在 CentOS 上系统化加固 Nginx 的安全防护
一 系统与网络基线
二 Nginx 基础加固
if ($request_method !~ ^(GET|HEAD|POST)$) { return 405; }
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trustedscripts.example.com; object-src 'none';"";
client_body_timeout 12;
client_header_timeout 12;
keepalive_timeout 15;
send_timeout 10;
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
limit_req zone=one burst=5 nodelay;
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 100;
三 加密与证书部署
server {
listen 443 ssl http2;
server_name yourdomain.com www.yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
# 可选:启用 OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
}
server {
listen 80;
server_name yourdomain.com www.yourdomain.com;
return 301 https://$host$request_uri;
}
四 访问控制与请求防护
location /admin/ {
allow 192.168.1.0/24;
deny all;
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/.htpasswd;
}
location /uploads/ {
location ~ \.php$ { deny all; }
}
location ~* \.(jpg|jpeg|png|gif|webp)$ {
valid_referers none blocked yourdomain.com www.yourdomain.com;
if ($invalid_referer) {
return 403;
# 或 rewrite ^ /static/error.png last;
}
}
五 日志监控 备份与应急响应
http {
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;
}
# 备份
tar -czvf nginx-backup-$(date +%F).tar.gz /etc/nginx /var/log/nginx
# 恢复
tar -xzvf nginx-backup-*.tar.gz -C /
nginx -t && systemctl restart nginx