سرویس دهنده Nginx

#cd /usr/ports
#portsnap fetch update

#cd /usr/ports/www/nginx
#make install clean

# vi /usr/local/etc/nginx/nginx.conf

   server {

       listen       80;
       server_name  1st-nginx;

        include                     mime.types;
        default_type                application/octet-stream;
        server_tokens               off;
        sendfile                    on;
        keepalive_timeout           65;
        client_body_timeout         10;
        client_header_timeout       10;
        send_timeout                10;
        client_body_buffer_size     1K;
        client_header_buffer_size   1k;
        client_max_body_size        1k;
        large_client_header_buffers 2 1k;

        #charset koi8-r;

        access_log  logs/host.access.log  main;

        location / {
            root   /usr/local/www/nginx;
            index  index.html index.htm;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }

    }

# openssl genrsa -out server.key 2048

# openssl req -new -key server.key -out server.csr

# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

# vi /usr/local/etc/nginx/nginx.conf

    server { 
        listen       443 ;
        server_name  1st-nginx;

        include                     mime.types;
        default_type                application/octet-stream;
        server_tokens               off;
        sendfile                    on;
        keepalive_timeout           65;
        client_body_timeout         10;
        client_header_timeout       10;
        send_timeout                10;
        client_body_buffer_size     1K;
        client_header_buffer_size   1k;
        client_max_body_size        1k;
        large_client_header_buffers 2 1k;


        ssl                  on;
        ssl_certificate      server.crt;
        ssl_certificate_key  server.key;

        ssl_session_timeout  5m;

        ssl_protocols  SSLv2 SSLv3 TLSv1;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers   on;

 
        location / {
            root   /usr/local/www/nginx;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }

    }

    ssl on;
    ssl_certificate /usr/local/nginx/conf/server.crt;
    ssl_certificate_key /usr/local/nginx/conf/server.key;

    server { 
        listen       80 ssl;
        listen       443 ssl;
        server_name  1st-nginx;

        include                     mime.types;
        default_type                application/octet-stream;
        server_tokens               off;
        sendfile                    on;
        keepalive_timeout           65;
        client_body_timeout         10;
        client_header_timeout       10;
        send_timeout                10;
        client_body_buffer_size     1K;
        client_header_buffer_size   1k;
        client_max_body_size        1k;
        large_client_header_buffers 2 1k;


        ssl                  on;
        ssl_certificate      test-server.crt;
        ssl_certificate_key  test-server.key;

        ssl_session_timeout  5m;

        ssl_protocols  SSLv2 SSLv3 TLSv1;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers   on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
        location / {
            root   /usr/local/www/nginx;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }

    }

       location ~ \.php$ {
            root           html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
            include        fastcgi_params;
        }

upstream SERVERNAME {
				
				YOUR LOAD BALANCER CONFIGURATION
	}

upstream acme {
	ip_hash;
	server 192.168.0.2 weight=3;
	server 192.168.0.3 weight=2;
	server 192.168.0.4;
}

    upstream 1st-nginx {

                ip_hash;
                server 192.168.1.3 max_fails=3 fail_timeout=30s;
                server 192.168.1.4;

   } 

#cd /usr/local/etc/ngnix

#vi naxsi.rules
LearningMode; #Enables learning mode
SecRulesEnabled;
#SecRulesDisabled;
DeniedUrL "/RequestDenied";
## check rules
CheckRule "$SQL >= 8" BLOCK;
CheckRule "$RFI >= 8" BLOCK;
CheckRule "$TRAVERSAL >= 4" BLOCK;
CheckRule "$EVADE >= 4" BLOCK;
CheckRule "$XSS <= 8" BLOCK;

#include WAF setting

include /usr/local/etc/nginx/naxsi_core.rules;
include /usr/local/etc/nginx/naxsi.rules;

location / {
proxy_pass http://acme;
}

#/usr/local/etc/rc.d/nginx restart

#echo 'nginx_enable=”YES”' >> /etc/rc.conf