[{"data":1,"prerenderedAt":338},["ShallowReactive",2],{"site-data":3,"article-36":143,"article-show-hot-36":172,"article-show-new-36":262},{"settings":4,"categorys":35,"tree":97,"models":118,"search_model_select":128,"nav_list":130},{"changefreq":5,"changyan_app_id":6,"changyan_app_key":6,"copy":7,"description":8,"editor":9,"file":6,"guest_feedback":10,"head_html":6,"icp":11,"index_banner":12,"index_banner_bg":13,"is_excel":14,"is_watermark":10,"keywords":15,"links":16,"logo":17,"lzcms_banner":6,"lzcms_banner_link":18,"member_register_enabled":14,"qq_app_id":6,"qq_app_key":6,"qr_code":6,"search_model":19,"site_closedreason":6,"site_idea":6,"site_idea1":20,"site_idea2":21,"site_idea3":22,"site_name":23,"site_statistice":6,"site_status":14,"site_url":18,"sitemap_model":19,"stationmaster_motto":24,"stationmaster_name":25,"stationmaster_occupation":26,"stationmaster_qq":27,"stationmaster_qqnet":28,"stationmaster_qqnet_code":29,"threshold":14,"title_add":30,"watermark":6,"watermark_alpha":31,"watermark_height":32,"watermark_locate":33,"watermark_width":34},"weekly","","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"link_url\":\"https://linux.org\",\"logo\":\"\",\"name\":\"linux\",\"sort\":\"0\",\"status\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","linux","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":36,"17":51,"18":60,"19":63,"20":67,"21":71,"22":76,"25":80,"26":83,"27":89,"29":94},{"children":37},{"0":38,"25":43,"26":48},[39,40,41,42],25,21,22,26,[44,45,46,47],17,18,19,20,[49,50],27,29,{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},"index",1,"list","article",2,"文章模型","show","/article/lists?category_id=17",{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},"python","/article/lists?category_id=18",{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},"容器技术",3,"/article/lists?category_id=19",{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},"负载均衡",4,"/article/lists?category_id=20",{"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},"分享无价",0,5,"/article/lists?category_id=21",{"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},"随笔",6,"/article/lists?category_id=22",{"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},"学无止境","/article/lists?category_id=25",{"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},"page","单页模型","关于博主","/page/27",{"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},"留言","/feedback",[98,108,110,112],{"children":99,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[100,102,104,106],{"children":101,"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},[],{"children":103,"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},[],{"children":105,"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},[],{"children":107,"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},[],{"children":109,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":111,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":113,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[114,116],{"children":115,"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},[],{"children":117,"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},[],{"1":119,"2":120,"3":121,"4":122,"5":125},{"id":53,"index_template":52,"list_template":54,"name":91,"show_template":58,"status":73,"tablename":90},{"id":56,"index_template":52,"list_template":54,"name":57,"show_template":58,"status":73,"tablename":55},{"id":65,"index_template":52,"list_template":54,"name":85,"show_template":58,"status":73,"tablename":84},{"id":69,"index_template":52,"list_template":54,"name":123,"show_template":58,"status":73,"tablename":124},"链接模型","link",{"id":74,"index_template":52,"list_template":54,"name":126,"show_template":58,"status":73,"tablename":127},"下载模型","download",[129],{"id":56,"name":57,"tablename":55},[131,137,139,141],{"children":132,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[133,134,135,136],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"children":138,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":140,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":142,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[],{"article":144,"breadcrumb":155,"category":159,"next":160,"prev":163,"second_categorys":166,"seo":171},{"id":145,"category_id":44,"title":146,"keywords":147,"description":148,"image_url":6,"content":149,"content_md":150,"url":151,"hits":152,"is_recommend":73,"is_top":73,"create_time":153,"update_time":154},36,"nginx 安全设置详解 ","安全,设置,详解","Nginx是一个轻量级的，高性能的Web服务器以及反向代理和邮箱(IMAP/POP3)代理服务器。它运行在UNIX,GNU/Linux,BSD各种版本，Mac OS X,Solaris和Windows。根据调查统计，6%的网站使用Nginx Web服务器。Nginx是少数能处理C10K问题的服务器之一。跟传统的服务器不同，Nginx不依赖线程来处理请求。相反，它使用了更多的可扩展的事件驱动（异步）架构。Nginx为一些高流量的网站提供动力，比如WordPress,人人网，腾讯，网易等。这篇文章主","\u003Cdiv align=\"left\">\u003Cfont size=\"3\">\u003Cspan>\u003Cfont face=\"宋体 \">\u003Cdiv align=\"left\">Nginx是一个轻量级的，高性能的Web服务器以及反向代理和邮箱(IMAP/POP3)代理服务器。它运行在UNIX,GNU/Linux,BSD各种版本，Mac OS X,Solaris和Windows。根据调查统计，6%的网站使用Nginx Web服务器。Nginx是少数能处理C10K问题的服务器之一。跟传统的服务器不同，Nginx不依赖线程来处理请求。相反，它使用了更多的可扩展的事件驱动（异步）架构。Nginx为一些高流量的网站提供动力，比如WordPress,人人网，腾讯，网易等。这篇文章主要是介绍如何提高运行在Linux或UNIX系统的Nginx Web服务器的安全性。\u003C/div>\u003Cdiv align=\"left\">\u003Cbr>\u003C/div>\u003Cdiv align=\"left\">默认配置文件和Nginx端口\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/conf/ – Nginx配置文件目录，/usr/local/nginx/conf/nginx.conf是主配置文件\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/html/ – 默认网站文件位置\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/logs/ – 默认日志文件位置\u003C/div>\u003Cdiv align=\"left\">Nginx HTTP默认端口 : TCP 80\u003C/div>\u003Cdiv align=\"left\">Nginx HTTPS默认端口: TCP 443\u003C/div>\u003Cdiv align=\"left\">你可以使用以下命令来测试Nginx配置文件准确性。\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/sbin/nginx -t\u003C/div>\u003Cdiv align=\"left\">将会输出。\u003C/div>\u003Cdiv align=\"left\">the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok\u003C/div>\u003Cdiv align=\"left\">configuration file /usr/local/nginx/conf/nginx.conf test is successful\u003C/div>\u003Cdiv align=\"left\">执行以下命令来重新加载配置文件。\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/sbin/nginx -s reload\u003C/div>\u003Cdiv align=\"left\">执行以下命令来停止服务器。\u003C/div>\u003Cdiv align=\"left\">/usr/local/nginx/sbin/nginx -s stop\u003C/div>\u003Cdiv align=\"left\">一、配置SELinux\u003C/div>\u003Cdiv align=\"left\">安全增强型Linux（SELinux）的是一个Linux内核的功能，它提供支持访问控制的安全政策保护机制。它可以大部分的攻击。下面我们来看如何启动基于CentOS/RHEL系统的SELinux。\u003C/div>\u003Cdiv align=\"left\">安装SELinux\u003C/div>\u003Cdiv align=\"left\">rpm -qa | grep selinux\u003C/div>\u003Cdiv align=\"left\">libselinux-1.23.10-2\u003C/div>\u003Cdiv align=\"left\">selinux-policy-targeted-1.23.16-6\u003C/div>\u003Cdiv align=\"left\">如果没有返回任何结果，代表没有安装 SELinux，如果返回了类似上面的结果，则说明系统安装了 SELinux。\u003C/div>\u003Cdiv align=\"left\">布什值锁定\u003C/div>\u003Cdiv align=\"left\">运行命令getsebool -a来锁定系统。