个人网站安全加固

最近nezha又出问题了，分享下nginx配置

当然不止是哪吒，所有你既放在公网又想要安全保障的都可以这样做，下面配置游客只允许访问'/'，'/service'，'/network'

此方法主要是使用user-agent过滤，以下uuid放在浏览器ua中即可访问，只要这串字符不丢就安全，具体浏览器设置ua可以网上搜，或者看看我发的类似这贴的历史贴

map_hash_bucket_size 256;

map $http_user_agent $is_allowed {

    default 0;

    "~*9de359a9-0670-4bff-91bf-ace959289b23" 1; #"~*uuid"需要更换为其他随机字符

}

server {

    listen 80;

    server_name view.kksk.io;

    return 301 https://$host$request_uri;

}

server {

    listen 443 ssl;

    http2 on;

    server_name view.kksk.io;

    access_log /var/log/nginx/view.kksk.io/access.log;

    error_log /var/log/nginx/view.kksk.io/error.log;

    ssl_certificate /etc/nginx/ssl/fullchain.pem;

    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    location = / {

        proxy_pass http://127.0.0.1:8008;

        proxy_set_header Host $http_host;

        proxy_set_header Upgrade $http_upgrade;

    }

    location = /network {

        proxy_pass http://127.0.0.1:8008;

        proxy_set_header Host $http_host;

        proxy_set_header Upgrade $http_upgrade;



    }

    location = /service {

        proxy_pass http://127.0.0.1:8008;

        proxy_set_header Host $http_host;

        proxy_set_header Upgrade $http_upgrade;

    }

    location ~ ^/(ws|terminal/.+)$ {

        proxy_pass http://127.0.0.1:8008;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "Upgrade";

        proxy_set_header Host $http_host;

    }

    location ~ ^/(terminal|setting|notification|cron|monitor|server|login|oauth2/(login|callback))$ {

        if ($is_allowed != 1) {

            return 403;

        }

        proxy_pass http://127.0.0.1:8008;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "Upgrade";

        proxy_set_header Host $http_host;

    }

    location / {

        if ($is_allowed != 1) {

            return 403;

        }

        proxy_pass http://127.0.0.1:8008;

        proxy_set_header Host $http_host;

        proxy_set_header Upgrade $http_upgrade;

    }

}