Nginx 安全与调优

朱雀 2023-07-13 10:40 101阅读 0赞

转载自：[https://itgod.org/book/system\_security/\_book/Nginx/][https_itgod.org_book_system_security_book_Nginx]

## 安全策略 ##

**禁止IP直接访问，防止非法域名直接解析到IP上**

# 禁止使用IP直接访问，返回403错误码
        server {
            listen       80 default;
            server_name _;
            return 403;
    }
    #server_name处定义允许访问的域名，将80端口的http请求转发到https
        server {
            listen       80;
            server_name  www.itgod.org itgod.org;
            rewrite ^(.*)$ https://$host$1 permanent;

**在Http中配置autoindex off;关闭目录浏览**

http {
        include       mime.types;
        default_type  application/octet-stream;
        server_tokens off;
        include vhost/*.conf;
        #添加这行
        autoindex off;

*  **只允许referer为空或者referer为信任站点时才能拉取图片**
 *  **允许referer为空是为了允许浏览器直接访问图片路径**
 *  **伪造referer很容易，所以此方法只能防止一般的盗链**

location ~*\.(gif|jpg|png|swf|flv|bmp)$ {
                valid_referers none blocked *.itgod.org itgod.org;
                if ($invalid_referer) {
                    return 403;
                }
            }

**屏蔽Nginx版本号，减低被版本漏洞攻击风险，在HTTP下添加一行内容 `server_tokens off;`**

http {
        include       mime.types;
        default_type  application/octet-stream;
        server_tokens off;

**恶意攻击通常会尝试通过URL执行一些命令，有必要禁用包含一些特殊字符串的链接访问，比如URL中包含.sh old bak sql等关键词，直接进行URL访问限制**

location ~*\.(sh|git|bak|sql|old)$ {
                    return 403;
            }

## 性能优化 ##

**优化链接参数**

<table> 
 <thead> 
  <tr> 
   <th>优化前</th> 
   <th>优化后</th> 
   <th>参数说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>worker_processes 1;</td> 
   <td>worker_processes auto;</td> 
   <td>进程数</td> 
  </tr> 
  <tr> 
   <td>worker_connections 1024;</td> 
   <td>worker_connections 65535;</td> 
   <td>每个进程允许的最多链接</td> 
  </tr> 
 </tbody> 
</table>

**系统内核参数优化**

vim /etc/sysctl.conf

net.ipv4.tcp_max_tw_buckets = 6000
    net.ipv4.tcp_tw_recycle = 1
    net.ipv4.tcp_syncookies = 1

vim /etc/security/limits.conf

**配置Nginx进程数量**

worker_processes  auto;

