Usually, SSL termination takes place at the load balancer and unencrypted traffic sent to the backend web servers. All HTTPS/SSL/TLS and HTTP requests are terminated on the Nginx server itself. Nginx server uses the HTTP protocol to speak with the backend server. You must take great care to make sure no one snoops traffic between your private network. In shared environment, the private network might not be safe, or you may not be able to get VLAN and VPN for the private network. In that case, you can configure Nginx to pass all encrypted traffic directly to the backend end web server. The traffic remains encrypted between all backend web servers:
Please note that you must install the SSL/TLS on all backend server such as 192.168.1.100 and 192.168.1.101.
Please note that you must install the SSL/TLS on all backend server such as 192.168.1.100 and 192.168.1.101.
Say hello to stream module
You need to use the ngx_stream_core_module module for TCP load balancing and is available since version 1.9.0. This module is not built by default on a Debian/Ubuntu or any other distro, it should be enabled with the --with-stream configuration parameter. However, you can install the official Nginx package and use this module.
Step 1: Install Nginx LB
Run commands as per your Linux distro:
Ubuntu Linux 16.04 LTS server
First grab PGP key using wget command:
Install the same using apt-get command:
Create a config file:
Append the following code:
Save and close the file. Update repo and install nginx:
$ cd /tmp/
$ wget https://nginx.org/keys/nginx_signing.keyInstall the same using apt-get command:
$ sudo apt-key add nginx_signing.keyCreate a config file:
$ sudo vi /etc/apt/sources.list.d/nginx.listAppend the following code:
deb http://nginx.org/packages/ubuntu/ xenial nginx
deb-src http://nginx.org/packages/ubuntu/ xenial nginxSave and close the file. Update repo and install nginx:
$ sudo apt-get update
$ sudo apt-get install nginxDebian Linux 9.x server
First grab PGP key using wget command:
Install the same using apt-get command:
Create a config file:
Append the following code:
Save and close the file. Update repo and install nginx:
$ cd /tmp/
$ wget http://nginx.org/keys/nginx_signing.keyInstall the same using apt-get command:
$ sudo apt-key add nginx_signing.keyCreate a config file:
$ sudo vi /etc/apt/sources.list.d/nginx.listAppend the following code:
## [ NOTE: Debian 8.x user replace stretch with jessie ] ##
deb http://nginx.org/packages/debian/ stretch nginx
deb-src http://nginx.org/packages/debian/ stretch nginxSave and close the file. Update repo and install nginx:
$ sudo apt-get update
$ sudo apt-get install nginxRHEL/CentOS Linux 6.x/7.x server
You must set up the yum repository for RHEL/CentOS, create the file named /etc/yum.repos.d/nginx.repo:
Add the the following config:
$ sudo vi /etc/yum.repos.d/nginx.repoAdd the the following config:
## Replace "OS" with rhel or centos depending on the distribution used ## Replace "OSRELEASE" with 6 or 7, for 6.x or 7.x versions, respectively ## An example for CentOS 7.x is as follows: [nginx] name=nginx repo baseurl=http://nginx.org/packages/centos/7/$basearch/ gpgcheck=0 enabled=1
Save and close the file. Run the following yum command:
Sample outputs:
$ sudo yum update
$ sudo yum install nginxSample outputs:
Step 2: Configure Nginx LB
Edit the /etc/nginx/nginx.conf file, run:
Append the following line:
$ sudo vi /etc/nginx/nginx.confAppend the following line:
include /etc/nginx/passthrough.conf;
Here is how it looks:
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
include /etc/nginx/passthrough.conf;
Save and close the file. Create a text file:
Update it as follows:
$ sudo vi /etc/nginx/passthrough.confUpdate it as follows:
## tcp LB and SSL passthrough for backend ##
stream {
upstream cybercitibizapache {
server 192.168.1.100:443 max_fails=3 fail_timeout=10s;
server 192.168.1.101:443 max_fails=3 fail_timeout=10s;
}
log_format basic '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
access_log /var/log/nginx/www.cyberciti.biz_access.log basic;
error_log /var/log/nginx/wwww.cyberciti.biz_error.log;
server {
listen 443;
proxy_pass cybercitibizapache;
proxy_next_upstream on;
}
}
Save and close the file. Test it:
Restart or reload the nginx server, run:
OR
$ nginx -tRestart or reload the nginx server, run:
$ sudo systemctl reload nginxOR
$ sudo /etc/init.d/nginx reloadOPEN PORT 443 AND 80 (MUST TYPE ON NGINX SERVER RUNNING ON PUBLIC IP)
Use the ufw command to open port 443 on Debian/Ubuntu Linux:
You can use the following on CentOS7/RHEL7 to open port 80/443:
$ sudo ufw allow proto tcp from any to 202.54.1.5 port 443
$ sudo ufw allow proto tcp from any to 202.54.1.5 port 80You can use the following on CentOS7/RHEL7 to open port 80/443:
# firewall-cmd --get-default-zone
# firewall-cmd --get-active-zones
# firewall-cmd --permanent --add-service=http
# firewall-cmd --permanent --add-service=https
# firewall-cmd --reloadStep 3: Backend web server config at 192.168.1.{100,101}
You must use the real/commercial certificate for your production site. I am going to use Nginx with free Let’s Encrypt SSL certificate:
Edit config for ssl:
$ sudo apt-get install git bc wget curl
$ cd /tmp/
$ git clone https://github.com/Neilpang/acme.sh.git
$ cd acme.sh/
$ sudo -i
# ./acme.sh --install
$ sudo source ~/.bashrc
# D=/var/www/html
# DOM='www.cyberciti.biz'
# mkdir -vp ${D}/.well-known/acme-challenge/
###---[ NOTE: Adjust permission as per your setup ]---###
# chown -R www-data:www-data ${D}/.well-known/acme-challenge/
# chmod -R 0555 ${D}/.well-known/acme-challenge/
# mkdir -p /etc/nginx/ssl/${DOM}/
# cd /etc/nginx/ssl/${DOM}/
# openssl dhparam -out dhparams.pem -dsaparam 4096
# acme.sh --issue -w $D -d $DOM -k 4096
# vi /etc/nginx/sites-available/defaultEdit config for ssl:
Save and close the file. Create a shell script called /root/hook.sh to copy your /etc/nginx/ config from 192.168.1.100 to second server (192.168.1.101) and reload it. Here is a sample script:
Type the following command:
The cron job will now automatically create certificates and run /root/hook.sh every time to replicate settings:
# acme.sh --installcert -d $DOM --keypath /etc/nginx/ssl/$DOM/$DOM.key --fullchainpath /etc/nginx/ssl/$DOM/$DOM.in.cer --reloadcmd '/root/hook.sh'The cron job will now automatically create certificates and run /root/hook.sh every time to replicate settings:
No comments:
Post a Comment