目录
WEB相关工具
范例：http协议常见状态码
1xx：100-101 信息提示
200 成功
301、302 重定向
403 请求被禁止，权限错误或文件不存在
404 资源不存在
5xx：500-505 服务器端错误
范例：wget下载
##-q 静默模式
##-c 断点续传
##-P /path 保存在指定目录
##-O filename 保存为指定文件名，与-P同时使用会报错，可以-O /path/filename
##--limit-rate= 指定传输速率，单位K，M等
[root@anolis-32 ~]$wget -O 'nginx-1.24.0.tar.gz' --limit-rate 1M 'https://nginx.org/download/nginx-1.24.0.tar.gz'
范例：curl获取响应码和ip
##获取响应码
[root@rocky-41 ~]$curl -s -I -m10 -o /dev/null -w %{http_code} 10.0.0.31:8080
200
##获取远程、本地ip
[root@rocky-41 ~]$curl -s -I -m10 -o /dev/null -w %{remote_ip} www.baidu.com
183.2.172.185
[root@rocky-41 ~]$curl -s -I -m10 -o /dev/null -w %{local_ip} www.baidu.com
10.0.0.41
Nginx安装与平滑升级回滚
Nginx 分为社区版和商业版
版本分类：
Mainline version 主要开发版本,一般为奇数版本号,比如1.19
Stable version 当前最新稳定版,一般为偶数版本,如:1.20
Legacy versions 旧的稳定版,一般为偶数版本,如:1.18
社区版官网：
http://nginx.org/en/download.html
范例：Nginx编译安装
##Nginx由C语言编写，需要安装编译器gcc等
#!/bin/bash
set -o nounset
set -o errexit
NGINX_FILE=nginx-1.24.0.tar.gz
LOCAL_DIR=/usr/local
NGINX_INSTALL_DIR=/usr/local/nginx
SRC_DIR=/root
CPUS=`lscpu |awk '/^CPU\(s\)/{print $2}'`
. /etc/os-release
check () {
if ! [ -f "${SRC_DIR}/${NGINX_FILE}" ];then
echo "${NGINX_FILE} 文件不存在"
exit;
elif [ -d ${LOCAL_DIR}/nginx ];then
echo "nginx 已经安装"
exit
else
[ -d "$LOCAL_DIR" ] || mkdir -pv $LOCAL_DIR
fi
}
install () {
if id nginx &> /dev/null;then
echo "nginx 用户已存在"
else
useradd -s /sbin/nologin -r nginx
echo "创建 nginx 用户"
fi
echo "开始安装 nginx 依赖包"
yum -y install make gcc-c++ libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel perl-ExtUtils-Embed
[ $? -ne 0 ] && { echo "安装依赖包失败" ; exit; }
cd $SRC_DIR
tar xf ${NGINX_FILE}
NGINX_DIR=`echo ${NGINX_FILE}| sed -nr 's/^(.*[0-9]).*/\1/p'`
cd ${NGINX_DIR}
./configure --prefix=${NGINX_INSTALL_DIR} --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
make -j $CPUS && make install
[ $? -eq 0 ] && echo "nginx 编译安装成功" || { echo "nginx 编译安装失败,退出!" ;exit; }
chown -R nginx.nginx ${NGINX_INSTALL_DIR}
ln -s ${NGINX_INSTALL_DIR}/sbin/nginx /usr/local/sbin/nginx
echo "PATH=${NGINX_INSTALL_DIR}/sbin:${PATH}" > /etc/profile.d/nginx.sh
cat > /lib/systemd/system/nginx.service <<EOF
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
PIDFile=${NGINX_INSTALL_DIR}/logs/nginx.pid
ExecStartPre=/bin/rm -f ${NGINX_INSTALL_DIR}/logs/nginx.pid
ExecStartPre=${NGINX_INSTALL_DIR}/sbin/nginx -t
ExecStart=${NGINX_INSTALL_DIR}/sbin/nginx
ExecReload=/bin/kill -s HUP \$MAINPID
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=process
PrivateTmp=true
LimitNOFILE=100000
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now nginx &> /dev/null
systemctl is-active nginx &> /dev/null || { echo "nginx 启动失败,退出!" ; exit; }
echo "nginx 安装完成"
}
check
install
##常用功能，-h查看帮助
##-t，检查配置文件
##-s发送信号，nginx -s reload，一般修改完文件-t后-s reload
[root@rocky-41 ~]$nginx -h
nginx version: nginx/1.24.0
Usage: nginx [-?hvVtTq] [-s signal] [-p prefix]
[-e filename] [-c filename] [-g directives]
Options:
-?,-h : this help
-v : show version and exit
-V : show version and configure options then exit
-t : test configuration and exit
-T : test configuration, dump it and exit
-q : suppress non-error messages during configuration testing
-s signal : send signal to a master process: stop, quit, reopen, reload