\u003C/div>\u003Cdiv align=\"left\">getsebool -a | less\u003C/div>\u003Cdiv align=\"left\">getsebool -a | grep off\u003C/div>\u003Cdiv align=\"left\">getsebool -a | grep o\u003C/div>\u003Cdiv align=\"left\">二、通过分区挂载允许最少特权\u003C/div>\u003Cdiv align=\"left\">服务器上的网页/html/php文件单独分区。例如，新建一个分区/dev/sda5(第一逻辑分区)，并且挂载在/nginx。确保/nginx是以noexec, nodev and nosetuid的权限挂载。以下是我的/etc/fstab的挂载/nginx的信息：\u003C/div>\u003Cdiv align=\"left\">LABEL=/nginx /nginx ext3 defaults,nosuid,noexec,nodev 1 2\u003C/div>\u003Cdiv align=\"left\">注意：你需要使用fdisk和mkfs.ext3命令创建一个新分区。\u003C/div>\u003Cdiv align=\"left\">三、配置/etc/sysctl.conf强化Linux安全\u003C/div>\u003Cdiv align=\"left\">你可以通过编辑/etc/sysctl.conf来控制和配置Linux内核、网络设置。\u003C/div>\u003Cdiv align=\"left\"># Avoid a smurf attack\u003C/div>\u003Cdiv align=\"left\">net.ipv4.icmp_echo_ignore_broadcasts = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Turn on protection for bad icmp error messages\u003C/div>\u003Cdiv align=\"left\">net.ipv4.icmp_ignore_bogus_error_responses = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Turn on syncookies for SYN flood attack protection\u003C/div>\u003Cdiv align=\"left\">net.ipv4.tcp_syncookies = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Turn on and log spoofed, source routed, and redirect packets\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.log_martians = 1\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.log_martians = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># No source routed packets here\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.accept_source_route = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.accept_source_route = 0\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Turn on reverse path filtering\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.rp_filter = 1\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.rp_filter = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Make sure no one can alter the routing tables\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.accept_redirects = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.accept_redirects = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.secure_redirects = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.secure_redirects = 0\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Don't act as a router\u003C/div>\u003Cdiv align=\"left\">net.ipv4.ip_forward = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.all.send_redirects = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv4.conf.default.send_redirects = 0\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Turn on execshild\u003C/div>\u003Cdiv align=\"left\">kernel.exec-shield = 1\u003C/div>\u003Cdiv align=\"left\">kernel.randomize_va_space = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Tuen IPv6\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.router_solicitations = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.accept_ra_rtr_pref = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.accept_ra_pinfo = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.accept_ra_defrtr = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.autoconf = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.dad_transmits = 0\u003C/div>\u003Cdiv align=\"left\">net.ipv6.conf.default.max_addresses = 1\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Optimization for port usefor LBs\u003C/div>\u003Cdiv align=\"left\"># Increase system file descriptor limit\u003C/div>\u003Cdiv align=\"left\">fs.file-max = 65535\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Allow for more PIDs (to reduce rollover problems); may break some programs 32768\u003C/div>\u003Cdiv align=\"left\">kernel.pid_max = 65536\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Increase system IP port limits\u003C/div>\u003Cdiv align=\"left\">net.ipv4.ip_local_port_range = 2000 65000\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Increase TCP max buffer size setable using setsockopt()\u003C/div>\u003Cdiv align=\"left\">net.ipv4.tcp_rmem = 4096 87380 8388608\u003C/div>\u003Cdiv align=\"left\">net.ipv4.tcp_wmem = 4096 87380 8388608\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Increase Linux auto tuning TCP buffer limits\u003C/div>\u003Cdiv align=\"left\"># min, default, and max number of bytes to use\u003C/div>\u003Cdiv align=\"left\"># set max to at least 4MB, or higher if you use very high BDP paths\u003C/div>\u003Cdiv align=\"left\"># Tcp Windows etc\u003C/div>\u003Cdiv align=\"left\">net.core.rmem_max = 8388608\u003C/div>\u003Cdiv align=\"left\">net.core.wmem_max = 8388608\u003C/div>\u003Cdiv align=\"left\">net.core.netdev_max_backlog = 5000\u003C/div>\u003Cdiv align=\"left\">net.ipv4.tcp_window_scaling = 1\u003C/div>\u003Cdiv align=\"left\">四、删除所有不需要的Nginx模块\u003C/div>\u003Cdiv align=\"left\">你需要直接通过编译Nginx源代码使模块数量最少化。通过限制只允许web服务器访问模块把风险降到最低。你可以只配置安装nginx你所需要的模块。例如，禁用SSL和autoindex模块你可以执行以下命令：\u003C/div>\u003Cdiv align=\"left\">./configure --without-http_autoindex_module --without-http_ssi_module\u003C/div>\u003Cdiv align=\"left\">make\u003C/div>\u003Cdiv align=\"left\">make install\u003C/div>\u003Cdiv align=\"left\">通过以下命令来查看当编译nginx服务器时哪个模块能开户或关闭：\u003C/div>\u003Cdiv align=\"left\">./configure --help | less\u003C/div>\u003Cdiv align=\"left\">禁用你用不到的nginx模块。\u003C/div>\u003Cdiv align=\"left\">（可选项）更改nginx版本名称。\u003C/div>\u003Cdiv align=\"left\">编辑文件/http/ngx_http_header_filter_module.c：\u003C/div>\u003Cdiv align=\"left\">vi +48 src/http/ngx_http_header_filter_module.c\u003C/div>\u003Cdiv align=\"left\">找到行：\u003C/div>\u003Cdiv align=\"left\">static char ngx_http_server_string[] = \"Server: nginx\" CRLF;\u003C/div>\u003Cdiv align=\"left\">static char ngx_http_server_full_string[] = \"Server: \" NGINX_VER CRLF;\u003C/div>\u003Cdiv align=\"left\">按照以下行修改：\u003C/div>\u003Cdiv align=\"left\">static char ngx_http_server_string[] = \"Server: Ninja Web Server\" CRLF;\u003C/div>\u003Cdiv align=\"left\">static char ngx_http_server_full_string[] = \"Server: Ninja Web Server\" CRLF;\u003C/div>\u003Cdiv align=\"left\">保存并关闭文件。现在你可以编辑服务器了。增加以下代码到nginx.conf文件来关闭nginx版本号的显示。\u003C/div>\u003Cdiv align=\"left\">server_tokens off\u003C/div>\u003Cdiv align=\"left\">五、使用mod_security(只适合后端Apache服务器)\u003C/div>\u003Cdiv align=\"left\">mod_security为Apache提供一个应用程序级的防火墙。为后端Apache Web服务器安装mod_security，这会阻止很多注入式攻击。\u003C/div>\u003Cdiv align=\"left\">六、安装SELinux策略以强化Nginx Web服务器\u003C/div>\u003Cdiv align=\"left\">默认的SELinux不会保护Nginx Web服务器，但是你可以安装和编译保护软件。\u003C/div>\u003Cdiv align=\"left\">1、安装编译SELinux所需环境支持\u003C/div>\u003Cdiv align=\"left\">yum -y install selinux-policy-targeted selinux-policy-devel\u003C/div>\u003Cdiv align=\"left\">2、下载SELinux策略以强化Nginx Web服务器。