nginx服务器实验

1.实验要求

1）在Nginx服务器上搭建LNMP服务，并且能够对外提供Discuz论坛服务。
在Web1、Web2服务器上搭建Tomcat 服务。

2）为nginx服务配置虚拟主机，新增两个域名 www.kgc.com 和 www.benet.com，使用http://www.kgc.com/index.php可访问上一题的Discuz论坛页面。
使用http://www.benet.com则访问/var/www/html目录中的index.html文件的内容，内容自定义。

3）对基于www.benet.com域名的虚拟机主机的nginx服务调优：隐藏nginx版本号，缓存静态图片网页时间为1天，设置防盗链功能。

4）网关服务器搭建NFS服务，提供的文件系统使用LVM类型，共享目录名称为/opt/nfs；要求根据日期对Discuz论坛服务的访问日志进行日志分割，要求每天生成一份日志文件，保存到NFS服务共享的目录内

5）要求配置location匹配请求地址http://www.kgc.com/test/XXXX，使用户访问该路径下的文件时返回/var/share/nginx/html/目录下的文件内容。
要求使用rewrite将使用域名www.benet.com 请求以 .php 结尾的访问都跳转到域名www.kgc.com上，而且后面的参数保持不变，比如访问http://www.benet.com/bbs/index.php跳转到http://www.kgc.com/bbs/index.php。

6）在Nginx服务器上对基于www.benet.com域名的虚拟机主机设置动静分离由nginx提供静态页面服务，将对 .jsp文件的动态页面请求转发到Tomcat 服务器处理，并实现负载均衡

7）在网关服务器上设置SNAT/DNAT，使client使用网关服务器的ens36接口的IP地址访问也可实现上一题的效果。

注：IP地址自己规划

要求1

nginx搭建LNMP

#安装nginx
yum -y install epel-release
yum -y install nginx#安装mysql：
tee /etc/yum.repos.d/mysql.repo <<EOF
[mysql57-community]
name=MySQL 5.7 Community Server
baseurl=http://repo.mysql.com/yum/mysql-5.7-community/el/7/x86_64/
enabled=1
gpgcheck=0
EOFyum clean all &&yum makecacheyum -y install mysql-community-server
systemctl start mysqld#进入mysql数据库，第一次密码是默认密码
mysql-uroot -p 
grep "password" /var/log/mysql.log
2025-05-09T08:30:52.285182Z 1 [Note] A temporary password is generated for r                                                                                                          oot@localhost: wUtlmd-q;6<V
mysql -uroot -p'wUtlmd-q;6<V'#每个密码都是不一样的，需要自己查看自己的默认密码#修改数据库密码为“abc123”
set global validate_password_policy=0;
set global validate_password_length=1;
alter user root@'localhost' identified by 'abc123';
#使用ctrl+d#编译安装php，需要php-7.1.10.tar.bz2压缩包：
#安装环境
yum -y install gd \
libjpeg libjpeg-devel \
libpng libpng-devel \
freetype freetype-devel \
libxml2 libxml2-devel \
zlib zlib-devel \
curl curl-devel \
openssl openssl-devel#解压安装包，编译并安装
tar xf php-7.1.10.tar.bz2
cd php-7.1.10
./configure \
--prefix=/usr/local/php \
--with-mysql-sock=/usr/local/mysql/mysql.sock \
--with-mysqli \
--with-zlib \
--with-curl \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-freetype-dir \
--with-openssl \
--enable-fpm \
--enable-mbstring \
--enable-xml \
--enable-session \
--enable-ftp \
--enable-pdo \
--enable-tokenizer \
--enable-zipmake&&make install#将php写入PATH
ln -s /usr/local/php/bin/* /usr/local/bin/
ln -s /usr/local/php/sbin/* /usr/local/sbin/#调整配置文件
cp /opt/php-7.1.10/php.ini-development  /usr/local/php/lib/php.ini
vim /usr/local/php/lib/php.ini
#939行
date.timezone = Asia/Shanghai
#1170行
mysqli.default_socket = /var/lib/mysql/mysql.sockcd /usr/local/php/etc/
cp php-fpm.conf.default php-fpm.conf
cd php-fpm.d
cp www.conf.default www.conf
cp /opt/php-7.1.10/sapi/fpm/php-fpm.service   /usr/lib/systemd/system/php-fpm.servicesystemctl daemon-reload
systemctl start php-fpm.service
systemctl status nginx mysqld php-fpmvim /etc/nginx/nignx.conf#server模块下
index index.html index.htm index.php;
....
location ~ \.php$ {
root           html;
fastcgi_pass   127.0.0.1:9000;
fastcgi_index  index.php;
fastcgi_param  SCRIPT_FILENAME  /usr/share/nginx/html$fastcgi_script_name;
include        fastcgi_params;mysql -uroot -p '密码'
CREATE DATABASE bbs;
set global validate_password_policy=0;
set global validate_password_length=1;
GRANT all ON bbs.* TO 'bbsuser'@'%' IDENTIFIED BY 'admin123';
GRANT all ON bbs.* TO 'bbsuser'@'localhost' IDENTIFIED BY 'admin123';
flush privileges;
show databases;安装论坛，准备Discuz_X3.4_SC_UTF8.zip压缩包：
unaip  Discuz_X3.4_SC_UTF8.zip
cp -a dir_SC_UTF8/upload  /usr/share/nginx/html/bbscd /usr/share/nginx/html/bbs
chown -R nobody ./config/
chown -R nobody ./data/
chown -R nobody ./uc_client/
chown -R nobody ./uc_server/访问http://IP地址/bbs  

