DOCSLIB.ORG

Why NGINX Plus?

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Why NGINX Plus? Learn more at nginx.com If You Like NGINX, You’ll Love NGINX Plus Every company is a technology company. NGINX Plus is the only all-in-one API gateway, The applications you build play a critical role in cache, load balancer, web application firewall your company’s future. But building applications (WAF), and web server. NGINX Plus extends is only the half the battle; success or failure NGINX Open Source with exclusive features depends on how well you deploy, secure, and and award-winning support, providing customers scale your applications. with a complete application delivery solution. Application Servers Web Server Reverse Proxy API Gateway Cache Load Balancer WAF Why NGINX Plus? Consolidation Cost Savings Flexibility Reduce complexity and simplify Save more than 80% compared Deploy anywhere. Multi-cloud: management by consolidating to hardware load balancers with AWS, Azure, GCP, and VMware. load balancer, API gateway, NGINX Plus and commodity Containers: Docker, Kubernetes, and WAF into a single elastic hardware and OpenShift ingress/egress tier NGINX is a part of F5 NGINX Plus Features AUTHENTICATION PROGRAMMABILITY • HTTP Basic Authentication • NGINX JavaScript module for scripting and • HTTP authentication subrequests advanced configurations • X.509 client certificate authentication • Lua scripting language • NTLM authentication • Ansible, Chef, and Puppet integration • JSON Web Token (JWT) validation • Key-value store for dynamic configuration • OpenID Connect • NGINX Plus API for managing upstream servers, • Single sign-on: Keycloak, Okta, OneLogin, key-value stores, and metrics Ping Identity, most IdPs • Dynamic reconfiguration without process reloads CONTENT CACHE SECURITY CONTROLS • Cache static and dynamic content • Request, connection, and bandwidth limiting • Micro and byte-range caching • IP address access control list (ACL) • Serve content when origin is unavailable; • Dual stack RSA/ECC SSL/TLS offloading improves uptime • Server-side SSL/TLS encryption • Override or set Cache-Control headers • TLS 1.3 support • Cache purging • Mutual TLS termination and proxying • Secure links HIGH AVAILABILITY • Dynamic DDoS mitigation • • Active-active and active-passive HA modes NGINX WAF module* • Configuration synchronization • State sharing: sticky-learn session persistence, STREAMING MEDIA rate limiting, and key-value stores • Live: RTMP, HTTP Live Streaming (HLS), DASH • Easy installation with built-in script • VoD: Flash (flv), MP4 • Adaptive-bitrate VOD: HLS, Adobe HTTP Dynamic LOAD BALANCER Streaming (HDS) • HTTP, TCP, and UDP load balancing • Bandwidth controls for MP4 streaming • Random with Two Choices, Round Robin, and Least Connections algorithms THIRD-PARTY INTEGRATIONS • Passive health checks • Kubernetes Ingress Controller • IP Hash session persistence • OpenShift Router • IP transparency • Third-party modules: Headers-More, Set-Misc, etc. • Direct Server Return (DSR) • Certified modules: 51Degrees, ForgeRock, etc. • Layer 7 request routing • Least Time algorithm, can be used with WEB SERVER/REVERSE PROXY Random with Two Choices • Serve static content with low memory footprint • Active HTTP, TCP, and UDP health checks • Reverse proxy gRPC, HTTP, Memcached, PHP-FPM, – Customizable HTTP status code check SCGI, and uwsgi servers – Regex pattern matching on HTTP response body • IP address geolocation (requires MaxMind – TCP Connect health check GeoIP database) • Sticky-cookie (insertion and learning) and sticky- • HTTP/2 termination and HTTP/2 server push route session persistence • Service discovery using DNS SUPPORTED ENVIRONMENTS MONITORING Cloud Operating Systems • Amazon Web Services (AWS) • Alpine Linux • Stub status module with 7 aggregated metrics • Google Cloud Platform (GCP) • Amazon Linux • Extended status with over 150 unique metrics • Microsoft Azure • CentOS • Real-time graphical dashboard • VMware • Debian • JSON output for integration with custom • FreeBSD monitoring tools Containers • Oracle Linux • Docker • RHEL * NGINX WAF is based on ModSecurity. Additional cost. • Kubernetes • SUSE Bold features are exclusive to NGINX Plus. • OpenShift • Ubuntu CPUs For more information, visit: • ARM (64 bit) • PowerPC (64 bit) nginx.com/products/nginx/ • x86 (32 and 64 bit) or send us an email at [email protected] ©2020 F5 Networks, Inc. All rights reserved. NGINX, NGINX Controller, NGINX Plus, NGINX Unit, NGINX WAF, F5, F5 Networks, the NGINX logo, the NGINX Controller logo, and the F5 logo are trademarks of F5 Networks, Inc. in the U.S. and in certain other countries. Other F5 trademarks are identified at f5.com. Any other products, services, or company names referenced herein may be trademarks of their respective owners with no endorsement or affiliation, expressed or implied, claimed by F5. .
