nginx部署
检查部署nginx的依赖包 pcre pcre-devel openssl openssl-devel
pcre pcre-devel :这个依赖包是nginx的rewrite模块需要的包，只有安装了这个依赖包，nginx才支持伪静态的正则表达式的编写
openssl openssl-devel：这个依赖包是nginx用到https协议的时候会用到，只有安装了这个依赖包，nginx才可以使用https协议加密算法
检查：rpm -qa pcre pcre-devel openssl openssl-devel
检查没有的依赖包进行安装：yum install pcre pcre-devel openssl openssl-devel -y
添加虚拟用户nginx，这个用户作为nginx服务的默认用户，在./configure中会用到
useradd nginx -s /sbin/nologin -M
切换到用户的工具目录：[root@lnmp01 ~]# cd /home/oldboy/tools/
下载nginx：[root@lnmp01 tools]#wget -q http://nginx.org/download/nginx-1.6.3.tar.gz 解压
切换到nginx的解压目录 [root@lnmp01 tools]# cd nginx-1.6.3
查看nginx支持的那些模块
[root@lnmp01 nginx-1.6.3]# ./configure --help --help print this message --prefix=PATH set installation prefix --sbin-path=PATH set nginx binary pathname --conf-path=PATH set nginx.conf pathname --error-log-path=PATH set error log pathname --pid-path=PATH set nginx.pid pathname --lock-path=PATH set nginx.lock pathname --user=USER set non-privileged user for worker processes --group=GROUP set non-privileged group for worker processes --builddir=DIR set build directory --with-rtsig_module enable rtsig module --with-select_module enable select module --without-select_module disable select module --with-poll_module enable poll module --without-poll_module disable poll module --with-file-aio enable file AIO support --with-ipv6 enable IPv6 support --with-http_ssl_module enable ngx_http_ssl_module --with-http_spdy_module enable ngx_http_spdy_module --with-http_realip_module enable ngx_http_realip_module --with-http_addition_module enable ngx_http_addition_module --with-http_xslt_module enable ngx_http_xslt_module --with-http_image_filter_module enable ngx_http_image_filter_module --with-http_geoip_module enable ngx_http_geoip_module --with-http_sub_module enable ngx_http_sub_module --with-http_dav_module enable ngx_http_dav_module --with-http_flv_module enable ngx_http_flv_module --with-http_mp4_module enable ngx_http_mp4_module --with-http_gunzip_module enable ngx_http_gunzip_module --with-http_gzip_static_module enable ngx_http_gzip_static_module --with-http_auth_request_module enable ngx_http_auth_request_module --with-http_random_index_module enable ngx_http_random_index_module --with-http_secure_link_module enable ngx_http_secure_link_module --with-http_degradation_module enable ngx_http_degradation_module --with-http_stub_status_module enable ngx_http_stub_status_module --without-http_charset_module disable ngx_http_charset_module --without-http_gzip_module disable ngx_http_gzip_module --without-http_ssi_module disable ngx_http_ssi_module --without-http_userid_module disable ngx_http_userid_module --without-http_access_module disable ngx_http_access_module --without-http_auth_basic_module disable ngx_http_auth_basic_module --without-http_autoindex_module disable ngx_http_autoindex_module --without-http_geo_module disable ngx_http_geo_module --without-http_map_module disable ngx_http_map_module --without-http_split_clients_module disable ngx_http_split_clients_module --without-http_referer_module disable ngx_http_referer_module --without-http_rewrite_module disable ngx_http_rewrite_module --without-http_proxy_module disable ngx_http_proxy_module --without-http_fastcgi_module disable ngx_http_fastcgi_module --without-http_uwsgi_module disable ngx_http_uwsgi_module --without-http_scgi_module disable ngx_http_scgi_module --without-http_memcached_module disable ngx_http_memcached_module --without-http_limit_conn_module disable ngx_http_limit_conn_module --without-http_limit_req_module disable ngx_http_limit_req_module --without-http_empty_gif_module disable ngx_http_empty_gif_module --without-http_browser_module disable ngx_http_browser_module --without-http_upstream_ip_hash_module disable ngx_http_upstream_ip_hash_module --without-http_upstream_least_conn_module disable ngx_http_upstream_least_conn_module --without-http_upstream_keepalive_module disable ngx_http_upstream_keepalive_module --with-http_perl_module enable ngx_http_perl_module --with-perl_modules_path=PATH set Perl modules path --with-perl=PATH set perl binary pathname --http-log-path=PATH set http access log pathname --http-client-body-temp-path=PATH set path to store http client request body temporary files --http-proxy-temp-path=PATH set path to store http proxy temporary files --http-fastcgi-temp-path=PATH set path to store http fastcgi temporary files --http-uwsgi-temp-path=PATH set path to store http uwsgi temporary files --http-scgi-temp-path=PATH set path to store http scgi temporary files --without-http disable HTTP server --without-http-cache disable HTTP cache --with-mail enable POP3/IMAP4/SMTP proxy module --with-mail_ssl_module enable ngx_mail_ssl_module --without-mail_pop3_module disable ngx_mail_pop3_module --without-mail_imap_module disable ngx_mail_imap_module --without-mail_smtp_module disable ngx_mail_smtp_module --with-google_perftools_module enable ngx_google_perftools_module --with-cpp_test_module enable ngx_cpp_test_module --add-module=PATH enable an external module --with-cc=PATH set C compiler pathname --with-cpp=PATH set C preprocessor pathname --with-cc-opt=OPTIONS set additional C compiler options --with-ld-opt=OPTIONS set additional linker options --with-cpu-opt=CPU build for the specified CPU, valid values: pentium, pentiumpro, pentium3, pentium4, athlon, opteron, sparc32, sparc64, ppc64 --without-pcre disable PCRE library usage --with-pcre force PCRE library usage --with-pcre=DIR set path to PCRE library sources --with-pcre-opt=OPTIONS set additional build options for PCRE --with-pcre-jit build PCRE with JIT compilation support --with-md5=DIR set path to md5 library sources --with-md5-opt=OPTIONS set additional build options for md5 --with-md5-asm use md5 assembler sources --with-sha1=DIR set path to sha1 library sources --with-sha1-opt=OPTIONS set additional build options for sha1 --with-sha1-asm use sha1 assembler sources --with-zlib=DIR set path to zlib library sources --with-zlib-opt=OPTIONS set additional build options for zlib --with-zlib-asm=CPU use zlib assembler sources optimized for the specified CPU, valid values: pentium, pentiumpro --with-libatomic force libatomic_ops library usage --with-libatomic=DIR set path to libatomic_ops library sources --with-openssl=DIR set path to OpenSSL library sources --with-openssl-opt=OPTIONS set additional build options for OpenSSL --with-debug enable debug logging
