Linux我爱编程

Linux之http协议及apache

2016-03-07  本文已影响679人  魏镇坪

http协议及Apache服务

http协议

什么是http?

http全称为超文件传输协议（Hyper text transfer protocol）,其是一个应用层协议，基于tcp的80端口，一般使用ASCII编码传输。http协议是无状态的(stateless),即服务器无法追踪访问者来源. 其可以使用cokie机制来追踪同一个用户.

Cookie的追踪用户的原理

第一次方访问服务时,服务器发送一个cookie的小数据(随机数,用来标识客户端身份), 客户端会将其保存下来,随后 , 访问同一个站点时,会把应用于此站点的cookie提交给服务器,从而服务器就能识别客户端身份.

什么是超文本？

使用html（Hyper text mark language）编程语言编写，被称为文本标记语言。大致格式如下:

<html>
    <head>
        <title>Title</title>
    </head>
    <body>
        <h1></h1>
        <h2></h2>
            <p>正文<a href="www.magedu.com/download.html">正文</a></p>
        <h2></h2>
    </body>
</html>

http协议版本

http的工作模式

报文示例:
手动模拟一个http请求会话：
telnet 172.16.36.60 80
Trying 172.16.36.60...
Connected to www.a.com.
Escape character is '^]'.
GET /index.html HTTP/1.1   #输入获取方法 请求的url 使用的协议
host:www.a.com              #指定主机
                            #两次回车
HTTP/1.1 200 OK
Date: Tue, 12 Jan 2016 04:29:18 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 11 Jan 2016 11:41:51 GMT
ETag: "e000f-13-5290d6c437a91"
Accept-Ranges: bytes
Content-Length: 19
Connection: close
Content-Type: text/html; charset=UTF-8

<h1>www.a.com</h1>
Connection closed by foreign host.
http的状态码：

http报文首部

什么是keep-alive？

其被称之为长连接，由于http基于tcp协议通信，每个资源的请求都需要建立一个会话的虚拟通道，如果对于并发大的服务器来讲，高频的TCP会议建立和拆除将消耗更多的系统开销，故长连接可以实现tcp协议通信建立后，在允许的机制下，进行多个资源请求获取，当服务端设定的条件达到时，将断开与客户端的TCP连接。

keep-alive的控制机制
实现步骤

client发起请求并与server建立Tcp的连接，进行数据传输，当client的资源请求完成后，通知服务端断开连接，服务端并予ack报文，并不发送fin报文，此时连接将处理半连接状态，服务器会检查httpd的keep-alive参数设置的两个条件：1、如果半连接空闲时间超出keep-alive设定的值，将主动断开连接 ；2、当客户端请求的资源次数达到httpd的参数设置，也将会主动断开连接。

客户端浏览器加速访问的机制

web资源的类型：

服务端完整的HTTP请求处理过程

HTTP的访问归类：

服务端接收请求的模型

1、单进程I/O模型

启动一个进程处理用户请求，这意味着，一次只能处理一个请求，多个请求被串形响应

2、多进程I/O模型

每个请求都有一个独立的进程来响应，并行启动多个进程，每个进程响应一个请求

3、复用的I/O模型（必须要有多路IO管理机制）
4、利用的多进程I/O结构

启动M个进程，每个进程生成N个线程

http服务的实现软件

httpd服务程序

httpd简介

httpd是apache基金会（ASF：apache foundation）维护，其官网为httpd.apache.org,其基金会下有众多的著名软件。

http的版本
httpd的功能特性

HTTPD的配置文件

1、httpd-2.2的版本（Centos 6）
2、httpd-2.4的版本（Centos 7）

HTTPD的进程

1、主进程的属主和属组

root:root

2、子进程或工作进程

apache:apache

HTTPD主配置文件

主配置文件的选项
主配置文件的格式
常用配置选项
httpd的子命令
15 Curl命令

Curl是基于URL语法在命令行下工作的文件传输工具,它支持FTP,FTPS,HTTP,HTTPS,GOPHER,TELNET,DICT,FILE及LDAP等协议,curl支持https认证,并且支持HTTP的POST,PUT等方法,FTP上传,kerberos认证,HTTP上传,代理服务器,cookies,用户名/密码认证,下载文件断点续传,上载文件断点续传,http代理服务器管道(proxy tunneling),甚至它还支持IPv6,socket5代理服务器,通过http代理服务器上传文件到FTP服务器等,功能十分强大.

