编译Nginx支持Tcp_wrappers

201次阅读

共计 3595 个字符，预计需要花费 9 分钟才能阅读完成。

Tcp wrappers：Transmission Control Protocol (TCP) Wrappers 为由 inetd 生成的服务提供了增强的安全性。Tcp wrappers 是一种对使用 /etc/inetd.sec 的替换方法。TCP Wrappers 提供防止主机名和主机地址欺骗的保护。欺骗是一种伪装成有效用户或主机以获得对系统进行未经授权的访问的方法。

1、重新编译 Nginx

[root@ipython nginx–1.6.1]# tar zxf ../ngx_tcpwrappers.tar.gz –C ./
[root@ipython nginx–1.6.1]#./configure —prefix=/software/nginx —user=nginx —group=nginx —with–http_stub_status_module —with–http_ssl_module —with–http_realip_module —with–http_gzip_static_module —with–google_perftools_module —with–debug —http–client–body–temp–path=/var/tmp/nginx/client —http–proxy–temp–path=/var/tmp/nginx/proxy —http–fastcgi–temp–path=/var/tmp/nginx/fastcgi —http–uwsgi–temp–path=/var/tmp/nginx/uwsgi —http–scgi–temp–path=/var/tmp/nginx/scgi —with–pcre=/root/pcre–8.35—with–openssl=/root/openssl–1.0.1i—with–zlib=/root/zlib–1.2.8—add–module=./ngx_tcpwrappers
[root@ipython nginx–1.6.1]# sed –i s‘#CFLAGS = -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror#CFLAGS = -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -g#’ objs/Makefile
#### 不要 make install 哦，编译好即可 ####
[root@ipython nginx–1.6.1]# make

2、完成升级，以及模块的使用，Nginx 还是很奇特的哦~~

#### 备份可执行文件，复制新的文件 ####
[root@ipython nginx–1.6.1]# mv /software/nginx/sbin/nginx /software/nginx/conf/@nginx
[root@ipython nginx–1.6.1]# cp objs/nginx /software/nginx/sbin/
#### 测试新版本的 Nginx####
[root@ipython nginx–1.6.1]#/software/nginx/sbin/nginx –t
nginx: the configuration file /software/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /software/nginx/conf/nginx.conf test is successful
### 此时没有加入 Tcp_wrappers 的配置测试下访问 ###
[root@ipython openssl–1.0.1i]# curl –I http://www.ipython.me
HTTP/1.1200 OK
Server: nginx/1.6.1
Date:Mon,11Aug201423:08:08 GMT
Content–Type: text/html
Content–Length:612
Last–Modified:Mon,11Aug201422:45:25 GMT
Connection: keep–alive
ETag:“53e94785-264”
Accept–Ranges: bytes
### 平滑升级 ###
[root@ipython nginx–1.6.1]# make upgrade
## 测试模块，拒绝 1.1.1.30 的 Nginx 请求 ## ## 在 http 块里加入如下配置 ##
tcpwrappers on;
tcpwrappers_daemon nginx;
tcpwrappers_thorough off;
##hosts.deny 如下 ##
[root@ipython nginx–1.6.1]# awk ‘!/^#/’/etc/hosts.deny
nginx:1.1.1.30
## 重新读取 Nginx 配置文件 ##
[root@ipython nginx–1.6.1]#/software/nginx/sbin/nginx –s reload
### 此时访问就是 403 了 ###
[root@itchenyi ~]# curl –I http://www.ipython.me
HTTP/1.1403Forbidden
Server: nginx/1.6.1
Date:Mon,11Aug201423:12:47 GMT
Content–Type: text/html
Content–Length:168
Connection: keep–alive