#创建数据库页面
数据库用户名 :bbsuser (mysql数据库里设定)
数据库密码：admin123(mysql数据库里设定)
...
管理员密码：abc123
二次确认：abc123

搭建tomcat

准备jdk-8u201-linux-x64.rpm；apache-tomcat-9.0.16.tar.gz2个压缩包
tar xf jdk-8u201-linux-x64.rpm -C /usr/local/
tar xf apache-tomcat-9.0.16.tar.gz -C /usr/local/cd /usr/local/
ln -s /usr/local/jdk1.8.0_291/ ./jdk
ln -s /usr/local/apache-tomcat-9.0.16/ ./tomcat
vim /etc/profile.d/jdk.shexport JAVA_HOME=/usr/local/jdk
export PATH=$JAVA_HOME/bin:$PATH
export JRE_HOME=$JAVA_HOME/jre
export CLASSPATH=$JAVA_HOME/lib:$JRE_HOME/libsource /etc/profile.d/jdk.shtomcat安装：
useradd -M -s /sbin/nologin tomcat
chown -R tomcat:tomcat /usr/local/apache-tomcat-9.0.16/
vim /usr/lib/systemd/system/tomcat.service[Unit]
Description=Tomcat
After=syslog.target network.target[Service]
Type=forking
Environment=PATH=$PATH:$JAVA_HOME/bin
Environment=CLASSPATH=/usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
Environment=CATALINA_HOME=/usr/local/tomcat
Environment=JAVA_HOME=/usr/local/jdk
Environment=CATALINA_HOME=/usr/local/tomcat
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/jdk/bin
ExecStart=/usr/local/tomcat/bin/startup.sh
ExecStop=/usr/local/tomcat/bin/shutdown.sh
RestartSec=3
PrivateTmp=true
User=tomcat
Group=tomcat[Install]
WantedBy=multi-user.targetsystemctl daemon-reload
systemctl start tomcat
systemctl status tomcat测试：
访问此IP地址的8080端口

要求2

vim /etc/nginx/nginx.conf
#添加到server模块下
include /etc/nginx/conf.d/*.confmkdir -p /etc/nginx/conf.d/
touch kgc.conf benet.conf#定义www.kgc.com
vim /etc/nginx/conf.d/kgc.conf server{
listen 80;
server_name www.kgc.com;
root /usr/share/nginx/html;
index index.html index.htm index.php;
location = /index.php {
rewrite .* http://www.kgc.com/bbs/;
}
location ~ \.php$ {root           html;fastcgi_pass   127.0.0.1:9000;fastcgi_index  index.php;fastcgi_param  SCRIPT_FILENAME /usr/share/nginx/html$fastcgi_script_name;include        fastcgi_params;}
}#定义www.benet.com域名
vim /etc/nginx/conf.d/benet.confserver{
listen 80;
server_name www.benet.com;
root /var/www/html;
}vim /var/www/html/index.htmlni hao zhe li shi benetnginx -t &&nginx -s reload