16 apache的用户及组

指定以哪个用户的身份运行httpd服务进程

如果需要使用root权限执行操作时,需要使用SUexec命令调用相关操作
17 使用mod_deflate模块压缩页面优化传输速度
####设置一个过滤器,名称为DEFLATE ,名称用于后面设置参数引用 
SetOutputFilter DEFLATE 
# mod_deflate configuration
####设置指定那些类型需要压缩
# Restrict compression to these MIME types
AddOutputFilterByType DEFLATE text/plain 
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE text/css
####设置压缩级别
# Level of compression (Highest 9 - Lowest 1)
DeflateCompressionLevel 9
####排除老的浏览器
# Netscape 4.x has some problems.
BrowserMatch ^Mozilla/4  gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
BrowserMatch  ^Mozilla/4\.0[678]  no-gzip
# MSIE masquerades as Netscape, but it is fine
BrowserMatch \bMSI[E]  !no-gzip !gzip-only-text/html
18 配置https
yum install httpd -y

CA
cd /etc/pki/CA/
[root@Centos7 CA]# ls
certs  crl  newcerts  private
[root@Centos7 CA]# cd private/
[root@Centos7 private]# (umask 077; openssl genrsa -out cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.........................................+++
........................+++
e is 65537 (0x10001)
[root@Centos7 private]#

[root@Centos7 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:CN
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:Mageedu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:ca.mageedu.com
Email Address []:admin@mageedu.com
[root@Centos7 CA]# ls
cacert.pem  certs  crl  newcerts  private

[root@Centos7 CA]# touch index.txt serial
[root@Centos7 CA]# echo 01 > serial
[root@Centos7 CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial


http server
root@Centos7 ~]# cd /etc/httpd/
[root@Centos7 httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run
[root@Centos7 httpd]# mkdir ssl

root@Centos7 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
...+++
.................................................................................+++
e is 65537 (0x10001)

[root@Centos7 ssl]# openssl req -new -key httpd.key -out httpd.csr -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:CN
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:Mageedu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www.zhenping.com
Email Address []:admin@zhenping.com

[root@Centos7 ssl]# scp httpd.csr root@172.16.36.71:/tmp


CA Server
[root@Centos7 CA]# openssl ca -in /tmp/httpd.csr -out certs/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jan 17 23:42:58 2016 GMT
            Not After : Jan 16 23:42:58 2017 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = CN
            organizationName          = Mageedu
            organizationalUnitName    = Ops
            commonName                = www.zhenping.com
            emailAddress              = admin@zhenping.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                61:7F:29:8A:68:A6:70:C2:F2:0E:49:15:D7:DD:4D:02:BF:EF:92:6A
            X509v3 Authority Key Identifier:
                keyid:18:F8:A6:71:FB:05:F3:0C:D3:56:9C:90:78:F1:4D:B5:0E:EC:51:5F

Certificate is to be certified until Jan 16 23:42:58 2017 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@Centos7 CA]# scp certs/httpd.crt root@172.16.36.70:/etc/httpd/ssl
The authenticity of host '172.16.36.70 (172.16.36.70)' can't be established.
ECDSA key fingerprint is f7:6e:2f:38:57:8e:8c:0b:12:74:cc:af:44:82:88:17.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.36.70' (ECDSA) to the list of known hosts.
root@172.16.36.70's password:
httpd.crt                                                                                                                                       100% 4606     4.5KB/s   00:00


httpd server

vim /etc/httpd/conf.d/ssl.conf
DocumentRoot "/var/www/html"
ServerName www.zhenping.com
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
http的配置实例：
root@Centos6-ser1 ~]# cat /etc/httpd/conf.d/vhost.conf
    LoadModule status_module modules/mod_status.so
    <Location /server-status>
        SetHandler server-status
        order deny,allow
        deny from all
        allow from 172.16.249.148
    </Location>

    namevirtualhost 172.16.36.60:80
    <VirtualHost 172.16.36.60:80>
        servername wwww.a.com
        Documentroot "/www/a.com/htdocs/"
        alias /download "/www/a.com/htdocs/file"
        Errorlog /www/log/a.com/error.log
        LogLevel warn
        Customlog /www/log/a.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/a.com/htdocs/file/">
            Options Indexes
            AllowOverride None
            AuthType Basic
            AuthName "Please enter you username and password...."
            AuthUserFile "/etc/httpd/conf/.htpass"
            Require user zhenping
        </Directory>
    </virtualhost>

    <virtualhost 172.16.36.60:80>
        servername www.b.com
        documentroot "/www/b.com/htdocs"
        Errorlog /www/log/b.com/error.log
        LogLevel warn
        Customlog /www/log/b.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/b.com/htdocs">
            Options None
            AllowOverride None
            AuthType Basic
            AuthName "Please Enter your username and password."
            AuthUserFile "/etc/httpd/conf/.htpass"
            AuthGroupFile "/etc/httpd/conf/.htpass_group"
            Require group mygrp
        </Directory>
    </virtualhost>

    <virtualhost 172.16.36.60:80>
        servername www.c.com
        documentroot "/www/c.com/htdocs"
        ErrorLog /www/log/c.com/error.log
        LogLevel warn
        CustomLog /www/log/c.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/c.com/htdocs">
            Options None
            AllowOverride None
            order deny,allow
            deny from all
            allow from 172.16.249.148
        </Directory>
    </virtualhost>
上一篇下一篇

猜你喜欢

热点阅读