高性能服务器-Nginx

   server {
        listen       80;
        server_name  www.luo.com;
        location / {
            root   /data/webapps/www;
            index  index.html index.htm;
        }
    }
    server {
        listen       80;
        server_name  bbs.luo.com;
        location / {
            root   /data/webapps/bbs;
            index  index.html index.htm;
        }
    }

 server {
    listen   80;
    server_name  bbs.luo.com;
    location / {
        root   /data/webapps/bbs;
        index  index.html index.htm;
    auth_basic     "Auth Page";  # 基于用户认证
    auth_basic_user_file  /etc/nginx/.user; 
#   deny 192.168.1.107;  # 基于IP的访问控制，访问的话网页默认会返回403 Forbidden
#   allow 192.168.1.0/24;
#   deny  all; 

    autoindex on;  # 打开目录浏览功能,主页面不在在时
    autoindex_exact_size on; 
    autoindex_localtime on; 
        }
    location /status {   # 开启状态页面信息查看，并以认证用户访问
     root /; 
     stub_status on; 
     auth_basic "NginxStatus";              
     auth_basic_user_file /etc/nginx/.user; 
     }
    }

# yum install -y httpd
# cd /etc/nginx
# htpasswd -c -m /etc/nginx/.user nginx
New password:   nginx
Re-type new password: 
Adding password for user nginx
# ll .user 
-rw-r--r-- 1 root root 44 Sep 26 00:16 .user
# service nginx reload    

# cd /etc/pki/CA/
[root@node CA]# ls
certs  crl  newcerts  private
[root@node CA]# cd private/
[root@node private]# (umask 077; openssl genrsa 2048 > cakey.pem) #生成私钥 
Generating RSA private key, 2048 bit long modulus
......................................................................................................................................................................................+++
e is 65537 (0x10001)
[root@node private]# cd ..
[root@node CA]# openssl req -new -x509 -key ./private/cakey.pem -out cacert.pem  #生成自签证书
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HA    
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:LUO
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server‘s hostname) []:

[root@node CA]# touch serial 
[root@node CA]# echo 01 > serial
[root@node CA]# touch index.txt
[root@node CA]# ll
total 24
-rw-r--r--  1 root root 1224 Sep 26 00:54 cacert.pem
drwxr-xr-x. 2 root root 4096 Nov 22  2013 certs
drwxr-xr-x. 2 root root 4096 Nov 22  2013 crl
-rw-r--r--  1 root root    0 Sep 26 00:56 index.txt
drwxr-xr-x. 2 root root 4096 Nov 22  2013 newcerts
drwx------. 2 root root 4096 Sep 26 00:51 private
-rw-r--r--  1 root root    3 Sep 26 00:55 serial

[root@node CA]# mkdir /etc/nginx/ssl
[root@node CA]# cd /etc/nginx/ssl
[root@node ssl]# (umask 077; openssl genrsa 1024 > nginx.key) #生成私钥
Generating RSA private key, 1024 bit long modulus
...............++++++
.++++++
e is 65537 (0x10001)
[root@node ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HA
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:LUO
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server‘s hostname) []:
Email Address []:

[root@node CA]# mkdir /etc/nginx/ssl
[root@node CA]# cd /etc/nginx/ssl
[root@node ssl]# (umask 077; openssl genrsa 1024 > nginx.key) #生成私钥
Generating RSA private key, 1024 bit long modulus
...............++++++
.++++++
e is 65537 (0x10001)
[root@node ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HA
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:LUO
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server‘s hostname) []:
Email Address []:

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@node ssl]# openssl ca -in nginx.csr -out nginx.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Sep 25 17:05:46 2014 GMT
            Not After : Sep 22 17:05:46 2024 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HA
            organizationName          = LUO
            organizationalUnitName    = Tech
            commonName                = node.luo.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                23:DF:A7:65:EC:04:18:FE:15:9F:D5:D7:87:51:AF:CA:6C:6C:F8:1C
            X509v3 Authority Key Identifier: 
                keyid:CC:49:57:FB:D2:E8:5F:6F:46:44:0A:33:6E:43:F6:17:E8:6D:9F:6E

Certificate is to be certified until Sep 22 17:05:46 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

server { 
      listen       443; 
      server_name  localhost;
      ssl                  on; 
      ssl_certificate      /etc/nginx/ssl/nginx.crt; 
      ssl_certificate_key  /etc/nginx/ssl/nginx.key;
      ssl_session_timeout  5m;
      ssl_protocols  SSLv2 SSLv3 TLSv1; 
      ssl_ciphers  HIGH:!aNULL:!MD5; 
      ssl_prefer_server_ciphers   on;
      location / { 
          root   html; 
          index  index.html index.htm; 
      } 
  }