Load more

Recommended publications
  • The Application Delivery Firewall Paradigm | F5 White Paper
    White Paper The Application Delivery Firewall Paradigm The increasing sophistication, frequency, and diversity of today’s network attacks are overwhelming conventional stateful security devices at the edge of the data center. A new data center architecture based on the security services of the F5 application delivery firewall solution effectively combats modern attacks while providing significant CapEx savings. Lori MacVittie Senior Technical Marketing Manager David Holmes Senior Technical Marketing Manager White Paper The Application Delivery Firewall Paradigm Contents Introduction 3 Firewall Limitations 4 A New Data Center Architecture 6 Native Application Protocol Fluency 7 Advanced Network Protection 8 Advanced DNS Protection 9 Advanced Web Application Protection 9 Web Access Management 9 Cumulative Benefits 9 Conclusion 10 2 White Paper The Application Delivery Firewall Paradigm Introduction In most organizations, firewalls are the first line of defense for web and application services. The firewall is, and has been, the primary foundation around which conventional network security architectures are built. The conventional architecture has matured so that many security standards require the deployment of certified firewalls. For example, any data center that processes credit card numbers must comply with the Payment Card Industry (PCI) standard, which requires a certified network firewall. The de facto standard referenced by PCI auditors is an International Computer Security Association (ICSA) Labs–certified network firewall. ICSA defines a short list of firewalls that can be used for card processing purposes. But the conventional firewall is beginning to show its limitations in detecting and repelling modern attacks. Attacks targeted at the application or network layers are causing failures of these stateful—and often expensive—firewalls, and the number of such attacks is growing.
    [Show full text]
  • Uwsgi Documentation Release 1.9
    uWSGI Documentation Release 1.9 uWSGI February 08, 2016 Contents 1 Included components (updated to latest stable release)3 2 Quickstarts 5 3 Table of Contents 11 4 Tutorials 137 5 Articles 139 6 uWSGI Subsystems 141 7 Scaling with uWSGI 197 8 Securing uWSGI 217 9 Keeping an eye on your apps 223 10 Async and loop engines 231 11 Web Server support 237 12 Language support 251 13 Release Notes 317 14 Contact 359 15 Donate 361 16 Indices and tables 363 Python Module Index 365 i ii uWSGI Documentation, Release 1.9 The uWSGI project aims at developing a full stack for building (and hosting) clustered/distributed network applica- tions. Mainly targeted at the web and its standards, it has been successfully used in a lot of different contexts. Thanks to its pluggable architecture it can be extended without limits to support more platforms and languages. Cur- rently, you can write plugins in C, C++ and Objective-C. The “WSGI” part in the name is a tribute to the namesake Python standard, as it has been the first developed plugin for the project. Versatility, performance, low-resource usage and reliability are the strengths of the project (and the only rules fol- lowed). Contents 1 uWSGI Documentation, Release 1.9 2 Contents CHAPTER 1 Included components (updated to latest stable release) The Core (implements configuration, processes management, sockets creation, monitoring, logging, shared memory areas, ipc, cluster membership and the uWSGI Subscription Server) Request plugins (implement application server interfaces for various languages and platforms: WSGI, PSGI, Rack, Lua WSAPI, CGI, PHP, Go ...) Gateways (implement load balancers, proxies and routers) The Emperor (implements massive instances management and monitoring) Loop engines (implement concurrency, components can be run in preforking, threaded, asynchronous/evented and green thread/coroutine modes.
