V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
NGINX
NGINX Trac
3rd Party Modules
Security Advisories
CHANGES
OpenResty
ngx_lua
Tengine
在线学习资源
NGINX 开发从入门到精通
NGINX Modules
ngx_echo
Sirormy
V2EX  ›  NGINX

问个 nginx 配置二级域名的问题

  •  
  •   Sirormy · 2017-04-19 10:51:13 +08:00 · 3543 次点击
    这是一个创建于 2762 天前的主题,其中的信息可能已经有所发展或是发生改变。

    想把 api.example.com 解析到 123.123.123.123:8080/api 下

    nginx 我已经配置了 api.example.com 123.123.123.123:8080

    那个 /api 应该在哪里配置

    upstream api__upstream {
        server 127.0.0.1:8080;
        keepalive 64;
    }
    server {
        listen 443 ssl;
        ssl_certificate "/etc/nginx/cert/api.pem";
        ssl_certificate_key "/etc/nginx/cert/api.key";
        ssl_protocols SSLv2 SSLv3 TLSv1;
        ssl_session_timeout 5m;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
        server_name api.xxx.com;
        access_log /root/nginx.log;
        location / {
            proxy_pass http://api__upstream;
            proxy_set_header   X-Real-IP            $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_set_header   X-NginX-Proxy    true;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
        }
    }
    server {
       listen 80;
       server_name api.xxxx.com;
       return 301 https://$server_name$request_uri;
    }
        
    

    去网上搜不知道应该按什么关键字搜这个问题 →_→

    8 条回复    2017-04-21 17:17:22 +08:00
    gqkkk
        1
    gqkkk  
       2017-04-19 11:00:41 +08:00
    proxy_pass http://api__upstream/api;
    zzq4343
        2
    zzq4343  
       2017-04-19 11:42:54 +08:00
    靠,你在逗我
    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
    不应该是
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    然后删
    ssl_prefer_server_ciphers on;
    还有
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

    现在都 2017 年了,还有人用 SSLv2 SSLv3
    那个做教程的人也不应该把什么加密协议 /套件写死
    Sirormy
        3
    Sirormy  
    OP
       2017-04-19 13:16:32 +08:00
    @zzq4343 我是在阿里云申请的免费 HTTPS 证书,二级域名的那个确实给的是 SSLv2 SSLv3 TLSv1 ,根域名是 TLSv1.2 TLSv1.1 TLSv1 。不安全?
    Sirormy
        4
    Sirormy  
    OP
       2017-04-19 13:22:55 +08:00
    @gqkkk 试了一下,可以的, api 后边再加个“/”。棒棒哒 !
    neroxps
        5
    neroxps  
       2017-04-19 13:26:51 +08:00
    @Sirormy 不建议使用 SSLv2 SSLv3 印象中好像是著名的心血漏洞什么的~

    像我这种小白,用这个生成 nginx 配置文件 https://mozilla.github.io/server-side-tls/ssl-config-generator/

    安利给楼主试试

    不懂乱说光速逃跑 : )
    l9rw
        6
    l9rw  
       2017-04-19 23:03:11 +08:00
    rewrite ^(.*)$ http://api.example.com/api$1 permanent;
    zzq4343
        7
    zzq4343  
       2017-04-20 01:09:05 +08:00
    @Sirormy 当然不安全
    用 SSLv2 就是找死,参考 DROWN 攻击 ( https://drownattack.com/ ),不仅是开启 SSLv2 的机器本身会泄密,别的机器,只要使用一样的 RSA 密钥,就算你用 TLSv1.2 一样泄密。
    SSLv3 是 POODLE 攻击 ( https://censys.io/blog/poodle ),没有 SSLv2 严重,但是与任何 CBC 模式的块加密算法 (比如 AES-CBC, 3DES-EDE-CBC) 使用就会泄密,除非使用 RC4 ,问题是 RC4 也不安全( https://www.rc4nomore.com/ ),一个 cookie 在一个普通电脑上 75 小时破解
    @neroxps 不是什么 Heartbleed ,那个漏洞由于大家都很重视,基本上不存在了
    gqkkk
        8
    gqkkk  
       2017-04-21 17:17:22 +08:00
    https://mozilla.github.io/server-side-tls/ssl-config-generator/

    server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    return 301 https://$host$request_uri;
    }

    server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
    ssl_certificate /path/to/signed_cert_plus_intermediates;
    ssl_certificate_key /path/to/private_key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /path/to/dhparam.pem;

    # intermediate configuration. tweak to your needs.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    add_header Strict-Transport-Security max-age=15768000;

    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling on;
    ssl_stapling_verify on;

    ## verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

    resolver <IP DNS resolver>;

    ....
    }
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   实用小工具   ·   2609 人在线   最高记录 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 21ms · UTC 06:01 · PVG 14:01 · LAX 22:01 · JFK 01:01
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.