nginx源碼安裝、文件模塊的修改、訪問加密（自定義簽名證書）及輪詢負載均衡

主機環境 redhat6.5  64位

實驗環境 服務端 ip172.25.29.1    nginx

   服務端 ip 172.25.29.2  apache

   服務端 ip 172.25.29.3  apache

   測試端 ip 172.25.254.29

安裝包       nginx-1.10.1.tar.gz

nginx用做反向代理

 

服務端1

1.  安裝nginx

1.解壓及簡單配置

[root@server1 mnt]# yum install gcc -y      #安裝gcc

[root@server1 mnt]# tar zxf nginx-1.10.1.tar.gz   #解壓nginx壓縮包

[root@server1 mnt]# ls

nginx-1.10.1 nginx-1.10.1.tar.gz

[root@server1 mnt]# cd nginx-1.10.1

[root@server1 nginx-1.10.1]# vim auto/cc/gcc     #禁止debug調試

 178 # debug

 179#CFLAGS="$CFLAGS -g"

[root@server1 nginx-1.10.1]# vim src/core/nginx.h   #禁止出現nginx版本號，以保證安全性

 14 #defineNGINX_VER          "nginx/"

 

   2.軟件配置(靜態)

[root@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

 

若是出現如下錯誤

[root@server1 nginx-1.10.1]# yum install pcre-devel -y

 

從新配置

[root@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

 

若是出現如下錯誤

 

[root@server1 nginx-1.10.1]# yum install openssl-devel -y

 

從新配置

[root@server1 nginx-1.10.1]# ./configure--prefix=/usr/local/lnmp/nginx --with-http_ssl_module--with-http_stub_status_module

 

3.編譯、連接、安裝

[root@server1 nginx-1.10.1]# make

[root@server1 nginx-1.10.1]# make install

 

2.將nginx做爲系統變量，開啓nginx

 [root@server1nginx-1.10.1]# cd /usr/local/lnmp/nginx/

[root@server1 nginx]# ls

conf  html  logs sbin

[root@server1 nginx]# ln -s /usr/local/lnmp/nginx/sbin/nginx/usr/local/sbin/  #做軟連接將nginx的啓動命令做爲系統命令

[root@server1 nginx]# nginx -t     #檢測

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 nginx]# nginx    #打開nginx

[root@server1 nginx]# cd conf/

 

3.配置文件中模塊的修改及測試

[root@server1 conf]# useradd -u 900 -d /usr/local/lnmp/nginx/nginx  #建立管理nginx的用戶

 

1.修改用戶、添加cpu及綁定cpu

[root@server1 conf]# vim nginx.conf

  2 user  nginx;    #修改nginx的用戶

  3 worker_processes  2;   #工做進程，兩塊cpu

  4 worker_cpu_affinity01 10;  #綁定cpu

[root@server1 conf]# nginx -t   #檢測

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 conf]# nginx -s reload   #重載

 

測試

[root@server1 conf]# ps aux | grep nginx

 

[root@server1 conf]# vim nginx.conf

 13 events {

 14     worker_connections  4096; #支持的最大連接數

 15 }

[root@server1 conf]# nginx -t   #檢測

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 conf]# nginx -s reload  #重載

 

[root@server1 conf]# vim /etc/security/limits.conf  #系統分配給nginx的

 51 nginx   -      nofile  200

 52 nginx   -      nproc   200

[root@server1 conf]# :() { :|:& };:     #測試 

若是把上面200改爲4096，那麼系統直接卡死

 

2.查看nginx狀態

[root@server4 conf]# vim nginx.conf   #查看nginx狀態

 57         location /status {

 58                 stub_status on;

 59                 access_log off;

 60         }

[root@server1 conf]# nginx -t

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server4 conf]# nginx -s reload

[root@server1 mnt]# yum install httpd -y

 

[root@server1 conf]# vim /etc/httpd/conf/httpd.conf

  136 Listen 8080      #以前nginx監聽80端口，httpd就換了端口

[root@server1 conf]# /etc/init.d/httpd start

Starting httpd:                                           [  OK  ]

測試 172.25.29.1/status

 

3.nginx訪問加密（自定義簽名證書）

在互聯網中，若是訪問不加密，會致使不少重要信息泄露，全部纔有了加密

[root@server4 conf]# vim nginx.conf    #訪問加密

101     #

102     server {

103         listen       443 ssl;

104        server_name  localhost;

105

106        ssl_certificate      cert.pem;

107        ssl_certificate_key  cert.pem;

108

109         ssl_session_cache    shared:SSL:1m;

110        ssl_session_timeout  5m;

111

112        ssl_ciphers  HIGH:!aNULL:!MD5;

