☰

使 SSL 在 Django 项目上运行

tag-icon • tag-icon ubuntu nginx iptables ssl django
使 SSL 在 Django 项目上运行

我正在尝试将我的 Django 网站完全迁移到https(目前仅是http)。 Web 服务器是 nginx (反向代理) 和 gunicorn。

但是，即使正确安装了 SSL、打开了端口 443 并调整了我的 nginx 虚拟主机文件，我还是无法连接到我的网站https://example.com（http://example.com运行正常）。有人可以指导我如何解决此问题吗？

以下是详细信息：

在/etc/iptables/rules.v4（我使用该iptables-persistent包）中，我在其他行中有此代码片段：

# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT
-A TCP -p tcp --dport 80 -j ACCEPT
-A TCP -p tcp --dport 443 -j ACCEPT

如果我写入sudo netstat -4plunt，输出将显示端口 443 正在监听：

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      18445/nginx     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      923/sshd        
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      719/postgres    
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      18445/nginx

我的文件夹中的nginx虚拟主机文件中sites-enabled包含以下代码：

server {
    listen 80;

    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /etc/ssl/certs/ssl-bundle.crt;
    ssl_certificate_key /etc/ssl/private/myserver.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    charset utf-8;
    underscores_in_headers on;

    location = /favicon.ico { access_log off; log_not_found off; }

    location /static/ {

        root /home/myuser/myprojectfolder/myproject;
    }

    location /static/admin/ {

        root /home/myuser/.virtualenvs/myenv/local/lib/python2.7/site-packages/django/contrib/admin/static/;
    }

    location /status {
        stub_status on;
        allow 127.0.0.1;
        allow 40.114.247.165;
        deny all;
    }

    location / {
        proxy_pass_request_headers on;
        proxy_buffering on;
        proxy_buffers 8 24k;
        proxy_buffer_size 2k;
        include proxy_params;
        #include /etc/nginx/naxsi.rules;
        #include /etc/nginx/naxsi_whitelist.rules;
        proxy_pass          http://unix:/home/myuser/myprojectfolder/myproject/myproject.sock;

    }


    error_page 500 502 503 504 /500.html;
    location = /500.html {
        root /home/myuser/myprojectfolder/myproject/templates/;
   }
}

最后，我在 django 项目的文件中添加了以下行settings.py：

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

完成上述所有更改后，我仍然无法运行我的网站https；连接总是超时。

有人能帮助我解决该问题吗？如果您需要，请向我了解更多信息。

完整规则设置/etc/iptables/rules.v4如下：

*filter
# Allow all outgoing, but drop incoming and forwarding packets by default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Custom per-protocol chains
:UDP - [0:0]
:TCP - [0:0]
:ICMP - [0:0]

# Acceptable UDP traffic

# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT
-A TCP -p tcp --dport 80 -j ACCEPT
-A TCP -p tcp --dport 443 -j ACCEPT

# Acceptable ICMP traffic

# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT

# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Pass traffic to protocol-specific chains
## Only allow new connections (established and related should already be handled)
## For TCP, additionally only allow new SYN packets since that is the only valid
## method for establishing a new TCP connection
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP

# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable

# Commit the changes
COMMIT

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

/proc/net/ip_tables_matches包含：

conntrack
conntrack
conntrack
udplite
udp
tcp
icmp

proxy_params我的 nginx 虚拟主机文件中包含以下内容：

proxy_set_header Host $host;
proxy_set_header User-Agent $http_user_agent;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Remote-Addr $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

答案1

连接可能超时，因为您的 Iptables 在某些时候可能不正确。

尝试刷新你的 Iptables (如果你在其中有一些工作，请先保存它们) 刷新测试后添加这些会很好。

-A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

# Allow inbound traffic from established connections.
# This includes ICMP error returns.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

相关内容