Nginx-Architecture Chapter

1. Nginx FAQ

1. Multiple virtual hosts with the same server_name have priority access

# 三个配置文件：

# testserver1：
server_name testserver1 www.rona1do.top;
root /opt/app/code1;

# testserver2：
server_name testserver2 www.rona1do.top;
root /opt/app/code2;

# testserver3：
server_name testserver3 www.rona1do.top;
root /opt/app/code3;

Copy after login

Configure the three virtual hosts with the same server_name mentioned above The host will access testserver1 first, and the priority of access is based on the server's reading order, that is, the order of file names.

2. Location matching priority

=: Exact matching of ordinary characters, that is, complete matching
^~ : Indicates ordinary character matching, use prefix matching
##~ ~
: Indicates performing a regular match (adding is not case-sensitive)

The above priorities decrease from top to bottom. The first two matches are exact matches. After matching, they will no longer search downwards. If a regular match matches the corresponding string, they will continue to search downwards to see if there is more. Exact match.

3. Use of Nginx’s try_files

Check whether files exist in order

# 先检查对应的url地址下的文件存不存在，如果不存在找/index.php，类似于重定向
location / {
    try_file $uri /index.php;
}

Copy after login

4. The difference between Nginx’s alias and root

root

location /request_path/image/ {
    root /local_path/image/;
}
# 请求：http://www.rona1do.top/request_path/image/cat.png
# 查询： /local_path/image/request_path_image/cat.png

Copy after login

alias

location /request_path/image/ {
    alias /local_path/image/;
}
# 请求：http://www.rona1do.top/request_path/image/cat.png
# 查询： /local_path/image/cat.png

Copy after login

5. What method is used to pass the user’s real IP address

In the case of a proxy, remote_addr obtains the proxy's IP, not the user's IP
x-forwarded-for is easily tampered with

General solution: You can negotiate with the first-level agent and set the header information x_real_ip to record the user’s ip
set x_real_ip=$remote_addr

6. Common error codes in Nginx

413: request entity too large

User upload File limit: client_max_body_size

1. Performance optimization considerations

Current system structure bottleneck

Installation

-n: Total number of requests
-c: Number of concurrent requests
-k : Whether to enable long connections

File handle

- 系统全局性修改、用户局部性修改、进程局部性修改

Copy after login

System global modification And user locality modification:

Configuration file:

/etc/security/limits.conf

# root：root用户
root soft nofile 65535
# hard 强制限制、soft 超过会发送提醒（邮件等），不限制
root hard nofile 65535
# *：所有用户
*     soft nofile 65535
*     hard nofile 65535

Copy after login

Process locality modification

Configuration File:

/etc/nginx/nginx.conf
# 针对nginx进程进行设置
worker_rlimit_nofile 35535;
Copy after login
4. CPU affinity

CPU affinity:

Place the process /The most intuitive benefit of binding threads to the CPU is to increase the hit rate of the CPU cache, thereby reducing memory access losses and increasing program speed.

Number of physical CPUs:

CPU core:
Core and process usage: press
1
<div class="code" style="position:relative; padding:0px; margin:0px;"><pre class="brush:php;toolbar:false;"># /etc/nginx/nginx.conf # nginx建议数量跟cpu核心数保持一致 worker_processes 2; # 配置cpu亲和 worker_cpu_affinity 0000000000000001 0000000000000010 # 与上一行等价，自动对应（Nginx1.9版本以上） worker_cpu_affinity auto</pre><div class="contentsignin">Copy after login</div></div>
to view the cpu binding status of Nginx:

ps -eo pid, args,psr | grep [n]ginx
5. Nginx general configuration optimization<div class="code" style="position:relative; padding:0px; margin:0px;"><pre class="brush:php;toolbar:false;"># nginx服务使用nginx用户（最好不要使用root用户） user nginx; # cpu亲和（最好跟核心数保持一致） worker_processes 2; worker_cpu_affinity auto; # error的日志级别设置为warn error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; # 文件句柄对于进程间的限制（建议1w以上） worker_rlimit_nofile 35535; # 事件驱动器 events { use epoll; # 限制每一个worker_processes进程可以处理多少个连接 worker_connections 10240; } http { include /etc/nginx/mime.types; default_type application/octet-stream; #字符集（服务端响应发送的报文字符集） charset utf-8; log_format main &#39;$remote_addr - $remote_user [$time_local] "$request" &#39; &#39;$status $body_bytes_sent "$http_referer" &#39; &#39;"$http_user_agent" "$http_x_forwarded_for"&#39;; access_log /var/log/nginx/access.log main; # 静态资源的处理 sendfile on; #tcp_nopush on; keepalive_timeout 65; # gzip压缩（对于IE6或以下版本对于gzip压缩支持不是很好） gzip on; # IE6或以下不进行压缩（兼容） gzip_disable "MSIE [1-6]\."; gzip_http_version 1.1; include /etc/nginx/conf.d/*.conf; }</pre><div class="contentsignin">Copy after login</div></div>3. Nginx security

1. Common malicious behaviors

Crawling behavior and malicious grabbing and resource theft

Basic anti-leeching function prevents malicious users from easily crawling external data of the website

secure_link_module, improves encryption verification and effectiveness of data security, suitable for core important data
acces_module, serves the backend and some users Data provides IP prevention and control

2. 常见的攻击手段

后台密码撞库，通过猜测密码字典不断对后台系统尝试性登录，获取后台登录密码

后台登录密码复杂度
access_module，对后台提供IP防控
预警机制（一个IP在一段时间内重复不断请求等）

3. 文件上传漏洞

利用一些可以上传的接口将恶意代码植入到服务器中，再通过url去访问以执行代码

例：http://www.rona1do.top/upload...（Nginx将1.jpg作为php代码执行）

# 文件上传漏洞解决办法
location ^~ /upload {
    root /opt/app/images;
    if ($request_file ~* (.*)\.php){
        return 403;
    }
}

Copy after login

4. SQL注入

利用未过滤/未审核用户输入的攻击方法，让应用运行本不应该运行的SQL代码

Nginx+LUA配置WAF防火墙防止SQL注入

About Nginx architecture

ngx_lua_waf 下载地址

使用waf步骤：

git clone https://github.com/loveshell/ngx_lua_waf.git
cd ngx_lua_waf
mv ngx_lua_waf /etc/nginx/waf
vim /etc/nginx/waf/conf.lua，修改RulePath为对应路径（/etc/nginx/waf/wafconf）
vim /etc/nginx/waf/wafconf/post，加入一行，\sor\s+，放sql注入的正则
集成waf：

# /etc/nginx/nginx.conf
lua_package_path "/etc/nginx/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file /etc/nginx/waf/init.lua;
access_by_lua_file /etc/nginx/waf/waf.lua

Copy after login