    [Show full text]
  • NOTICE of ANNUAL MEETING of SHAREHOLDERS to Be Held on March 13, 2013
    NOTICE OF ANNUAL MEETING OF SHAREHOLDERS To Be Held on March 13, 2013 TO SHAREHOLDERS OF F5 NETWORKS, INC.: The annual meeting of shareholders of F5 Networks, Inc. (the “Company”) for fiscal year 2012 will be held on March 13, 2013 at 11:00 a.m. Pacific Time at F5 Networks, Inc., 351 Elliott Avenue West, Seattle, Washington 98119 for the following purposes, as more fully described in the accompanying Proxy Statement: 1. to elect two Class I directors to hold office until the annual meeting of shareholders for fiscal year 2014, three Class II directors to hold office until the annual meeting of shareholders for fiscal year 2015, and one Class III director to hold office until the annual meeting of shareholders for fiscal year 2013 and until their successors are elected and qualified; 2. to ratify the selection of PricewaterhouseCoopers LLP as the Company’s independent registered public accounting firm for fiscal year 2013; 3. to conduct an advisory vote on compensation of our named executive officers; 4. to adopt and approve an amendment to our Second Amended and Restated Articles of Incorporation to declassify our Board of Directors and provide for an annual election of directors; and 5. to transact such other business as may properly come before the meeting and any adjournments or postponements thereof. Only shareholders of record at the close of business on January 7, 2013 are entitled to notice of, and to vote at, the annual meeting. By Order of the Board of Directors, JEFFREY A. CHRISTIANSON Secretary Seattle, Washington January 22, 2013 YOUR VOTE IS IMPORTANT! Whether or not you attend the annual meeting, it is important that your shares be represented and voted at the meeting.
    [Show full text]
  • NGINX-Conf-2018-Slides Rawdat
    Performance Tuning NGINX Name: Amir Rawdat Currently: Technical Marketing Engineer at NGINX inc. Previously: - Customer Applications Engineer at Nokia inc. Multi-Process Architecture with QPI Bus Web Server Topology wrk nginx Reverse Proxy Topology wrk nginx nginx J6 Technical Specifications # Sockets # Cores # Model RAM OS NIC per Threads Name Socket per Core Client 2 22 2 Intel(R) 128 GB Ubuntu 40GbE Xeon(R) CPU Xenial QSFP+ E5-2699 v4 @ 2.20GHz Web Server 2 24 2 Intel(R) 192 GB Ubuntu 40GbE Xeon(R) & Platinum Xenial QSFP+ Reverse 8168 CPU @ Proxy 2.70GHz Multi-Processor Architecture #1 Duplicate NGINX Configurations J9 Multi-Processor Architecture NGINX Configuration (Instance 1) user root; worker_processes 48 ; worker_cpu_affinity auto 000000000000000000000000111111111111111111111111000000000000000000000000111111111111111111111111; worker_rlimit_nofile 1024000; error_log /home/ubuntu/access.error error; ….. ……. J11 NGINX Configuration (Instance 2) user root; worker_processes 48 ; worker_cpu_affinity auto 111111111111111111111111000000000000000000000000111111111111111111111111000000000000000000000000; worker_rlimit_nofile 1024000; error_log /home/ubuntu/access.error error; ……. ……. J12 Deploying NGINX Instances $ nginx –c /path/to/configuration/instance-1 $ nginx –c /path/to/configuration/instance-2 $ ps aux | grep nginx nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx_0.conf nginx: worker process nginx: worker process nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx_1.conf nginx: worker process nginx: worker process
    [Show full text]
  • Bepasty Documentation Release 0.3.0
    bepasty Documentation Release 0.3.0 The Bepasty Team (see AUTHORS file) Jul 02, 2019 Contents 1 Contents 3 1.1 bepasty..................................................3 1.2 Using bepasty’s web interface......................................4 1.3 Using bepasty with non-web clients...................................6 1.4 Quickstart................................................7 1.5 Installation tutorial with Debian, NGinx and gunicorn......................... 10 1.6 ChangeLog................................................ 12 1.7 The bepasty software Project....................................... 14 1.8 License.................................................. 14 1.9 Authors.................................................. 