使用nginx防止机器攻击策略

灰太狼 2022-05-18 08:13 367阅读 0赞

可以使用nginx对$request进行控制if ($request ~ "GET /sms/sendVerifyCode.do?")

--------------------

user  nginx;  
worker\_processes  1;

error\_log  /var/logs/nginx/error.log;

pid  /var/run/nginx.pid;

events \{  
    worker\_connections  1024;  
\}

http \{  
    include       mime.types;  
    client\_max\_body\_size 10m;  
    default\_type  application/octet-stream;  
    server\_tokens off;  
    fastcgi\_intercept\_errors on;  
    log\_format  main  '$remote\_addr - $remote\_user \[$time\_local\] "$request" '  
                      '$status $body\_bytes\_sent "$http\_referer" '  
                      '"$http\_user\_agent" "$http\_x\_forwarded\_for"';  
    access\_log  /var/logs/nginx/access.log  main;  
    sendfile        on;  
    tcp\_nopush     on;  
    keepalive\_timeout  65;  
    gzip  on;  
    include conf.d/\*.conf;  
  \}

--------------------

upstream  myapp \{  
    ip\_hash;  
    server 172.18.111.32:8080;  
    server 172.18.111.31:8080;  
\}  
server  
     \{  
    listen       80;  
    server\_name www.myapp .com;  
\#    rewrite ^(.\*)$ https://$host$1 permanent;    
   location / \{  
        client\_max\_body\_size 10m;  
        proxy\_set\_header Host $host;  
        proxy\_set\_header X-Real-IP $remote\_addr;  
        proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
        proxy\_pass http://myapp;  
      \}   
     
    location  ^~  /images/ \{  
            root /var/upload/app\_cust\_platform/;  
            index photo\_not\_found.png;  
            access\_log  /var/logs/nginx/imghost.log  main;  
      \}

location ~ /.well-known \{  
          allow all;  
    \}

location ^~ /apiDocs/ \{  
          root /var/upload/myapp\_platform/images/;  
          error\_page 404  /404.html;  
    \}  
    location = /404.html \{  
            root /usr/local/nginx/html;  
            access\_log  /var/logs/nginx/error.log  main;  
    \}

location ~ /sms/sendSmsCode.do?(/.\*) \{  
    if ($http\_referer = "-") \{return 200; \}  
    proxy\_pass http://myapp;  
\}

server \{  
 listen 443;  
 ssl on;  
 server\_name www.myapp.com;  
 ssl\_certificate /etc/letsencrypt/live/api.myapp.com/fullchain.pem;  
 ssl\_certificate\_key /etc/letsencrypt/live/api.myapp.com/privkey.pem;  
ssl\_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";  
 ssl\_protocols TLSv1 TLSv1.1 TLSv1.2;  
 ssl\_prefer\_server\_ciphers on;  
 ssl\_session\_cache shared:SSL:10m;  
 location / \{  
     proxy\_set\_header Host $host;  
     proxy\_set\_header X-Real-IP $remote\_addr;  
     proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
     proxy\_pass http://myapp;  
  \}  
 location  ^~  /images/ \{  
            root /myapp/upload/myapp\_platform/;  
            index photo\_not\_found.png;  
            access\_log  /var/logs/nginx/imghost.log  main;  
      \}  
    location ~ /.well-known \{  
          allow all;  
    \}

location ^~ /apiDocs/ \{  
          root /var/upload/myapp\_cust\_platform/images/;  
          error\_page 404  /404.html;  
    \}  
    location = /404.html \{  
            root /usr/local/nginx/html;  
            access\_log  /var/logs/nginx/error.log  main;  
    \}