\u003C/div>\u003Cdiv align=\"left\">cd /opt\u003C/div>\u003Cdiv align=\"left\">wget 'http://downloads.sourceforge.net/project/selinuxnginx/se-ngix_1_0_10.tar.gz?use_mirror=nchc'\u003C/div>\u003Cdiv align=\"left\">3、解压文件\u003C/div>\u003Cdiv align=\"left\">tar -zxvf se-ngix_1_0_10.tar.gz\u003C/div>\u003Cdiv align=\"left\">4、编译文件\u003C/div>\u003Cdiv align=\"left\">cd se-ngix_1_0_10/nginx\u003C/div>\u003Cdiv align=\"left\">make\u003C/div>\u003Cdiv align=\"left\">将会输出如下：\u003C/div>\u003Cdiv align=\"left\">Compiling targeted nginx module\u003C/div>\u003Cdiv align=\"left\">/usr/bin/checkmodule: loading policy configuration from tmp/nginx.tmp\u003C/div>\u003Cdiv align=\"left\">/usr/bin/checkmodule: policy configuration loaded\u003C/div>\u003Cdiv align=\"left\">/usr/bin/checkmodule: writing binary representation (version 6) to tmp/nginx.mod\u003C/div>\u003Cdiv align=\"left\">Creating targeted nginx.pp policy package\u003C/div>\u003Cdiv align=\"left\">rm tmp/nginx.mod.fc tmp/nginx.mod\u003C/div>\u003Cdiv align=\"left\">5、安装生成的nginx.pp SELinux模块：\u003C/div>\u003Cdiv align=\"left\">/usr/sbin/semodule -i nginx.pp\u003C/div>\u003Cdiv align=\"left\">七、基于Iptables防火墙的限制\u003C/div>\u003Cdiv align=\"left\">下面的防火墙脚本阻止任何除了允许：\u003C/div>\u003Cdiv align=\"left\">来自HTTP(TCP端口80)的请求\u003C/div>\u003Cdiv align=\"left\">来自ICMP ping的请求\u003C/div>\u003Cdiv align=\"left\">ntp(端口123)的请求输出\u003C/div>\u003Cdiv align=\"left\">smtp(TCP端口25)的请求输出\u003C/div>\u003Cdiv align=\"left\">#!/bin/bash\u003C/div>\u003Cdiv align=\"left\">IPT=\"/sbin/iptables\"\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">#### IPS ######\u003C/div>\u003Cdiv align=\"left\"># Get server public ip\u003C/div>\u003Cdiv align=\"left\">SERVER_IP=$(ifconfig eth0 | grep 'inet addr:' | awk -F'inet addr:' '{ print $2}' | awk '{ print $1}')\u003C/div>\u003Cdiv align=\"left\">LB1_IP=\"204.54.1.1\"\u003C/div>\u003Cdiv align=\"left\">LB2_IP=\"204.54.1.2\"\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Do some smart logic so that we can use damm script on LB2 too\u003C/div>\u003Cdiv align=\"left\">OTHER_LB=\"\"\u003C/div>\u003Cdiv align=\"left\">SERVER_IP=\"\"\u003C/div>\u003Cdiv align=\"left\">[[ \"$SERVER_IP\" == \"$LB1_IP\" ]] && OTHER_LB=\"$LB2_IP\" || OTHER_LB=\"$LB1_IP\"\u003C/div>\u003Cdiv align=\"left\">[[ \"$OTHER_LB\" == \"$LB2_IP\" ]] && OPP_LB=\"$LB1_IP\" || OPP_LB=\"$LB2_IP\"\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">### IPs ###\u003C/div>\u003Cdiv align=\"left\">PUB_SSH_ONLY=\"122.xx.yy.zz/29\"\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">#### FILES #####\u003C/div>\u003Cdiv align=\"left\">BLOCKED_IP_TDB=/root/.fw/blocked.ip.txt\u003C/div>\u003Cdiv align=\"left\">SPOOFIP=\"127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 169.254.0.0/16 0.0.0.0/8 240.0.0.0/4 255.255.255.255/32 168.254.0.0/16 224.0.0.0/4 240.0.0.0/5 248.0.0.0/5 192.0.2.0/24\"\u003C/div>\u003Cdiv align=\"left\">BADIPS=$( [[ -f ${BLOCKED_IP_TDB} ]] && egrep -v \"^#|^$\" ${BLOCKED_IP_TDB})\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">### Interfaces ###\u003C/div>\u003Cdiv align=\"left\">PUB_IF=\"eth0\"   # public interface\u003C/div>\u003Cdiv align=\"left\">LO_IF=\"lo\"      # loopback\u003C/div>\u003Cdiv align=\"left\">VPN_IF=\"eth1\"   # vpn / private net\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">### start firewall ###\u003C/div>\u003Cdiv align=\"left\">echo \"Setting LB1 $(hostname) Firewall...\"\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># DROP and close everything\u003C/div>\u003Cdiv align=\"left\">$IPT -P INPUT DROP\u003C/div>\u003Cdiv align=\"left\">$IPT -P OUTPUT DROP\u003C/div>\u003Cdiv align=\"left\">$IPT -P FORWARD DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Unlimited lo access\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${LO_IF} -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${LO_IF} -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Unlimited vpn / pnet access\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${VPN_IF} -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${VPN_IF} -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Drop sync\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Drop Fragments\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -f -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Drop NULL packets\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" NULL Packets \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Drop XMAS\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" XMAS Packets \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Drop FIN packet scans\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" Fin Packets Scan \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Log and get rid of broadcast / multicast and invalid\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type broadcast -j LOG --log-prefix \" Broadcast \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type broadcast -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type multicast -j LOG --log-prefix \" Multicast \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type multicast -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m state --state INVALID -j LOG --log-prefix \" Invalid \"\u003C/div>\u003Cdiv align=\"left\">$IPT  -A INPUT -i ${PUB_IF} -m state --state INVALID -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Log and block spoofed ips\u003C/div>\u003Cdiv align=\"left\">$IPT -N spooflist\u003C/div>\u003Cdiv align=\"left\">for ipblock in $SPOOFIP\u003C/div>\u003Cdiv align=\"left\">do\u003C/div>\u003Cdiv align=\"left\">        $IPT -A spooflist -i ${PUB_IF} -s $ipblock -j LOG --log-prefix \" SPOOF List Block \"\u003C/div>\u003Cdiv align=\"left\">        $IPT -A spooflist -i ${PUB_IF} -s $ipblock -j DROP\u003C/div>\u003Cdiv align=\"left\">done\u003C/div>\u003Cdiv align=\"left\">$IPT -I INPUT -j spooflist\u003C/div>\u003Cdiv align=\"left\">$IPT -I OUTPUT -j spooflist\u003C/div>\u003Cdiv align=\"left\">$IPT -I FORWARD -j spooflist\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># Allow ssh only from selected public ips\u003C/div>\u003Cdiv align=\"left\">for ip in ${PUB_SSH_ONLY}\u003C/div>\u003Cdiv align=\"left\">do\u003C/div>\u003Cdiv align=\"left\">       $IPT -A INPUT -i ${PUB_IF} -s ${ip} -p tcp -d ${SERVER_IP} --destination-port 22 -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">       $IPT -A OUTPUT -o ${PUB_IF} -d ${ip} -p tcp -s ${SERVER_IP} --sport 22 -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">done\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># allow incoming ICMP ping pong stuff\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -m limit --limit 30/sec  -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># allow incoming HTTP port 80\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -p tcp -s 0/0 --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># allow outgoing ntp\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\"># allow outgoing smtp\u003C/div>\u003Cdiv align=\"left\">$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">### add your other rules here ####\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">#######################\u003C/div>\u003Cdiv align=\"left\"># drop and log everything else\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" DEFAULT DROP \"\u003C/div>\u003Cdiv align=\"left\">$IPT -A INPUT -j DROP\u003C/div>\u003Cdiv align=\"left\">\u003C/div>\u003Cdiv align=\"left\">exit 0\u003C/div>\u003C/font>\u003C/span>\u003C/font>\u003C/div>\u003Cp>\u003Cfont size=\"3\">\u003Cfont face=\"宋体 \">\u003Cbr>\u003Cspan>八、控制缓冲区溢出攻击\u003C/span> \u003Cbr>编辑nginx.conf，为所有客户端设置缓冲区的大小限制。 \u003Cbr>vi /usr/local/nginx/conf/nginx.conf \u003Cbr>编辑和设置所有客户端缓冲区的大小限制如下： \u003Cbr>## Start: Size Limits & Buffer Overflows ## \u003Cbr>  client_body_buffer_size  1K; \u003Cbr>  client_header_buffer_size 1k; \u003Cbr>  client_max_body_size 1k; \u003Cbr>  large_client_header_buffers 2 1k; \u003Cbr> ## END: Size Limits & Buffer Overflows ## \u003Cbr>解释： \u003Cbr>1、client_body_buffer_size 1k-（默认8k或16k）这个指令可以指定连接请求实体的缓冲区大小。如果连接请求超过缓存区指定的值，那么这些请求实体的整体或部分将尝试写入一个临时文件。 \u003Cbr>2、client_header_buffer_size 1k-指令指定客户端请求头部的缓冲区大小。绝大多数情况下一个请求头不会大于1k，不过如果有来自于wap客户端的较大的cookie它可能会大于1k，Nginx将分配给它一个更大的缓冲区，这个值可以在large_client_header_buffers里面设置。 \u003Cbr>3、client_max_body_size 1k-指令指定允许客户端连接的最大请求实体大小，它出现在请求头部的Content-Length字段。 \u003Cbr>如果请求大于指定的值，客户端将收到一个”Request Entity Too Large” (413)错误。记住，浏览器并不知道怎样显示这个错误。 \u003Cbr>4、large_client_header_buffers-指定客户端一些比较大的请求头使用的缓冲区数量和大小。请求字段不能大于一个缓冲区大小，如果客户端发送一个比较大的头，nginx将返回”Request URI too large” (414)\u003Cbr>同样，请求的头部最长字段不能大于一个缓冲区，否则服务器将返回”Bad request” (400)。缓冲区只在需求时分开。默认一个缓冲区大小为操作系统中分页文件大小，通常是4k或8k，如果一个连接请求最终将状态转换为keep-alive，它所占用的缓冲区将被释放。 \u003Cbr>你还需要控制超时来提高服务器性能并与客户端断开连接。按照如下编辑： \u003Cbr>## Start: Timeouts ## \u003Cbr>  client_body_timeout   10; \u003Cbr>  client_header_timeout 10; \u003Cbr>  keepalive_timeout     5 5; \u003Cbr>  send_timeout          10; \u003Cbr>## End: Timeouts ## \u003Cbr>1、client_body_timeout 10;-指令指定读取请求实体的超时时间。这里的超时是指一个请求实体没有进入读取步骤，如果连接超过这个时间而客户端没有任何响应，Nginx将返回一个”Request time out” (408)错误。 \u003Cbr>2、client_header_timeout 10;-指令指定读取客户端请求头标题的超时时间。这里的超时是指一个请求头没有进入读取步骤，如果连接超过这个时间而客户端没有任何响应，Nginx将返回一个”Request time out” (408)错误。 \u003Cbr>3、keepalive_timeout 5 5; – 参数的第一个值指定了客户端与服务器长连接的超时时间，超过这个时间，服务器将关闭连接。参数的第二个值（可选）指定了应答头中Keep-Alive: timeout=time的time值，这个值可以使一些浏览器知道什么时候关闭连接，以便服务器不用重复关闭，如果不指定这个参数，nginx不会在应答头中发送Keep-Alive信息。（但这并不是指怎样将一个连接“Keep-Alive”）参数的这两个值可以不相同。 \u003Cbr>4、send_timeout 10; 指令指定了发送给客户端应答后的超时时间，Timeout是指没有进入完整established状态，只完成了两次握手，如果超过这个时间客户端没有任何响应，nginx将关闭连接。 \u003Cbr>九、控制并发连接 \u003Cbr>你可以使用NginxHttpLimitZone模块来限制指定的会话或者一个IP地址的特殊情况下的并发连接。编辑nginx.conf: \u003Cbr>### Directive describes the zone, in which the session states are stored i.e. store in slimits. ### \u003Cbr>### 1m can handle 32000 sessions with 32 bytes/session, set to 5m x 32000 session ### \u003Cbr>       limit_zone slimits $binary_remote_addr 5m; \u003Cbr>  \u003Cbr>### Control maximum number of simultaneous connections for one session i.e. ### \u003Cbr>### restricts the amount of connections from a single ip address ### \u003Cbr>        limit_conn slimits 5; \u003Cbr>上面表示限制每个远程IP地址的客户端同时打开连接不能超过5个。 \u003Cbr>十、只允许我们的域名的访问 \u003Cbr>如果机器人只是随机扫描服务器的所有域名，那拒绝这个请求。你必须允许配置的虚拟域或反向代理请求。你不必使用IP地址来拒绝。 \u003Cbr>\u003Cbr>\u003Cbr>## Only requests to our Host are allowed i.e. nixcraft.in, images.nixcraft.in and \u003Ca href=\"http://www.nixcraft.in/\" target=\"_blank\">www.nixcraft.in\u003C/a> \u003Cbr>      if ($host !~ ^(nixcraft.in|\u003Ca href=\"http://www.nixcraft.in%7Cimages.nixcraft.in/\" target=\"_blank\">www.nixcraft.in|images.nixcraft.in\u003C/a>)$ ) { \u003Cbr>         return 444; \u003Cbr>      } \u003Cbr>## \u003Cbr>十一、限制可用的请求方法 \u003Cbr>GET和POST是互联网上最常用的方法。 Web服务器的方法被定义在RFC 2616。如果Web服务器不要求启用所有可用的方法，它们应该被禁用。下面的指令将过滤只允许GET，HEAD和POST方法： \u003Cbr>## Only allow these request methods ## \u003Cbr>     if ($request_method !~ ^(GET|HEAD|POST)$ ) { \u003Cbr>         return 444; \u003Cbr>     } \u003Cbr>## Do not accept DELETE, SEARCH and other methods ## \u003Cbr>更多关于HTTP方法的介绍 \u003Cbr>GET方法是用来请求，如文件\u003Ca href=\"https://www.centos.bz/index.php\" target=\"_blank\">https://www.centos.bz/index.php\u003C/a>。 \u003Cbr>HEAD方法是一样的，除非该服务器的GET请求无法返回消息体。 \u003Cbr>POST方法可能涉及到很多东西，如储存或更新数据，或订购产品，或通过提交表单发送电子邮件。这通常是使用服务器端处理，如PHP，Perl和Python等脚本。如果你要上传的文件和在服务器处理数据，你必须使用这个方法。 \u003Cbr>十二、如何拒绝一些User-Agents？ \u003Cbr>你可以很容易地阻止User-Agents,如扫描器，机器人以及滥用你服务器的垃圾邮件发送者。 \u003Cbr>## Block download agents ## \u003Cbr>     if ($http_user_agent ~* LWP::Simple|BBBike|wget) { \u003Cbr>            return 403; \u003Cbr>     } \u003Cbr>## \u003Cbr>阻止Soso和有道的机器人： \u003Cbr>## Block some robots ## \u003Cbr>     if ($http_user_agent ~* Sosospider|YodaoBot) { \u003Cbr>            return 403; \u003Cbr>     } \u003Cbr>十三、如何防止图片盗链 \u003Cbr>图片或HTML盗链的意思是有人直接用你网站的图片地址来显示在他的网站上。最终的结果，你需要支付额外的宽带费用。这通常是在论坛和博客。我强烈建议您封锁，并阻止盗链行为。 \u003Cbr># Stop deep linking or hot linking \u003Cbr>location /images/ { \u003Cbr>  valid_referers none blocked \u003Ca href=\"http://www.example.com/\" target=\"_blank\">www.example.com\u003C/a> example.com; \u003Cbr>   if ($invalid_referer) { \u003Cbr>     return   403; \u003Cbr>   } \u003Cbr>} \u003Cbr>例如：重定向并显示指定图片 \u003Cbr>valid_referers blocked \u003Ca href=\"http://www.example.com/\" target=\"_blank\">www.example.com\u003C/a> example.com; \u003Cbr> if ($invalid_referer) { \u003Cbr>  rewrite ^/images/uploads.*\\.(gif|jpg|jpeg|png)$ \u003Ca href=\"http://www.examples.com/banned.jpg\" target=\"_blank\">http://www.examples.com/banned.jpg\u003C/a> last \u003Cbr> } \u003Cbr>十四、目录限制 \u003Cbr>你可以对指定的目录设置访问权限。所有的网站目录应该一一的配置，只允许必须的目录访问权限。 \u003Cbr>通过IP地址限制访问 \u003Cbr>你可以通过IP地址来限制访问目录/admin/: \u003Cbr>location /docs/ { \u003Cbr>  ## block one workstation \u003Cbr>  deny    192.168.1.1; \u003Cbr>  \u003Cbr>  ## allow anyone in 192.168.1.0/24 \u003Cbr>  allow   192.168.1.0/24; \u003Cbr>  \u003Cbr>  ## drop rest of the world \u003Cbr>  deny    all; \u003Cbr>} \u003Cbr>通过密码保护目录 \u003Cbr>首先创建密码文件并增加“user”用户： \u003Cbr>mkdir /usr/local/nginx/conf/.htpasswd/ \u003Cbr> htpasswd -c /usr/local/nginx/conf/.htpasswd/passwd user \u003Cbr>编辑nginx.conf,加入需要保护的目录： \u003Cbr>### Password Protect /personal-images/ and /delta/ directories ### \u003Cbr>location ~ /(personal-images/.*|delta/.*) { \u003Cbr>  auth_basic  \"Restricted\"; \u003Cbr>  auth_basic_user_file   /usr/local/nginx/conf/.htpasswd/passwd; \u003Cbr>} \u003Cbr>一旦密码文件已经生成，你也可以用以下的命令来增加允许访问的用户： \u003Cbr>htpasswd -s /usr/local/nginx/conf/.htpasswd/passwd userName \u003Cbr>十五、Nginx SSL配置 \u003Cbr>HTTP是一个纯文本协议，它是开放的被动监测。你应该使用SSL来加密你的用户内容。 \u003Cbr>创建SSL证书 \u003Cbr>执行以下命令： \u003Cbr>cd /usr/local/nginx/conf \u003Cbr>openssl genrsa -des3 -out server.key 1024 \u003Cbr>openssl req -new -key server.key -out server.csr \u003Cbr>cp server.key server.key.org \u003Cbr>openssl rsa -in server.key.org -out server.key \u003Cbr>openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt \u003Cbr>编辑nginx.conf并按如下来更新： \u003Cbr>server { \u003Cbr>    server_name example.com; \u003Cbr>    listen 443; \u003Cbr>    ssl on; \u003Cbr>    ssl_certificate /usr/local/nginx/conf/server.crt; \u003Cbr>    ssl_certificate_key /usr/local/nginx/conf/server.key; \u003Cbr>    access_log /usr/local/nginx/logs/ssl.access.log; \u003Cbr>    error_log /usr/local/nginx/logs/ssl.error.log; \u003Cbr>} \u003Cbr>重启nginx: \u003Cbr>/usr/local/nginx/sbin/nginx -s reload \u003Cbr>十六、Nginx与PHP安全建议 \u003Cbr>PHP是流行的服务器端脚本语言之一。如下编辑/etc/php.ini文件： \u003Cbr># Disallow dangerous functions \u003Cbr>disable_functions = phpinfo, system, mail, exec \u003Cbr>  \u003Cbr>## Try to limit resources  ## \u003Cbr>  \u003Cbr># Maximum execution time of each script, in seconds \u003Cbr>max_execution_time = 30 \u003Cbr>  \u003Cbr># Maximum amount of time each script may spend parsing request data \u003Cbr>max_input_time = 60 \u003Cbr>  \u003Cbr># Maximum amount of memory a script may consume (8MB) \u003Cbr>memory_limit = 8M \u003Cbr>  \u003Cbr># Maximum size of POST data that PHP will accept. \u003Cbr>post_max_size = 8M \u003Cbr>  \u003Cbr># Whether to allow HTTP file uploads. \u003Cbr>file_uploads = Off \u003Cbr>  \u003Cbr># Maximum allowed size for uploaded files. \u003Cbr>upload_max_filesize = 2M \u003Cbr>  \u003Cbr># Do not expose PHP error messages to external users \u003Cbr>display_errors = Off \u003Cbr>  \u003Cbr># Turn on safe mode \u003Cbr>safe_mode = On \u003Cbr>  \u003Cbr># Only allow access to executables in isolated directory \u003Cbr>safe_mode_exec_dir = php-required-executables-path \u003Cbr>  \u003Cbr># Limit external access to PHP environment \u003Cbr>safe_mode_allowed_env_vars = PHP_ \u003Cbr>  \u003Cbr># Restrict PHP information leakage \u003Cbr>expose_php = Off \u003Cbr>  \u003Cbr># Log all errors \u003Cbr>log_errors = On \u003Cbr>  \u003Cbr># Do not register globals for input data \u003Cbr>register_globals = Off \u003Cbr>  \u003Cbr># Minimize allowable PHP post size \u003Cbr>post_max_size = 1K \u003Cbr>  \u003Cbr># Ensure PHP redirects appropriately \u003Cbr>cgi.force_redirect = 0 \u003Cbr>  \u003Cbr># Disallow uploading unless necessary \u003Cbr>file_uploads = Off \u003Cbr>  \u003Cbr># Enable SQL safe mode \u003Cbr>sql.safe_mode = On \u003Cbr>  \u003Cbr># Avoid Opening remote files \u003Cbr>allow_url_fopen = Off \u003Cbr>十七、Nginx运行在chroot监狱 \u003Cbr>把nginx放在一个chroot监狱以减小潜在的非法进入其它目录。你可以使用传统的与nginx一起安装的chroot。如果可能，那使用FreeBSD jails，Xen，OpenVZ虚拟化的容器概念。 \u003Cbr>十八、在防火墙级限制每个IP的连接数 \u003Cbr>网络服务器必须监视连接和每秒连接限制。PF和Iptales都能够在进入你的nginx服务器之前阻止最终用户的访问。 \u003Cbr>Linux Iptables:限制每次Nginx连接数 \u003Cbr>下面的例子会阻止来自一个IP的60秒钟内超过15个连接端口80的连接数。 \u003Cbr>/sbin/iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set \u003Cbr>/sbin/iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60  --hitcount 15 -j DROP \u003Cbr>service iptables save \u003Cbr>请根据你的具体情况来设置限制的连接数。 \u003Cbr>十九：保护Web服务器 \u003Cbr>像以上介绍的启动SELinux.正确设置/nginx文档根目录的权限。Nginx以用户nginx运行。但是根目录（/nginx或者/usr/local/nginx/html）不应该设置属于用户nginx或对用户nginx可写。找出错误权限的文件可以使用如下命令： \u003Cbr>find /nginx -user nginx \u003Cbr>find /usr/local/nginx/html -user nginx \u003Cbr>确保你更所有权为root或其它用户，一个典型的权限设置 /usr/local/nginx/html/ \u003Cbr>ls -l /usr/local/nginx/html/ \u003Cbr>示例输出： \u003Cbr>-rw-r--r-- 1 root root 925 Jan  3 00:50 error4xx.html \u003Cbr>-rw-r--r-- 1 root root  52 Jan  3 10:00 error5xx.html \u003Cbr>-rw-r--r-- 1 root root 134 Jan  3 00:52 index.html \u003Cbr>你必须删除由vi或其它文本编辑器创建的备份文件： \u003Cbr>find /nginx -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*' \u003Cbr>find /usr/local/nginx/html/ -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*' \u003Cbr>通过find命令的-delete选项来删除这些文件。 \u003Cbr>二十、限制Nginx连接传出 \u003Cbr>黑客会使用工具如wget下载你服务器本地的文件。使用Iptables从nginx用户来阻止传出连接。ipt_owner模块试图匹配本地产生的数据包的创建者。下面的例子中只允许user用户在外面使用80连接。 \u003Cbr>/sbin/iptables -A OUTPUT -o eth0 -m owner --uid-owner vivek -p tcp --dport 80 -m state --state NEW,ESTABLISHED  -j ACCEPT\u003C/font>\u003C/font>\u003C/p>","Nginx是一个轻量级的，高性能的Web服务器以及反向代理和邮箱(IMAP/POP3)代理服务器。它运行在UNIX,GNU/Linux,BSD各种版本，Mac OS X,Solaris和Windows。根据调查统计，6%的网站使用Nginx Web服务器。Nginx是少数能处理C10K问题的服务器之一。跟传统的服务器不同，Nginx不依赖线程来处理请求。相反，它使用了更多的可扩展的事件驱动（异步）架构。Nginx为一些高流量的网站提供动力，比如WordPress,人人网，腾讯，网易等。这篇文章主要是介绍如何提高运行在Linux或UNIX系统的Nginx Web服务器的安全性。\n\n默认配置文件和Nginx端口\n\n/usr/local/nginx/conf/ – Nginx配置文件目录，/usr/local/nginx/conf/nginx.conf是主配置文件\n\n/usr/local/nginx/html/ – 默认网站文件位置\n\n/usr/local/nginx/logs/ – 默认日志文件位置\n\nNginx HTTP默认端口 : TCP 80\n\nNginx HTTPS默认端口: TCP 443\n\n你可以使用以下命令来测试Nginx配置文件准确性。\n\n/usr/local/nginx/sbin/nginx -t\n\n将会输出。\n\nthe configuration file /usr/local/nginx/conf/nginx.conf syntax is ok\n\nconfiguration file /usr/local/nginx/conf/nginx.conf test is successful\n\n执行以下命令来重新加载配置文件。\n\n/usr/local/nginx/sbin/nginx -s reload\n\n执行以下命令来停止服务器。\n\n/usr/local/nginx/sbin/nginx -s stop\n\n一、配置SELinux\n\n安全增强型Linux（SELinux）的是一个Linux内核的功能，它提供支持访问控制的安全政策保护机制。它可以大部分的攻击。下面我们来看如何启动基于CentOS/RHEL系统的SELinux。\n\n安装SELinux\n\nrpm -qa | grep selinux\n\nlibselinux-1.23.10-2\n\nselinux-policy-targeted-1.23.16-6\n\n如果没有返回任何结果，代表没有安装 SELinux，如果返回了类似上面的结果，则说明系统安装了 SELinux。\n\n布什值锁定\n\n运行命令getsebool -a来锁定系统。\n\ngetsebool -a | less\n\ngetsebool -a | grep off\n\ngetsebool -a | grep o\n\n二、通过分区挂载允许最少特权\n\n服务器上的网页/html/php文件单独分区。例如，新建一个分区/dev/sda5(第一逻辑分区)，并且挂载在/nginx。确保/nginx是以noexec, nodev and nosetuid的权限挂载。以下是我的/etc/fstab的挂载/nginx的信息：\n\nLABEL=/nginx /nginx ext3 defaults,nosuid,noexec,nodev 1 2\n\n注意：你需要使用fdisk和mkfs.ext3命令创建一个新分区。\n\n三、配置/etc/sysctl.conf强化Linux安全\n\n你可以通过编辑/etc/sysctl.conf来控制和配置Linux内核、网络设置。\n\n# Avoid a smurf attack\n\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\n\n# Turn on protection for bad icmp error messages\n\nnet.ipv4.icmp_ignore_bogus_error_responses = 1\n\n# Turn on syncookies for SYN flood attack protection\n\nnet.ipv4.tcp_syncookies = 1\n\n# Turn on and log spoofed, source routed, and redirect packets\n\nnet.ipv4.conf.all.log_martians = 1\n\nnet.ipv4.conf.default.log_martians = 1\n\n# No source routed packets here\n\nnet.ipv4.conf.all.accept_source_route = 0\n\nnet.ipv4.conf.default.accept_source_route = 0\n\n# Turn on reverse path filtering\n\nnet.ipv4.conf.all.rp_filter = 1\n\nnet.ipv4.conf.default.rp_filter = 1\n\n# Make sure no one can alter the routing tables\n\nnet.ipv4.conf.all.accept_redirects = 0\n\nnet.ipv4.conf.default.accept_redirects = 0\n\nnet.ipv4.conf.all.secure_redirects = 0\n\nnet.ipv4.conf.default.secure_redirects = 0\n\n# Don't act as a router\n\nnet.ipv4.ip_forward = 0\n\nnet.ipv4.conf.all.send_redirects = 0\n\nnet.ipv4.conf.default.send_redirects = 0\n\n# Turn on execshild\n\nkernel.exec-shield = 1\n\nkernel.randomize_va_space = 1\n\n# Tuen IPv6\n\nnet.ipv6.conf.default.router_solicitations = 0\n\nnet.ipv6.conf.default.accept_ra_rtr_pref = 0\n\nnet.ipv6.conf.default.accept_ra_pinfo = 0\n\nnet.ipv6.conf.default.accept_ra_defrtr = 0\n\nnet.ipv6.conf.default.autoconf = 0\n\nnet.ipv6.conf.default.dad_transmits = 0\n\nnet.ipv6.conf.default.max_addresses = 1\n\n# Optimization for port usefor LBs\n\n# Increase system file descriptor limit\n\nfs.file-max = 65535\n\n# Allow for more PIDs (to reduce rollover problems); may break some programs 32768\n\nkernel.pid_max = 65536\n\n# Increase system IP port limits\n\nnet.ipv4.ip_local_port_range = 2000 65000\n\n# Increase TCP max buffer size setable using setsockopt()\n\nnet.ipv4.tcp_rmem = 4096 87380 8388608\n\nnet.ipv4.tcp_wmem = 4096 87380 8388608\n\n# Increase Linux auto tuning TCP buffer limits\n\n# min, default, and max number of bytes to use\n\n# set max to at least 4MB, or higher if you use very high BDP paths\n\n# Tcp Windows etc\n\nnet.core.rmem_max = 8388608\n\nnet.core.wmem_max = 8388608\n\nnet.core.netdev_max_backlog = 5000\n\nnet.ipv4.tcp_window_scaling = 1\n\n四、删除所有不需要的Nginx模块\n\n你需要直接通过编译Nginx源代码使模块数量最少化。