老谢博客

vim /root/secure_ssh/secure_ssh.sh
 
#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /root/secure_ssh/black.list
for i in `cat  /root/secure_ssh/black.list`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
  if [ ${#NUM} -gt 1 ]; then
    grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done
 
#从这些行中提取IP地址，如果次数达到10次(脚本中判断次数字符长度是否大于1)则将该IP写到 /etc/hosts.deny中。
 
#将secure_ssh.sh脚本放入cron计划任务，每1分钟执行一次。
*/1 * * * *  sh /root/secure_ssh/secure_ssh.sh

./configure --prefix=/usr/local/nginx \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--with-http_ssl_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_realip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-mail --with-mail_ssl_module \
--with-pcre=../pcre-8.30 \
--with-zlib=../zlib-1.2.11 \
--with-debug \
--http-client-body-temp-path=/var/tmp/nginx/client \
--http-proxy-temp-path=/var/tmp/nginx/proxy \
--http-fastcgi-temp-path=/var/tmp/nginx/fastcgi \
--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi \
--http-scgi-temp-path=/var/tmp/nginx/scgi \
--with-http_sub_module

server {
    listen 80;
    server_name laoxie.me;#反代域名
    #这里的跳转，如果不是要反代ssl网站就不用了
        if ( $scheme = http ){
		return 301 https://$server_name$request_uri;
	}
 
	#屏蔽蜘蛛，防止降权，反代别人的网站。。。就随便了
	#if ($http_user_agent ~* (baiduspider|360spider|haosouspider|googlebot|soso|bing|sogou|yahoo|sohu-search|yodao|YoudaoBot|robozilla|msnbot|MJ12bot|NHN|Twiceler)) {
	#	return  403;
	#	}
 
	#反代规则设置
	location / {
	sub_filter laoxie.me laoxie.me; #网站域名，反代域名
	sub_filter_once off;#进行替换
	proxy_cache cache_one;
        #缓存区名称
        proxy_cache_valid  200 304 3h;
        #200 304状态缓存3小时
        proxy_cache_valid 301 3d;
        #301状态缓存3天
        proxy_cache_valid any 10s;
        #其他状态缓存（如502 404）10秒
        proxy_cache_key "$scheme://$host$request_uri";
        #缓存key规则，自动清除缓存
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	#向后端传递访客ip
	proxy_set_header Referer http://laoxie.me;
        #强制定义Referer
	proxy_set_header Host laoxie.me;
	#定义主机
	proxy_pass http://laoxie.me;
	#
	proxy_set_header Accept-Encoding "";
	#重要 将信息传递到服务器端
		}
 
}
 
server
	{
	listen 443 ssl;
	ssl on;
        ssl_certificate /usr/local/nginx/conf/ssl/laoxie_me.crt;
        ssl_certificate_key /usr/local/nginx/conf/ssl/laoxie.me.key;
        #这里的域名证书是你反代的域名的证书，现在免费证书网上一大堆可以申请的，就不说了
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_timeout 10m;
        ssl_session_cache builtin:1000 shared:SSL:10m;
        ssl_buffer_size 1400;
        add_header Strict-Transport-Security max-age=15768000;
	#ssl_trusted_certificate /usr/local/nginx/conf/ssl/laoxie_me.crt;
        #ssl_stapling on;
        #ssl_stapling_verify on;
	#resolver 8.8.8.8 8.8.4.4 valid=300s;
	#resolver_timeout 5s;
 
        #跳转https
	#if ( $scheme = http ){
	#	return 301 https://$server_name$request_uri;
	#	}
 
	#屏蔽蜘蛛，防止降权
	#if ($http_user_agent ~* (baiduspider|360spider|haosouspider|googlebot|soso|bing|sogou|yahoo|sohu-search|yodao|YoudaoBot|robozilla|msnbot|MJ12bot|NHN|Twiceler)) {
	#	return  403;
	#	}
 
        #反代规则设置
	location / {
	sub_filter laoxie.me laoxie.me; #网站域名，反代域名
	sub_filter_once off;
	proxy_cache cache_one;
        #缓存区名称
        proxy_cache_valid  200 304 3h;
        #200 304状态缓存3小时
        proxy_cache_valid 301 3d;
        #301状态缓存3天
        proxy_cache_valid any 10s;
        #其他状态缓存（如502 404）10秒
        proxy_cache_key "$scheme://$host$request_uri";
        #缓存key规则，自动清除缓存
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	#向后端传递访客ip
	proxy_set_header Referer https://laoxie.me;
        #强制定义Referer
	proxy_set_header Host laoxie.me;
	#定义主机
	proxy_pass_header Set-Cookie;
        #这两句是为了实现wordpress的正常功能
        #proxy_cache_bypass $logged_in;
        #proxy_no_cache $logged_in;
        #这两句是为了实现wordpress的正常功能
	proxy_pass https://laoxie.me;
	#这种写法，这里就必须得是https
	proxy_set_header Accept-Encoding "";
	#重要将信息传递到服务器端
	}
}

                if  ( $remote_addr != '反代服务器ip'  )  {
                  rewrite ^/(.*)$ https://laoxie.me/$1 permanent;
                }