stop() {
echo -n $"Stopping $prog: "
killproc $prog -QUIT
retval=$?
echo
[ $retval -eq 0 ] && rm -f $lockfile
return $retval
}
restart() {
configtest || return $?
stop
sleep 1
start
}
reload() {
configtest || return $?
echo -n $"Reloading $prog: "
killproc $nginx -HUP
RETVAL=$?
echo
}
force_reload() {
restart
}
configtest() {
$nginx -t -c $NGINX_CONF_FILE
}
rh_status() {
status $prog
}
rh_status_q() {
rh_status >/dev/null 2>&1
}
case "$1" in
start)
rh_status_q && exit 0
$1
;;
stop)
rh_status_q || exit 0
$1
;;
restart|configtest)
$1
;;
reload)
rh_status_q || exit 7
$1
;;
force-reload)
force_reload
;;
status)
rh_status
;;
condrestart|try-restart)
rh_status_q || exit 0
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload|configtest}"
exit 2
esac
为此脚本赋予执行权限：
# chmod +x /etc/rc.d/init.d/nginx
4 添加至服务管理列表，并让其开机自动启动：
# chkconfig --add nginx
# chkconfig nginx on
5 启动服务并测试：
# service nginx start
二 location
location [ = | ~ | ~* | ^~ ] uri { ... }
location uri {}:对当前路径及其子路径下的所有文件都生效
location = uri {}:精确匹配，只对当前资源生效，不包含子路径
location ~ uri {}:模式匹配uri，可使用正则表达式，区分大小写
location ~* uri {}:模式匹配uri，可使用正则表达式，不区分大小写
location ^~ uri {}:不使用正则表达式
location / {
root /web/html;
index index.html index.htm;
}
error_page 404 /404.html; # 访问不存在的资源，错误返回页，的或禁止访问
location /bbs {
root /web;
index index.html index.htm; # 此处注释后，仍可以正常访问
}
和httpd对比
filesystem path
<DocumentRoot "">
</DocumentRoot>
uri path
<location "">
</localtion>
三 基于ip的访问控制
默认是允许所有，若部分允许需定义deny all
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
allow 2001:0db8::/32;
deny all;
}
四 基于用户的访问控制
location / {
auth_basic "closed site";
auth_basic_user_file /etc/nginx/.htpasswd;
}
生成密码文件需借助于htpasswd工具
# htpasswd -c -m /etc/nginx/.htpasswd tom
使用curl -u user：passwd url可测试，也可以在浏览器测试
五 索引indexlocation /download {
root /web;
index home.html;
autoindex on; # 自动索引默认为关闭，打开较为不安全
}
Syntax: autoindex on | off;
Default: autoindex off;
Context: http, server, location
Enables or disables the directory listing output.
Syntax: autoindex_exact_size on | off;
Default: autoindex_exact_size on;
Context: http, server, location
Syntax: autoindex_localtime on | off;
Default: autoindex_localtime off;
Context: http, server, location
六 状态信息
location /nginx_status {
stub_status on;
access_log off;
allow ip；
deny all；
}
状态信息解读
Active connections: 3
server accepts handled requests
154 154 153
Reading: 0 Writing: 1 Waiting: 2
Active connections
The current number of active client connections including Waiting connections.
活动的连接数（包括等待的连接）
accepts
The total number of accepted client connections.
已经接收的连接数
handled
The total number of handled connections. Generally, the parameter value is the same as accepts unless some resource limits have been reached (for example, the worker_connections limit).
已经处理的连接数
requests
The total number of client requests.
已处理的请求数
Reading
The current number of connections where nginx is reading the request header.
nginx正在读取其请求首部的的连接个数
Writing
The current number of connections where nginx is writing the response back to the client.
nginx正在读取其请求主体的连接数/正在处理请求内容的连接数/正在向其发送响应的连接数
Waiting
The current number of idle client connections waiting for a request.
空闲的连接数
七 开启ssl功能
1 nginx的配置
server {
listen 443;
server_name localhost;
ssl on;
ssl_certificate /etc/nginx/ssl/nginx_ssl.crt;
ssl_certificate_key /etc/nginx/ssl/nginx_ssl.key;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
root /web/html;
index index.html index.htm;
}
}
2 openssl服务端配置文件
# vim /etc/pki/tls/openssl.cnf
dir = /etc/pki/CA
2.1 生成CA私钥
# (umask 077 ;openssl genrsa 2048 > private/cakey.pem）
# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
2.2 创建CA证书
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HA
Locality Name (eg, city) [Default City]:SH
Organization Name (eg, company) [Default Company Ltd]:HIYANG
Organizational Unit Name (eg, section) []:TECH
Common Name (eg, your name or your server‘s hostname) []:ca.node1.test.com
Email Address []:caadmin@test.com
# echo 01 > serial
# touch index.txt
3 CA客户端
3.1 创建私钥
# cd /etc/nginx/ssl/
# (umask 077;openssl genrsa 1024 > nginx_ssl.key)
3.2 发起认证请求
# openssl req -new -key nginx_ssl.key -out nginx_ssl.csr
4 签署认证
# openssl ca -in nginx_ssl.csr -out nginx_ssl.crt -days 3650
八 虚拟主机
server {
listen 80;
server_name www.hiyang.com;
location / {
root /web/hiyang/;
index index.html;
}
}
2 nginx编译安装
标签：blank 用户 target
原文地址：http://hiyang.blog.51cto.com/10728919/1813865