通过限制只允许web服务器访问模块把风险降到最低。你可以只配置安装nginx你所需要的模块。例如，禁用SSL和autoindex模块你可以执行以下命令：\n\n./configure --without-http_autoindex_module --without-http_ssi_module\n\nmake\n\nmake install\n\n通过以下命令来查看当编译nginx服务器时哪个模块能开户或关闭：\n\n./configure --help | less\n\n禁用你用不到的nginx模块。\n\n（可选项）更改nginx版本名称。\n\n编辑文件/http/ngx_http_header_filter_module.c：\n\nvi +48 src/http/ngx_http_header_filter_module.c\n\n找到行：\n\nstatic char ngx_http_server_string[] = \"Server: nginx\" CRLF;\n\nstatic char ngx_http_server_full_string[] = \"Server: \" NGINX_VER CRLF;\n\n按照以下行修改：\n\nstatic char ngx_http_server_string[] = \"Server: Ninja Web Server\" CRLF;\n\nstatic char ngx_http_server_full_string[] = \"Server: Ninja Web Server\" CRLF;\n\n保存并关闭文件。现在你可以编辑服务器了。增加以下代码到nginx.conf文件来关闭nginx版本号的显示。\n\nserver_tokens off\n\n五、使用mod_security(只适合后端Apache服务器)\n\nmod_security为Apache提供一个应用程序级的防火墙。为后端Apache Web服务器安装mod_security，这会阻止很多注入式攻击。\n\n六、安装SELinux策略以强化Nginx Web服务器\n\n默认的SELinux不会保护Nginx Web服务器，但是你可以安装和编译保护软件。\n\n1、安装编译SELinux所需环境支持\n\nyum -y install selinux-policy-targeted selinux-policy-devel\n\n2、下载SELinux策略以强化Nginx Web服务器。\n\ncd /opt\n\nwget 'http://downloads.sourceforge.net/project/selinuxnginx/se-ngix_1_0_10.tar.gz?use_mirror=nchc'\n\n3、解压文件\n\ntar -zxvf se-ngix_1_0_10.tar.gz\n\n4、编译文件\n\ncd se-ngix_1_0_10/nginx\n\nmake\n\n将会输出如下：\n\nCompiling targeted nginx module\n\n/usr/bin/checkmodule: loading policy configuration from tmp/nginx.tmp\n\n/usr/bin/checkmodule: policy configuration loaded\n\n/usr/bin/checkmodule: writing binary representation (version 6) to tmp/nginx.mod\n\nCreating targeted nginx.pp policy package\n\nrm tmp/nginx.mod.fc tmp/nginx.mod\n\n5、安装生成的nginx.pp SELinux模块：\n\n/usr/sbin/semodule -i nginx.pp\n\n七、基于Iptables防火墙的限制\n\n下面的防火墙脚本阻止任何除了允许：\n\n来自HTTP(TCP端口80)的请求\n\n来自ICMP ping的请求\n\nntp(端口123)的请求输出\n\nsmtp(TCP端口25)的请求输出\n\n#!/bin/bash\n\nIPT=\"/sbin/iptables\"\n\n#### IPS ######\n\n# Get server public ip\n\nSERVER_IP=$(ifconfig eth0 | grep 'inet addr:' | awk -F'inet addr:' '{ print $2}' | awk '{ print $1}')\n\nLB1_IP=\"204.54.1.1\"\n\nLB2_IP=\"204.54.1.2\"\n\n# Do some smart logic so that we can use damm script on LB2 too\n\nOTHER_LB=\"\"\n\nSERVER_IP=\"\"\n\n[[ \"$SERVER_IP\" == \"$LB1_IP\" ]] && OTHER_LB=\"$LB2_IP\" || OTHER_LB=\"$LB1_IP\"\n\n[[ \"$OTHER_LB\" == \"$LB2_IP\" ]] && OPP_LB=\"$LB1_IP\" || OPP_LB=\"$LB2_IP\"\n\n### IPs ###\n\nPUB_SSH_ONLY=\"122.xx.yy.zz/29\"\n\n#### FILES #####\n\nBLOCKED_IP_TDB=/root/.fw/blocked.ip.txt\n\nSPOOFIP=\"127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 169.254.0.0/16 0.0.0.0/8 240.0.0.0/4 255.255.255.255/32 168.254.0.0/16 224.0.0.0/4 240.0.0.0/5 248.0.0.0/5 192.0.2.0/24\"\n\nBADIPS=$( [[ -f ${BLOCKED_IP_TDB} ]] && egrep -v \"^#|^$\" ${BLOCKED_IP_TDB})\n\n### Interfaces ###\n\nPUB_IF=\"eth0\"   # public interface\n\nLO_IF=\"lo\"      # loopback\n\nVPN_IF=\"eth1\"   # vpn / private net\n\n### start firewall ###\n\necho \"Setting LB1 $(hostname) Firewall...\"\n\n# DROP and close everything\n\n$IPT -P INPUT DROP\n\n$IPT -P OUTPUT DROP\n\n$IPT -P FORWARD DROP\n\n# Unlimited lo access\n\n$IPT -A INPUT -i ${LO_IF} -j ACCEPT\n\n$IPT -A OUTPUT -o ${LO_IF} -j ACCEPT\n\n# Unlimited vpn / pnet access\n\n$IPT -A INPUT -i ${VPN_IF} -j ACCEPT\n\n$IPT -A OUTPUT -o ${VPN_IF} -j ACCEPT\n\n# Drop sync\n\n$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP\n\n# Drop Fragments\n\n$IPT -A INPUT -i ${PUB_IF} -f -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP\n\n# Drop NULL packets\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" NULL Packets \"\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP\n\n# Drop XMAS\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" XMAS Packets \"\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP\n\n# Drop FIN packet scans\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" Fin Packets Scan \"\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP\n\n# Log and get rid of broadcast / multicast and invalid\n\n$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type broadcast -j LOG --log-prefix \" Broadcast \"\n\n$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type broadcast -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type multicast -j LOG --log-prefix \" Multicast \"\n\n$IPT  -A INPUT -i ${PUB_IF} -m pkttype --pkt-type multicast -j DROP\n\n$IPT  -A INPUT -i ${PUB_IF} -m state --state INVALID -j LOG --log-prefix \" Invalid \"\n\n$IPT  -A INPUT -i ${PUB_IF} -m state --state INVALID -j DROP\n\n# Log and block spoofed ips\n\n$IPT -N spooflist\n\nfor ipblock in $SPOOFIP\n\ndo\n\n        $IPT -A spooflist -i ${PUB_IF} -s $ipblock -j LOG --log-prefix \" SPOOF List Block \"\n\n        $IPT -A spooflist -i ${PUB_IF} -s $ipblock -j DROP\n\ndone\n\n$IPT -I INPUT -j spooflist\n\n$IPT -I OUTPUT -j spooflist\n\n$IPT -I FORWARD -j spooflist\n\n# Allow ssh only from selected public ips\n\nfor ip in ${PUB_SSH_ONLY}\n\ndo\n\n       $IPT -A INPUT -i ${PUB_IF} -s ${ip} -p tcp -d ${SERVER_IP} --destination-port 22 -j ACCEPT\n\n       $IPT -A OUTPUT -o ${PUB_IF} -d ${ip} -p tcp -s ${SERVER_IP} --sport 22 -j ACCEPT\n\ndone\n\n# allow incoming ICMP ping pong stuff\n\n$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -m limit --limit 30/sec  -j ACCEPT\n\n$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# allow incoming HTTP port 80\n\n$IPT -A INPUT -i ${PUB_IF} -p tcp -s 0/0 --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT\n\n$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT\n\n# allow outgoing ntp\n\n$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT\n\n$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT\n\n# allow outgoing smtp\n\n$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT\n\n$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT\n\n### add your other rules here ####\n\n#######################\n\n# drop and log everything else\n\n$IPT -A INPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix \" DEFAULT DROP \"\n\n$IPT -A INPUT -j DROP\n\nexit 0\n\n八、控制缓冲区溢出攻击\n \n编辑nginx.conf，为所有客户端设置缓冲区的大小限制。 \nvi /usr/local/nginx/conf/nginx.conf \n编辑和设置所有客户端缓冲区的大小限制如下： \n## Start: Size Limits & Buffer Overflows ## \n  client_body_buffer_size  1K; \n  client_header_buffer_size 1k; \n  client_max_body_size 1k; \n  large_client_header_buffers 2 1k; \n ## END: Size Limits & Buffer Overflows ## \n解释： \n1、client_body_buffer_size 1k-（默认8k或16k）这个指令可以指定连接请求实体的缓冲区大小。如果连接请求超过缓存区指定的值，那么这些请求实体的整体或部分将尝试写入一个临时文件。 \n2、client_header_buffer_size 1k-指令指定客户端请求头部的缓冲区大小。绝大多数情况下一个请求头不会大于1k，不过如果有来自于wap客户端的较大的cookie它可能会大于1k，Nginx将分配给它一个更大的缓冲区，这个值可以在large_client_header_buffers里面设置。 \n3、client_max_body_size 1k-指令指定允许客户端连接的最大请求实体大小，它出现在请求头部的Content-Length字段。 \n如果请求大于指定的值，客户端将收到一个”Request Entity Too Large” (413)错误。记住，浏览器并不知道怎样显示这个错误。 \n4、large_client_header_buffers-指定客户端一些比较大的请求头使用的缓冲区数量和大小。请求字段不能大于一个缓冲区大小，如果客户端发送一个比较大的头，nginx将返回”Request URI too large” (414)\n同样，请求的头部最长字段不能大于一个缓冲区，否则服务器将返回”Bad request” (400)。缓冲区只在需求时分开。默认一个缓冲区大小为操作系统中分页文件大小，通常是4k或8k，如果一个连接请求最终将状态转换为keep-alive，它所占用的缓冲区将被释放。 \n你还需要控制超时来提高服务器性能并与客户端断开连接。按照如下编辑： \n## Start: Timeouts ## \n  client_body_timeout   10; \n  client_header_timeout 10; \n  keepalive_timeout     5 5; \n  send_timeout          10; \n## End: Timeouts ## \n1、client_body_timeout 10;-指令指定读取请求实体的超时时间。这里的超时是指一个请求实体没有进入读取步骤，如果连接超过这个时间而客户端没有任何响应，Nginx将返回一个”Request time out” (408)错误。 \n2、client_header_timeout 10;-指令指定读取客户端请求头标题的超时时间。这里的超时是指一个请求头没有进入读取步骤，如果连接超过这个时间而客户端没有任何响应，Nginx将返回一个”Request time out” (408)错误。 \n3、keepalive_timeout 5 5; – 参数的第一个值指定了客户端与服务器长连接的超时时间，超过这个时间，服务器将关闭连接。参数的第二个值（可选）指定了应答头中Keep-Alive: timeout=time的time值，这个值可以使一些浏览器知道什么时候关闭连接，以便服务器不用重复关闭，如果不指定这个参数，nginx不会在应答头中发送Keep-Alive信息。（但这并不是指怎样将一个连接“Keep-Alive”）参数的这两个值可以不相同。 \n4、send_timeout 10; 指令指定了发送给客户端应答后的超时时间，Timeout是指没有进入完整established状态，只完成了两次握手，如果超过这个时间客户端没有任何响应，nginx将关闭连接。 \n九、控制并发连接 \n你可以使用NginxHttpLimitZone模块来限制指定的会话或者一个IP地址的特殊情况下的并发连接。编辑nginx.conf: \n### Directive describes the zone, in which the session states are stored i.e. store in slimits. ### \n### 1m can handle 32000 sessions with 32 bytes/session, set to 5m x 32000 session ### \n       limit_zone slimits $binary_remote_addr 5m; \n  \n### Control maximum number of simultaneous connections for one session i.e. ### \n### restricts the amount of connections from a single ip address ### \n        limit_conn slimits 5; \n上面表示限制每个远程IP地址的客户端同时打开连接不能超过5个。 \n十、只允许我们的域名的访问 \n如果机器人只是随机扫描服务器的所有域名，那拒绝这个请求。你必须允许配置的虚拟域或反向代理请求。你不必使用IP地址来拒绝。 \n\n## Only requests to our Host are allowed i.e. nixcraft.in, images.nixcraft.in and [www.nixcraft.in](http://www.nixcraft.in/) \n      if ($host !~ ^(nixcraft.in|[www.nixcraft.in|images.nixcraft.in](http://www.nixcraft.in%7Cimages.nixcraft.in/))$ ) { \n         return 444; \n      } \n## \n十一、限制可用的请求方法 \nGET和POST是互联网上最常用的方法。 Web服务器的方法被定义在RFC 2616。如果Web服务器不要求启用所有可用的方法，它们应该被禁用。下面的指令将过滤只允许GET，HEAD和POST方法： \n## Only allow these request methods ## \n     if ($request_method !~ ^(GET|HEAD|POST)$ ) { \n         return 444; \n     } \n## Do not accept DELETE, SEARCH and other methods ## \n更多关于HTTP方法的介绍 \nGET方法是用来请求，如文件[https://www.centos.bz/index.php](https://www.centos.bz/index.php)。 \nHEAD方法是一样的，除非该服务器的GET请求无法返回消息体。 \nPOST方法可能涉及到很多东西，如储存或更新数据，或订购产品，或通过提交表单发送电子邮件。这通常是使用服务器端处理，如PHP，Perl和Python等脚本。如果你要上传的文件和在服务器处理数据，你必须使用这个方法。 \n十二、如何拒绝一些User-Agents？ \n你可以很容易地阻止User-Agents,如扫描器，机器人以及滥用你服务器的垃圾邮件发送者。 \n## Block download agents ## \n     if ($http_user_agent ~* LWP::Simple|BBBike|wget) { \n            return 403; \n     } \n## \n阻止Soso和有道的机器人： \n## Block some robots ## \n     if ($http_user_agent ~* Sosospider|YodaoBot) { \n            return 403; \n     } \n十三、如何防止图片盗链 \n图片或HTML盗链的意思是有人直接用你网站的图片地址来显示在他的网站上。最终的结果，你需要支付额外的宽带费用。这通常是在论坛和博客。我强烈建议您封锁，并阻止盗链行为。 \n# Stop deep linking or hot linking \nlocation /images/ { \n  valid_referers none blocked [www.example.com](http://www.example.com/) example.com; \n   if ($invalid_referer) { \n     return   403; \n   } \n} \n例如：重定向并显示指定图片 \nvalid_referers blocked [www.example.com](http://www.example.com/) example.com; \n if ($invalid_referer) { \n  rewrite ^/images/uploads.*\\.(gif|jpg|jpeg|png)$ [http://www.examples.com/banned.jpg](http://www.examples.com/banned.jpg) last \n } \n十四、目录限制 \n你可以对指定的目录设置访问权限。所有的网站目录应该一一的配置，只允许必须的目录访问权限。 \n通过IP地址限制访问 \n你可以通过IP地址来限制访问目录/admin/: \nlocation /docs/ { \n  ## block one workstation \n  deny    192.168.1.1; \n  \n  ## allow anyone in 192.168.1.0/24 \n  allow   192.168.1.0/24; \n  \n  ## drop rest of the world \n  deny    all; \n} \n通过密码保护目录 \n首先创建密码文件并增加“user”用户： \nmkdir /usr/local/nginx/conf/.htpasswd/ \n htpasswd -c /usr/local/nginx/conf/.htpasswd/passwd user \n编辑nginx.conf,加入需要保护的目录： \n### Password Protect /personal-images/ and /delta/ directories ### \nlocation ~ /(personal-images/.*|delta/.*) { \n  auth_basic  \"Restricted\"; \n  auth_basic_user_file   /usr/local/nginx/conf/.htpasswd/passwd; \n} \n一旦密码文件已经生成，你也可以用以下的命令来增加允许访问的用户： \nhtpasswd -s /usr/local/nginx/conf/.htpasswd/passwd userName \n十五、Nginx SSL配置 \nHTTP是一个纯文本协议，它是开放的被动监测。你应该使用SSL来加密你的用户内容。 \n创建SSL证书 \n执行以下命令： \ncd /usr/local/nginx/conf \nopenssl genrsa -des3 -out server.key 1024 \nopenssl req -new -key server.key -out server.csr \ncp server.key server.key.org \nopenssl rsa -in server.key.org -out server.key \nopenssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt \n编辑nginx.conf并按如下来更新： \nserver { \n    server_name example.com; \n    listen 443; \n    ssl on; \n    ssl_certificate /usr/local/nginx/conf/server.crt; \n    ssl_certificate_key /usr/local/nginx/conf/server.key; \n    access_log /usr/local/nginx/logs/ssl.access.log; \n    error_log /usr/local/nginx/logs/ssl.error.log; \n} \n重启nginx: \n/usr/local/nginx/sbin/nginx -s reload \n十六、Nginx与PHP安全建议 \nPHP是流行的服务器端脚本语言之一。如下编辑/etc/php.ini文件： \n# Disallow dangerous functions \ndisable_functions = phpinfo, system, mail, exec \n  \n## Try to limit resources  ## \n  \n# Maximum execution time of each script, in seconds \nmax_execution_time = 30 \n  \n# Maximum amount of time each script may spend parsing request data \nmax_input_time = 60 \n  \n# Maximum amount of memory a script may consume (8MB) \nmemory_limit = 8M \n  \n# Maximum size of POST data that PHP will accept. \npost_max_size = 8M \n  \n# Whether to allow HTTP file uploads. \nfile_uploads = Off \n  \n# Maximum allowed size for uploaded files. \nupload_max_filesize = 2M \n  \n# Do not expose PHP error messages to external users \ndisplay_errors = Off \n  \n# Turn on safe mode \nsafe_mode = On \n  \n# Only allow access to executables in isolated directory \nsafe_mode_exec_dir = php-required-executables-path \n  \n# Limit external access to PHP environment \nsafe_mode_allowed_env_vars = PHP_ \n  \n# Restrict PHP information leakage \nexpose_php = Off \n  \n# Log all errors \nlog_errors = On \n  \n# Do not register globals for input data \nregister_globals = Off \n  \n# Minimize allowable PHP post size \npost_max_size = 1K \n  \n# Ensure PHP redirects appropriately \ncgi.force_redirect = 0 \n  \n# Disallow uploading unless necessary \nfile_uploads = Off \n  \n# Enable SQL safe mode \nsql.safe_mode = On \n  \n# Avoid Opening remote files \nallow_url_fopen = Off \n十七、Nginx运行在chroot监狱 \n把nginx放在一个chroot监狱以减小潜在的非法进入其它目录。