Nginx 版本平滑升级

介绍

在我们日常工作中，Nginx使用非常频繁的WEB中间件，但广泛的使用范围也就意味着安全问题不可忽视。因此，经常需要通过升级Nginx版本来规避漏洞。

系统: CentOS7
版本: Nginx 1.23.2

1 查看现有的Nginx编译配置

$ cd /usr/local/nginx/sbin && ./nginx -V

nginx version: nginx/1.22.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/usr/local/nginx/logs/error.log --http-log-path=/usr/local/nginx/logs/access.log --pid-path=/usr/local/nginx/logs/nginx.pid --lock-path=/usr/local/nginx/logs/nginx.lock --modules-path=/usr/local/nginx/modules --sbin-path=/usr/local/nginx/sbin/nginx --http-client-body-temp-path=/usr/local/nginx/client_temp --http-proxy-temp-path=/usr/local/nginx/proxy_temp --http-fastcgi-temp-path=/usr/local/nginx/fastcgi_temp --http-uwsgi-temp-path=/usr/local/nginx/uwsgi_temp --http-scgi-temp-path=/usr/local/nginx/scgi_temp --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-mail --with-mail_ssl_module --with-file-aio --with-stream --with-stream_ssl_module --with-stream_realip_module --with-stream_ssl_preread_module

参数-V可将Nginx的配置信息显示出来

2 解压新版本Nginx，进入新版本nginx目录

$ tar -zxvf nginx-1.23.2.tar.gz && cd nginx-1.23.2

3 配置新版本Nginx编译信息

复制刚刚查询的旧版本Nginx配置信息，重新配置

$ ./configure --prefix=/usr/local/nginx \
  --user=nginx \
  --group=nginx \
  --conf-path=/usr/local/nginx/conf/nginx.conf \
  --error-log-path=/usr/local/nginx/logs/error.log \
  --http-log-path=/usr/local/nginx/logs/access.log \
  --pid-path=/usr/local/nginx/logs/nginx.pid \
  --lock-path=/usr/local/nginx/logs/nginx.lock \
  --modules-path=/usr/local/nginx/modules \
  --sbin-path=/usr/local/nginx/sbin/nginx \
  --http-client-body-temp-path=/usr/local/nginx/client_temp \
  --http-proxy-temp-path=/usr/local/nginx/proxy_temp \
  --http-fastcgi-temp-path=/usr/local/nginx/fastcgi_temp \
  --http-uwsgi-temp-path=/usr/local/nginx/uwsgi_temp \
  --http-scgi-temp-path=/usr/local/nginx/scgi_temp \
  --with-http_ssl_module \
  --with-http_realip_module \
  --with-http_addition_module \
  --with-http_sub_module \
  --with-http_dav_module \
  --with-http_flv_module \
  --with-http_mp4_module \
  --with-http_gunzip_module \
  --with-http_gzip_static_module \
  --with-http_random_index_module \
  --with-http_secure_link_module \
  --with-http_stub_status_module \
  --with-http_auth_request_module \
  --with-mail \
  --with-mail_ssl_module \
  --with-file-aio \
  --with-stream \
  --with-stream_ssl_module \
  --with-stream_realip_module \
  --with-stream_ssl_preread_module

4 编译（无需安装）

$ make

5 替换旧版本Nginx

# 备份旧版本Nginx
$ mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx_bak
# 将刚刚编译的新版Nginx替换旧版本Nginx
$ cp objs/nginx /usr/local/nginx/sbin/nginx

6 测试

# 查看当前Nginx版本
$ cd /usr/local/nginx/sbin && ./nginx -v

$ nginx version: nginx/1.23.2

6.1 启动测试

$ ./nginx
netstat -nltp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name  
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      15182/nginx: master 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      940/sshd    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1113/master   
tcp6       0      0 :::22                   :::*                    LISTEN      940/sshd    
tcp6       0      0 ::1:25                  :::*                    LISTEN      1113/master