Linux初学者学习笔记我爱编程

20170929 http服务和apache（三）

2017-10-09  本文已影响32人  哈喽别样
  • mod_flate模块
  • https实现
  • http重定向https
  • HSTS
  • httpd相关程序
  • httpd-2.4
  • 编译安装httpd-2.4

一、mod_deflate模块

vim /etc/httpd/conf.d/deflate.conf
LoadModule deflate_module modules/mod_deflate.so 
SetOutputFilter DEFLATE
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE text/css
DeflateCompressionLevel 9

service httpd reload
curl -I 192.168.136.229/large.txt
curl --compressed -I 192.168.136.229/large.txt

二、https实现：

（一）为httpd服务器申请数字证书

通过创建私有CA签发证书
(a) 创建私有CA

cd /etc/pki/CA/
(umask 066;openssl genrsa -out private/cakey.pem 2048)                       //创建私钥
openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650     //创建自签名证书
echo 00 > serial
touch index.txt

(b) 在服务器创建证书签署请求

mkdir /etc/httpd/conf.d/ssl
cd /etc/httpd/conf.d/ssl
(umask 066;openssl genrsa -out httpd.key 2048)      //创建私钥
openssl req -new -key httpd.key -out httpd.csr      //创建证书申请
scp httpd.csr 192.168.136.230:/etc/pki/CA           //向CA传送证书申请

(c) CA签证

openssl ca -in httpd.csr -out certs/httpd.crt -days 365     //签发证书
scp certs/httpd.crt cacert.pem 192.168.136.229:/etc/httpd/conf.d/ssl/
//向httpd服务器传送证书和CA的自签名证书

（二）配置httpd支持使用ssl

yum -y install mod_ssl
vim /etc/httpd/conf.d/ssl.conf
SSLCertificateFile /etc/httpd/conf.d/ssl/httpd.crt     //httpd服务器证书
SSLCertificateKeyFile /etc/httpd/conf.d/ssl/httpd.key     //httpd私钥
SSLCACertificateFile /etc/httpd/conf.d/ssl/cacert.pem     //CA自签名证书

httpd -t
service httpd reload

（三）配置DNS服务器

yum install bind
//1. 编辑通用配置文件
vim /etc/named.conf
options {
        listen-on port 53 { localhost; };      //修改的行
        allow-query     { any; };      //修改的行
};
//2. 编辑独立分区解析文件
vim /etc/named.rfc1912.zones
zone "hellopeiyang.com" IN {
        type master;
        file "hellopeiyang.com.zone";
};

named-checkconf
//3. 编辑解析库文件
vim /var/named/hellopeiyang.com.zone
$TTL 1D
@       IN SOA  dns1 admin.hellopeiyang.com. (
                                        101     ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns1
dns1    A       192.168.136.130
websrv  A       192.168.136.229
www     CNAME   websrv

named-checkzone hellopeiyang.com /var/named/hellopeiyang.com.zone
dig www.hellopeiyang.com @127.0.0.1

（四）服务器准备文件

vim /etc/httpd/conf/httpd.conf
DocumentRoot "/app"

vim /app/index.html
<h1>Welcome to hellopeiyang.com</h1>

httpd -t
service httpd reload
scp /etc/httpd/conf.d/ssl/cacert.pem 192.168.136.129:/root     //向客户端传送CA自签名证书

（五）客户端测试

vim /etc/sysconfig/network-scripts/ifcfg-eth1
DNS1=192.168.136.130                                       //增加一行DNS服务器IP
service network restart
cat /etc/resolv.conf
curl https://www.hellopeiyang.com                          //直接登录失败
curl -k  https://www.hellopeiyang.com                      //-k选项忽略证书能够看到网页内容正确
curl --cacert cacert.pem  https://www.hellopeiyang.com     //成功连接

三、http重定向https

vim /etc/httpd/conf.d/redirect.conf
Redirect temp / https://www.hellopeiyang.com/
httpd -t
service httpd reload

四、HSTS

vim /etc/httpd/conf.d/hsts.conf
Header always set Strict-Transport-Security "max-age=15768000"
RewriteEngine on
RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=301]

httpd -t
service httpd reload

五、httpd相关程序

（一）httpd自带工具程序

（二）httpd的压力测试工具

六、httpd-2.4

（一）httpd-2.4的变化

（二）httpd-2.4的程序环境

（三）httpd-2.4的配置

（1）切换使用的MPM

Centos 7环境：
编辑/etc/httpd/conf.modules.d/00-mpm.conf
启用要启用的MPM相关的LoadModule指令即可

（2）主目录

DocumentRoot /path

（3）基于IP的访问控制
//1. 修改主目录
vim /etc/httpd/conf/httpd.conf
DocumentRoot "/app"
<Directory "/app">
        Require all granted
</Directory>

httpd -t
systemctl reload httpd
echo "/app/index.html" > /app/index.html

//2. 修改访问权限
vim /etc/httpd/conf/httpd.conf
<Directory "/app">
        <RequireAny>
                Require all denied
                Require ip 192.168.136.130
        </RequireAny>
</Directory>

httpd -t
systemctl reload httpd
（4）虚拟主机
//1. 建立网页文件
mkdir /app/website{1..3}
echo "/app/website1/index.html" >  /app/website1/index.html
echo "/app/website2/index.html" >  /app/website2/index.html
echo "/app/website3/index.html" >  /app/website3/index.html

