nginx正向代理SFTP整体配置方案

一、概述
目前由于行内网络规划以及安全的原因，不能直接从应用区域直接访问第三方SFTP文件服务器，只能允许代理服务器网络区域出去，也就是SFTP正向代理转发到第三方的SFTP文件服务器，而我们使用的代理应用软件则是开源的nginx。以前搞过正向代理HTTP，而没有尝试过正向代理SFTP，其实也就是TCP协议。为了满足应用需求，我们需要搭建nginx正向代理SFTP服务应用。

二、Nginx编译安装步骤
1、首先，要准备的是软件，可以在网上下载，Baidu or Google都可以找到开源的软件：nginx-1.10.3.tar.gz、ngx_cache_purge-2.3.tar.gz、pcre-8.38.tar.gz，如果机器上已经安装好了nginx的话，那就是添加模块即可，不需要重新覆盖安装，直接添加安装即可。

1.png

2、原本我们是没有安装nginx，这首先需要编译安装，我们找来了10.10.35.10这台Linux服务器机器，安装一下nginx

2.png

3、上传文件成功之后，则是解压nginx-1.10.3.tar.gz压缩包，如下：

3.png

4、同样解压其他的两个压缩包（ngx_cache_purge-2.3.tar.gz、pcre-8.38.tar.gz）

4.png

5、将nginx-1.10.3目录名改成nginx，然后移动到/usr/local/目录下，另外的两个文件夹也移动到/usr/local/目录下。

5.png

6、接着先编译安装nginx，则是敲下如下命令，同时make install即可完成安装

 ./configure --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/access.lod --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=root --group=root --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre=/usr/local/pcre-8.38/
checking for OS
 + Linux 2.6.32-504.el6.x86_64 x86_64
checking for C compiler ... found
 + using GNU C compiler
 + gcc version: 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC) 
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for O_PATH ... not found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for sched_setaffinity() ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for IP_RECVDSTADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... not found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for OpenSSL library ... found
checking for zlib library ... found
creating objs/Makefile

Configuration summary
  + using PCRE library: /usr/local/pcre-8.38/
  + using system OpenSSL library
  + md5: using OpenSSL library
  + sha1: using OpenSSL library
  + using system zlib library

  nginx path prefix: "/usr/local/nginx"
  nginx binary file: "/usr/local/nginx/sbin/nginx"
  nginx modules path: "/usr/local/nginx/modules"
  nginx configuration prefix: "/usr/local/nginx/conf"
  nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
  nginx pid file: "/var/run/nginx/nginx.pid"
  nginx error log file: "/var/log/nginx/error.log"
  nginx http access log file: "/var/log/access.lod"
  nginx http client request body temporary files: "/var/tmp/nginx/client/"
  nginx http proxy temporary files: "/var/tmp/nginx/proxy/"
  nginx http fastcgi temporary files: "/var/tmp/nginx/fcgi/"
  nginx http uwsgi temporary files: "/var/tmp/nginx/uwsgi"
  nginx http scgi temporary files: "/var/tmp/nginx/scgi"

7、最后是make install 编译安装，代码我就不截了。

6.png

8、最后，修改一下配置文件，通常是会有默认端口的。
在/usr/local/nginx/sbin/nginx 启动即可，在浏览器打开地址：http:10.10.35.10，能够打开这个nginx欢迎页面，那就是成功安装启动nginx了。

7.png

三、其他模块的添加安装
1、如果已经是安装好了nginx的话，在添加其他模块的时候，则不需要重新安装了，直接添加其他模块即可。首先需要检查一下已经安装了哪些模块，在/usr/local/nginx/sbin/目录下 敲./nginx -v命令即可。

8.png

2、上面则显示已经安装了pcre-8.38了，则后续就是安装ngx_cache_purge-2.3.tar.gz模块即可。回到上一级目录，/usr/local/src/nginx/ 敲下一下命令：

./configure --prefix=/usr/local/nginx --with-pcre=/usr/local/pcre-8.38/ --add-module=/usr/local/ngx_cache_purge-2.3 --with-stream 

9.png

3、最后就是make一下即可，（注意不需要make install）

10.png

4、接着修改配置文件，在/usr/local/nginx/conf目录下，找到nginx.conf配置文件
添加以下内容

11.png

新增这个模块：

stream { 
upstream sftp { 
hash $remote_addr consistent; 
server 127.0.0.1:22 max_fails=3 fail_timeout=60s; 
} 
server { 
listen 90; 
proxy_connect_timeout 60s; 
proxy_timeout  30s; 
proxy_pass sftp; 
} 
}

5、最后即可安装成功。