Nginx基础-Nginx+Lua实现灰度发布与WAF 1.Nginx加载Lua环境
默认情况下Nginx不⽀持Lua模块, 需要安装LuaJIT解释器, 并且需要重新编译Nginx, 建议使⽤openrestry
1）环境准备
[root@localhost ~]# yum -y install gcc gcc-c++ make pcre-devel zlib-devel openssl-devel
2）下载luajit和ngx_devel_kit以及lua-nginx-module
[root@localhost ~]# cd /usr/local/src
[root@localhost src]# wget /download/LuaJIT-2.0.
[root@localhost src]# wget github/simpl/ngx_devel_kit/archive/v0.2.
[root@localhost src]# wget github/openresty/lua-nginx-module/archive/v0.10.
3）解压ngx_devel_kit和lua-nginx-module
[root@localhost src]# tar xf v0.2.
[root@localhost src]# tar xf v0.10.
4）安装LuaJIT Luajit是Lua即时编译器。
[root@localhost src]# tar zxvf LuaJIT-2.0.
[root@localhost src]# cd LuaJIT-2.0.3
[root@localhost LuaJIT-2.0.3]# make && make install
5）安装Nginx并加载模块
[root@localhost ~]# cd /usr/local/src
[root@localhost src]# wget /download/nginx-1.12.
[root@localhost src]# tar xf nginx-1.12.
[root@localhost src]# cd nginx-1.12.2
[root@localhost nginx-1.12.2]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module \
-
-with-http_stub_status_module --with-http_dav_module \
--add-module=../ngx_devel_kit-0.2.19/ \
--add-module=../lua-nginx-module-0.10.13
[root@localhost nginx-1.12.2]# make -j2 && make install
#建⽴软链接, 不建⽴会出现share object错误
[root@localhost ~]#ln -s /usr/local/lib/libluajit-5.1.so.2 /lib64/libluajit-5.1.so.2
#加载lua库，加⼊到f⽂件
[root@localhost ~]# echo "/usr/local/LuaJIT/lib" >> /etc/f
[root@localhost ~]# ldconfig
2.Nginx调⽤Lua指令
Nginx调⽤Lua模块指令, Nginx的可插拔模块加载执⾏, 共11个处理阶段
语法
set_by_lua
set_by_lua_file 设置Nginx变量，可以实现负载的赋值逻辑
access_by_lua
access_by_lua_file 请求访问阶段处理, ⽤于访问控制
content_by_lua
content_by_lua_file 内容处理器, 接受请求处理并输出响应
Nginx调⽤Lua API
变量
ngx.var nginx变量
ngx.print 输出响应内容体
ngx.say 输出响应内容体，最后输出⼀个换⾏符
ngx.header 输出响应头
3.Nginx+Lua实现代码灰度发布
使⽤Nginx结合lua实现代码灰度发布
按照⼀定的关系区别，分不分的代码进⾏上线，使代码的发布能平滑过渡上线
1.⽤户的信息cookie等信息区别
2.根据⽤户的ip地址, 颗粒度更⼴
执⾏过程：
nginx和apache区别
1.⽤户请求到达前端代理Nginx, 内嵌的lua模块会解析Nginx配置⽂件中Lua脚本
2.Lua脚本会获取客户端IP地址，查看Memcached缓存中是否存在该键值
3.如果存在则执⾏@java_test，否则执⾏@java_prod
4.如果是@java_test, 那么location会将请求转发⾄新版代码的集组
5.如果是@java_prod, 那么location会将请求转发⾄原始版代码集组
6.最后整个过程执⾏后结束
实践环境准备:
系统服务地址
CentOS7 Nginx+Lua+Memached 10.0.0.11
CentOS7 Tomcat集8080_Prod 10.0.0.12
CentOS7 Tomcat集9090_Test 10.0.0.13
1）安装两台服务器Tomcat，分别启动8080和9090端⼝
[root@tomcat-node1 ~]# yum install java -y
[root@tomcat-node1 ~]# cd /usr/local/src
[root@tomcat-node1 src]# wget mirrors.tuna.tsinghua.edu/apache/tomcat/tomcat-9/v9.0.36/bin/apache-tomcat-9.0. [root@tomcat-node1 src]# tar xf apache-tomcat-9.0.