15 Index 17 i ii bepasty Documentation, Release 0.3.0 bepasty is like a pastebin for every kind of file (text, image, audio, video, documents, . ). You can upload multiple files at once, simply by drag and drop. Contents 1 bepasty Documentation, Release 0.3.0 2 Contents CHAPTER 1 Contents 1.1 bepasty bepasty is like a pastebin for all kinds of files (text, image, audio, video, documents, . , binary). The documentation is there: http://bepasty-server.readthedocs.org/en/latest/ 1.1.1 Features • Generic: – you can upload multiple files at once, simply by drag and drop – after upload, you get a unique link to a view of each file – on that view, we show actions you can do with the file, metadata of the file and, if possible, we also render the file contents – if you uploaded multiple files, you can create a pastebin with the list
    [Show full text]
  • Next Generation Web Scanning Presentation
    Next generation web scanning New Zealand: A case study First presented at KIWICON III 2009 By Andrew Horton aka urbanadventurer NZ Web Recon Goal: To scan all of New Zealand's web-space to see what's there. Requirements: – Targets – Scanning – Analysis Sounds easy, right? urbanadventurer (Andrew Horton) www.morningstarsecurity.com Targets urbanadventurer (Andrew Horton) www.morningstarsecurity.com Targets What does 'NZ web-space' mean? It could mean: •Geographically within NZ regardless of the TLD •The .nz TLD hosted anywhere •All of the above For this scan it means, IPs geographically within NZ urbanadventurer (Andrew Horton) www.morningstarsecurity.com Finding Targets We need creative methods to find targets urbanadventurer (Andrew Horton) www.morningstarsecurity.com DNS Zone Transfer urbanadventurer (Andrew Horton) www.morningstarsecurity.com Find IP addresses on IRC and by resolving lots of NZ websites 58.*.*.* 60.*.*.* 65.*.*.* 91.*.*.* 110.*.*.* 111.*.*.* 113.*.*.* 114.*.*.* 115.*.*.* 116.*.*.* 117.*.*.* 118.*.*.* 119.*.*.* 120.*.*.* 121.*.*.* 122.*.*.* 123.*.*.* 124.*.*.* 125.*.*.* 130.*.*.* 131.*.*.* 132.*.*.* 138.*.*.* 139.*.*.* 143.*.*.* 144.*.*.* 146.*.*.* 150.*.*.* 153.*.*.* 156.*.*.* 161.*.*.* 162.*.*.* 163.*.*.* 165.*.*.* 166.*.*.* 167.*.*.* 192.*.*.* 198.*.*.* 202.*.*.* 203.*.*.* 210.*.*.* 218.*.*.* 219.*.*.* 222.*.*.* 729,580,500 IPs. More than we want to try. urbanadventurer (Andrew Horton) www.morningstarsecurity.com IP address blocks in the IANA IPv4 Address Space Registry Prefix Designation Date Whois Status [1] -----
    [Show full text]
  • Load Balancing for Heterogeneous Web Servers
    Load Balancing for Heterogeneous Web Servers Adam Pi´orkowski1, Aleksander Kempny2, Adrian Hajduk1, and Jacek Strzelczyk1 1 Department of Geoinfomatics and Applied Computer Science, AGH University of Science and Technology, Cracow, Poland {adam.piorkowski,jacek.strzelczyk}@agh.edu.pl http://www.agh.edu.pl 2 Adult Congenital and Valvular Heart Disease Center University of Muenster, Muenster, Germany [email protected] http://www.ukmuenster.de Abstract. A load balancing issue for heterogeneous web servers is de- scribed in this article. The review of algorithms and solutions is shown. The selected Internet service for on-line echocardiography training is presented. The independence of simultaneous requests for this server is proved. Results of experimental tests are presented3. Key words: load balancing, scalability, web server, minimum response time, throughput, on-line simulator 1 Introduction Modern web servers can handle millions of queries, although the performance of a single node is limited. Performance can be continuously increased, if the services are designed so that they can be scaled. The concept of scalability is closely related to load balancing. This technique has been used since the beginning of the first distributed systems, including rich client architecture. Most of the complex web systems use load balancing to improve performance, availability and security [1{4]. 2 Load Balancing in Cluster of web servers Clustering of web servers is a method of constructing scalable Internet services. The basic idea behind the construction of such a service is to set the relay server 3 This is the accepted version of: Piorkowski, A., Kempny, A., Hajduk, A., Strzelczyk, J.: Load Balancing for Heterogeneous Web Servers.
