Nginx服务优化（一）隐藏版本号

配置Nginx隐藏版本号

在生产环境中，需要隐藏Nginx的版本号，以避免安全漏洞的泄漏

查看方法

• 使用fiddler工具在Windows客户端查看Nginx版本号

• 在CentOS系统中使用"curl -I网址"命令查看

Nginx隐藏版本号的方法

• 修改配置文件法
• 修改源码法

编译安装nginx服务

1.将宿主机上的工具包共享出去

2.通过Samba服务将工具包挂载到Linux系统

[root@localhost ~]# mkdir /mnt/tools[root@localhost ~]# smbclient -L //192.168.100.50/Enter SAMBA\root's password: OS=[Windows 10 Enterprise LTSC 2019 17763] Server=[Windows 10 Enterprise LTSC 2019 6.3]    Sharename       Type      Comment    ---------       ----      -------    IPC$            IPC       远程 IPC    share           Disk          tools           Disk          Users           Disk      Connection to 192.168.100.50 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)NetBIOS over TCP disabled -- no workgroup available[root@localhost ~]# mount.cifs //192.168.100.50/tools /mnt/tools/Password for root@//192.168.100.50/tools:  [root@localhost ~]# 

3.将nginx服务源码包解压到"/opt/"目录

[root@localhost ~]# cd /mnt/tools/[root@localhost tools]# lsawstats-7.6.tar.gz                extundelete-0.2.4.tar.bz2  forbid.png                 jdk-8u191-windows-x64.zip  LAMP-C7  picture.jpgcronolog-1.6.2-14.el7.x86_64.rpm  fiddler.exe                intellijideahahau2018.rar  john-1.8.0.tar.gz          LNMP[root@localhost tools]# cd LNMP/[root@localhost LNMP]# lsDiscuz_X3.4_SC_UTF8.zip  mysql-boost-5.7.20.tar.gz  nginx-1.12.2.tar.gz  php-7.1.10.tar.bz2  php-7.1.20.tar.gz[root@localhost LNMP]# tar zxvf nginx-1.12.2.tar.gz -C /opt/...............//省略解压过程[root@localhost LNMP]#

4.安装编译所需工具包

[root@localhost ~]# yum install gcc gcc-c++ pcre-devel zlib-devel -y...........//省略安装过程[root@localhost ~]#

5.切换到nginx服务源码包目录，创建一个nginx用户

[root@localhost LNMP]# cd /opt/[root@localhost opt]# lsnginx-1.12.2  rh[root@localhost opt]# cd nginx-1.12.2/[root@localhost nginx-1.12.2]# lsauto  CHANGES  CHANGES.ru  conf  configure  contrib  html  LICENSE  man  README  src[root@localhost nginx-1.12.2]# [root@localhost nginx-1.12.2]# useradd -M -s /sbin/nologin nginx    //-M 不创建家目录[root@localhost nginx-1.12.2]# id nginxuid=1001(nginx) gid=1001(nginx) 组=1001(nginx)[root@localhost nginx-1.12.2]# 

6.配置nginx服务

[root@localhost nginx-1.12.2]# ./configure \> --prefix=/usr/local/nginx \      //安装路径> --user=nginx \    //属主> --group=nginx \   //属组> --with-http_stub_status_module   //启用统计模块

7.编译安装nginx服务

[root@localhost nginx-1.12.2]# make && make install..........//省略过程[root@localhost nginx-1.12.2]#

8.在易于系统识别的目录下，建立nginx服务命令的软链接

[root@localhost nginx-1.12.2]# ln -s /usr/local/nginx/sbin/* /usr/local/sbin/   //建立软链接[root@localhost nginx-1.12.2]# nginx -t    //配置文件测试nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[root@localhost nginx-1.12.2]# 

9.制作nginx服务管理脚本（任选一种即可）

脚本一：通过"systemctl"命令管理

[root@localhost nginx-1.12.2]# cd /lib/systemd/system[root@localhost system]# vim nginx.service[Unit]Description=nginxAfter=network.target[Service]Type=forkingPIDFile=/usr/local/nginx/logs/nginx.pidExecStart=/usr/local/nginx/sbin/nginxExecReload=/usr/bin/kill -s HUP $MAINPIDExecStop=/usr/bin/kill -s QUIT $MAINPIDPrivateTmp=true[Install]WantedBy=multi-user.target[root@localhost system]# chmod 754 nginx.service     //添加执行权限[root@localhost system]# systemctl start nginx.service   //开启服务[root@localhost system]# netstat -ntap | grep 80   //查看tcp80端口tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      52924/nginx: master [root@localhost system]# [root@localhost system]# systemctl stop firewalld.service   //关闭防火墙[root@localhost system]# setenforce 0[root@localhost system]# 

