1. java -jar 启动halo，默认8090端口，通过ip+端口访问是可以正常查看上传的附件 2.访问nginx反向代理后域名，则上传的附件无法展示 3.f12查看网络请求，发现nginx获取资源报错 403forbidden 请教大佬，是nginx配置的不对吗还是什么问题尝试chmod linux文件夹权限，并无解决问题

@"bert"#p11547 可是我们没有使用 Tomcat 啊，建议提供一下 Nginx 的配置文件，应该和 Nginx 配置有关系。

@"Ryan Wang 👍"#p11614 你好配置了重新加载以后通过www.keym.top域名进不去了😢

halo 使用nginx反向代理去掉端口后，上传附件的图片无法展示（403 forbidden）

bert

java -jar 启动halo，默认8090端口，通过ip+端口访问是可以正常查看上传的附件
2.访问nginx反向代理后域名，则上传的附件无法展示
3.f12查看网络请求，发现nginx获取资源报错 403forbidden
请教大佬，是nginx配置的不对吗还是什么问题

尝试chmod linux文件夹权限，并无解决问题

bert

新版本的tomcat加强了安全性，通过tomcat在服务器端建立的文件，其他用户是没有访问权限的。这样导致Nginx静态图片服务无法访问报403

Forbidden
You don't have permission to access /img/test/2019/12/20191217174607011628.jpe on this server.

错误。

解决办法是在tomcat的bin目录下的catalina.sh文件中大约260行覆盖默认的umask

if [ -z "$LOGGING_MANAGER" ]; then
LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"
fi

Set UMASK unless it has been overridden

if [ -z "$UMASK" ]; then
UMASK="0027" 修改0027 为 022
fi
umask $UMASK
保存重启tomcat即可。

如果nginx use = root则不会出现以上问题, 但是通过为了安全性都会设置一个指定用户去执行nginx

Ryan Wang 👍

bert 可是我们没有使用 Tomcat 啊，建议提供一下 Nginx 的配置文件，应该和 Nginx 配置有关系。

bert

本人直接将nginx权限设为root了，简单暴力，亲测可用。
答案来源于：https://zhuanlan.zhihu.com/p/97861811

lianyan

我的建议是用图床

lihaojieM

Ryan Wang 👍

upstream halo {
  server 127.0.0.1:8090;
}
server {
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  ssl_certificate /usr/local/nginx/conf/ssl/www.keym.top.crt;
  ssl_certificate_key /usr/local/nginx/conf/ssl/www.keym.top.key;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_prefer_server_ciphers on;
  ssl_session_timeout 10m;
  ssl_session_cache builtin:1000 shared:SSL:10m;
  ssl_buffer_size 1400;
  add_header Strict-Transport-Security max-age=15768000;
  ssl_stapling on;
  ssl_stapling_verify on;
  server_name www.keym.top;
  access_log /data/wwwlogs/www.keym.top_nginx.log combined;
  index index.html index.htm index.php;
  root /data/wwwroot/www.keym.top;
  if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
  
  include /usr/local/nginx/conf/rewrite/none.conf;
  #error_page 404 /404.html;
  #error_page 502 /502.html;
  location ~ .*\.(wma|wmv|asf|mp3|mmf|zip|rar|jpg|gif|png|swf|flv|mp4)$ {
    valid_referers none blocked *.keym.top www.keym.top;
    if ($invalid_referer) {
        return 403;
    }
  }

  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
    proxy_pass http://halo;
    expires 30d;
    access_log off;
  }
  location ~ .*\.(js|css)?$ {
    proxy_pass http://halo;
    expires 7d;
    access_log off;
  }
  location ~ /(\.user\.ini|\.ht|\.git|\.svn|\.project|LICENSE|README\.md) {
    deny all;
  }
  location / {
  proxy_set_header HOST $host;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_pass http://halo;
  }
  location ^~ /.well-known/acme-challenge/ {
  default_type "text/plain";
  allow all;
  root /data/wwwroot/www.keym.top/;
  }
  location /.well-known {
    allow all;
  }
}

我这个是/upload/目录下的资源404 能帮忙看看是哪里配置的不对吗

Ryan Wang 👍

lihaojieM

upstream halo {
  server 127.0.0.1:8090;
}
server {
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  ssl_certificate /usr/local/nginx/conf/ssl/www.keym.top.crt;
  ssl_certificate_key /usr/local/nginx/conf/ssl/www.keym.top.key;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_prefer_server_ciphers on;
  ssl_session_timeout 10m;
  ssl_session_cache builtin:1000 shared:SSL:10m;
  ssl_buffer_size 1400;
  add_header Strict-Transport-Security max-age=15768000;
  ssl_stapling on;
  ssl_stapling_verify on;
  server_name www.keym.top;
  access_log /data/wwwlogs/www.keym.top_nginx.log combined;
  index index.html index.htm index.php;
  root /data/wwwroot/www.keym.top;
  if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
  
  include /usr/local/nginx/conf/rewrite/none.conf;
  #error_page 404 /404.html;
  #error_page 502 /502.html;

  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
    proxy_pass http://halo;
    expires 30d;
    access_log off;
  }
  location ~ .*\.(js|css)?$ {
    proxy_pass http://halo;
    expires 7d;
    access_log off;
  }
  location ~ /(\.user\.ini|\.ht|\.git|\.svn|\.project|LICENSE|README\.md) {
    deny all;
  }
  location / {
  proxy_set_header HOST $host;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_pass http://halo;
  }
  location ^~ /.well-known/acme-challenge/ {
  default_type "text/plain";
  allow all;
  root /data/wwwroot/www.keym.top/;
  }
  location /.well-known {
    allow all;
  }
}

lihaojieM

Ryan Wang 👍 你好配置了重新加载以后通过www.keym.top域名进不去了😢