你可以使用传统的与nginx一起安装的chroot。如果可能，那使用FreeBSD jails，Xen，OpenVZ虚拟化的容器概念。 \n十八、在防火墙级限制每个IP的连接数 \n网络服务器必须监视连接和每秒连接限制。PF和Iptales都能够在进入你的nginx服务器之前阻止最终用户的访问。 \nLinux Iptables:限制每次Nginx连接数 \n下面的例子会阻止来自一个IP的60秒钟内超过15个连接端口80的连接数。 \n/sbin/iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set \n/sbin/iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60  --hitcount 15 -j DROP \nservice iptables save \n请根据你的具体情况来设置限制的连接数。 \n十九：保护Web服务器 \n像以上介绍的启动SELinux.正确设置/nginx文档根目录的权限。Nginx以用户nginx运行。但是根目录（/nginx或者/usr/local/nginx/html）不应该设置属于用户nginx或对用户nginx可写。找出错误权限的文件可以使用如下命令： \nfind /nginx -user nginx \nfind /usr/local/nginx/html -user nginx \n确保你更所有权为root或其它用户，一个典型的权限设置 /usr/local/nginx/html/ \nls -l /usr/local/nginx/html/ \n示例输出： \n-rw-r--r-- 1 root root 925 Jan  3 00:50 error4xx.html \n-rw-r--r-- 1 root root  52 Jan  3 10:00 error5xx.html \n-rw-r--r-- 1 root root 134 Jan  3 00:52 index.html \n你必须删除由vi或其它文本编辑器创建的备份文件： \nfind /nginx -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*' \nfind /usr/local/nginx/html/ -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*' \n通过find命令的-delete选项来删除这些文件。 \n二十、限制Nginx连接传出 \n黑客会使用工具如wget下载你服务器本地的文件。使用Iptables从nginx用户来阻止传出连接。ipt_owner模块试图匹配本地产生的数据包的创建者。下面的例子中只允许user用户在外面使用80连接。 \n/sbin/iptables -A OUTPUT -o eth0 -m owner --uid-owner vivek -p tcp --dport 80 -m state --state NEW,ESTABLISHED  -j ACCEPT","/article/36",6189,"2016-09-09 16:59:03","2018-10-18 17:00:37",[156,157,158],{"id":39,"name":81,"url":82},{"id":44,"name":23,"url":59},{"id":145,"name":146,"url":151},{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"title":161,"url":162},"tomcat反向代理-mod_jk、mod_proxy ","/article/37",{"title":164,"url":165},"Tomcat会话集群-基于session复制的搭建 ","/article/35",[167,168,169,170],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"description":148,"keywords":147,"title":146},[173,182,191,200,209,218,227,236,245,253],{"id":174,"category_id":44,"title":175,"keywords":176,"description":177,"image_url":6,"url":178,"hits":179,"is_recommend":73,"is_top":73,"create_time":180,"update_time":181},101,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","/article/101",18546,"2019-11-26 16:12:11","2019-11-26 16:23:16",{"id":183,"category_id":44,"title":184,"keywords":185,"description":186,"image_url":6,"url":187,"hits":188,"is_recommend":73,"is_top":73,"create_time":189,"update_time":190},113,"在CentOS 7中添加命令自动补全功能","命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl","/article/113",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":192,"category_id":44,"title":193,"keywords":194,"description":195,"image_url":6,"url":196,"hits":197,"is_recommend":53,"is_top":73,"create_time":198,"update_time":199},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":201,"category_id":44,"title":202,"keywords":203,"description":204,"image_url":6,"url":205,"hits":206,"is_recommend":73,"is_top":73,"create_time":207,"update_time":208},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":210,"category_id":46,"title":211,"keywords":212,"description":213,"image_url":6,"url":214,"hits":215,"is_recommend":73,"is_top":73,"create_time":216,"update_time":217},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":219,"category_id":44,"title":220,"keywords":221,"description":222,"image_url":6,"url":223,"hits":224,"is_recommend":73,"is_top":73,"create_time":225,"update_time":226},107,"Acme.sh 给 SSL 证书自动续期失败的解决方法","HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file","/article/107",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":228,"category_id":44,"title":229,"keywords":230,"description":231,"image_url":6,"url":232,"hits":233,"is_recommend":53,"is_top":73,"create_time":234,"update_time":235},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":237,"category_id":46,"title":238,"keywords":239,"description":240,"image_url":6,"url":241,"hits":242,"is_recommend":53,"is_top":73,"create_time":243,"update_time":244},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":246,"category_id":44,"title":247,"keywords":6,"description":248,"image_url":6,"url":249,"hits":250,"is_recommend":73,"is_top":73,"create_time":251,"update_time":252},100,"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn","/article/100",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":254,"category_id":44,"title":255,"keywords":256,"description":257,"image_url":6,"url":258,"hits":259,"is_recommend":73,"is_top":73,"create_time":260,"update_time":261},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[263,271,279,287,295,303,311,319,328,337],{"id":264,"category_id":40,"title":265,"keywords":6,"description":266,"image_url":6,"url":267,"hits":268,"is_recommend":73,"is_top":73,"create_time":269,"update_time":270},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":272,"category_id":44,"title":273,"keywords":6,"description":274,"image_url":6,"url":275,"hits":276,"is_recommend":73,"is_top":73,"create_time":277,"update_time":278},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":280,"category_id":46,"title":281,"keywords":6,"description":282,"image_url":6,"url":283,"hits":284,"is_recommend":73,"is_top":73,"create_time":285,"update_time":286},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",{"id":288,"category_id":44,"title":289,"keywords":6,"description":290,"image_url":6,"url":291,"hits":292,"is_recommend":73,"is_top":73,"create_time":293,"update_time":294},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":296,"category_id":44,"title":297,"keywords":6,"description":298,"image_url":6,"url":299,"hits":300,"is_recommend":73,"is_top":73,"create_time":301,"update_time":302},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":304,"category_id":44,"title":305,"keywords":6,"description":306,"image_url":6,"url":307,"hits":308,"is_recommend":73,"is_top":73,"create_time":309,"update_time":310},118,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180","/article/118",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":312,"category_id":44,"title":313,"keywords":6,"description":314,"image_url":6,"url":315,"hits":316,"is_recommend":73,"is_top":73,"create_time":317,"update_time":318},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",{"id":320,"category_id":40,"title":321,"keywords":322,"description":323,"image_url":6,"url":324,"hits":325,"is_recommend":73,"is_top":73,"create_time":326,"update_time":327},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":329,"category_id":40,"title":330,"keywords":331,"description":332,"image_url":6,"url":333,"hits":334,"is_recommend":73,"is_top":73,"create_time":335,"update_time":336},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":183,"category_id":44,"title":184,"keywords":185,"description":186,"image_url":6,"url":187,"hits":188,"is_recommend":73,"is_top":73,"create_time":189,"update_time":190},1784716029176]