如果想使用真机浏览器访问www.benet.com或者www.kgc.com：

访问结果：

要求3

vim /etc/nginx/conf.d/benet.conf#http模块下
server_tokens off;
expires 1d;
server{
listen 80;
server_name www.benet.com;
root /var/www/html;
location ~* \.(jpg|gif|swf|jpeg|bmp)$ {
root  /var/www/html;
valid_referers none blocked *.kgc.com kgc.com;
if ( $invalid_referer ) {
rewrite ^/ http://www.benet.com/error.jpg;
#return   403;
}
}
location = /error.jpg {
root /var/www/html;
}
}cd /var/www/html
创建a.jpg;error.jpg文件可以使用其他带有nginx服务器的设备
vim /.../nginx/html/index.html
<img src="http://被盗图的IP地址/a.jpg"/>

访问www.benet.com/a.jpg，再访问新的nginx设备

改变配置文件为返回403状态码。

要求4

网关服务器：
vgcreate lvm /dev/sdb /dev/sdc /dev/sdd
lvcreate -n lvm -L 35G lvm
mkfs.xfs /dev/lvm/lvm
mkdir /opt/lvm
mount /dev/lvm/lvm /opt/lvmvim /etc/exports
/opt/lvm *(rw)exportfs -r
exportfs -v
chmod 777 /opt/lvm 
systemctl restart nfs nginx服务器：mkdir /opt/lvm
mount 192.168.174.190:/opt/lvm /opt/lvm
vim access.sh#制作脚本#!/bin/bash
y=`date | awk '{print $2}'`
mkdir /opt/lvm/$y &> /dev/null
if [ -e /var/log/nginx/access.log ]
thenmv /var/log/nginx/access.log /opt/lvm/${y}/`date +%F`-access.log &> /dev/nulltouch /var/log/nginx/access.logkill -USR1 `cat /run/nginx.pid`
ficrontab -e#制作定时任务，可以先制作一个每2分钟就执行的定时任务进行实验
55 23 * * * /usr/bin/bash /opt/access.sh
crontab -l#查看定时任务

要求5

vim /etc/nginx/conf.d/kgc.conflocation /test {
alias /var/share/nginx/html/;
}mkdir -p /var/share/nginx/html
vim /var/share/nginx/html/a.html
{自定义}nginx -s reload

vim /etc/nginx/conf.d/benet.conf#server模块下
location ~* \.php$ {
rewrite /(.*)  http://www.kgc.com/$1;
}nginx -s reload

访问：

得到：

要求6

nginx服务器上：
vim /etc/nginx/conf.d/benet.conf
#http模块下
upstream web {
server 192.168.174.103;
server 192.168.174.102;
}
...
#server模块下
location ~* \.txt$ {
proxy_pass http://web/;
}nginx -s reloadtomcat服务器上：
vim /usr/share/nginx/html/1.txt
{自定义}

要求7

配置网关服务双网卡：

vim /etc/sysconfig/network-scripts/ifcfg-ens33TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="static"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="ens33"
UUID="fd7d808c-0292-4c69-93e5-b301eaa9e1c7"
DEVICE="ens33"
ONBOOT="yes"
IPADDR=192.168.174.190
NETMASK=255.255.255.0
GATEWAY=192.168.174.190
DNS1=114.114.114.114vim /etc/sysconfig/network-scripts/ifcfg-ens36TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="static"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="ens36"
DEVICE="ens36"
ONBOOT="yes"
IPADDR=12.0.0.100
NETMASK=255.255.255.0
GATEWAY=12.0.0.100
DNS1=114.114.114.114

配置client服务器(仅本地）：

vim /etc/sysconfig/network-scripts/ifcfg-esn33TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
UUID=e50fd064-465c-4451-81f8-4d9f81ee27d3
DEVICE=ens33
NBOOT=yes
IPADDR=12.0.0.105
NETMASK=255.255.255.0
GATEWAY=12.0.0.100
DNS1=114.114.114.114

网关服务器配置：

sysctl -a | grep ip_forward#查看路由转发是否打开vim /etc/sysctl.confnet.ipv4.ip_forward = 1sysctl -piptables -t nat -A POSTROUTING -s 12.0.0.0/24 -j SNAT --to 192.168.174.190