解决任意域名都能访问nginx443端口的问题
发表于:2021-09-26 |

今天调试时发现,使用b.nbxg.com,c.errb.com等域名也可以访问 a.2kb.com下载目录,这对搜索引擎抓包时应该会产生比较严重的影响,导致搜索引擎误判。

例如

https://www.nbxg.com/index.html

同样也可以访问

https://www.2kb.com/index.html

server {

listen 443 ssl;

server_name a.2kb.com;

root html;

index index.html index.htm;

ssl_certificate  cert/a.crt;

ssl_certificate_key  cert/a.key;

ssl_session_timeout 5m;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_dhparam cert/a.pem;

location / { 

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header Host $http_host;

    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;

    proxy_connect_timeout      240;

    proxy_send_timeout         240;

    proxy_read_timeout         240;

    client_max_body_size 1000m;

    proxy_pass http://localhost/;

}

}

经查找,采用以下解决方案

添加一个默认的ssl默置,Nginx找不到ssl server_name时,将转向默认的配置,但必须指定一下证书,随意证书即可

server {

 listen 443 default_server;

 server_name _ ;

 ssl on;

 ssl_certificate     cert/a.crt;                    

 ssl_certificate_key cert/a.key; 

 #return 404;
  location  / {
    root   /etc/nginx/error;
    index index.html;

 }


}
上一篇:
docker删除所有容器/镜像
下一篇:
vim 给每行首加入#