21-Linux学习之旅之HTTPS和安全加固

Linux学习之旅之HTTPS和安全加固

一、为什么要https

bash 复制代码

#防信息窃听
在外奶茶店、车站公共 WiFi 登录账号、填手机号、身份证、银行卡信息，HTTP 很容易被抓包窃取；HTTPS 经过 TLS 加密，中间人只能看到访问的域名，看不到你的账号密码、聊天、支付信息。

#防页面篡改、流量劫持
HTTP 网站容易被劫持：运营商强行插广告、恶意中间人把页面换成假链接、悄悄跳转别的网站；HTTPS 有数据校验，一旦内容被改，浏览器直接拒绝加载。

#防钓鱼仿冒网站
HTTPS 依靠数字证书核验网站真实身份。假站很难拿到可信证书；如果证书不对，浏览器直接弹出大红警告，提醒你这是危险网站，减少被骗转账、泄露信息的风险。

#直观安全感
地址栏小锁图标，给普通人直观提示；HTTP 页面浏览器直接标注「不安全」，用户会本能警惕、不敢填信息。

二、https配置

前置环境：20-Linux学习之旅之反向代理与负载均衡-CSDN博客

1、检查SSl安装模块是否安装

bash 复制代码

[root@LB1 ~]# nginx -V
nginx version: nginx/1.30.4
built by gcc 14.3.1 20251022 (Red Hat 14.3.1-4) (GCC)
built with OpenSSL 3.5.5 27 Jan 2026
TLS SNI support enabled

 --with-http_ssl_module

2、创建ca

bash 复制代码

[root@LB1 ~]# mkdir -p /opt/ca
[root@LB1 ~]# cd /opt/ca


[root@LB1 ca]# openssl req -x509 -new -nodes -newkey rsa:4096 -keyout ca.key -out ca.crt \
-days 3650 -sha256 -subj "/C=CN/ST=rongcheng/L=rongcheng/O=rongcheng/OU=IT/CN=XYX Root CA"
chmod 400 ca.key

.+...+...+.........+.......+.....+.+..+..........+...........+.+....             ....+.....+......+.+..................+++++
-----


[root@LB1 ca]# openssl req -new -nodes -out xyx.csr -keyout xyx.key \
-subj "/C=CN/ST=rongcheng/L=rongcheng/O=rongcheng/OU=IT/CN=*.xyx.com" \
-addext "subjectAltName=DNS:*.xyx.com,DNS:xyx.com"

......+...+......+.....+....+...+.........+...+..+.........+.......+             .....+.....+.+...++++++
-----
[root@LB1 ca]# openssl x509 -req -in xyx.csr -CA ca.crt -CAkey ca.key \
-CAcreateserial -out xyx.crt -days 365 -copy_extensions copy
Certificate request self-signature ok
subject=C=CN, ST=rongcheng, L=rongcheng, O=rongcheng, OU=IT, CN=*.xyx.com
[root@LB1 ca]# ls
ca.crt  ca.key  ca.srl  xyx.crt  xyx.csr  xyx.key


[root@LB1 ca]# vim /etc/nginx/conf.d/proxy-lb.conf
[root@LB1 ca]# cat /etc/nginx/conf.d/proxy-lb.conf
upstream backend {
    server 10.0.0.21:8080 max_fails=3 fail_timeout=30s;
    server 10.0.0.22:8080 max_fails=3 fail_timeout=30s;
    server 10.0.0.23:8080 max_fails=3 fail_timeout=30s;
}
server {
    listen 443 ssl;            将80改为443 ssl
    server_name  xyy.xyx.com xyx.com;   #改网页名
    root /var/www/nginx;
    ssl_certificate /opt/ca/xyx.crt;    #指定ca路径
    ssl_certificate_key /opt/ca/xyx.key;     #指定ca路径
# 静态资源：LB 直接返回
    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|css|js)$ {
        expires 30d;
        access_log off;
    }
# API 请求：转发到后端（负载均衡）
    location /api/ {
        proxy_pass http://backend;
# 传递真实客户端信息
        proxy_set_header Host $host;                    # 原始 Host
        proxy_set_header X-Real-IP $remote_addr;        # 客户端真实 IP
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  # 代理链
        proxy_set_header X-Forwarded-Proto $scheme;     # 原始协议(http/https)
    }
# 其他请求：LB 直接返回静态文件
    location / {
        root /var/www/nginx;
        index index.html;
        #try_files $uri $uri/ /index.html;
    }

}

#添加80端口的重定向
server {
    listen 80;
    server_name xyy.xyx.com xyy.xyx.com;
    return 301 https://$host$request_uri;
}

[root@LB1 ca]# nginx -t && systemctl reload nginx.service
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

3、导入ca

下载/opt/ca下的ca.crt

双击打开-安装证书

本地计算机-下一步

按照图片选择

完成

导入成功确认

4、修改主机hosts文件

bash 复制代码

#Windows:C:\Windows\System32\drivers\etc

10.0.0.11    xyy.xyx.com xyx.com

#linux:/etc/hosts


10.0.0.11    xyy.xyx.com xyx.com

5、验证

bash 复制代码

#linux
#上传到/tmp下
root@ubt2604ser:~# cp /tmp/ca.crt ./
root@ubt2604ser:~# ls
ca.crt  sshd.tcpdump

#拷贝到认证的位置
#Ubuntu
root@ubt2604ser:~# cp ca.crt /usr/local/share/ca-certificates/ && update-ca-cert
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt, it does not contain exactly one cCRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
#rocky
cp ca.crt /etc/pki/ca-trust/source/anchors/ && update-ca-trust