113        ssl_prefer_server_ciphers  on;

114

115         location / {

116             root   html;

117            index  index.html index.htm;

118         }

119     }

120

[root@server1 conf]# cd /etc/pki/tls/certs/

[root@server1 certs]# make cert.pem    #生成自定義簽名證書

umask 77 ; \

    PEM1=`/bin/mktemp/tmp/openssl.XXXXXX` ; \

    PEM2=`/bin/mktemp/tmp/openssl.XXXXXX` ; \

    /usr/bin/openssl req-utf8 -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2-set_serial 0 ; \

    cat $PEM1 >  cert.pem ; \

    echo ""    >> cert.pem ; \

    cat $PEM2 >>cert.pem ; \

    rm -f $PEM1 $PEM2

Generating a 2048 bit RSA private key

..............+++

................+++

writing new private key to '/tmp/openssl.9egbT2'

-----

You are about to be asked to enter information that will beincorporated

into your certificate request.

What you are about to enter is what is called a DistinguishedName or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:Shaanxi

Locality Name (eg, city) [Default City]:xi'an

Organization Name (eg, company) [Default Company Ltd]:wen

Organizational Unit Name (eg, section) []:linux

Common Name (eg, your name or your server's hostname)[]:server1.example.com

Email Address []:root@server1.example.com

[root@server1 certs]# mv cert.pem /usr/local/lnmp/nginx/conf/

[root@server1 certs]# nginx -t

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 certs]# nginx -s reload

 

測試 https：//172.25.29.1

選擇 I Understand the Risks,確認

 

4.虛擬主機

虛擬主機容許從一個httpd服務器同時爲多個網站提供服務

[root@server1 certs]# cd /usr/local/lnmp/nginx/conf/

[root@server1 conf]# vim nginx.conf

120     server {

121                 listen 80;  #監聽端口

122                server_name www.wen.com;   #域名

123

124                location / {

125                        root /web1;    #默認發佈目錄

126                        index index.html;  #默認發佈文件

127                 }

128     }

129     server {

130                listen 80;

131                server_name www.mi.com;

132

133                location / {

134                        root /web2;

135                        index index.html;

136                 }

137     }

[root@server1 conf]# mkdir /web1 /web2

[root@server1 conf]# vim /web1/index.html

Welcome to www.wen.com

[root@server1 conf]# vim /web2/index.html

Welcome to www.mi.com

[root@server1 conf]# nginx -t

nginx: the configuration file /usr/local/lnmp/nginx/conf/nginx.confsyntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 conf]# nginx -s reload

測試

在測試端的主機里加上域名解析

[root@foundation29 Desktop]# vim /etc/hosts

172.25.29.1 www.wen.comwww.mi.com

 

5.輪詢負載均衡

  參數說明： round-robin （默認）

    wegiht ：默認爲1.weight越大，負載的權重就越大

            backup： 其它全部的非backup機器都down時，纔會請求backup機器。因此這臺機器壓力會最輕

ip_hash：每一個請求按訪問ip的hash結果分配，這樣每一個訪客固定訪問一個後端服務器，能夠解決session的問題

 

 [root@server1 conf]# vim nginx.conf

 18 http {

 19         upstream wen {

 20                 server 172.25.29.2:80;

 21                 server 172.25.29.3:80weight=2;

 22                 server 172.25.29.4:8080backup;

 23         } 

125     server {

126                 listen80;

127                server_name www.wen.com;

128

129                location / {

130                        #root /web1;

131                        #index index.html;

132                        proxy_pass http://wen;   

133                 }

134     }

[root@server1 conf]# nginx -t

nginx: the configuration file/usr/local/lnmp/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/lnmp/nginx/conf/nginx.conftest is successful

[root@server1 conf]# nginx -s reload

[root@server1 conf]# vim /var/www/html/index.html

[root@server1 conf]# /etc/init.d/httpd restart

Stopping httpd:                                           [  OK  ]

Starting httpd:                                           [  OK  ]

 

 

其餘兩個2，3服務端，測試時要保證其http服務開啓且默認訪問的首頁的路徑下要有index.html文件，在文件裏要有內容（隨便什麼都行）

測試

[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done

<h1>server3</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>

[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done   當server3 httpd stop 以後

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done  當server2和server3httpd都 stop 以後

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

<h1>please try again!</h1>

 

[kiosk@foundation29 ~]$ for i in $(seq 10 );do curl www.wen.com; done  當server2 和server3的httpd 都start以後，繼續輪詢

<h1>www.westos.org-server2</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>

<h1>www.westos.org-server2</h1>

<h1>server3</h1>

<h1>server3</h1>