Home Operation and Maintenance Nginx How to implement access control and connection restrictions based on Nginx

How to implement access control and connection restrictions based on Nginx

May 14, 2023 pm 06:46 PM
nginx

1. Default configuration syntax

How to implement access control and connection restrictions based on Nginx

##nginx.conf as the main configuration file

include /etc/nginx/conf. When d/*.conf is read, the .conf of the directory will also be read in.

1.1 Global and service level

user 设置使用用户
worker_processes 进行增大并发连接数的处理 跟cpu保持一致 八核设置八个
error_log nginx的错误日志
pid nginx服务启动时候pid

1.2 event module for events

worker_connections一个进程允许处理的最大连接数
use定义使用的内核模型

1.3 server

root 首页的路径
index 首页默认访问哪个页面
error_page 500 502 503 504 /50x.html 错误页面 前面的500是**`http状态码`**
systemctl restart nginx.service 重启nginx
systemctl reload nginx.service 不关闭服务柔和地重启

2. http

How to implement access control and connection restrictions based on Nginx

curl-v http://www.baidu.com >/dev/null #-v 同时显示状态码等信息
nginx -v #显示nginx版本及配置文件等信息

3. Log

Log type: error.log and access.log

error.log(记录处理http请求的错误状态以及nginx本身服务的错误状态)
access.log(每次http请求的访问状态)

log_format: Sets the recording format of the log and defines the style in which the log is recorded in error.log and access.log. The configuration of log_format can only Configured in the http module.

access_log is configured in http.

4. Variables

How to implement access control and connection restrictions based on Nginx

#Connection limit limit_conn_module

limit_conn_module: Tcp connection frequency limit, one TCP connection can establish multiple http requests. Configuration syntax:

limit_conn_module syntaxRangeDescriptionlimit_conn_zone identification zone=space name:space size;httpUsed to declare a storage spacelimit_conn space name concurrency Limit number;http, server or locationUsed to limit the number of concurrencies of a certain storage spacelimit_conn_log_level log level;http, server or locationWhen the maximum number of connection limits is reached, the level of the log is recordedlimit_conn_status status code;http, server Or locationWhen the limit is exceeded, the response status code returned, the default is 503limit_conn_zone will declare a
zone space to record the connection status , to limit the quantity.

zone is a space that stores connection status, stored in key-value pairs, usually using the client address $binary_remote_addr as key to identify each connection. When
zone space is exhausted, the server will return 503 (service temporarily unavailable) error to all subsequent requests.

Request limit limit_req_mudule

##limit_req_mudule

:httpRequest frequency limit, one tcp connection can Create multiple http requests. Configuration syntax:

limit_req_mudule syntaxlimit_req_zone key zone=space name:space size rate=number of requests per second;limit_req zone=space name [burst=number of queues] [nodelay];
RangeDescription
httpUsed to declare a storage space
http, server or locationUsed to limit the number of concurrencies of a certain storage space
##

这里的zone也是用来存储连接的一个空间。

burst 和 nodelay

burstnodelay对并发请求设置了一个缓冲区和是否延迟处理的策略。
先假设有如下zone配置。

http {
 limit_req_zone $binan_remote_addr zone=req_zone:1m rate=10r/s;
}

情况 1:limit_req zone=req_zone;

  • 1秒发送10个请求, 正常响应。

  • 1秒发送13个请求, 前10个请求正常响应, 后3个请求返回503(service temporarily unavailable)

不加brustnodelay的情况下,rate=10r/s每秒只能执行10次请求, 多的直接返回503错误。

情况 2:limit_req zone=req_zone brust=5;

  • 1秒发送10个请求, 正常响应。

  • 1秒发送13个请求, 前10个请求正常响应, 后3个请求放入brust等待响应。

  • 1秒发送20个请求, 前10个请求正常响应, 后5个请求放入brust等待响应, 最后5个请求返回503(service temporarily unavailable), 第2秒执行brust中的5个请求。

  • 1秒发送20个请求, 前10个请求正常响应, 后5个请求放入brust等待响应, 最后5个请求返回503(service temporarily unavailable), 第2秒发送6个请求, 执行brust中的5个请求, 将5个请求放入brust等待响应, 剩下的1个请求返回503(service temporarily unavailable)

brust=5不加nodelay的情况下, 有一个容量为5的缓冲区,rate=10r/s每秒只能执行10次请求, 多的放到缓冲区中, 如果缓冲区满了, 就直接返回503错误。而缓冲区在下一个时间段会取出请求进行响应, 如果还有请求进来, 则继续放缓冲区, 多的就返回503错误。

情况 3:limit_req zone=req_zone brust=5 nodelay;

  • 1秒发送10个请求, 正常响应。

  • 1秒发送13个请求,13个请求正常响应。

  • 1秒发送20个请求, 前15个请求正常响应, 后5个请求返回503(service temporarily unavailable)

  • 1秒发送20个请求, 前15个请求正常响应, 后5个请求返回503(service temporarily unavailable), 第2秒发送6个请求, 正常响应。

brust=5nodelay的情况下, 有一个容量为5的缓冲区,rate=10r/s每秒能执行15次请求,15=10+5。多的直接返回503错误。

基于 ip 的访问控制

http_access_module: 基于ip的访问控制, 通过代理可以绕过限制, 防君子不防小人。


http_access_module语法范围说明
allow ip地址 | cidr网段 | unix: | all;http、server、location和limit_except允许ip地址、cidr格式的网段、unix套接字或所有来源访问
deny ip地址 | cidr网段 | unix: | all;http、server、location和limit_except禁止ip地址、cidr格式的网段、unix套接字或所有来源访问

allow和deny会按照顺序, 从上往下, 找到第一个匹配规则, 判断是否允许访问, 所以一般把all放最后

location / {
 deny 192.168.1.1;
 allow 192.168.1.0/24;
 allow 10.1.1.0/16;
 allow 2001:0db8::/32;
 deny all;
}