    [Show full text]
  • Enabling HTTP/2 on an IBM® Lotus Domino® Server
    Enabling HTTP/2 on an IBM® Lotus Domino® Server Setup Guide Alex Elliott © AGECOM 2019 https://www.agecom.com.au CONTENTS Introduction ..................................................................................................................................................... 3 Requirements .................................................................................................................................................. 3 About HTTP/2 ................................................................................................................................................. 3 About NGINX .................................................................................................................................................. 3 How this works ................................................................................................................................................ 4 Step 1 – Install NGINX .................................................................................................................................... 5 Step 2 – Setting up NGINX to run as a Windows Service ............................................................................... 6 Step 3 – Update Windows Hosts File .............................................................................................................. 8 Step 4 – Add another local IP Address ........................................................................................................... 8 Step 5 - Creating SSL Certificate Files
    [Show full text]
  • Zope Documentation Release 5.3
    Zope Documentation Release 5.3 The Zope developer community Jul 31, 2021 Contents 1 What’s new in Zope 3 1.1 What’s new in Zope 5..........................................4 1.2 What’s new in Zope 4..........................................4 2 Installing Zope 11 2.1 Prerequisites............................................... 11 2.2 Installing Zope with zc.buildout .................................. 12 2.3 Installing Zope with pip ........................................ 13 2.4 Building the documentation with Sphinx ............................... 14 3 Configuring and Running Zope 15 3.1 Creating a Zope instance......................................... 16 3.2 Filesystem Permissions......................................... 17 3.3 Configuring Zope............................................. 17 3.4 Running Zope.............................................. 18 3.5 Running Zope (plone.recipe.zope2instance install)........................... 20 3.6 Logging In To Zope........................................... 21 3.7 Special access user accounts....................................... 22 3.8 Troubleshooting............................................. 22 3.9 Using alternative WSGI server software................................. 22 3.10 Debugging Zope applications under WSGI............................... 26 3.11 Zope configuration reference....................................... 27 4 Migrating between Zope versions 37 4.1 From Zope 2 to Zope 4 or 5....................................... 37 4.2 Migration from Zope 4 to Zope 5.0..................................
