网络系统管理Linux环境——11.AppSrv之APACHE2

题目要求

服务器AppSrv上的工作任务

4.  APACHE2

安装apache服务;

服务以用户webuser系统用户运行;

全站点启用TLS访问,使用本机上的“CSK Global Root CA”颁发机构颁发,网站证书信息如下:

    C = CN

    ST = China

    L = BeiJing

    O = skills

    OU = Operations Departments

    CN = ​​*.chinaskills.co​​m

客户端访问https时应无浏览器(含终端)安全警告信息;

当用户使用http访问时自动跳转到https安全连接;

搭建www.chinaskills.cn站点;

网页文件放在StorgeSrv服务器上;

在StorageSrv上安装MriaDB,在本机上安装PHP,发布WordPress网站;

MariaDB数据库管理员信息:User: root/ Password: Chinaskill21!。

创建网站download.chinaskills.cn站点;

网页文件存放在StorageSrv服务器上;

在该站点的根目录下创建以下文件“test.mp3, test.mp4, test.pdf”,其中test.mp4文件的大小为100M,页面访问成功后能够列出目录所有文件。

作安全加固,在任何页面不会出现系统和WEB服务器版本信息。

项目实施

安装httpd以及ssl模块:

代码语言:javascript
复制
[root@appsrv ~]# yum install httpd mod_ssl  php php-mbstring php-mysql mariadb-server -y

增加用户和修改物理内存大小:

代码语言:javascript
复制
[root@appsrv ~]# useradd -r webuser
代码语言:javascript
复制
[root@appsrv ~]# vim /etc/httpd/conf/httpd.conf 
#修改66和67行
User webuser
Group webuser
代码语言:javascript
复制
[root@appsrv ~]# systemctl enable httpd.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@appsrv ~]# vim /etc/systemd/system/multi-user.target.wants/httpd.service 
第8行添加
memory_limit_in_bytes=500*1024*1024
#然后重启服务
[root@appsrv ~]# systemctl daemon-reload 
[root@appsrv ~]# systemctl restart httpd.service

创建证书并申请:(还有一种方法就是还可以将证书给CA根证书机构(Rserver)去签发)

创建跟证书:

代码语言:javascript
复制
[root@appsrv ~]# vim /etc/pki/tls/openssl.cnf 
#修改
42 dir             = /csk-rootca  
50 certificate     = $dir/csk-ca.pem

[root@appsrv ~]# mkdir /csk-rootca
[root@appsrv ~]# cp -rf /etc/pki/tls/* /csk-rootca/
[root@appsrv ~]# cd /csk-rootca/
[root@appsrv csk-rootca]# touch index.txt
[root@appsrv csk-rootca]# echo 01 >serial
[root@appsrv csk-rootca]# openssl genrsa -out private/cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
..................................................................+++
e is 65537 (0x10001)
[root@appsrv csk-rootca]#

代码语言:javascript
复制
[root@appsrv csk-rootca]# openssl req -new -x509 -key ./private/cakey.pem -out csk-ca.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:#CN
State or Province Name (full name) []:#China
Locality Name (eg, city) [Default City]:#BeiJing
Organization Name (eg, company) [Default Company Ltd]:#skills
Organizational Unit Name (eg, section) []:#Operations Departments
Common Name (eg, your name or your server's hostname) []:CSK Global Root CA
Email Address []:
[root@appsrv csk-rootca]#

申请网站证书秘钥和请求证书:

代码语言:javascript
复制
[root@appsrv csk-rootca]# openssl genrsa -out httpd.key 2048
Generating RSA private key, 2048 bit long modulus
.............................................................+++
............+++
e is 65537 (0x10001)
[root@appsrv csk-rootca]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:#CN
State or Province Name (full name) []:#China
Locality Name (eg, city) [Default City]:#BeiJing
Organization Name (eg, company) [Default Company Ltd]:#skills
Organizational Unit Name (eg, section) []:#Operations Departments
Common Name (eg, your name or your server's hostname) []:*.chinaskills.cn
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@appsrv csk-rootca]#

给证书签名:

代码语言:javascript
复制
[root@appsrv csk-rootca]# openssl x509 -req -in httpd.csr -CA /csk-rootca/csk-ca.pem -CAkey /csk-rootca/private/cakey.pem -CAcreateserial -out httpd.crt
Signature ok
subject=/C=CN/ST=China/L=BeiJing/O=skills/OU=Operations Departments/CN=*.chinaskills.cn
Getting CA Private Key
[root@appsrv csk-rootca]#

挂载apache目录以及上传内容:

代码语言:javascript
复制
[root@appsrv ~]# cd /csk-rootca/
[root@appsrv csk-rootca]# mkdir /webdata/
[root@appsrv csk-rootca]# mount -t nfs 192.168.100.200:/webdata /webdata
#查看挂载
[root@appsrv webdata]# df -h
文件系统 容量 已用 可用 已用% 挂载点
devtmpfs 475M 0 475M 0% /dev
tmpfs 487M 0 487M 0% /dev/shm
tmpfs 487M 7.7M 479M 2% /run
tmpfs 487M 0 487M 0% /sys/fs/cgroup
/dev/mapper/centos-root 37G 1.6G 36G 5% /
/dev/sr0 4.4G 4.4G 0 100% /media/CentOS
/dev/sda1 1014M 138M 877M 14% /boot
tmpfs 98M 0 98M 0% /run/user/0
192.168.100.200:/webdata 37G 1.4G 36G 4% /webdata #得得这就是新挂载
#上传worpress压缩包到/webdata
#上传好之后查看
[root@appsrv webdata]# ls
test.mp3 wordpress-4.6.18.tar.gz
#进行解压
[root@appsrv webdata]# tar -zxf wordpress-4.6.18.tar.gz
#查看
[root@appsrv webdata]# ls
test.mp3 wordpress wordpress-4.6.18.tar.gz
#创建一个pdf文件
[root@appsrv webdata]# touch test.pdf
#执行
[root@appsrv webdata]# dd if=/dev/zero of=test.mp4 bs=100M count=1
记录了1+0 的读入
记录了1+0 的写出
104857600字节(105 MB)已复制,1.5661 秒,67.0 MB/秒

配置数据库连接:

代码语言:javascript
复制
#启动数据库服务
[root@appsrv ~]# systemctl restart mariadb
[root@appsrv ~]# systemctl enable mariadb.service
#登录数据库(初次没有密码)
[root@appsrv webdata]# mysql
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 5.5.68-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database wordpress;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON . TO 'root'@'%' IDENTIFIED BY 'Chinaskill22!' WITH GRANT OPTION;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit
Bye

创建虚拟主机文件:

代码语言:javascript
复制
[root@appsrv webdata]# vim /etc/httpd/conf.d/welcome.conf
#添加
<Virtualhost *:80>
redirect permanent / https://www.chinaskills.cn #http的跳转https(永久)
servername www.chinaskills.cn #访问域名
</Virtualhost>

<Virtualhost *:443>
servername www.chinaskills.cn
documentroot /webdata/wordpress
<directory /webdata/wordpress>
require all granted
</directory>
sslengine on
sslcertificatefile /csk-rootca/httpd.crt
sslcertificatekeyfile /csk-rootca/httpd.key
</Virtualhost>

<Virtualhost *:80>
redirect permanent / https://download.chinaskills.cn
servername download.chinaskills.cn
</Virtualhost>

<Virtualhost *:443>
servername download.chinaskills.cn
documentroot /webdata/download/
<directory /webdata/download/>
options indexes followsymlinks
require all granted
</directory>
sslengine on
sslcertificatefile /csk-rootca/httpd.crt
sslcertificatekeyfile /csk-rootca/httpd.key
</Virtualhost>

代码语言:javascript
复制
[root@appsrv ~]# htpasswd -c /var/passwd zsuser
New password: #ChinaSkill22!
Re-type new password: #ChinaSkill22!
Adding password for user zsuser
[root@appsrv ~]#
#删除默认主页
[root@appsrv webdata]# rm /etc/httpd/conf.d/welcome.conf
rm:是否删除普通文件 "/etc/httpd/conf.d/welcome.conf"?y
[root@appsrv webdata]# htpasswd -c /var/passwd zsuser
New password:
Re-type new password:
htpasswd: password verification error
[root@appsrv webdata]# htpasswd -c /var/passwd zsuser
New password:
Re-type new password:
Adding password for user zsuser
[root@appsrv webdata]#

重启服务:

代码语言:javascript
复制
[root@appsrv webdata]# systemctl restart httpd

将根证书拷贝到客户端上面:

代码语言:javascript
复制
[root@appsrv webdata]# scp /csk-rootca/csk-ca.pem root@192.168.0.190:/root
The authenticity of host '192.168.0.190 (192.168.0.190)' can't be established.
ECDSA key fingerprint is SHA256:7xsUDRDvnVsiuwjjjsuSbDksox+WpR/BOX8WZRIGOB0.
ECDSA key fingerprint is MD5:37:ed:a8:ff:8f:fd:46:a9:47:8d:20:38:1a:a0:05:11.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.190' (ECDSA) to the list of known hosts.
root@192.168.0.190's password:
csk-ca.pem 100% 1383 915.8KB/s 00:00

客户端IN配置:

网络系统管理Linux环境——11.AppSrv之APACHE2_服务器
网络系统管理Linux环境——11.AppSrv之APACHE2_服务器_02