-p prefix : set prefix path (default: /usr/local/nginx/)
-e filename : set error log file (default: logs/error.log)
-c filename : set configuration file (default: conf/nginx.conf)
-g directives : set global directives out of configuration file
范例：nginx平滑升级
##四个阶段
##旧版处理--新旧并存，旧版处理--新旧并存，新版处理--旧版退出，只有新版
##目标，目前运行nginx-1.24.0，更新为nginx-1.26.1
##-V，大V选项查看旧版本的详细信息，需要使用相同的编译参数configure arguments
[root@rocky-41 ~]$nginx -V
nginx version: nginx/1.24.0
built by gcc 8.5.0 20210514 (Red Hat 8.5.0-22) (GCC)
built with OpenSSL 1.1.1k FIPS 25 Mar 2021
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
##编译新版本，使用旧版的参数
[root@rocky-41 ~]$tar xf nginx-1.26.1.tar.gz
[root@rocky-41 ~]$cd nginx-1.26.1/
[root@rocky-41 nginx-1.26.1]$./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
##只执行make，不执行make install（即不生成目录，手动处理目录）
[root@rocky-41 nginx-1.26.1]$make
[root@rocky-41 nginx-1.26.1]$objs/nginx -v
nginx version: nginx/1.26.1
##对比两个版本
[root@rocky-41 nginx-1.26.1]$objs/nginx -v ; /usr/local/nginx/sbin/nginx -v
nginx version: nginx/1.26.1
nginx version: nginx/1.24.0
##备份旧版本后，强制覆盖
[root@rocky-41 nginx-1.26.1]$cp /usr/local/nginx/sbin/nginx /opt/nginx-1.24.0
[root@rocky-41 nginx-1.26.1]$cp objs/nginx /usr/local/nginx/sbin/nginx -f
##检测新版本和配置文件语法兼容性
[root@rocky-41 nginx-1.26.1]$/usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
##发送信号USR2，将旧版进程重命名为nginx.pid.oldbin，并开启新版进程
##新旧并存，旧版处理阶段
##执行前后查看进程变化
[root@rocky-41 ~]$ps -auxf | grep 'nginx'
root 37153 0.0 0.0 222012 1212 pts/3 S+ 15:59 0:00 \_ grep --color=auto nginx
root 33711 0.0 0.0 26876 848 ? Ss 14:30 0:00 nginx: master process /usr/local/nginx/sbin/nginx
nginx 33712 0.0 0.2 47684 4764 ? S 14:30 0:00 \_ nginx: worker process
[root@rocky-41 ~]$kill -USR2 `cat /usr/local/nginx/logs/nginx.pid`
[root@rocky-41 ~]$ps -auxf | grep 'nginx'
root 37158 0.0 0.0 222012 1120 pts/3 S+ 15:59 0:00 \_ grep --color=auto nginx
root 33711 0.0 0.1 26876 2748 ? Ss 14:30 0:00 nginx: master process /usr/local/nginx/sbin/nginx
nginx 33712 0.0 0.2 47684 4764 ? S 14:30 0:00 \_ nginx: worker process
root 37155 0.0 0.3 26888 6072 ? S 15:59 0:00 \_ nginx: master process /usr/local/nginx/sbin/nginx
nginx 37156 0.0 0.2 47696 4832 ? S 15:59 0:00 \_ nginx: worker process
##新旧并存，新版处理阶段：旧版worker进程退出，新请求由新版worker进程处理
##旧版worker进程会处理完用户请求才关闭，即平滑关闭
[root@rocky-41 ~]$kill -WINCH `cat /usr/local/nginx/logs/nginx.pid.oldbin`
[root@rocky-41 ~]$ps -auxf | grep 'nginx'
root 37195 0.0 0.0 222012 1112 pts/3 S+ 16:03 0:00 \_ grep --color=auto nginx
root 33711 0.0 0.1 26876 2748 ? Ss 14:30 0:00 nginx: master process /usr/local/nginx/sbin/nginx
root 37155 0.0 0.3 26888 6072 ? S 15:59 0:00 \_ nginx: master process /usr/local/nginx/sbin/nginx
nginx 37156 0.0 0.2 47696 4832 ? S 15:59 0:00 \_ nginx: worker process
#########################################################
##虚拟机做快照，后续可以进行回滚操作
##先经过一段时间测试，新版没问题后，删除旧版，实现升级
[root@rocky-41 ~]$kill -QUIT `cat /usr/local/nginx/logs/nginx.pid.oldbin`
[root@rocky-41 ~]$ps -auxf | grep 'nginx'
root 37201 0.0 0.0 222012 1208 pts/3 S+ 16:18 0:00 \_ grep --color=auto nginx
root 37155 0.0 0.3 26888 6072 ? S 15:59 0:00 nginx: master process /usr/local/nginx/sbin/nginx
nginx 37156 0.0 0.2 47696 4832 ? S 15:59 0:00 \_ nginx: worker process
