nginx
1. 访问控制
用于location段
allow：设定允许哪台或哪些主机访问，多个参数间用空格隔开
deny：设定禁止哪台或哪些主机访问，多个参数间用空格隔开
[root@RS1 ~]# vim /usr/local/nginx/conf/nginx.conf
location / {
allow 192.168.29.1;
deny all;
}
[root@RS1 ~]# systemctl restart nginx.service
[root@RS1 ~]# curl 127.0.0.1
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.22.0</center>
</body>
</html>
2. 基于用户认证
[root@RS1 ~]# dnf -y install httpd-tools
[root@RS1 ~]# htpasswd -c -m /usr/local/nginx/conf/.usr_auth_file mr
New password: 123456
Re-type new password: 123456
Adding password for user mr
[root@RS1 ~]# cat /usr/local/nginx/conf/.usr_auth_file
mr:$aprFJHCElgce8y26)bB2vcs(BG9(bTdKfJr/
[root@RS1 ~]# vim /usr/local/nginx/conf/nginx.conf
auth_basic "hello";
auth_basic_user_file /usr/local/nginx/conf/.usr_auth_file;
}
[root@RS1 ~]# systemctl restart nginx.service
3. https配置
生成私钥，生成证书签署请求并获得证书，然后在nginx.conf中配置如下内容：
server {
listen 443 ssl;
server_name www.idfsoft.com;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
}
}
[root@RS1 ~]# mkdir /usr/local/nginx/conf/ssl
[root@RS1 ~]# cd /usr/local/nginx/conf/ssl
[root@RS1 ssl]# openssl genrsa -out nginx.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.....+++++
.......+++++
e is 65537 (0x010001)
[root@RS1 ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:RT
Organization Name (eg, company) [Default Company Ltd]:www.mr.com
Organizational Unit Name (eg, section) []:www.mr.com
Common Name (eg, your name or your server's hostname) []:www.mr.com
Email Address []:3215547886@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:******
An optional company name []:******
[root@RS1 ssl]#
[root@RS1 ssl]# ls
nginx.crt nginx.csr nginx.key
[root@RS1 ssl]# vim ../nginx.conf
server {
listen 443 ssl;
server_name www.mr.com;
ssl_certificate ssl/nginx.crt;
ssl_certificate_key ssl/nginx.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
[root@RS1 ssl]# systemctl restart nginx.service
4. 开启状态界面
开启status：
location /status {
stub_status {on | off};
allow 172.16.0.0/16;
deny all;
}
访问状态页面的方式：http://server_ip/status
[root@RS1 ~]# nginx -V
nginx version: nginx/666
built by gcc 8.5.0 20210514 (Red Hat 8.5.0-15) (GCC)
built with OpenSSL 1.1.1k FIPS 25 Mar 2021
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module
[root@RS1 ~]# vim /usr/local/nginx/conf/nginx.conf
location = /status {
stub_status;
}
[root@RS1 ~]# systemctl reload nginx.service
[root@RS1 ~]# curl 127.0.0.1/status
Active connections: 1
server accepts handled requests
3 3 4
Reading: 0 Writing: 1 Waiting: 0
状态页面信息详解：
| 状态码 | 表示的意义 |
|---|---|
| Active connections 2 | 当前所有处于打开状态的连接数 |
| accepts | 总共处理了多少个连接 |
| handled | 成功创建多少握手 |
| requests | 总共处理了多少个请求 |
| Reading | nginx读取到客户端的Header信息数，表示正处于接收请求状态的连接数 |
| Writing | nginx返回给客户端的Header信息数，表示请求已经接收完成，且正处于处理请求或发送响应的过程中的连接数 |
| Waiting | 开启keep-alive的情况下，这个值等于active - (reading + writing)，意思就是Nginx已处理完正在等候下一次请求指令的驻留连接 |
nginx 192.168.29.141
zabbix 192.168.29.140
[root@RS1 ~]# useradd -r -M -s /sbin/nologin zabbix
[root@RS1 ~]# cat /etc/redhat-release
CentOS Stream release 8
[root@RS1 ~]# dnf -y install gcc gcc-c++ make vim
[root@RS1 ~]# cd /usr/src/
[root@RS1 src]# ls
debug kernels zabbix-6.2.2.tar.gz
[root@RS1 src]# tar xf zabbix-6.2.2.tar.gz
[root@RS1 src]# cd zabbix-6.2.2/
[root@RS1 zabbix-6.2.2]# ls
AUTHORS Makefile.am aclocal.m4 conf configure.ac install-sh missing
COPYING Makefile.in bin config.guess database m4 sass
ChangeLog NEWS build config.sub depcomp man src
INSTALL README compile configure include misc ui
[root@RS1 zabbix-6.2.2]# ./configure --enable-agent
......
checking for the linux kernel version... unknown family (4.18.0-257.el8.x86_64)
checking size of void *... 8
configure: using old pcre library by default
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: error: cannot find pkg-config package for libpcre
[root@RS1 zabbix-6.2.2]# dnf -y install pcre-devel openssl openssl-devel
[root@RS1 zabbix-6.2.2]# ./configure --enable-agent
......
***********************************************************
* Now run 'make install' *
* *
* Thank you for using Zabbix! *
* <http://www.zabbix.com> *
***********************************************************
[root@RS1 zabbix-6.2.2]# make install
[root@RS1 zabbix-6.2.2]# cd
[root@RS1 ~]# cd /usr/local/etc/
[root@RS1 etc]# ls
zabbix_agentd.conf zabbix_agentd.conf.d
[root@RS1 etc]# vim zabbix_agentd.conf
Server=192.168.29.140（被动模式）
ServerActive=192.168.29.140（主动模式）
[root@RS1 zabbix-6.2.2]# zabbix_agentd
[root@RS1 zabbix-6.2.2]# ss -anlt |grep 10050
LISTEN 0 128 0.0.0.0:10050 0.0.0.0:*
[root@RS1 ~]# vim /usr/local/nginx/conf/nginx.conf
…………
location = /status {
stub_status;
allow 127.0.0.1;
deny all;
}
…………
[root@RS1 ~]# mkdir /scripts
[root@RS1 ~]# cd /scripts/
[root@RS1 scripts]# vim nginx_status.sh
#!/bin/bash
case $1 in
Reading)
curl -s 127.0.0.1/status |awk "NR==4{print\$2}"
;;
Writing)
curl -s 127.0.0.1/status |awk "NR==4{print\$4}"
;;
Waiting)
curl -s 127.0.0.1/status |awk "NR==4{print\$6}"
;;
*)
exit
;;
esac
[root@RS1 scripts]# chmod +x nginx_status.sh
[root@RS1 scripts]# vim /usr/local/etc/zabbix_agentd.conf
UnsafeUserParameters=1
UserParameter=nginx_status[*],/bin/bash /scripts/nginx_status.sh $1
[root@RS1 scripts]# pkill zabbix_agentd
[root@RS1 scripts]# zabbix_agentd
[root@RS2 ~]# zabbix_get -s 192.168.29.141 -k nginx_status[Writing]
1
