目標：
一、創建白名單文件
sudo mkdir -p /usr/local/nginx/conf/whitelist
sudo touch /usr/local/nginx/conf/whitelist/temporary.conf二、創建Python認證服務
文件路徑：/opt/script/auth_server.py
import os
import time
from flask import Flask, request, abort
import sysapp = Flask(__name__)# 配置參數
USERS = [{"username": "admin1", "password": "111111"},{"username": "admin2", "password": "222222"}
]
TEMP_CONF = "/usr/local/nginx/conf/whitelist/temporary.conf"
IP_LOG = "/usr/local/nginx/conf/whitelist/ip_time.log" # 存儲IP和添加時間def update_whitelist():"""更新臨時白名單文件"""current_time = time.time()valid_ips = []# 讀取所有IP并過濾過期項if os.path.exists(IP_LOG):with open(IP_LOG, "r") as f:for line in f.readlines():parts = line.strip().split()if len(parts) == 2:ip, timestamp = partsif current_time - float(timestamp) < 7200: # 2小時=7200秒valid_ips.append(ip)# 生成新的白名單配置with open(TEMP_CONF, "w") as f:for ip in set(valid_ips): # 去重f.write(f"allow {ip};\n")# 重載Nginxos.system("sudo /usr/local/nginx/sbin/nginx -s reload")@app.route('/auth', methods=['POST'])
def auth():# 獲取客戶端提交的憑證submitted_user = request.form.get('user')submitted_pass = request.form.get('pass')# 驗證用戶名密碼 - 支持多個賬號authenticated = Falsefor user in USERS:if submitted_user == user["username"] and submitted_pass == user["password"]:authenticated = Truebreakif not authenticated:abort(401)# 獲取真實客戶端IPclient_ip = request.headers.get('X-Real-IP', request.remote_addr)# 記錄IP和當前時間戳with open(IP_LOG, "a") as f:f.write(f"{client_ip} {time.time()}\n")# 更新白名單文件update_whitelist()return "認證成功！您的IP已加入白名單，有效期2小時。", 200if __name__ == '__main__':if len(sys.argv) > 1 and sys.argv[1] == "update":update_whitelist()else:app.run(host='127.0.0.1', port=5000)
三、創建登錄頁面
文件路徑：/usr/local/nginx/html/auth.html
<!DOCTYPE html>
<html>
<head><title>訪問授權</title>
</head>
<body><h2>請輸入管理員憑據</h2><form action="/auth" method="POST"><label>用戶名: <input type="text" name="user"></label><br><label>密碼: <input type="password" name="pass"></label><br><button type="submit">授權我的IP</button></form>
</body>
</html>四、配置Nginx
在nginx.conf的http塊內添加：
server {listen 80;server_name your_domain.com; # 改為你的域名或IP# 授權頁面location = /auth.html {alias /usr/local/nginx/html/auth.html;}# Python認證服務代理location = /auth {proxy_pass http://127.0.0.1:5000/auth;proxy_set_header X-Real-IP $remote_addr; # 傳遞真實IP}# 需要保護的資源location /protected {if ($whitelist = 0) {return 302 /auth.html; # 重定向到登錄頁}# 這里放被保護的內容（例如反向代理）# proxy_pass http://your_backend;}
}五、設置定時清理任務
創建清理腳本：/usr/local/nginx/scripts/clean_whitelist.py
#!/usr/bin/env python3
import os
import time
import sysIP_LOG = "/usr/local/nginx/conf/whitelist/ip_time.log"def main():# 讀取并過濾過期IPvalid_entries = []current_time = time.time()if not os.path.exists(IP_LOG):returnwith open(IP_LOG, "r") as f:for line in f:parts = line.strip().split()if len(parts) == 2:ip, timestamp = partsif current_time - float(timestamp) < 7200: # 保留未過期IPvalid_entries.append(line)# 更新日志文件with open(IP_LOG, "w") as f:f.writelines(valid_entries)# 調用認證服務更新白名單os.system("sudo /usr/bin/python3 /usr/local/nginx/scripts/auth_server.py update")if __name__ == '__main__':main()?添加cron任務
# 添加cron任務
sudo crontab -e
# 每10分鐘檢查一次
*/10 * * * * /usr/bin/python3 /opt/script/clean_whitelist.py六、啟動服務
啟動Python認證服務：
sudo pip3 install flask
sudo -b nohup python3 auth_server.py > /var/log/auth_server.log 2>&1重載Nginx配置：
sudo /usr/local/nginx/sbin/nginx -s reload七、驗證功能
訪問
http://your_domain.com/protected將被重定向到登錄頁
輸入用戶名
admin1和密碼111111成功后：
你的IP會被添加到
temporary.conf可訪問
/protected資源2小時后IP自動刪除
注意
# 確保所有腳本有執行權限
chmod +x /opt/script/*.py
N1盒子 - Armbian25.05(Debian 12)刷入U盤/EMMC)
