keepalived+nginx安全

原创
小哥 3年前 (2022-11-04) 阅读数 2 #大杂烩

nginx默认监听本地所有ip,0.0.0.0:80,所以域名可以绑定到keepalived的虚拟ip上。

keepalived主机master配置:

! Configuration File for keepalived

global_defs {
notification_email {
! Configuration File for keepalived

global_defs {
notification_email {
acassen@firewall.loc
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc
smtp_server 192.168.200.1
smtp_connect_timeout 30
router_id woshizhu
vrrp_skip_check_adv_addr

vrrp_strict

vrrp_garp_interval 0
vrrp_gna_interval 0
}

vrrp_script chk_nginx {
script "/data/check_nginx.sh" ##检查本地nginx是否存活脚本需要自己写,
interval 2
weight -20
}

VIP1

vrrp_instance VI_1 {
state MASTER
interface ens32
virtual_router_id 151
priority 150
advert_int 5 #健康检测频率
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.91.200/24
}
track_script {
chk_nginx
}
}

keepalived从机backup配置:

! Configuration File for keepalived

global_defs {
notification_email {
acassen@firewall.loc
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc
smtp_server 192.168.200.1
smtp_connect_timeout 30
router_id woshicong
vrrp_skip_check_adv_addr

vrrp_strict

vrrp_garp_interval 0
vrrp_gna_interval 0
}

vrrp_script chk_nginx {
script "/data/check_nginx.sh" ##检查本地nginx是否存活脚本需要自己写
interval 2
weight -20
}

VIP1

vrrp_instance VI_1 {
state BACKUP
interface ens32
virtual_router_id 151
priority 100
advert_int 5 #健康检测频率
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.91.200/24
}
track_script {
chk_nginx
}
}

检查nginx存活脚本check_nginx.sh:

!/bin/bash

killall -0 nginx
if [[ $? -ne 0 ]]; then
systemctl stop keepalived
fi

版权声明

所有资源都来源于爬虫采集,如有侵权请联系我们,我们将立即删除