Wang's Tech Blog

Tagged: Security Toggle Comment Threads | Keyboard Shortcuts

• 

  Wang 19:05 on 2018-01-20 Permalink | Reply
  Tags: AliCloud, Blog ( 7 ), Domain ( 7 ), Nginx ( 4 ), Security   

  Proxy AliCloud’s domain to AWS’s server 

  I registed my domain “wanghongmeng.com” on Aliyun, and applied free EC2 server for one year on AWS.

  After building my blog on AWS, I set A parse to the server’s IP of AWS.

  But yesterday I received email from Aliyun which said that my server was not in Aliyun after they checking, it was not allowed, I have to miggrate my blog server to Aliyun, otherwise they will undo my authority number.

  After thinking about this, for saving money(Aliyun is not free for one year), I solved it by the way below:

  1.Set A parse to my friend’s server ip which was bought in Aliyun

  2.Add a piece of configuration in his nginx.conf:

  server {
      listen  80;
      server_name  wanghongmeng.com www.wanghongmeng.com;
  
      location / {
          rewrite ^/(.*)$ https://$server_name/$1 permanent;
      }
  }
  
  server {
      listen 443;
      server_name wanghongmeng.com www.wanghongmeng.com;
      ssl on;
      ssl_certificate "Location of Pem File";
      ssl_certificate_key "Location of Key File";
      ssl_session_timeout 5m;
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers "Your Algorithm";
      ssl_session_cache shared:SSL:50m;
      ssl_prefer_server_ciphers on;
  
      location / {
          proxy_pass  http://AWS's IP:443/;
      }
  }
  

  3.Expose 443 port on my AWS, and only accept requests from my friend’s server IP:

  server {
      listen  443;
      
      set $flag 0;
      if ($host = 'www.wanghongmeng.com') {
          set $flag 1;
      }
      if ($host = 'wanghongmeng.com') {
          set $flag 1;
      }
      if ($flag = 0){
          return 403;
      }    
      
      location / {
          allow "My Friend's Server IP";
          proxy_pass  http://blog-ip;
      }
  }
  

  Things done! 😀😀

  Like Loading...
   

  Reply Cancel reply

  Name

  Email

  Website

  Notify me of new comments via email.

  Notify me of new posts via email.

  Δ

• 

  Wang 18:29 on 2018-01-13 Permalink | Reply
  Tags: Domain ( 7 ), Nginx ( 4 ), Security   

  Prevent web site being mirrored 

  I thought something before, when I check nginx’s log, I found a wired hostname.

  After checking, I think our website was mirrored.

  I think they parsed their domain by CNAME to our domain, and we don’t do any host check at that time.

  To prevent being mirrored again, I add host check configuration in nginx.conf

  set $flag 0;
  if ($host = 'www.wanghongmeng.com') {
      set $flag 1;
  }
  if ($host = 'wanghongmeng.com') {
      set $flag 1;
  }
  if ($flag = 0){
      return 403;
  }
  

  By adding this, nginx will check every request to see if it’s from our domain, if not, return 403 response code.

  After this, our website was no longer mirrored again.

  Nginx Version: 1.9.12

  Like Loading...