##########################################################
##回滚操作，-hup拉起旧版worker，-quit关闭新版
[root@rocky-41 ~]$kill -HUP `cat /usr/local/nginx/logs/nginx.pid.oldbin`
[root@rocky-41 ~]$ps -auxf | grep nginx
root 37239 0.0 0.0 222012 1116 pts/4 S+ 16:08 0:00 \_ grep --color=auto nginx
root 33711 0.0 0.1 26876 2748 ? Ss 14:30 0:00 nginx: master process /usr/local/nginx/sbin/nginx
root 37155 0.0 0.3 26888 6072 ? S 15:59 0:00 \_ nginx: master process /usr/local/nginx/sbin/nginx
nginx 37156 0.0 0.2 47696 4832 ? S 15:59 0:00 | \_ nginx: worker process
nginx 37237 0.0 0.2 47684 4760 ? S 16:08 0:00 \_ nginx: worker process
[root@rocky-41 ~]$kill -QUIT `cat /usr/local/nginx/logs/nginx.pid`
[root@rocky-41 ~]$ps -auxf | grep nginx
root 37243 0.0 0.0 222012 1184 pts/4 S+ 16:11 0:00 \_ grep --color=auto nginx
root 33711 0.0 0.1 26876 2748 ? Ss 14:30 0:00 nginx: master process /usr/local/nginx/sbin/nginx
nginx 37237 0.0 0.2 47684 4760 ? S 16:08 0:00 \_ nginx: worker process
##恢复旧版程序
[root@rocky-41 ~]$mv /opt/nginx-1.24.0 /usr/local/nginx/sbin/nginx
mv: overwrite '/usr/local/nginx/sbin/nginx'? y
[root@rocky-41 ~]$nginx -v
nginx version: nginx/1.24.0
Nginx核心模块
nginx常用配置文件说明
主配置文件：nginx.conf
子配置文件: include conf.d/*.conf
##默认内容如下
##main主配置（全局配置）和http同级，events时间驱动配置，http可有多个server
[root@rocky-41 conf]$grep -v ' *#\|^$' nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name localhost;
location / {
root html;
index index.html index.htm;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}
范例：全局配置说明
##启动Nginx工作进程的用户和组
user nginx nginx;
##启动Nginx工作进程的数量，worker数量，采用auto和cpu核心数相同，绑定工作进程到CPU
worker_processes auto;
worker_cpu_affinity auto;
###日志记录配置级别 [debug | info | notice | warn | error | crit | alert | emerg]
##工作进程优先级，可设置较低则优先高（-20~19）
##worker_priority 0;
##worker进程打开的文件数量上限，默认不限制，但和系统设置也有关ulimit -n查看系统当前设置
##worker_rlimit_nofile 65536;
events {
##设置单个工作进程的最大并发连接数，默认512
worker_connections 65536;
##使用epoll的I/O多路复用技术
use epoll;
##同一时刻一个请求轮流由worker进程处理,而防止被同时唤醒所有worker
accept_mutex on;
###on时Nginx服务器的每个工作进程可以同时接受多个新的网络连接
multi_accept on;
}
范例：使用ab进行压力测试
##默认进程打开的文件数量上限很小，导致测试时报错
##-c 5000表示使用5000个并发连接进行测试
##-n 10000表示总共发起10000个请求
[root@rocky-41 ~]$ulimit -n 1024
[root@rocky-41 ~]$ab -c 5000 -n 10000 http://10.0.0.41/
This is ApacheBench, Version 2.3 <$Revision: 1843412 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 10.0.0.41 (be patient)
socket: Too many open files (24)
##修改文件数量上限后测试，失败请求过多，修改并发连接，发现本机800个并发时不会有请求失败
[root@rocky-41 ~]$ulimit -n 102400
[root@rocky-41 ~]$ab -c 5000 -n 10000 http://10.0.0.41/ | grep "Failed requests"
Completed 1000 requests
Completed 2000 requests
Completed 3000 requests
Completed 4000 requests
Completed 5000 requests
Completed 6000 requests
Completed 7000 requests
Completed 8000 requests
Completed 9000 requests
Completed 10000 requests
Finished 10000 requests
Failed requests: 16252
[root@rocky-41 ~]$ab -c 800 -n 10000 http://10.0.0.41/ | grep "Failed requests"
Completed 1000 requests
Completed 2000 requests
Completed 3000 requests
Completed 4000 requests
Completed 5000 requests
Completed 6000 requests
Completed 7000 requests
Completed 8000 requests
Completed 9000 requests
Completed 10000 requests
Finished 10000 requests
Failed requests: 0
Nginx常见模块
http配置文件说明
http {
#server的公共配置
...