基于用户密码的访问控制

http_auth_basic_module: 基于文件匹配用户密码的登录

http_auth_basic_module语法范围说明
auth_basic 请输入你的帐号密码 | off;http、server、location和limit_except显示用户登录提示 (有些浏览器不显示提示)
auth_basic_user_file 存储帐号密码的文件路径;http、server、location和limit_except从文件中匹配帐号密码

密码文件可以通过htpasswd生成,htpasswd需要安装yum install -y httpd-tools

# -c 创建新文件, -b在参数中直接输入密码
$ htpasswd -bc /etc/nginx/conf.d/passwd user1 pw1
adding password for user user1
$ htpasswd -b /etc/nginx/conf.d/passwd user2 pw2
adding password for user user2
$ cat /etc/nginx/conf.d/passwd 
user1:$apr1$7v/m0.if$2kpm9nvvxbav.jsuvuqr01
user2:$apr1$xmoo4zzy$df76u0gzxbd7.5vxe0use0

The above is the detailed content of How to implement access control and connection restrictions based on Nginx. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

PHP Tutorial
1505
276
NGINX vs. Apache: A Comparative Analysis of Web Servers NGINX vs. Apache: A Comparative Analysis of Web Servers Apr 21, 2025 am 12:08 AM

NGINX is more suitable for handling high concurrent connections, while Apache is more suitable for scenarios where complex configurations and module extensions are required. 1.NGINX is known for its high performance and low resource consumption, and is suitable for high concurrency. 2.Apache is known for its stability and rich module extensions, which are suitable for complex configuration needs.

How to execute php code after writing php code? Several common ways to execute php code How to execute php code after writing php code? Several common ways to execute php code May 23, 2025 pm 08:33 PM

PHP code can be executed in many ways: 1. Use the command line to directly enter the "php file name" to execute the script; 2. Put the file into the document root directory and access it through the browser through the web server; 3. Run it in the IDE and use the built-in debugging tool; 4. Use the online PHP sandbox or code execution platform for testing.

NGINX and Apache: Understanding the Key Differences NGINX and Apache: Understanding the Key Differences Apr 26, 2025 am 12:01 AM

NGINX and Apache each have their own advantages and disadvantages, and the choice should be based on specific needs. 1.NGINX is suitable for high concurrency scenarios because of its asynchronous non-blocking architecture. 2. Apache is suitable for low-concurrency scenarios that require complex configurations, because of its modular design.

After installing Nginx, the configuration file path and initial settings After installing Nginx, the configuration file path and initial settings May 16, 2025 pm 10:54 PM

Understanding Nginx's configuration file path and initial settings is very important because it is the first step in optimizing and managing a web server. 1) The configuration file path is usually /etc/nginx/nginx.conf. The syntax can be found and tested using the nginx-t command. 2) The initial settings include global settings (such as user, worker_processes) and HTTP settings (such as include, log_format). These settings allow customization and extension according to requirements. Incorrect configuration may lead to performance issues and security vulnerabilities.

How to limit user resources in Linux? How to configure ulimit? How to limit user resources in Linux? How to configure ulimit? May 29, 2025 pm 11:09 PM

Linux system restricts user resources through the ulimit command to prevent excessive use of resources. 1.ulimit is a built-in shell command that can limit the number of file descriptors (-n), memory size (-v), thread count (-u), etc., which are divided into soft limit (current effective value) and hard limit (maximum upper limit). 2. Use the ulimit command directly for temporary modification, such as ulimit-n2048, but it is only valid for the current session. 3. For permanent effect, you need to modify /etc/security/limits.conf and PAM configuration files, and add sessionrequiredpam_limits.so. 4. The systemd service needs to set Lim in the unit file

What are the Debian Nginx configuration skills? What are the Debian Nginx configuration skills? May 29, 2025 pm 11:06 PM

When configuring Nginx on Debian system, the following are some practical tips: The basic structure of the configuration file global settings: Define behavioral parameters that affect the entire Nginx service, such as the number of worker threads and the permissions of running users. Event handling part: Deciding how Nginx deals with network connections is a key configuration for improving performance. HTTP service part: contains a large number of settings related to HTTP service, and can embed multiple servers and location blocks. Core configuration options worker_connections: Define the maximum number of connections that each worker thread can handle, usually set to 1024. multi_accept: Activate the multi-connection reception mode and enhance the ability of concurrent processing. s

NGINX's Purpose: Serving Web Content and More NGINX's Purpose: Serving Web Content and More May 08, 2025 am 12:07 AM

NGINXserveswebcontentandactsasareverseproxy,loadbalancer,andmore.1)ItefficientlyservesstaticcontentlikeHTMLandimages.2)Itfunctionsasareverseproxyandloadbalancer,distributingtrafficacrossservers.3)NGINXenhancesperformancethroughcaching.4)Itofferssecur

Nginx Troubleshooting: Diagnosing and Resolving Common Errors Nginx Troubleshooting: Diagnosing and Resolving Common Errors May 05, 2025 am 12:09 AM

Diagnosis and solutions for common errors of Nginx include: 1. View log files, 2. Adjust configuration files, 3. Optimize performance. By analyzing logs, adjusting timeout settings and optimizing cache and load balancing, errors such as 404, 502, 504 can be effectively resolved to improve website stability and performance.

See all articles