


How to implement access control and connection restrictions based on Nginx
1. Default configuration syntax
user 设置使用用户 worker_processes 进行增大并发连接数的处理 跟cpu保持一致 八核设置八个 error_log nginx的错误日志 pid nginx服务启动时候pid1.2 event module for events
worker_connections一个进程允许处理的最大连接数 use定义使用的内核模型1.3 server
root 首页的路径 index 首页默认访问哪个页面 error_page 500 502 503 504 /50x.html 错误页面 前面的500是**`http状态码`** systemctl restart nginx.service 重启nginx systemctl reload nginx.service 不关闭服务柔和地重启
2. http
curl-v http://www.baidu.com >/dev/null #-v 同时显示状态码等信息 nginx -v #显示nginx版本及配置文件等信息
3. Log
Log type: error.log and access.logerror.log(记录处理http请求的错误状态以及nginx本身服务的错误状态) access.log(每次http请求的访问状态)log_format: Sets the recording format of the log and defines the style in which the log is recorded in error.log and access.log. The configuration of log_format can only Configured in the http module. access_log is configured in http.
4. Variables
#Connection limit limit_conn_module
limit_conn_module: Tcp connection frequency limit, one TCP connection can establish multiple http requests.
Configuration syntax:
Range | Description | |
---|---|---|
http | Used to declare a storage space | |
http, server or location | Used to limit the number of concurrencies of a certain storage space | |
http, server or location | When the maximum number of connection limits is reached, the level of the log is recorded | |
http, server Or location | When the limit is exceeded, the response status code returned, the default is 503 |
space to record the connection status , to limit the quantity.
zone is a space that stores connection status, stored in key-value pairs, usually using the client address
$binary_remote_addr as
key to identify each connection.
When
zone space is exhausted, the server will return
503 (service temporarily unavailable) error to all subsequent requests.
Request limit limit_req_mudule
##limit_req_mudule:http
Request frequency limit, one tcp
connection can Create multiple http
requests. Configuration syntax:
Range | Description | |
---|---|---|
http | Used to declare a storage space | |
http, server or location | Used to limit the number of concurrencies of a certain storage space |
http_access_module语法 | 范围 | 说明 |
---|---|---|
allow ip地址 | cidr网段 | unix: | all; | http、server、location和limit_except | 允许ip地址、cidr格式的网段、unix套接字或所有来源访问 |
deny ip地址 | cidr网段 | unix: | all; | http、server、location和limit_except | 禁止ip地址、cidr格式的网段、unix套接字或所有来源访问 |
allow和deny会按照顺序, 从上往下, 找到第一个匹配规则, 判断是否允许访问, 所以一般把all
放最后
location / { deny 192.168.1.1; allow 192.168.1.0/24; allow 10.1.1.0/16; allow 2001:0db8::/32; deny all; }
基于用户密码的访问控制
ht
tp_auth_basic_module: 基于文件匹配用户密码的登录
http_auth_basic_module语法 | 范围 | 说明 |
---|---|---|
auth_basic 请输入你的帐号密码 | off; | http、server、location和limit_except | 显示用户登录提示 (有些浏览器不显示提示) |
auth_basic_user_file 存储帐号密码的文件路径; | http、server、location和limit_except | 从文件中匹配帐号密码 |
密码文件可以通过htpasswd
生成,htpasswd
需要安装yum install -y httpd-tools
。
# -c 创建新文件, -b在参数中直接输入密码 $ htpasswd -bc /etc/nginx/conf.d/passwd user1 pw1 adding password for user user1 $ htpasswd -b /etc/nginx/conf.d/passwd user2 pw2 adding password for user user2 $ cat /etc/nginx/conf.d/passwd user1:$apr1$7v/m0.if$2kpm9nvvxbav.jsuvuqr01 user2:$apr1$xmoo4zzy$df76u0gzxbd7.5vxe0use0
The above is the detailed content of How to implement access control and connection restrictions based on Nginx. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

NGINX is more suitable for handling high concurrent connections, while Apache is more suitable for scenarios where complex configurations and module extensions are required. 1.NGINX is known for its high performance and low resource consumption, and is suitable for high concurrency. 2.Apache is known for its stability and rich module extensions, which are suitable for complex configuration needs.

PHP code can be executed in many ways: 1. Use the command line to directly enter the "php file name" to execute the script; 2. Put the file into the document root directory and access it through the browser through the web server; 3. Run it in the IDE and use the built-in debugging tool; 4. Use the online PHP sandbox or code execution platform for testing.

NGINX and Apache each have their own advantages and disadvantages, and the choice should be based on specific needs. 1.NGINX is suitable for high concurrency scenarios because of its asynchronous non-blocking architecture. 2. Apache is suitable for low-concurrency scenarios that require complex configurations, because of its modular design.

Understanding Nginx's configuration file path and initial settings is very important because it is the first step in optimizing and managing a web server. 1) The configuration file path is usually /etc/nginx/nginx.conf. The syntax can be found and tested using the nginx-t command. 2) The initial settings include global settings (such as user, worker_processes) and HTTP settings (such as include, log_format). These settings allow customization and extension according to requirements. Incorrect configuration may lead to performance issues and security vulnerabilities.

Linux system restricts user resources through the ulimit command to prevent excessive use of resources. 1.ulimit is a built-in shell command that can limit the number of file descriptors (-n), memory size (-v), thread count (-u), etc., which are divided into soft limit (current effective value) and hard limit (maximum upper limit). 2. Use the ulimit command directly for temporary modification, such as ulimit-n2048, but it is only valid for the current session. 3. For permanent effect, you need to modify /etc/security/limits.conf and PAM configuration files, and add sessionrequiredpam_limits.so. 4. The systemd service needs to set Lim in the unit file

When configuring Nginx on Debian system, the following are some practical tips: The basic structure of the configuration file global settings: Define behavioral parameters that affect the entire Nginx service, such as the number of worker threads and the permissions of running users. Event handling part: Deciding how Nginx deals with network connections is a key configuration for improving performance. HTTP service part: contains a large number of settings related to HTTP service, and can embed multiple servers and location blocks. Core configuration options worker_connections: Define the maximum number of connections that each worker thread can handle, usually set to 1024. multi_accept: Activate the multi-connection reception mode and enhance the ability of concurrent processing. s

NGINXserveswebcontentandactsasareverseproxy,loadbalancer,andmore.1)ItefficientlyservesstaticcontentlikeHTMLandimages.2)Itfunctionsasareverseproxyandloadbalancer,distributingtrafficacrossservers.3)NGINXenhancesperformancethroughcaching.4)Itofferssecur

Diagnosis and solutions for common errors of Nginx include: 1. View log files, 2. Adjust configuration files, 3. Optimize performance. By analyzing logs, adjusting timeout settings and optimizing cache and load balancing, errors such as 404, 502, 504 can be effectively resolved to improve website stability and performance.
