nginx源码安装、文件模块的修改、访问加密（自定义签名...

21fsdsd

                        nginx源码安装、文件模块的修改、访问加密（自定义签名证书）及负载均衡+轮询
主机环境 redhat6.5
实验环境 服务端 ip172.25.29.1    nginx
   服务端 ip 172.25.29.2  apache
   服务端 ip 172.25.29.3  apache
   测试端 ip 172.25.254.29
安装包       nginx-1.10.1.tar.gz
nginx用作反向代理

服务端1

1.  安装nginx

1.解压及简单配置

[iyunv@server1 mnt]# yum install gcc -y      #安装gcc
[iyunv@server1 mnt]# tar zxf nginx-1.10.1.tar.gz   #解压nginx压缩包
[iyunv@server1 mnt]# ls
nginx-1.10.1 nginx-1.10.1.tar.gz
[iyunv@server1 mnt]# cd nginx-1.10.1
[iyunv@server1 nginx-1.10.1]# vim auto/cc/gcc     #禁止debug调试
178 # debug
179#CFLAGS="$CFLAGS -g"
[iyunv@server1 nginx-1.10.1]# vim src/core/nginx.h   #禁止出现nginx版本号，以保证安全性
14 #defineNGINX_VER          "nginx/"

   2.软件配置(静态)
[iyunv@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

如果出现以下错误


[iyunv@server1 nginx-1.10.1]# yum install pcre-devel -y

重新配置
[iyunv@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

如果出现以下错误


[iyunv@server1 nginx-1.10.1]# yum install openssl-devel -y

重新配置
[iyunv@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

3.编译、链接、安装
[iyunv@server1 nginx-1.10.1]# make

[iyunv@server1 nginx-1.10.1]# make install


2.将nginx作为系统变量，开启nginx
[root@server1nginx-1.10.1]# cd /usr/local/lnmp/nginx/
[iyunv@server1 nginx]# ls
conf  html  logs sbin
[iyunv@server1 nginx]# ln -s /usr/local/lnmp/nginx/sbin/nginx/usr/local/sbin/  #作软链接将nginx的启动命令作为系统命令
[iyunv@server1 nginx]# nginx -t     #检测
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 nginx]# nginx    #打开nginx
[iyunv@server1 nginx]# cd conf/

3.配置文件中模块的修改及测试
[iyunv@server1 conf]# useradd -u 900 -d /usr/local/lnmp/nginx/nginx  #创建管理nginx的用户

1.修改用户、添加cpu及绑定cpu
[iyunv@server1 conf]# vim nginx.conf
  2 user  nginx;    #修改nginx的用户
  3 worker_processes  2;   #工作进程，两块cpu
  4 worker_cpu_affinity01 10;  #绑定cpu
[iyunv@server1 conf]# nginx -t   #检测
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 conf]# nginx -s reload   #重载

测试
[iyunv@server1 conf]# ps aux | grep nginx


[iyunv@server1 conf]# vim nginx.conf
13 events {
14     worker_connections  4096; #支持的最大链接数
15 }
[iyunv@server1 conf]# nginx -t   #检测
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 conf]# nginx -s reload  #重载

[iyunv@server1 conf]# vim /etc/security/limits.conf  #系统分配给nginx的
51 nginx   -      nofile  200
52 nginx   -      nproc   200
[iyunv@server1 conf]# :() { :|:& };:     #测试  
如果把上面200改成4096，那么系统直接卡死

2.查看nginx状态
[iyunv@server4 conf]# vim nginx.conf   #查看nginx状态
57         location /status {
58                 stub_status on;
59                 access_log off;
60         }
[iyunv@server1 conf]# nginx -t
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server4 conf]# nginx -s reload
[iyunv@server1 mnt]# yum install httpd -y

[iyunv@server1 conf]# vim /etc/httpd/conf/httpd.conf
  136 Listen 8080      #之前nginx监听80端口，httpd就换了端口
[iyunv@server1 conf]# /etc/init.d/httpd start
Starting httpd:                                           [  OK  ]
测试 172.25.29.1/status