[root@tomcat-node1 src]# cp -r apache-tomcat-9.0.36 /usr/local/tomcat-8080
[root@tomcat-node1 src]# /usr/local/tomcat-8080/bin/startup.sh
#tomcat默认监听在8080端⼝, 如果需要启动9090端⼝需要修改l配置⽂件
2）配置Memcached并让其⽀持Lua调⽤
#安装memcached服务
[root@localhost ~]# yum install memcached -y
#配置memcached⽀持lua
[root@localhost ~]# cd /usr/local/src
[root@localhost src]# wget github/openresty/lua-resty-memcached/archive/lua-resty-memcached-master.zip
[root@localhost src]# tar xf v0.
[root@localhost src]# cp -r lua-resty-memcached-0.11/lib/resty/memcached.lua /usr/local/nginx/lua/
#启动memcached
[root@localhost ~]# systemctl start memcached
[root@localhost ~]# systemctl enable memcached
3）配置负载均衡调度
#必须在http层
lua_package_path "/usr/local/nginx/lua/memcached.lua";
upstream java_prod {
server 10.0.0.12:8080;
}
upstream java_test {
server 10.0.0.13:9090;
}
server {
listen 80;
server_name 10.0.0.11;
location /hello {
default_type 'text/plain';
content_by_lua 'ngx.say("hello ,lua scripts")';
}
location /myip {
default_type 'text/plain';
content_by_lua '
clientIP = _headers()["x_forwarded_for"]
ngx.say("Forwarded_IP:",clientIP)
if clientIP == nli then
clientIP = _addr
ngx.say("Remote_IP:",clientIP)
end
';
}
location / {
default_type 'text/plain';
content_by_lua_file /usr/local/nginx/lua/dep.lua;
}
location @java_prod {
proxy_pass java_prod;
include proxy_params;
}
location @java_test {
proxy_pass java_test;
include proxy_params;
}
}
#nginx反向代理tomcat，必须配置头部信息否则返回400错误
proxy_redirect default;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffer_size 32k;
proxy_buffering on;
proxy_buffers 4 128k;
proxy_busy_buffers_size 256k;
proxy_max_temp_file_size 256k;
4）编写Nginx调⽤灰度发布Lua脚本
[root@localhost ~]# vim /usr/local/nginx/lua/dep.lua
--获取x-real-ip
clientIP = _headers()["X-Real-IP"]
--如果IP为空-取x_forwarded_for
if clientIP == nil then
clientIP = _headers()["x_forwarded_for"]
end
--如果IP为空-取remote_addr
if clientIP == nil then
clientIP = _addr
end
--定义本地，加载memcached
local memcached = require "ached"
--实例化对象
local memc, err = memcached:new()
--判断连接是否存在错误
if not memc then
ngx.say("failed to instantiate memc: ", err)
return
end
--建⽴memcache连接
local ok, err = memc:connect("127.0.0.1", 11211)
--⽆法连接往前端抛出错误信息
if not ok then
ngx.say("failed to connect: ", err)
return
end
-
-获取对象中的ip-存在值赋给res
local res, flags, err = memc:get(clientIP)
--
--ngx.say("value key: ",res,clientIP)
if err then
ngx.say("failed to get clientIP ", err)
return
end
--如果值为1则调⽤local-@java_test
if res == "1" then
<("@java_test")
return
end
--否则调⽤local-@java_prod
<("@java_prod")
return
5）使⽤Memcache set IP, 测试灰度发布
#telnet传⼊值
[root@localhost ~]# telnet 127.0.0.1 11211
# set对应IP
set 10.0.0.10 0 0 1
# 输⼊1
1
4.基本安全概述
1）常见的恶意⾏为
爬⾍⾏为和恶意抓取，资源盗取
防护⼿段
基础防盗链功能不让恶意⽤户能够轻易的爬取⽹站对外数据
access_moudle->对后台，部分⽤户服务的数据提供IP防护
解决⽅法
server {
listen 80;
server_name localhost;
set $ip 0;
if ($http_x_forward_for ~ 10.0.0.10){
set $ip 1;
}
if ($remote_addr ~ 10.0.0.10){
set $ip 1;
}
# 如果$ip值为0，则返回403, 否则允许访问
location /admin {
if ($ip = "0"){
return 403;
}
default_type application/json;
return 200 '{"status":"success"}';
}
2）常见的攻击⼿段（代码植⼊）
后台密码撞库，通过猜测密码字典不断对后台系统登陆性尝试，获取后台登陆密码
防护⼿段
1.后台登陆密码复杂度
2.使⽤access_module-对后台提供IP防控
3.预警机制
⽂件上传漏洞，利⽤上传接⼝将恶意代码植⼊到服务器中，再通过url去访问执⾏代码