--help查看帮助中的--without....模块表示安装nginx的话默认是安装的，with.....模块表示安装nginx的时候需要手动激活状态信息，所以在安装nginx前可以指定那些模块是需要安装或不安装
编译前预处理：
[root@lnmp01 nginx-1.6.3]# ./configure --prefix=/application/nginx-1.6.3 --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module
编译和安装：
[root@lnmp01 nginx-1.6.3]# make && make install
对安装的nginx软件做软连接
[root@lnmp01 ~]# ln -s /application/nginx-1.6.3/ /application/nginx
启动nginx服务
[root@lnmp01 ~]# /application/nginx/sbin/nginx
查看nginx进程和端口
[root@lnmp01 ~]# ps -ef |grep nginx |grep -v grep root 11021 1 0 10:46 ? 00:00:00 nginx: master process /application/nginx/sbin/nginx nginx 11022 11021 0 10:46 ? 00:00:00 nginx: worker process
[root@lnmp01 ~]# netstat -lntup|grep nginx tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 11021/nginx
到此nginx安装成功了，用浏览器打开http://192.168.1.103测试成功。
如果nginx是他人安装的，可以使用-V来查看nginx安装时候的编译参数
[root@lnmp01 ~]# /application/nginx/sbin/nginx -V nginx version: nginx/1.6.3 built by gcc 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC) TLS SNI support enabled configure arguments: --prefix=/application/nginx-1.6.3 --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module
拍错的话用
[root@lnmp01 ~]# cat /application/nginx/logs/
[root@lnmp01 ~]# cat /application/nginx/logs/error.log
基于域名创建虚拟主机
去除nginx.conf配置文件的注释和空行：egrep -v "#|^$" nginx.conf.default >nginx.conf
编辑配置文件，这里的root html/www目录是相对于nginx的安装目录/application/nginx/
[root@lnmp01 conf]# cat nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name www.goser.org;
location / {
root html/www;
index index.html index.htm;
}
}
server {
listen 80;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
server_name bbs.goser.org;
location / {
root html/bbs;
index index.html index.htm;
}
}
}
要使配置生效就需要重启nginx服务，在重启服务前应先检查语法
[root@lnmp01 conf]# /application/nginx/sbin/nginx -t nginx: the configuration file /application/nginx-1.6.3/conf/nginx.conf syntax is ok nginx: configuration file /application/nginx-1.6.3/conf/nginx.conf test is successful
语法没有错误在重启
[root@lnmp01 conf]# /application/nginx/sbin/nginx -s reload
如果虚拟主机添加多的话，nginx的配置文件中的虚拟主机看起来就比较乱，这时候就可以使用include方法来调整nginx.conf配置文件
[root@lnmp01 conf]# vim nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include extra/www.conf;
include extra/bbs.conf;
include extra/blog.conf;
}
然后在extra目录下创建www.conf bbs.conf blog.conf各个虚拟主机的配置文件
[root@lnmp01 conf]# sed -n '10,17p' nginx.conf.ori1 >extra/www.conf [root@lnmp01 conf]# sed -n '18,25p' nginx.conf.ori1>extra/bbs.conf [root@lnmp01 conf]# sed -n '26,33p' nginx.conf.ori1>extra/blog.conf
最后再检查语法和重启nginx服务，curl www.goser.com等是否正确。
当然也可以对虚拟主机设置别名，在server_name行添加别名：
[root@lnmp01 conf]# vim extra/www.conf
server {
listen 80;
server_name www.goser.com goser.com;
location / {
root html/www;
index index.html index.htm;
}
}
最后再检查语法和重启nginx服务，curl goser.com等是否正确。
配置nginx查看连接状态文件
[root@lnmp01 extra]# vim status.conf
server {
listen 80;
server_name status.etiantian.org;
location / {
stub_status on;
access_log off;
}
}
将此状态配置文件添加到nginx主配置文件中
[root@lnmp01 conf]# vim nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include extra/www.conf;
include extra/bbs.conf;
include extra/blog.conf;
include extra/status.conf;
}
最后再检查语法和重启nginx服务，curl status.goser.com查看nginx服务的连接信息
