在Debian上安全运行Nginx涉及多个步骤,包括安装、配置、启用服务、设置防火墙规则以及启用HTTPS。以下是详细的步骤指南:
首先,确保你的Debian系统是最新的:
sudo apt update
sudo apt upgrade -y
然后,安装Nginx:
sudo apt install nginx -y
安装完成后,启动Nginx并设置开机自启动:
sudo systemctl start nginx
sudo systemctl enable nginx
编辑Nginx的默认站点配置文件:
sudo nano /etc/nginx/sites-available/default
找到以下部分并进行修改:
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
index index.php index.html index.htm index.nginx-debian.html;
server_name _;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}
location ~ /\.ht {
deny all;
}
}
保存并退出编辑器,然后测试Nginx配置:
sudo nginx -t
重新加载Nginx以应用更改:
sudo systemctl reload nginx
安装并启用UFW(Uncomplicated Firewall):
sudo apt install ufw
sudo ufw enable
允许HTTP和HTTPS流量:
sudo ufw allow 'Nginx Full'
或者手动允许特定端口:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
重新加载UFW以使更改生效:
sudo ufw reload
配置SSL证书并强制HTTPS访问。你可以使用Let’s Encrypt免费获取SSL证书:
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com
按照提示完成证书的安装和配置。
编辑Nginx配置文件(通常位于 /etc/nginx/nginx.conf
或 /etc/nginx/sites-available/default
),添加或修改以下配置:
server {
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
root /var/www/html;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
}
重启Nginx以应用更改:
sudo systemctl reload nginx
保持系统和软件包的最新状态,以修补已知的安全漏洞:
sudo apt update && sudo apt upgrade
通过以上步骤,你可以在Debian上安全地运行Nginx,并确保其具有良好的安全性和性能。