用了nginx有段时间了,今天总结一下包括80端口的配置 443端口 ssl配置
首先看防火墙,本地直接就关了吧,如果是服务器看看防火墙看的没,看的话看看端口开了没。参考centos添加端口白名单
nginx配置
进到目录 cd /usr/local/nginx/conf/
创建两个文件vhost(虚拟主机)和cert(证书)方便管理。
先把原来的备份了 mv nginx.conf nginx.conf.back
vim nginx.conf
#user nobody;
worker_processes auto;
worker_rlimit_nofile 51200;
#pid logs/nginx.pid;
events {
use epoll;
worker_connections 51200;
multi_accept on;
}
http
{
include mime.types;
default_type application/octet-stream;
server_tokens off; #nginx关掉版本号
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 50m;
sendfile on;
tcp_nopush on;
keepalive_timeout 60;
tcp_nodelay on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 256k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_disable "MSIE [1-6]\.";
#limit_conn_zone $binary_remote_addr zone=perip:10m;
##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.
#log format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log off;
include vhost/*.conf;
}
vhost里面专门放配置文件 进入vhost文件
例如:vim 80.conf
server {
listen 80;
server_name localhost;
#rewrite ^(.*)$ https://$host$1 permanent;
root html;
location / {
index index.php index.html index.htm;
try_files $uri $uri/ /index.php?$query_string;
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php?s=$1 last; break;
}
}
location ~ .php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
#access_log logs/80.access.log main;
#error_log logs/80.error.log info;
}
443配置
server {
add_header Strict-Transport-Security "max-age=31536000";
server_name xxx.com www.xxx.com ;
listen 443;
root html;
ssl on;
ssl_certificate cert/xxx.com/full_chain.pem ;
ssl_certificate_key cert/xxx.com/private.key ;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
ssl_prefer_server_ciphers on;
location / {
index index.php index.html index.htm;
try_files $uri $uri/ /index.php?$query_string;
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php?s=$1 last; break;
}
}
location ~ .php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}
location ~ .*\.(js|css)?$
{
expires 12h;
}
location ~ /\.
{
deny all;
}
access_log logs/443.access.log main;
error_log logs/443.error.log info;
}
如果您的网站的评分已经达到A
,那么没有被评到A+
的最大的可能性就是没有使用HSTS
,使用HSTS
的方法很简单,只要在添加Strict-Transport-Security
这个HTTP
头部信息即可
add_header Strict-Transport-Security "max-age=31536000";
如果您的服务器需要支持IE6
这种古董级别的浏览器,那么就按照百度
的做法,如果说对兼容性没有太大的需求,只要主流的浏览器能够访问那么就不要支持3DES
系列的加密套件,如果说想要在保证安全性的同时,也要有最好的兼容性,那么就请按照淘宝的
配置方式进行配置。
下面给出这三种配置情况:
类似百度
Nginx
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
类似淘宝
Nginx
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
最好的安全性
Nginx
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256::!MD5;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
但也有可能因为openssl
版本的不同会导致相同的配置得到不同的检测结果。如果您的openssl
处于较新的版本那么按照最好的安全性
进行配置,得到一个A
,应该是没有问题的。
参考:
HTTPS安全与兼容性配置指南
--------------------
location / {
rewrite ^/Mobile/(.*)$ /index.php?s=Mobile/$1 last;
rewrite ^/Admin/(.*)$ /index.php?s=Admin/$1 last;
rewrite ^/(.*)$ /index.php?s=Home/$1 last;
break;
}