[root@lnmp01 conf]# curl status.goser.com Active connections: 1 server accepts handled requests 31 31 29 Reading: 0 Writing: 1 Waiting: 0
nginx错误日志配置
在nginx主配置文件中添加error_log logs/error.log error;
[root@lnmp01 conf]# vim nginx.conf
worker_processes 1;
error_log logs/error.log error;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include extra/www.conf;
include extra/bbs.conf;
include extra/blog.conf;
include extra/status.conf;
}
在主配置文件中添加日志格式，这个日志格式最好添加到http块中
[root@lnmp01 conf]# vim nginx.conf
worker_processes 1;
error_log logs/error.log error;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
include extra/www.conf;
include extra/bbs.conf;
include extra/blog.conf;
include extra/status.conf;
}
配置好日志格式后就可以配置访问日志了，这个访问日志定义最好添加到每个server块中。比如在www.conf的虚拟主机中添加访问日子www_access.log
[root@lnmp01 conf]# vim extra/www.conf
server {
listen 80;
server_name www.goser.com goser.com;
location / {
root html/www;
index index.html index.htm;
}
access_log logs/www_access.log main;
}
这里的access_log后的main就是定义日志格式的名称
最后再检查语法和重启nginx服务，用tail -f /application/nginx/logs/www_access.log来追踪www_access.log日志文件的变化
当用客户端访问www.goser.com的时候，就会在www_access.log的访问日志中记录
[root@lnmp01 conf]# tail -f /application/nginx/logs/www_access.log 192.168.1.3 - - [19/Sep/2017:15:35:43 +0800] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" "-"
这个记录和上面的日志格式的定义对比如下：
默认情况下nginx不支持日志切割，可以手动创建脚本对nginx的日志进行切割和轮询
在/server/scripts/下创建cut_nginx_log.sh的日志切割和轮询脚本
[root@lnmp01 scripts]# vim cut_nginx_log.sh
Nginxlogdir="$Basedir/logs"
#!/bin/sh
Dateformat=`date +%Y-%m-%d`
Basedir='/application/nginx'
Nginxlogdir="$Basedir/logs"
Logname='www_access'
[ -d $Nginxlogdir ] && cd $Nginxlogdir||exit 1
[ -f ${Logname}.log ]||exit 1
/bin/mv ${Logname}.log ${Dateformat}_${Logname}.log
/bin/mv bbs_access.log ${Dateformat}_bbs_access.log
/bin/mv blog_access.log ${Dateformat}_blog_access.log
$Basedir/sbin/nginx -s reload
测试脚本有没有效果
[root@lnmp01 ~]# /bin/sh /server/scripts/cut_nginx_log.sh
这时候生成的日志有：
[root@lnmp01 scripts]# ll /application/nginx/logs/ total 20 -rw-r--r-- 1 root root 0 Sep 19 16:00 2017-09-19_bbs_access.log -rw-r--r-- 1 root root 0 Sep 19 16:00 2017-09-19_blog_access.log -rw-r--r-- 1 root root 0 Sep 19 16:08 2017-09-19_www_access.log -rw-r--r-- 1 root root 188 Sep 19 15:35 20170919_www_access.log -rw-r--r-- 1 root root 4562 Sep 19 14:24 access.log -rw-r--r-- 1 root root 0 Sep 19 16:11 bbs_access.log -rw-r--r-- 1 root root 0 Sep 19 16:11 blog_access.log -rw-r--r-- 1 root root 1744 Sep 19 16:11 error.log -rw-r--r-- 1 root root 6 Sep 19 10:46 nginx.pid -rw-r--r-- 1 root root 0 Sep 19 16:11 www_access.log
更改日期再测试一遍
[root@lnmp01 scripts]# date -s "2015/09/20"
生产的日志为：
[root@lnmp01 scripts]# ll /application/nginx/logs/ total 20 -rw-r--r-- 1 root root 0 Sep 19 2017 2015-09-20_bbs_access.log -rw-r--r-- 1 root root 0 Sep 19 2017 2015-09-20_blog_access.log -rw-r--r-- 1 root root 0 Sep 19 2017 2015-09-20_www_access.log -rw-r--r-- 1 root root 0 Sep 19 2017 2017-09-19_bbs_access.log -rw-r--r-- 1 root root 0 Sep 19 2017 2017-09-19_blog_access.log -rw-r--r-- 1 root root 0 Sep 19 2017 2017-09-19_www_access.log -rw-r--r-- 1 root root 188 Sep 19 2017 20170919_www_access.log -rw-r--r-- 1 root root 4562 Sep 19 2017 access.log -rw-r--r-- 1 root root 0 Sep 20 00:00 bbs_access.log -rw-r--r-- 1 root root 0 Sep 20 00:00 blog_access.log -rw-r--r-- 1 root root 1805 Sep 20 00:00 error.log -rw-r--r-- 1 root root 6 Sep 19 2017 nginx.pid -rw-r--r-- 1 root root 0 Sep 20 00:00 www_access.log
