Linux学习笔记十二周五次课（4月27日）

Posted 2020-11-02

12.17 nginx负载均衡

代理服务器代理多个WEB即为均衡，dig命令可以查看域名对应IP地址，安装dig命令为#yum install -y bind-utils

例如#dig qq.com

vim /usr/local/nginx/conf/vhost/load.conf //写入如下内容

-------------------------------------------------------------------------

upstream qq

{

ip_hash; //同一个用户，保持在同一个IP上；

server 61.135.157.156:80;

server 125.39.240.113:80;

}

server

{

listen 80;

server_name www.qq.com;

location /

{

proxy_pass http://qq;

proxy_ser_header Hsot $host;

proxy_ser_header X-Real-IP $remote_addr;

proxy_ser_header X-Forward-For $proxy_add_x_forwarded_for;

}

}

-------------------------------------------------------------------------

curl -x127.0.0.1:80 www.qq.com //正常情况会访问默认网页；

/usr/local/nginx/sbin/nginx -t

/usr/local/nginx/sbin/nginx -s reload

curl -x127.0.0.1:80 www.qq.com 

nginx不支持代理https网站

12.18 ssl原理

12.19 生成ssl密钥对

cd /usr/local/nginx/conf

openssl genrsa -des3 -out tmp.key 2048 //key文件为私钥

openssl rsa -in tmp.key -out aminglinux.key //转换key，取消密码

rm -f tmp.key

openssl req -new -key aming.key -out aminglinux.csr //生成证书请求文件，需要拿这个和私钥一起生产公钥文件

openssl x509 -req -days 365 -in aminglinux.csr -singkey aminglinux.key -out aminglinux.crt //这里的amingliux.crt为公钥 

12.20 Nginx配置ssl

vim /usr/local/nginx/conf/vhost/ssl.conf //加入如下内容

--------------------------------------------------------------------

server

{

listen 443;

server_name aming.com;

index index.html index.php;

root /data/wwwroot/aming.com; //目录

ssl on; //开启

ssl_certificate aminglinux.crt; //私钥

ssl_certificate_key aminglinux.key; //公钥

ssl_protocols  TLSv1 TLSv1.1 TLSv1.2; //协议

}

--------------------------------------------------------------------

/usr/local/nginx/sbin/nginx -t

/usr/local/nginx/sbin/nginx -s reload //若报错unknown directive "ssl"，需要重新编译nginx，加上--with-http_ssl_module

-------------------------------------------------------------------------

./configure --prefix-/usr/local/nginx --with-http_ssl_module

make

make install

/usr/local/nginx/sbin/nginx -V //查看配置信息

/usr/local/nginx/sbin/nginx -t

/etc/init.d/nginx restart //重启服务

-------------------------------------------------------------------------

netstat -lntp //查看监听端口443

mkdir /data/wwwroot/aming.com

echo "ssl test page." > /data/wwwroot/aming.com/index.html

编辑hosts，增加127.0.0.1 aming.com

vim /etc/hosts

127.0.0.1 其他域名 aming.com

curl https://aming.com/

如果访问不到，查看防火墙，#iptables -nvl

#iptables -F关闭防火墙

扩展 

针对请求的uri来代理 http://ask.apelearn.com/question/1049

根据访问的目录来区分后端的web http://ask.apelearn.com/question/920

nginx长连接 http://www.apelearn.com/bbs/thread-6545-1-1.html

nginx算法分析 http://blog.sina.com.cn/s/blog_72995dcc01016msi.html