access 模块
示例从上向下匹配
location / { deny 192.168.1.1; allow 192.168.1.0/24; allow 10.1.1.0/16; allow 2001:0db8::/32; deny all; }
auth_basic模块 基于用户名密码做认证
安装http-tools 工具
[root@python ~]# htpasswd -cb yt yu 123 Adding password for user yu [root@python ~]# htpasswd -b yt yutre 123qwe Adding password for user yutre [root@python ~]# cat yt yu:$apr1$/N3KI0q8$UxOw8KlG1QBO5N2Niryxo0 yutre:$apr1$BAFJsGn2$qKrWI0G6cSzPPIEG4XGPV0
nginx配置
[root@python vhast]# cat auth_basic.conf server { server_name auth_basic.com; default_type text/plain; root html/; location /{ satisfy any; auth_basic "tset auth_basic"; auth_basic_user_file passwd; deny all; } }
auth_request模块 基于第三方库做认证;需要重新编译,默认没有这个模块;
[root@python vhast]# cd ~/nginx-1.15.9/ [root@python nginx-1.15.9]# ./configure --prefix=/data/web --sbin-path=/usr/bin --user=nginx --group=nginx --with-http_stub_status_module --with-http_auth_request_module checking for OS [root@python nginx-1.15.9]# make [root@python nginx-1.15.9]# rm -rf /usr/bin/nginx [root@python nginx-1.15.9]# cp objs/nginx /usr/bin/
原理:收到请求后,生成子请求,通过反向代理技术把请求传递给上游服务器,通过上游服务的响应来判断是否处理这个请求,若上游服务器返回的响应码是2**,则继续执行,若返回401或403;则将响应码返回客户端
指令介绍
Syntax: auth_request uri | off; Default: auth_request off; Context: http, server, location Syntax: auth_request_set $variable value; Default: — Context: http, server, location
配置
server { server_name auth_basic.com; root html; location /iiiii{ satisfy any; auth_basic "tset auth_basic"; auth_basic_user_file passwd; deny all; } location / { auth_request /test_auth; } location = /test_auth { proxy_pass http://127.0.0.1:90; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URI $request_uri; } } 认证服务器 server { listen 90; location / { return 201 'auth succes'; } }
测试正常返回
测试异常返回
[root@python vhast]# cat test-l.conf server { listen 90; location / { return 401 'auth succes'; } }
测试