CentOS 6.5安装Nginx-1.6.2及安全配置

# id www
id: www：无此用户
# groupadd www
# useradd -g www -s /sbin/nologin www
# id www
uid=501(www) gid=501(www) 组 =501(www) 

# cd /usr/local/src
# wget http://nginx.org/download/nginx-1.6.2.tar.gz
# tar zxf nginx-1.6.2.tar.gz
# cd nginx-1.6.2
# ./configure --prefix=/usr/local/nginx-1.6.2 --group=www --user=www --with-http_ssl_module --with-pcre --with-http_stub_status_module --with-http_gzip_static_module
 
Configuration summary
  + using system PCRE library
  + using system OpenSSL library
  + md5: using OpenSSL library
  + sha1: using OpenSSL library
  + using system zlib library
 
  nginx path prefix: "/usr/local/nginx-1.6.2"
  nginx binary file: "/usr/local/nginx-1.6.2/sbin/nginx"
  nginx configuration prefix: "/usr/local/nginx-1.6.2/conf"
  nginx configuration file: "/usr/local/nginx-1.6.2/conf/nginx.conf"
  nginx pid file: "/usr/local/nginx-1.6.2/logs/nginx.pid"
  nginx error log file: "/usr/local/nginx-1.6.2/logs/error.log"
  nginx http access log file: "/usr/local/nginx-1.6.2/logs/access.log"
  nginx http client request body temporary files: "client_body_temp"
  nginx http proxy temporary files: "proxy_temp"
  nginx http fastcgi temporary files: "fastcgi_temp"
  nginx http uwsgi temporary files: "uwsgi_temp"
  nginx http scgi temporary files: "scgi_temp"
 
# make && make install
# ln -s /usr/local/nginx-1.6.2/ /usr/local/nginx
# chown -R www:www /usr/local/nginx
# chown -R www:www /usr/local/nginx-1.6.2

# vim /etc/profile
 
export PATH=$PATH:/usr/local/mysql/bin:$JAVA_HOME/bin:/usr/local/nginx/sbin
 
# source /etc/profile

# nginx -V
nginx version: nginx/1.6.2
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC)
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx-1.6.2 --group=www --user=www --with-http_ssl_module --with-pcre --with-http_stub_status_module

# mkdir -p /data/www

# vim /usr/local/nginx/conf/nginx.conf
 
user  www;
worker_processes  1;
events {worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout  65;
    gzip  on;
    server {listen       80;
        server_name  localhost;
        location / {
            root   html;
            index  index.html index.htm;
        }
    }
}

# nginx

# nginx -t
nginx: the configuration file /usr/local/nginx-1.6.2/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx-1.6.2/conf/nginx.conf test is successful
# nginx -s reload

# kill -HUP ${master_pid}

# nginx -s quit
# nginx -s stop

# kill -QUIT ${nginx_master}
# kill -TERM ${nginx_master}
# kill -9 ${nginx_master}

# vim /etc/init.d/nginxd
 
#!/bin/sh
# chkconfig: 2345 85 15
# description:Nginx Server
 
NGINX_HOME=/usr/local/nginx-1.6.2
NGINX_SBIN=$NGINX_HOME/sbin/nginx
NGINX_CONF=$NGINX_HOME/conf/nginx.conf
NGINX_PID=$NGINX_HOME/logs/nginx.pid
 
NGINX_NAME="Nginx"
 
. /etc/rc.d/init.d/functions
 
if [! -f $NGINX_SBIN ]
then
    echo "$NGINX_NAME startup: $NGINX_SBIN not exists! "
    exit
fi
 
start() {$NGINX_SBIN -c $NGINX_CONF
    ret=$?
    if [$ret -eq 0 ]; then
        action $"Starting $NGINX_NAME: " /bin/true
    else
        action $"Starting $NGINX_NAME: " /bin/false
    fi
}
 
stop() {kill `cat $NGINX_PID`
    ret=$?
    if [$ret -eq 0 ]; then
        action $"Stopping $NGINX_NAME: " /bin/true
    else
        action $"Stopping $NGINX_NAME: " /bin/false
    fi
}
 
restart() {
    stop
    start
}
 
check() {$NGINX_SBIN -c $NGINX_CONF -t
}
 
 
reload() {kill -HUP `cat $NGINX_PID` && echo "reload success!"
}
 
relog() {kill -USR1 `cat $NGINX_PID` && echo "relog success!"
}
 
case "$1" in
    start)
        start
        ;;
    stop)
        stop
        ;;
    restart)
        restart
        ;;
    check|chk)
        check
        ;;
    status)
        status -p $NGINX_PID
        ;;
    reload)
        reload
        ;;
    relog)
        relog
        ;;
    *)
        echo $"Usage: $0 {start|stop|restart|reload|status|check|relog}"
        exit 1
esac
 
# chmod +x /etc/init.d/nginxd
# chkconfig nginxd on

# service nginxd start

autoindex off

access_log /data/www/logs/localhost.access.log

location ~* ^/data/www/logs/.*\.(php|php5)$ {deny all;}

location ~ ^/data/www/logs/ {deny all;}

server {location /nginx-admin {
        stub_status on;
        access_log logs/nginx-admin.log;
        allow 11.12.23.0/24;
        deny all;
    }
 
    location /admin {...}
}

server {listen        80 default;
    return 500;
}
server {listen        80;
    server_name   www.linuxidc.com tencent.com;
    root          /data/www/linuxidc;
 
    access_log    /data/logs/nginx/linuxidc.access.log;
    error_log     /data/logs/nginx/linuxidc.error.log;
}