脚本二：通过"service"命令管理

[root@nginx nginx-1.12.2]# vim /etc/init.d/nginx#!/bin/bash# chkconfig: - 99 20# description: Nginx Service Control ScriptPROG="/usr/local/nginx/sbin/nginx"PIDF="/usr/local/nginx/logs/nginx.pid"case "$1" in  start)    $PROG    ;;  stop)    kill -s QUIT $(cat $PIDF)    ;;  restart)    $0 stop    $0 start    ;;  reload)    kill -s HUP $(cat $PIDF)    ;;  *)        echo "Usage: $0 {start|stop|restart|reload}"        exit 1esacexit 0[root@nginx nginx-1.12.2]#[root@nginx nginx-1.12.2]# chmod +x /etc/init.d/nginx   //添加执行权限[root@nginx nginx-1.12.2]# chkconfig --add nginx    //添加让service能识别nginx服务[root@nginx nginx-1.12.2]# [root@nginx nginx-1.12.2]# service nginx start    //开启服务[root@nginx nginx-1.12.2]# netstat -ntap | grep 80   //查看tcp80端口tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      58696/nginx: master [root@nginx nginx-1.12.2]#[root@nginx nginx-1.12.2]# systemctl stop firewalld.service    //关闭防火墙[root@nginx nginx-1.12.2]# setenforce 0[root@nginx nginx-1.12.2]# 

修改配置文件法

1.查看IP地址

[root@localhost nginx-1.12.2]# ifconfig ens33: flags=4163  mtu 1500        inet 192.168.52.131  netmask 255.255.255.0  broadcast 192.168.52.255        inet6 fe80::8629:c3e2:139c:884a  prefixlen 64  scopeid 0x20        ether 00:0c:29:7a:41:33  txqueuelen 1000  (Ethernet)        RX packets 53364  bytes 74679913 (71.2 MiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 16068  bytes 1016893 (993.0 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

2.查看版本号

[root@localhost nginx-1.12.2]# curl -I http://192.168.52.131/HTTP/1.1 200 OKServer: nginx/1.12.2   //版本号Date: Wed, 13 Nov 2019 07:10:22 GMTContent-Type: text/htmlContent-Length: 612Last-Modified: Wed, 13 Nov 2019 07:03:51 GMTConnection: keep-aliveETag: "5dcbaad7-264"Accept-Ranges: bytes[root@localhost nginx-1.12.2]# 

3.修改配置文件

[root@localhost nginx-1.12.2]# vim /usr/local/nginx/conf/nginx.confhttp {    include       mime.types;    default_type  application/octet-stream;    server_tokens off;    //添加，关闭版本号显示

4.再次查看版本号

[root@localhost nginx-1.12.2]# service nginx restart [root@localhost nginx-1.12.2]# curl -I http://192.168.52.131/HTTP/1.1 200 OKServer: nginx    //版本号不再显示Date: Wed, 13 Nov 2019 07:15:09 GMTContent-Type: text/htmlContent-Length: 612Last-Modified: Wed, 13 Nov 2019 07:03:51 GMTConnection: keep-aliveETag: "5dcbaad7-264"Accept-Ranges: bytes[root@localhost nginx-1.12.2]#

修改源码法

1.修改配置文件

[root@localhost nginx-1.12.2]# vim /usr/local/nginx/conf/nginx.confhttp {    include       mime.types;    default_type  application/octet-stream;    server_tokens on;      //开启版本号显示

2.修改版本号

[root@localhost nginx-1.12.2]# vim src/core/nginx.h#define nginx_version      1012002#define NGINX_VERSION      "1.1.1"     //修改版本号为1.1.1#define NGINX_VER          "nginx/" NGINX_VERSION

3.重新配置nginx服务

[root@localhost nginx-1.12.2]# lsauto  CHANGES  CHANGES.ru  conf  configure  contrib  html  LICENSE  man  README  src[root@localhost nginx-1.12.2]# ./configure \> --prefix=/usr/local/nginx \> --user=nginx \> --group=nginx \> --with-http_stub_status_module........//省略配置过程

4.重新编译安装nginx服务

[root@localhost nginx-1.12.2]# make && make install.........//省略编译过程[root@localhost nginx-1.12.2]# 

5.开启服务，并查看版本号

[root@localhost nginx-1.12.2]# service nginx restart     //开启服务[root@localhost nginx-1.12.2]# curl -I http://192.168.52.131/   //查看版本HTTP/1.1 200 OKServer: nginx/1.1.1    //版本号伪装成功Date: Wed, 13 Nov 2019 07:35:32 GMTContent-Type: text/htmlContent-Length: 612Last-Modified: Wed, 13 Nov 2019 07:03:51 GMTConnection: keep-aliveETag: "5dcbaad7-264"Accept-Ranges: bytes