    [Show full text]
  • Application of GPU for High-Performance Network Processing
    SSLShader: Cheap SSL Acceleration with Commodity Processors Keon Jang+, Sangjin Han+, Seungyeop Han*, Sue Moon+, and KyoungSoo Park+ KAIST+ and University of Washington* 1 Security of Paper Submission Websites 2 Network and Distributed System Security Symposium Security Threats in the Internet . Public WiFi without encryption • Easy target that requires almost no effort . Deep packet inspection by governments • Used for censorship • In the name of national security . NebuAd’s targeted advertisement • Modify user’s Web traffic in the middle 3 Secure Sockets Layer (SSL) . A de-facto standard for secure communication • Authentication, Confidentiality, Content integrity Client Server TCP handshake Key exchange using public key algorithm Server (e.g., RSA) identification Encrypted data 4 SSL Deployment Status . Most of Web-sites are not SSL-protected • Less than 0.5% • [NETCRAFT Survey Jan ‘09] . Why is SSL not ubiquitous? • Small sites: lack of recognition, manageability, etc. • Large sites: cost • SSL requires lots of computation power 5 SSL Computation Overhead . Performance overhead (HTTPS vs. HTTP) • Connection setup 22x • Data transfer 50x . Good privacy is expensive • More servers • H/W SSL accelerators . Our suggestion: • Offload SSL computation to GPU 6 SSLShader . SSL-accelerator leveraging GPU • High-performance • Cost-effective . SSL reverse proxy • No modification on existing servers Web Server SMTP Server SSLShader POP3 Server SSL-encrypted session Plain TCP 7 Our Contributions . GPU cryptography optimization • The fastest RSA
    [Show full text]
  • F5 Big-Ip Afm—Service Provider Security Platform
    DATA SHEET F5 BIG-IP AFM—SERVICE PROVIDER SECURITY PLATFORM WHAT'S INSIDE DEFEND THE NETWORK CORE AND EDGE, 2 Key Benefits AND PROTECT SERVICES 2 Subscriber Services and Application-centric Security Mobile and fixed line service providers rely on their networks and data centers Polices to drive their service-based revenues. Given their critical nature, these networks 2 Full Proxy Security have become a major target for attack. While service providers are busy mitigating simple attacks, hackers are using more sophisticated, evolving strikes to disrupt 3 Application-centric Security Policies service or steal data. 4 Network DDoS Protection F5 BIG-IP Advanced Firewall Manager (AFM) is a high-performance, full-proxy network security solution designed to protect networks and data centers against incoming threats that enter 5 In-depth Infrastructure Protection the network on the most widely deployed protocols. Built on F5’s industry-leading Application Delivery Controller (ADC), BIG-IP AFM gives service providers a scalable, subscriber-aware 12 Features and Specifications platform that delivers the flexibility, performance, and control needed to mitigate aggressive 13 Platforms and Services distributed denial-of-service (DDoS) and protocol attacks before they overwhelm and degrade services. 15 More Information BIG-IP AFM’s unique application-centric design enables greater effectiveness in guarding against targeted network infrastructure-level attacks. It tracks the state of network sessions, maintains deep subscriber and application awareness, and uniquely mitigates attacks based on more granular details than traditional firewalls. With BIG-IP AFM, organizations receive protection from more than 100 attack signatures—more hardware-based signatures than any other leading firewall vendor—along with unsurpassed programmability, interoperability, and visibility into threat conditions.
    [Show full text]
  • Thesis.Pdf (5.857Mb)
    Faculty OF Science AND TECHNOLOGY Department OF Computer Science Metadata STATE AND HISTORY SERVICE FOR DATASETS Enable EXTRacting, STORING AND ACCESS TO METADATA ABOUT A DATASET OVER time. — Roberth Hansen INF-3990 Master’S Thesis IN Computer Science - May 2018 This thesis document was typeset using the UiT Thesis LaTEX Template. © 2018 – http://github.com/egraff/uit-thesis To Maria. Thank you very much. “When I’m working on a problem, I never think about beauty. I think only how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong.” –R. Buckminster Fuller “The most important property of a program is whether it accomplishes the intention of its user.” –C.A.R Hoare AbstrACT Distributed Arctic Observatory (DAO) aims to automate, streamline and im- prove the collection, storage and analysis of images, video and weather mea- surements taken on the arctic tundra. Automating the process means that there are no human users that needs to be involved in the process. This leads to a loss of monitoring capabilities of the process. There are insufficient tools that allow the human user to monitor the process and analyze the collected volume of data. This dissertation presents a prototype of a system to aid researchers in moni- toring and analyzing metadata about a dataset. The approach is a system that collects metadata over time, stores it in-memory and visualizes the metadata to a human user. The architecture comprises three abstractions Dataset, Instrument and Visual- ization. The Dataset contains metadata. The Instrument extracts the metadata.
    [Show full text]