#可有多个server，第一个server为默认虚拟服务器
server {
server_name #虚拟主机名
root #主目录
alias #路径别名
location [OPERATOR] URL { #指定URL的特性
...
if CONDITION {
...
}
}
}
}
范例：新建PC Web站点
##在主配置文件的http模块最后面添加此行，否则前面内容不会生效
##http {
## ......
## include /usr/local/nginx/conf/conf.d/*.conf;
##}
##sed替换最后一行}
[root@rocky-41 conf]$sed -i.bak '/^http {/,/^}/s/^}/ include \/usr\/local\/nginx\/conf\/conf.d\/\*\.conf;\n}/' nginx.conf
##添加目录和配置
[root@rocky-41 conf]$mkdir conf.d
[root@rocky-41 conf]$touch conf.d/pc.conf
[root@rocky-41 conf]$chown -R nginx.nginx conf.d
[root@rocky-41 conf]$cat conf.d/pc.conf
server {
listen 80 default_server;
server_name 10.0.0.41;
root /data/nginx/html/pc;
}
[root@rocky-41 ~]$mkdir -p /data/nginx/html/pc
[root@rocky-41 ~]$chown -R nginx.nginx /data/nginx
[root@rocky-41 ~]$echo "hello pc" >/data/nginx/html/pc/index.html
##测试配置文件，没问题后重新加载，然后访问验证
[root@rocky-41 ~]$nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@rocky-41 ~]$systemctl reload nginx.service
[root@rocky-41 ~]$curl 10.0.0.41
hello pc
范例：创建pc、mobile多站点
##目标：同一个服务器访问pc.wang.org、mobile.wang.org返回不同页面
##新增配置，注意listen 80 default_server;只能有一个default
[root@rocky-41 conf]$cat conf.d/mobile.conf
server {
listen 80;
server_name mobile.wang.org;
root /data/nginx/html/mobile;
}
[root@rocky-41 html]$mkdir mobile
[root@rocky-41 html]$echo "hello moblie" >/data/nginx/html/mobile/index.html
##修改DNS，只修改本机hosts做测试
[root@rocky-41 ~]$cat /etc/hosts | grep 10.0.0.41
10.0.0.41 www.wang.org
10.0.0.41 pc.wang.org
10.0.0.41 mobile.wang.org
##验证配置文件没问题，后重新加载，访问验证
[root@rocky-41 conf]$nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@rocky-41 conf]$systemctl reload nginx.service
[root@rocky-41 ~]$curl www.wang.org
hello pc
[root@rocky-41 ~]$curl pc.wang.org
hello pc
[root@rocky-41 ~]$curl mobile.wang.org
hello moblie
范例：location重定向error返回
##修改配置
[root@rocky-41 conf]$cat conf.d/pc.conf
server {
listen 80 default_server;
server_name pc.wang.org;
root /data/nginx/html/pc;
location / {
index index.html;
}
error_page 404 @error_404;
location @error_404 {
default_type text/html;
charset utf8;
return 200 '无此页面!';
}
}
##检测配置后重启验证
[root@rocky-41 conf]$nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@rocky-41 conf]$systemctl reload nginx.service
[root@rocky-41 ~]$curl www.wang.org/sdfasdf
无此页面!