#测试
root@ubt2604ser:~# curl -L xyy.xyx.com
LB Home Page

三、安全加固

1、隐藏版本号

#显示版本号：攻击者利用特定版本漏洞

隐藏版本号

#危险 HTTP 方法：PUT/DELETE 可被用于非法上传/删除

只允许 GET/HEAD/POST

#目录浏览：暴露网站文件结构

禁止 autoindex

bash 复制代码

[root@LB1 ca]# vim /etc/nginx/nginx.conf
[root@LB1 ca]# cat /etc/nginx/nginx.conf
http {
    include       mime.types;
    default_type  application/octet-stream;
    server_tokens off;    #在http中加入



#测试
root@ubt2604ser:~# curl -I https://xyy.xyx.com/
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 12 Aug 2026 01:47:21 GMT
Content-Type: text/html
Content-Length: 13
Last-Modified: Tue, 11 Aug 2026 09:15:39 GMT
Connection: keep-alive
ETag: "6a7ae83b-d"
Accept-Ranges: bytes

2、限制 HTTP 危险方法

bash 复制代码

[root@LB1 ca]# vim /etc/nginx/conf.d/proxy-lb.conf
[root@LB1 ca]# cat nginx.service
cat: nginx.service: 没有那个文件或目录
[root@LB1 ca]# cat /etc/nginx/conf.d/proxy-lb.conf

server {
    listen 443 ssl;
    server_name xyy.xyx.com xyx.com;
    root /var/www/nginx;
    ssl_certificate /opt/ca/xyx.crt;
    ssl_certificate_key /opt/ca/xyx.key;

    #只允许GET|HEAD|POST三种连接方式其他禁止
    if ($request_method !~ ^(GET|HEAD|POST)$ ) {
         return 444;
    }

#验证拦截
root@ubt2604ser:~# curl -X PUT -I https://xyy.xyx.com/
curl: (56) OpenSSL SSL_read: OpenSSL/3.5.5: error:0A000126:SSL routines::unexpec                ted eof while reading, errno 0

3、防盗链

防盗链 = 只允许自己网站的页面引用图片 / 视频 / 静态资源，拒绝别人直接偷链接嵌入使用
valid_referers none blocked server_names xyy.xyx.com xyx.com *.xyx.com;

bash 复制代码

#none：允许没有 Referer 的请求 
#blocked：允许Referer 被防火墙/代理移除 的请求 
#server_names 允许 Referer 匹配 server_name 列表 本站页面发起的请求
#xyy.xyx.com:明确允许的域名,从该域名发起的请求
#*.xyx.com：通配符匹配子域名 从任意 *.xyx.com 发起的请求


[root@LB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf
[root@LB1 ~]# cat /etc/nginx/conf.d/proxy-lb.conf
}
server {
    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|css|js)$ {
        expires 30d;
        access_log off;

        #添加条件
        valid_referers none blocked server_names;
        if ($invalid_referer) {
              return 403;
        }
    }

#验证配置和重新加载配置
[root@LB1 ~]# nginx -t && systemctl reload nginx.service
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@LB1 ~]#

#创建测试图片
[root@LB1 ~]# mkdir -p /var/www/nginx/images
[root@LB1 ~]# echo "test image" > /var/www/nginx/images/photo.jpg

#验证木有Referer的请求
root@ubt2604ser:~# curl --header "Referer: https://xyy.xyx.com/" https://xyy.xyx.com/images/photo.jpg
test image

#验证木错误Referer的请求
root@ubt2604ser:~# curl -H "Referer: https://myy.com/" https://xyy.xyx.com/images/photo.jpg   <html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>

#验证本身Referer的请求
root@ubt2604ser:~# curl https://xyy.xyx.com/images/photo.jpg
test image
root@ubt2604ser:~#

4、限流

限流：限制客户端在单位时间内的请求数量，防止单个客户端耗尽服务器资源。比如：恶意刷接口、暴力破解密码等等

bash 复制代码

[root@LB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf
[root@LB1 ~]# cat /etc/nginx/conf.d/proxy-lb.conf
#添加策略创建api的桶，分配10MB空间，每秒3个流速
limit_req_zone $binary_remote_addr zone=api:10m rate=3r/s;

upstream backend {
  server 10.0.0.21:8080 max_fails=3 fail_timeout=30s;
    server 10.0.0.22:8080 max_fails=3 fail_timeout=30s;
    server 10.0.0.23:8080 max_fails=3 fail_timeout=30s;
}
# API 请求：转发到后端（负载均衡）

    location /api/ {
         #添加桶限流3个通道
        limit_req zone=api burst=3 nodelay;


        proxy_pass http://backend;
# 传递真实客户端信息
    }

#加载
[root@LB1 ~]#nginx -t
[root@LB1 ~]# systemctl reload nginx.service

#20的访问连接，sort排序，uniq统计
root@ubt2604ser:~# for i in {1..20}; do curl -s -o /dev/null -w "%{http_code}\n" https://xyy.xyx.com/api/user; done | sort | uniq -c

      6 200
     14 503

elay;

复制代码

    proxy_pass http://backend;

传递真实客户端信息

复制代码

#加载

$root@LB1 \~$ #nginx -t

$root@LB1 \~$ # systemctl reload nginx.service

#20的访问连接，sort排序，uniq统计

root@ubt2604ser:~# for i in {1...20}; do curl -s -o /dev/null -w "%{http_code}\n" https://xyy.xyx.com/api/user; done | sort | uniq -c

复制代码

  6 200
 14 503

复制代码