3.nginx访问加密（自定义签名证书）
在互联网中，如果访问不加密，会导致很多重要信息泄露，所有才有了加密
[iyunv@server4 conf]# vim nginx.conf    #访问加密
101     #
102     server {
103         listen       443 ssl;
104        server_name  localhost;
105
106        ssl_certificate      cert.pem;
107        ssl_certificate_key  cert.pem;
108
109         ssl_session_cache    shared:SSL:1m;
110        ssl_session_timeout  5m;
111
112        ssl_ciphers  HIGH:!aNULL:!MD5;
113        ssl_prefer_server_ciphers  on;
114
115         location / {
116             root   html;
117            index  index.html index.htm;
118         }
119     }
120
[iyunv@server1 conf]# cd /etc/pki/tls/certs/
[iyunv@server1 certs]# make cert.pem    #生成自定义签名证书
umask 77 ; \
    PEM1=`/bin/mktemp/tmp/openssl.XXXXXX` ; \
    PEM2=`/bin/mktemp/tmp/openssl.XXXXXX` ; \
    /usr/bin/openssl req-utf8 -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2-set_serial 0 ; \
    cat $PEM1 >  cert.pem ; \
    echo ""    >> cert.pem ; \
    cat $PEM2 >>cert.pem ; \
    rm -f $PEM1 $PEM2
Generating a 2048 bit RSA private key
..............+++
................+++
writing new private key to '/tmp/openssl.9egbT2'
-----
You are about to be asked to enter information that will beincorporated
into your certificate request.
What you are about to enter is what is called a DistinguishedName or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:wen
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname)[]:server1.example.com
Email Address []:root@server1.example.com
[iyunv@server1 certs]# mv cert.pem /usr/local/lnmp/nginx/conf/
[iyunv@server1 certs]# nginx -t
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 certs]# nginx -s reload

测试 https：//172.25.29.1


选择 I Understand the Risks,确认

4.虚拟主机

虚拟主机允许从一个httpd服务器同时为多个网站提供服务
[iyunv@server1 certs]# cd /usr/local/lnmp/nginx/conf/
[iyunv@server1 conf]# vim nginx.conf
120     server {
121                 listen 80;  #监听端口
122                server_name www.wen.com;   #域名
123
124                location / {
125                        root /web1;    #默认发布目录
126                        index index.html;  #默认发布文件
127                 }
128     }
129     server {
130                listen 80;
131                server_name www.mi.com;
132
133                location / {
134                        root /web2;
135                        index index.html;
136                 }
137     }
[iyunv@server1 conf]# mkdir /web1 /web2
[iyunv@server1 conf]# vim /web1/index.html
Welcome to www.wen.com
[iyunv@server1 conf]# vim /web2/index.html
Welcome to www.mi.com
[iyunv@server1 conf]# nginx -t
nginx: the configuration file /usr/local/lnmp/nginx/conf/nginx.confsyntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 conf]# nginx -s reload
测试
在测试端的主机里加上域名解析
[iyunv@foundation29 Desktop]# vim /etc/hosts
172.25.29.1 www.wen.comwww.mi.com

5.负载均衡+轮询

  参数说明： round-robin （默认）

    wegiht ：默认为1.weight越大，负载的权重就越大

            backup： 其它所有的非backup机器都down时，才会请求backup机器。所以这台机器压力会最轻

ip_hash：每个请求按访问ip的hash结果分配，这样每个访客固定访问一个后端服务器，可以解决session的问题

[iyunv@server1 conf]# vim nginx.conf
18 http {
19         upstream wen {
20                 server 172.25.29.2:80;
21                 server 172.25.29.3:80weight=2;
22                 server 172.25.29.4:8080backup;
23         }
125     server {
126                 listen80;
127                server_name www.wen.com;
128
129                location / {
130                        #root /web1;
131                        #index index.html;
132                        proxy_pass http://wen;   
133                 }
134     }
[iyunv@server1 conf]# nginx -t
nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful
[iyunv@server1 conf]# nginx -s reload
[iyunv@server1 conf]# vim /var/www/html/index.html
[iyunv@server1 conf]# /etc/init.d/httpd restart
Stopping httpd:                                           [  OK  ]
Starting httpd:                                           [  OK  ]


其他两个2，3服务端，测试时要保证其http服务开启且默认访问的首页的路径下要有index.html文件，在文件里要有内容（随便什么都行）
测试
[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done
<h1>server3</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>
[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done   当server3 httpd stop 之后
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done  当server2和server3httpd都 stop 之后
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>
<h1>please try again!</h1>

[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done  当server2 和server3的httpd 都start之后，继续轮询
<h1>www.westos.org-server2</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>
<h1>www.westos.org-server2</h1>
<h1>server3</h1>
<h1>server3</h1>