执⾏⽅式admin/1.jpg/1.php
解决办法
location ^~ /upload {
root /usr/local/openresty/nginx/html/upload;
if ($request_filename ~* (.*)\.php){
return 403;
}
}
3）常见的攻击⼿段（SQL注⼊）
利⽤未过滤/未审核的⽤户输⼊进⾏Sql注⼊的攻击⽅法, 让应⽤运⾏本不应该运⾏的SQL代码防护⼿段
1.php配置开启安全相关限制
2.开发⼈员对sql提交进⾏审核，屏蔽常见的注⼊⼿段
3.Nginx+Lua构建WAF应⽤层防⽕墙, 防⽌Sql注⼊
5.Nginx+Lua实现WAF应⽤防⽕墙
1）快速安装lnmp架构（略）
2）配置MySQL
[root@localhost ~]# systemctl start mariadb
[root@localhost ~]# mysql
MariaDB [(none)]> create database info;
MariaDB [(none)]> use info;
MariaDB [info]> create table user(id int(11),username varchar(64), password varchar(64), email varchar(64)); MariaDB [info]> desc user;
+----------+-------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+----------+-------------+------+-----+---------+-------+
| id | int(11) | YES | | NULL | |
| username | varchar(64) | YES | | NULL | |
| password | varchar(64) | YES | | NULL | |
| email | varchar(64) | YES | | NULL | |
+----------+-------------+------+-----+---------+-------+
#插⼊数据
MariaDB [info]> insert into user (id,username,password,email) values(1,'admin',('123'),'admin@example'); MariaDB [info]> select * from info.user;
+------+----------+----------------------------------+-----------------+
| id | username | password | email |
+------+----------+----------------------------------+-----------------+
| 1 | admin | 123 | admin@example |
+------+----------+----------------------------------+-----------------+
1 row in set (0.00 sec)
3）配置php代码
[root@localhost ~]# vim /usr/local/nginx/html/login.html
<html>
<head>
<title> Sql注⼊演⽰场景 </title>
<meta http-equiv="content-type"content="text/html;charset=utf-8">
</head>
<body>
<form action="sql.php" method="post">
<table>
<tr>
<td> ⽤户: </td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td> 密码: </td>
<td><input type="text" name="password"></td>
</tr>
<tr>
<td><input type="submit" value="提交"></td>
<td><input type="reset" value="重置"></td>
</tr>
</table>
</form>
</body>
</html>
#被html调⽤的sql.php⽂件
[root@localhost ~]# vim /usr/local/nginx/html/sql.php
<?php
$conn = mysql_connect("localhost",'root','') or die("数据库连接失败！"); mysql_select_db("info",$conn) or die ("您选择的数据库不存在");
$name=$_POST['username'];
$pwd=$_POST['password'];
$sql="select * from user where username='$name' and password='$pwd'"; echo $sql."<br />";
$query=mysql_query($sql);
$arr=mysql_fetch_array($query);
if($arr){
echo "login success!<br />";
echo $arr[1];
echo $arr[3]."<br /><br />";
}else{
echo "login failed!";
}
>
4.部署Waf相关防护代码
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# git clone github/loveshell/ngx_lua_waf.git [root@localhost src]# cp -r ngx_lua_waf/ /usr/local/nginx/conf/waf
#在f的http段添加
lua_package_path "/usr/local/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file /usr/local/nginx/conf/waf/init.lua;
access_by_lua_file /usr/local/nginx/conf/waf/waf.lua;
#配置config.lua⾥的waf规则⽬录
[root@localhost ~]# vim /usr/local/nginx/conf/waf/config.lua
RulePath = "/usr/local/nginx/conf/waf/wafconf/"
#防⽌Sql注⼊
[root@localhost ~]# vim /usr/local/nginx/conf/waf/wafconf/post
\sor\s+
#防⽌CC攻击
[root@localhost ~]# vim /usr/local/nginx/conf/waf/config.lua
CCDeny="on"
CCrate="100/60"

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。