**配置系统最大句柄数量**

```
    #当前会话生效
    systemctl -w fs.file-max=2000000
    #永久生效
    echo 'fs.file-max=2000000' >> /etc/sysctl.conf
    ```

**查看当前系统打开句柄最大数量(默认为内存的10%，单位KB)**

`more /proc/sys/fs/file-max`
    
    >查看当前已经打开句柄总数
    
    `lsof|awk '{print $2}'|wc -l`
    
    
    >根据打开文件句柄的数量降序排列，其中第二列为进程ID：
    
    `lsof|awk '{print $2}'|sort|uniq -c|sort -nr|more`

**以下不包含图片缓存等配置，可以根据自身业务需求再合理添加图片等缓存、日志格式化等**

worker_processes  auto;
    events {
        worker_connections  65535;
    }
    http {
        include       mime.types;
        default_type  application/octet-stream;
        server_tokens off;
        sendfile        on;
        keepalive_timeout  65;
        server {
            listen       80 default;
        server_name _;
        return 403;
    }
        server {
            listen       80;
            server_name  www.itgod.org itgod.org;
        rewrite ^(.*)$ https://$host$1 permanent;
            error_page   500 502 503 504  /50x.html;
            location = /50x.html {
                root   html;
            }
    }
    
    
        server {
            listen       443 ssl default;
        server_name _;
            server_name  www.itgod.org itgod.org;
            error_page  404              /404.html;
            ssl_certificate      /etc/ssl/1_www.itgod.org_bundle.crt;
            ssl_certificate_key  /etc/ssl/2_www.itgod.org.key;
         ssl_session_cache    shared:SSL:1m;
          ssl_session_timeout  5m;
            ssl_ciphers  HIGH:!aNULL:!MD5;
            ssl_prefer_server_ciphers  on;
            location ~*\.(gif|jpg|png|swf|flv|bmp)$ {
            valid_referers none blocked *.itgod.org itgod.org;
            if ($invalid_referer) {
            return 403;}
            }
            location ~*\.(sh|git|bak|sql|old)$ {
            return 403;
            }
            location / {
                root   html;
                index  index.html index.htm;
            }
            location /first {
                alias   /home/gitbook/_book/;
                index  index.html index.htm;
            }
            location /two {
                alias   /home/gitbook2/_book/;
                index  index.html index.htm;
            }
        }
    }

## 黑名单 ##

**在nginx.conf的http中加入黑名单配置文件：**

`include website/blockip.conf;`

http {
      include       mime.types;
      default_type  application/octet-stream;
      #新增内容
      include website/blockip.conf;

**然后在conf目录下，创建website/blockip.conf**

mkdir /usr/local/nginx/conf/website
    touch /usr/local/nginx/conf/website/blockip.conf

**编辑blockip.conf文件，在blockip.conf中增加需要封禁的ip(将IP更改为需要禁用访问的IP)，我的配置如下:**

[root@nrffnginx-1 website]# pwd
    /usr/local/nginx/conf/website

[root@nrffnginx-1 website]# cat blockip.conf
    deny 42.96.128.0/17;
    deny 42.120.0.0/16;
    deny 42.121.0.0/16;
    deny 42.156.128.0/17;
    deny 110.75.0.0/16;
    deny 110.76.0.0/19;
    deny 110.76.32.0/20;
    deny 110.76.48.0/20;
    deny 110.173.192.0/20;
    deny 110.173.208.0/20;
    ....此处省略

**最后reload nginx即可生效:**

/usr/local/nginx/sbin/nginx -s reload

## 反向代理 ##

**在HTTP下创建代理池**

#新增名为portal_service_poo的代理池，后端有3台服务器的8080端口提供服务
    upstream portal_service_pool {
                    server 10.215.1.1:8080;
                    server 10.215.1.2:8080;
                    server 10.215.1.3:8080;
                    keepalive 8192;
        }
    新增名为aaa_service_poo的代理池，后端有3台服务器的8081端口提供服务
    upstream aaa_service_pool {
                    server 10.215.1.1:8081;
                    server 10.215.1.2:8081;
                    server 10.215.1.3:8081;
                    keepalive 8192;
        }

**在server监听下添加代理转发配置**

server {
            listen 8080;
    
            charset utf-8;     }
    #指定访问IP URL时转发到portal池处理
            location / {
                proxy_pass http://portal_service_pool;
            }
    #指定访问IP:/aaa URL时转发到aaa池处理
            location /aaa{
               proxy_pass http://aaa_service_pool;
            }
        }

**上述配置讲解**

假设Nginx本机地址为192.168.1.1，当用户访问192.168.1.1时，请求转发给了portal\_service\_pool池里的服务器:8080端口处理，

## 规则匹配 ##

= 严格匹配。如果这个查询匹配，那么将停止搜索并立即处理此请求。
    ~ 为区分大小写匹配(可用正则表达式)
    !~为区分大小写不匹配
    ~* 为不区分大小写匹配(可用正则表达式)
    !~*为不区分大小写不匹配
    ^~ 如果把这个前缀用于一个常规字符串,那么告诉nginx 如果路径匹配那么不测试正则表达式。
    
    
    
    location = / {
    # 只匹配 / 查询。
    }
    location / {
    # 匹配任何查询，因为所有请求都已 / 开头。但是正则表达式规则和长的块规则将被优先和查询匹配。
    }
    location ^~ /p_w_picpaths/ {
    # 匹配任何已 /p_w_picpaths/ 开头的任何查询并且停止搜索。任何正则表达式将不会被测试。
    }
    location ~*.(gif|jpg|jpeg)$ {
    # 匹配任何已 gif、jpg 或 jpeg 结尾的请求。
    }
    location ~*.(gif|jpg|swf)$ {
    valid_referers none blocked start.igrow.cn sta.igrow.cn;
    if ($invalid_referer) {
    #防盗链
    rewrite ^/ http://$host/logo.png;
    }
    }

[https_itgod.org_book_system_security_book_Nginx]: https://itgod.org/book/system_security/_book/Nginx/