Nginx

Nginx is an high-performance and lightweight multipurpose server for the web.

It can be used for various types of installation:

• Web server (HTTP)
• Secure web server (HTTPS)
• Proxy
• Reverse Proxy
• Email server (IMAP/POP3)

In this article we will cover the web server (HTTP and HTTPS) part.

Nginx installation

For example, if you are using a debian based distribution follow these steps to install nginx:

apt-get update
apt-get install nginx

For other distributions, use the packages manager provided with it.

If you want to compile nginx from source:

1. Download the latest version of nginx from here: http://www.nginx.org/en/download.html
2. Unzip it: tar xvf tar xvf nginx-1.0.2.tar.gz 
3. Change the directory: cd nginx-1.0.2
4. Start the configure: ./configure
5. If there aren't errors start the compilation: make
6. If there aren't errors install the program (root needed): make install

 Web server

After the installation start nginx:

Debian based: /etc/init.d/nginx start

If you can't start nginx check you have the root permissions.

And we can see that our web server is up and running:

root@debian:/etc/nginx# ps aux | grep nginx
root      2929  0.0  0.1   5000   704 ?        Ss   09:07   0:00 nginx: master process /usr/sbin/nginx
www-data  2930  0.0  0.4   5296  2192 ?        S    09:07   0:00 nginx: worker process
root      3087  0.0  0.1   3300   744 pts/0    S+   09:32   0:00 grep nginx


As you can see there are mainly two processes, the "master" process, wich is the main process and it's owned by "root". The other process is the one called "worker" and it's owned by an unprivileged users. In our case the web server user is called "www-data".

root@debian:/etc/nginx# netstat -na | grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*            LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     

With the default configuration, nginx will listen on both IPv4 and IPv6.

Now if you type the IP of your server in a browser you will see a welcome message like these:

In our case using lynx we obtain this message:

                                                                                      It works!

   This is the default web page for this server.

   The web server software is running but no content has been added, yet.


 If you don't see this message, probably the root document directory of the web server is empty. We will see this later.

 Configuration

You can find the configuration files in the "/etc/niginx" directory:

root@debian:/etc/nginx# ls -l
total 48
drwxr-xr-x 2 root root 4096 Jul 29  2010 conf.d
-rw-r--r-- 1 root root  909 Nov 26  2009 fastcgi_params
-rw-r--r-- 1 root root 2837 Nov 26  2009 koi-utf
-rw-r--r-- 1 root root 2223 Nov 26  2009 koi-win
-rw-r--r-- 1 root root 3042 May  6  2010 mime.types
-rw-r--r-- 1 root root 1019 Nov 26  2009 nginx.conf
drwxr-xr-x 2 root root 4096 May 16 09:05 sites-available
drwxr-xr-x 2 root root 4096 May 16 09:05 sites-enabled
-rw-r--r-- 1 root root 3610 Nov 26  2009 win-utf

We can see that there are some files and directories. We will begin with by configuring the main deamon, editing nginx.conf.

 nginx.conf

This is the main configuration file for the nginx daemon. By default it looks like this one:

root@debian:/etc/nginx# cat nginx.conf 
user www-data;
worker_processes  1;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;

    access_log  /var/log/nginx/access.log;

    sendfile        on;

    keepalive_timeout  65;
    tcp_nodelay        on;

    gzip  on;
    gzip_disable "MSIE [1-6].(?!.*SV1)";

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

Here the explanation line by line:

 Virtual hosts

Configuring virtual hosts using nginx is not a difficult task. In the configuration above, the directive "include /etc/nginx/sites-enabled/*;" specifies the virtual hosts folder, so we will place the file for every single virtual host here.

We only need to create a file that will contain the configuration for a single virtual host, in our case we'll call this one "slack.local".

NOTE: that you must have a DNS server in order to point the name "slack.local" to the web server. If you don't have a DNS server and you want only to try nginx on your localhost, you can edit the file "/etc/hosts" and add a line like this "127.0.0.1 slack.local".

For a very basic configuration we'll write these lines of code:

server{
    listen 80;
    server_name slack.local;
    access_log  /var/log/nginx/domain2.access.log;
    root /var/www/slack/;
}

In the section "server" we have to write the configuration parameters.

First we have "server_name" that specifies the name that we will type in the browser in order to access to this virtual host.

Secondly we define the "access_log" directory for storing the log of the people that will access the site.

The last line contains the root content directory for this virtual host. In our case we've choosed "/var/www/slack/".

Now we can perform some tests before accessing "slack.local" from our web browser.

If you have configured the system with DNS use "dig" and control if the name "slack.local" is resolved.

bash-4.1# dig slack.local

; <<>> DiG 9.7.3 <<>> slack.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER
;; QUESTION SECTION:
;slack.local.                   IN      A

;; ANSWER SECTION:
slack.local.            604800  IN      A       192.168.1.206

;; AUTHORITY SECTION:
slack.local.            604800  IN      NS      slack.local.

