生产环境中常常会遇到某个 ip 地址频繁异样的拜访 nginx 网站，此时咱们须要通过安全措施爱护咱们的服务器，接下来为大家介绍几种形式。
linux 平安篇：禁止频繁拜访的 ip 拜访 nginxlinux 平安篇：禁止频繁拜访的 ip 拜访 nginx
试验环境：
版本：redhat6.5
ip:172.16.1.100,172.16.10
软件：nginx
172.16.1.10 部署 nginx
[root@localhost tools]# ls
nginx-1.11.2.tar.gz
[root@localhost tools]# yum install gcc gcc-c++ make automake autoconf libtool pcre* zlib openssl openssl-devel
[root@localhost tools]# tar xf nginx-1.11.2.tar.gz
[root@localhost tools]# ls
nginx-1.11.2 nginx-1.11.2.tar.gz
[root@localhost tools]# cd nginx-1.11.2
[root@localhost nginx-1.11.2]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[root@localhost nginx-1.11.2]# ./configure
[root@localhost nginx-1.11.2]# make
[root@localhost nginx-1.11.2]# make install
测试 nginx 服务
[root@localhost ~]# curl -I 172.16.1.100
HTTP/1.1 200 OK
Server: nginx/1.11.2
Date: Mon, 17 Aug 2020 09:36:29 GMT
Content-Type: text/html
Content-Length: 15
Last-Modified: Mon, 17 Aug 2020 09:36:19 GMT
Connection: keep-alive
ETag: “5f3a4f93-f”
Accept-Ranges: bytes
nginx 能够失常拜访。
接下来，假如 172.16.1.100 是黑客主机，频繁拜访 nginx 服务
模仿 172.16.1.100 拜访 10 次 172.16.1.10
172.16.1.100
[root@localhost ~]# ab -c 1 -n 10 http://172.16.1.10/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 172.16.1.10 (be patient)…..done
Server Software: nginx/1.11.2
Server Hostname: 172.16.1.10
Server Port: 80
Document Path: /
Document Length: 612 bytes
Concurrency Level: 1
Time taken for tests: 0.016 seconds
Complete requests: 10
Failed requests: 0
Write errors: 0
Total transferred: 8450 bytes
HTML transferred: 6120 bytes
Requests per second: 617.02 [#/sec] (mean)
Time per request: 1.621 [ms] (mean)
Time per request: 1.621 [ms] (mean, across all concurrent requests)
Transfer rate: 509.16 [Kbytes/sec] received
Connection Times (ms)
min mean[+/-sd] median maxConnect: 0 1 0.3 0 1
Processing: 1 1 0.3 1 2
Waiting: 0 1 0.3 1 1
Total: 1 1 0.5 1 2
ERROR: The median and mean for the initial connection time are more than twice the standard
deviation apart. These results are NOT reliable.
Percentage of the requests served within a certain time (ms)
50% 1
66% 1
75% 1
80% 2
90% 2
95% 2
98% 2
99% 2
100% 2 (longest request)
查看 nginx 日志
172.16.1.10
[root@localhost ~]# tail /usr/local/nginx/logs/access.log
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
172.16.1.100 – – [26/Jul/2020:05:58:24 +0800] “GET / HTTP/1.0” 200 612 “-” “ApacheBench/2.3”
由此可见，一秒钟之内 172.16.1.100 拜访了 nginx10 次，接下来禁止掉这个问题 ip
通过 iptables 限度 ip 拜访
172.16.1.10
[root@localhost ~]# iptables -I INPUT -s 172.16.1.100 -ptcp –dport 80 -j DROP
172.16.1.100
[root@localhost ~]# curl 172.16.1.10
curl: (7) Failed connect to 172.16.1.10:80; 连贯超时
此时 172.16.1.100 再也不能拜访 nginx
nginx 配置文件限度
172.16.1.10
linux 平安篇：禁止频繁拜访的 ip 拜访 nginxlinux 平安篇：禁止频繁拜访的 ip 拜访 nginx
172.16.1.100
[root@localhost ~]# curl -I 172.16.1.10
HTTP/1.1 403 Forbidden
Server: nginx/1.11.2
Date: Sat, 25 Jul 2020 23:12:06 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
总结
以上就是两种简略的办法限度 ip 拜访，还有许多办法能够利用工具进行 ip 限度。