范例：allow/deny 四层访问控制（IP限制）
##目标：41能访问login的管理页面，其它不允许，后续可以修改allow内网访问，外网不允许访问
##如果能在防火墙设备控制，最好就不要在nginx上配置，可以更好的节约资源
[root@rocky-41 conf]$cat conf.d/pc.conf
server {
listen 80 default_server;
server_name pc.wang.org;
root /data/nginx/html/pc;
location /login {
allow 10.0.0.41;
deny all;
}
}
[root@rocky-41 html]$echo "login admin" >pc/login/index.html
##检测后重启验证
[root@rocky-41 conf]$nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@rocky-41 conf]$systemctl reload nginx.service
##allow的ip返回正确结果
[root@rocky-41 ~]$curl www.wang.org/login/
login admin
##命令访问返回非目标内容，网页访问403
[root@anolis31 ~]$curl www.wang.org/login/
...
范例：try_files页面不存在的跳转
[root@rocky-41 conf]$cat conf.d/pc.conf
server {
listen 80 default_server;
server_name pc.wang.org;
root /data/nginx/html/pc;
try_files $uri $uri.html $uri/index.html /default.html;
}
[root@rocky-41 html]$echo "default" >pc/default.html
##重启后验证
[root@rocky-41 ~]$curl www.wang.org/abc/abc
default
范例：nginx_status状态页
##增加stub_status状态页，只允许内网访问
[root@rocky-41 conf.d]$cat pc.conf
server {
listen 80 default_server;
server_name pc.wang.org;
root /data/nginx/html/pc;
location /nginx_status {
stub_status;
allow 10.0.0.0/24;
deny all;
}
}
##根据状态页，后续可以进行所需数据收集，还可以用监控查看数据
[root@rocky-41 ~]$curl -s http://www.wang.org/nginx_status |sed -n '/Waiting/p'
Reading: 0 Writing: 1 Waiting: 0
Https加密,rewrite模块
##客户端访问某个web端的https地址，一般都是443端口
server {
listen 80;
##启用网站http2协议和ssl加密
listen 443 ssl http2;
server_name www.wang.org;
##公钥文件
ssl_certificate /usr/local/nginx/certs/www.wang.org.pem;
##私钥文件
ssl_certificate_key /usr/local/nginx/certs/www.wang.org.key;
##在各worker之间使用一个共享的缓存，1M可以存储4000个会话信息
ssl_session_cache shared:sslcache:20m;
##缓存的有效时长，默认5分钟
ssl_session_timeout 10m;
}
Nginx 利用 ngx_http_rewrite_module 模块解析和处理rewrite请求，此功能依靠 PCRE(perl compatible regular expression)，因此编译之前要安装PCRE库
范例：http使用return跳转https
server {
listen 80 ;
listen 443 ssl http2;
ssl_certificate /usr/local/nginx/ssl/www.wang.org.crt;
ssl_certificate_key /usr/local/nginx/ssl/www.wang.org.key;
ssl_session_cache shared:sslcache:20m;
ssl_session_timeout 10m;
server_name www.wang.org;
root /data/nginx/html/pc;
if ($scheme = http) {
return https://$server_name$request_uri;
}
}
范例：网站维护跳转
server {
listen 80 default_server;
server_name www.wang.org;
root /data/nginx/html/pc;
index index.html;
#########################################################
##升级专用内容，升级完可都注释
#在server层下设定ip变量值为0
set $ip 0;
#如果来源IP是10.0.0.41，内网用户可以访问，则设定变量为ip变量为1。
if ($remote_addr = 10.0.0.41) {
set $ip 1;
}
#其它用户，则跳转到默认页
if ($ip = 0) {
rewrite ^(.*)$ /default.html break;
}
#########################################################
}
范例：Nginx防盗链
##防盗链基于客户端携带的referer实现， referer是记录打开一个页面之前记录是从哪个页面跳转过来的标记信息
server {
##定义有效referer，none：如直接在浏览器输入；blocked：空；server_names本主机名；*.wang.org域名；.google或.baidu搜索引擎过来的
valid_referers none blocked server_names *.wang.org ~\.google\. ~\.baidu\.;
##其它无效referer返回403
if ($invalid_referer) {
return 403 "Forbidden Access" ;
}
}