//2. 编辑独立配置文件
vim /etc/httpd/conf.d/virtualhost.conf
<Virtualhost *:80>
        ServerName www.hello.com
        DocumentRoot "/app/website1"
        <Directory "/app/website1">     //显式授权
                Require all granted
        </Directory>
</Virtualhost>

<Virtualhost *:80>
        ServerName www.hi.cn
        DocumentRoot "/app/website2"
        <Directory "/app/website2">     //显式授权
                Require all granted
        </Directory>
</Virtualhost>

<Virtualhost *:80>
        ServerName www.bye.net
        DocumentRoot "/app/website3"
        <Directory "/app/website3">     //显式授权
                Require all granted
        </Directory>
</Virtualhost>

httpd -t
systemctl reload httpd

//3. 配置DNS服务器或者编辑hosts文件

//4. 测试
curl www.hello.com
curl www.hi.cn
curl www.bye.net
（5）sendfile机制
vim /etc/httpd/conf/httpd.conf
EnableSendfile on
（6）反向代理
ProxyPass "/" "http://www.example.com/"
ProxyPassReverse "/" "http://www.example.com/"

//1. 编辑独立配置文件
vim /etc/httpd/conf.d/virtualhost.conf
<Virtualhost *:80>
        ServerName www.hello.com
        DocumentRoot "/app/website1"
        <Directory "/app/website1">
                Require all granted
        </Directory>
        ProxyPass "/" "http://192.168.136.129/"            //修改的部分
        ProxyPassReverse "/" "http://192.168.136.129/"     //修改的部分
</Virtualhost>

httpd -t
systemctl reload httpd

//2. 建立网页文件（ip: 192.168.136.129）
echo "welcome to hellopeiyang's home" > /var/www/html/index.html

//3. 测试
curl www.hello.com
curl 192.168.136.230
curl 192.168.136.129

七、编译安装httpd-2.4

（一）APR

（二）CentOS 7环境下源码编译安装httpd-2.4

（1）安装前准备：
（2）编译安装过程
（3）安装后配置
vim /app/httpd24/conf/httpd.conf
User apache
Group apache

vim /etc/profile.d/httpd24.sh
PATH=/app/httpd24/bin:$PATH

. /etc/profile.d/httpd24.sh

vim /etc/rc.d/rc.local
/app/httpd24/bin/apachectl start

chmod +x /etc/rc.d/rc.local

（三）CentOS 6环境下源码编译安装httpd-2.4（方法一）

（1）安装前准备：
yum groupinstall "development tools"
yum install pcre-devel openssl-devel expat-devel

tar xvf apr-1.6.2.tar.gz -C /usr/local/src/
tar xvf apr-util-1.6.0.tar.gz -C /usr/local/src/
tar xvf httpd-2.4.27.tar.bz2 -C /usr/local/src/
（2）编译安装apr
（3）编译安装apr-util
（4）编译安装httpd-2.4
（5）安装后配置
vim /app/httpd24/conf/httpd.conf
User apache                     //修改的行
Group apache                    //修改的行
DocumentRoot "/app/website"     //修改的行
<Directory "/app/website">      //修改的行

mkdir /app/website

vim /etc/profile.d/httpd24.sh
PATH=/app/httpd24/bin:$PATH

. /etc/profile.d/httpd24.sh

scp /etc/init.d/httpd 192.168.136.129:/etc/init.d/httpd24     //参考httpd-2.2的服务脚本进行修改
vim /etc/init.d/httpd24
apachectl=/app/httpd24/bin/apachectl               //修改的行
httpd=${HTTPD-/app/httpd24/bin/httpd}              //修改的行
pidfile=${PIDFILE-/app/httpd24/logs/httpd.pid}     //修改的行
lockfile=${LOCKFILE-/var/lock/subsys/httpd24}      //修改的行

chkconfig --add httpd24
chkconfig httpd24 on
service httpd24 start
echo "/app/website/index.html" > /app/website/index.html
（6）测试

curl 192.168.136.129

（四）CentOS 6环境下源码编译安装httpd-2.4（方法二）

//将apr, apr-util的源码目录复制到httpd源码的srclib子目录下，注意需要重命名
cd /usr/local/src/
cp -r apr-1.6.2/ httpd-2.4.27/srclib/apr
cp -r apr-util-1.6.0/ httpd-2.4.27/srclib/apr-util

//执行configure脚本时不需再指定apr和apr-util的安装路径，代替以--with-included-apr
cd httpd-2.4.27/
./configure --prefix=/app/httpd24 --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-included-apr --enable-modules=most --enable-mpms-shared=all --with-mpm=prefork
make -j 4 && make install
上一篇 下一篇

猜你喜欢

热点阅读