这时候说明脚本配置没问题，下面就要按照定时任务来做每日的日志切割和轮询
[root@lnmp01 ~]# crontab -e ####################### */5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1 ##################################### 00 01 * * * /bin/sh /server/scripts/bak.sh >/dev/null 2>&1 ######nginx log cut########### 00 00 * * * /bin/sh /server/scripts/cut_nginx_log.sh >/dev/null 2>&1
有些情况下，用户在输入浏览器中输入主域名的情况下会直接跳转到待主机的域名地址上，这是用到了rewrite和301跳转功能
比如配置www.conf配置文件的rewrite
[root@lnmp01 ~]# vim /application/nginx/conf/extra/www.conf
server {
listen 80;
server_name goser.org;
rewrite ^/(.*) http://www.goser.org/$1 permanent;
}
server {
listen 80;
server_name www.goser.org;
location / {
root html/www;
index index.html index.htm;
}
access_log logs/www_access.log main;
}
最后用curl命令就可以看到301跳转了
[root@lnmp01 ~]# curl -I goser.org HTTP/1.1 301 Moved Permanently Server: nginx/1.6.3 Date: Tue, 19 Sep 2017 08:41:58 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: http://www.goser.org/
location标签的应用案例：
比如企业中对域名www.goser.com有后台管理的平台，可以使用location标签来定位资源的位置，同时只允许内网的用户可以访问此域名的后台管理，外网用户禁止访问
[root@linux-node2 conf]# vim extra/www.conf
server {
listen 80;
server_name goser.com;
rewrite ^/(.*) http://www.goser.com/$1 permanent;
}
server {
listen 80;
server_name www.goser.com;
access_log logs/www-access.log main;
location / {
root /webroot/web-demo;
index index.html index.htm;
}
location /backend {
root /webroot/web-demo;
index index.html index.htm;
#允许192.168.80.0/24网段的内网可以访问/banckend后台，其他地址禁止访问
allow 192.168.80.0/24;
deny all;
}
error_page 500 502 503 504 404 /error/50x.html;
location = /error/50x.html {
root /webroot/web-demo;
}
}
location语法：
location 指令的作用是根据用户请求的URI来执行不同的应用。
locationn使用的语法为
location [=|~|~*|^~] uri {
....
}
location后的匹配标示说明：
- ~ 匹配内容区分大小写
- ~* 匹配内容不区分的小写
- !~ 取反
- ^~ 但多个匹配同时存在，优先匹配 ^~匹配的内容;不做正则表达式的检查 （优先处理）
官方示例：
location = / {
[ configuration A ]
}
location / {
[ configuration B ]
}
location /documents/ {
[ configuration C ]
}
location ^~ /images/ {
[ configuration D ]
}
location ~* \.(gif|jpg|jpeg)$ {
[ configuration E ]
}
不同uri及特殊字符组合匹配的顺序说明
- location = / {} 精确匹配 /
- location ^~ /image/{ 匹配常规字符串，不做正则表达式匹配检查
- location ~* \.(gif|jpg|jpeg)$ { 正则匹配
- location /documents/ { 匹配常规字符串，如果有正则，则优先匹配正则
- location / { 所有location 都不能匹配后的默认匹配
nginx访问认证
对于企业内部的管理平台，可以使用nginx访问认证的方式保证安全性，比如对www.goser.com/backend页面登录需要用户名和密码认证的方式才能登录
#安装htpasswd工具
yum install httpd-tools -y
#创建密码文件
htpasswd -c /application/nginx/conf/htpasswd goser
New password: test
Re-type new password: test
#修改www.conf的配置文件，对backend页面需要认证才可登录使用
location /backend{
root /webroot/web-demo;
index index.html index.htm;
auth_basic "goser test";
auth_basic_user_file /application/nginx/conf/htpasswd;
allow 192.168.0.0/16;
deny all;
}
#更改密码文件的权限
chmod 400 /application/nginx/conf/htpassw
chown www.www /application/nginx/conf/htpasswd
#重启nginx服务
/application/nginx/sbin/nginx -s reload
最后通过www.goser.com/backend就需要用户名和密码才可访问
浙公网安备 33010602011771号