;; Query time: 0 msec
;; SERVER: 192.168.1.206#53(192.168.1.206)
;; WHEN: Fri Jun 17 20:41:56 2011
;; MSG SIZE  rcvd: 59


We can see that "slack.local" is resolved correctly. When we will write "slack.local" in our web browser the web server 192.168.1.206 will handle the request.

Now the final test is to type "slack.local" using our web browser:

         It doesn't work!

   This isn't the default web page for this server.

   The web server software isn't running but some content has been added, yet.
   

This is the page we've set up for our test and as we see we can display it correctly.

If you want to be really sure that the configuration is working, add a second virtual host, create a new index.html for this virtual host, modifiy the dns and finally test if you can reach the two different pages in the browser.

 HTTPS

Our next step will be to set up a virtual host using the secure HTTPS protocol. When using HTTPS, the connections between server and client will be encrypted, and in order to encrypt this communication channel, we need to generate first the SSL certificate.

 Generating the certificate

To begin, we will move to the directory "/etc/nginx/" since we will store here the file for the certificates.

Now we have to generate the private key that we will use later to sign the CSR (Certificate Signing Request).

Type the following command to generate it:

root@debian:/etc/nginx/conf.d# openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................................................+++
..............................+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key

This will generate a 2048 bit long key. You can see that we want to protect the key by using a pass phrase. Using a pass phrase will avoid that anyone can read the key. We use the des3 to encrypt the pass phrase.

NOTE: with the pass phrase enabled you are asked every time you start nginx to enter it. If you want to disable this behaviour run the command above without the "-des3" option. If you do this, the private key will be world readable, so you have to be sure that only the root account or the administrator of the server can read the file.

Now the second step is to generate a CSR (Certificate Signing Request). A CSR is a certificate that must be sent to the CA (Certification Auhtority) along the private key in order to obtain a valid and verifyed SSL certificate. We will obiouvsly jump this step cause we will create a dummy certificate.

Generation of a CSR:

root@debian:/etc/nginx/conf.d# openssl req -new -key server.key -out server.csr 
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CH
State or Province Name (full name) [Some-State]:Ticino
Locality Name (eg, city) []:Lugano
Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:IT
Email Address []:it@company.domain

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

You are asked for the private key's password and then you have to insert some general information such as the "Organization Name" or the "Country Name".

Now we will create our dummy certificate with the following command:

root@debian:/etc/nginx# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CH/ST=Ticino/L=Lugano/O=IT/OU=IT/CN=IT/emailAddress=it@company.domain
Getting Private key
Enter pass phrase for server.key

We've generated a x509 certificate valid for one year (x509 -req -days 365) using the CSR and the private key (-in server.csr -signkey server.key) we've generated before to sign it. Our final certificate is "server.crt".

You can see that you must insert the password of your private key.

Virtual host with SSL

Now we have to configure nginx in order to access to the secure web site from our browser. In the sites-enabled folder we have added the virtual host "ssl.local":

root@debian:/etc/nginx/sites-enabled# cat ssl.local 
server{
        listen 443; 

        server_name ssl.local;

        ssl  on;
        ssl_certificate  /etc/nginx/server.crt;
        ssl_certificate_key  /etc/nginx/server.key;
        access_log  /var/log/nginx/ssl.access.log;

        root /var/www/ssl/;
}

 We've added "listen 443" so this virtual host will listen on the 443 (HTTPS) port. Then under "server_name" we've written three directive:

• ssl on; => we activate ssl for this virtual host
• ssl_certificate /etc/nginx/server.crt => the path to the certificate
• ssl_certificate_key /etc/nginx/server.key => the path to the private key

 Final configuration

 nginx.conf

root@debian:/etc/nginx# cat nginx.conf 
user www-data;
worker_processes  1;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
    # multi_accept on;
}

http {
    include       /etc/nginx/mime.types;

    access_log  /var/log/nginx/access.log;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay        on;

    gzip  on;
    gzip_disable "MSIE [1-6].(?!.*SV1)";

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

 Certificates

root@debian:/etc/nginx# ls -l server.*
-rw-r--r-- 1 root root 1249 Jun 20 15:40 server.crt
-rw-r--r-- 1 root root 1025 Jun 19 18:36 server.csr
-rw-r--r-- 1 root root 1743 Jun 19 18:12 server.key

 slack.local

root@debian:/etc/nginx/sites-enabled# cat slack.local 
server{
        listen 80;
        server_name slack.local;
        access_log  /var/log/nginx/slack.access.log;
        root /var/www/slack/;
}

 deb.local

root@debian:/etc/nginx/sites-enabled# cat deb.local 
server{
        listen 80;
        server_name deb.local;
        access_log  /var/log/nginx/deb.access.log;
        root /var/www/deb/;
}

 ssl.local

root@debian:/etc/nginx/sites-enabled# cat ssl.local 
server{
        listen 443; 

        server_name ssl.local;

        ssl  on;
        ssl_certificate  /etc/nginx/server.crt;
        ssl_certificate_key  /etc/nginx/server.key;
        access_log  /var/log/nginx/ssl.access.log;

        root /var/www/ssl/;
}