网络系统管理Linux环境——11.AppSrv之APACHE2

发布于

题目要求

服务器AppSrv上的工作任务

4.  APACHE2

安装apache服务；

服务以用户webuser系统用户运行；

全站点启用TLS访问，使用本机上的“CSK Global Root CA”颁发机构颁发，网站证书信息如下：

    C = CN

    ST = China

    L = BeiJing

    O = skills

    OU = Operations Departments

    CN = ​​*.chinaskills.co​​m

客户端访问https时应无浏览器（含终端）安全警告信息；

当用户使用http访问时自动跳转到https安全连接；

搭建www.chinaskills.cn站点；

网页文件放在StorgeSrv服务器上；

在StorageSrv上安装MriaDB，在本机上安装PHP，发布WordPress网站；

MariaDB数据库管理员信息：User: root/ Password: Chinaskill21!。

创建网站download.chinaskills.cn站点;

网页文件存放在StorageSrv服务器上；

在该站点的根目录下创建以下文件“test.mp3, test.mp4, test.pdf”，其中test.mp4文件的大小为100M，页面访问成功后能够列出目录所有文件。

作安全加固，在任何页面不会出现系统和WEB服务器版本信息。

项目实施

安装httpd以及ssl模块：

代码语言：javascript
复制
[root@appsrv ~]# yum install httpd mod_ssl  php php-mbstring php-mysql mariadb-server -y

增加用户和修改物理内存大小：

代码语言：javascript
复制
[root@appsrv ~]# useradd -r webuser
代码语言：javascript
复制
[root@appsrv ~]# vim /etc/httpd/conf/httpd.conf 
#修改66和67行
User webuser
Group webuser
代码语言：javascript
复制
[root@appsrv ~]# systemctl enable httpd.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@appsrv ~]# vim /etc/systemd/system/multi-user.target.wants/httpd.service 
第8行添加
memory_limit_in_bytes=500*1024*1024
#然后重启服务
[root@appsrv ~]# systemctl daemon-reload 
[root@appsrv ~]# systemctl restart httpd.service

创建证书并申请：（还有一种方法就是还可以将证书给CA根证书机构（Rserver）去签发）

创建跟证书：

代码语言：javascript
复制
[root@appsrv ~]# vim /etc/pki/tls/openssl.cnf 
#修改
42 dir             = /csk-rootca  
50 certificate     = $dir/csk-ca.pem

[root@appsrv ~]# mkdir /csk-rootca

[root@appsrv ~]# cp -rf /etc/pki/tls/* /csk-rootca/

[root@appsrv ~]# cd /csk-rootca/

[root@appsrv csk-rootca]# touch index.txt

[root@appsrv csk-rootca]# echo 01 >serial

[root@appsrv csk-rootca]# openssl genrsa -out private/cakey.pem 2048

Generating RSA private key, 2048 bit long modulus

..................................................................+++

e is 65537 (0x10001)

[root@appsrv csk-rootca]#
代码语言：javascript
复制
[root@appsrv csk-rootca]# openssl req -new -x509 -key ./private/cakey.pem -out csk-ca.pem

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:#CN

State or Province Name (full name) []:#China

Locality Name (eg, city) [Default City]:#BeiJing

Organization Name (eg, company) [Default Company Ltd]:#skills

Organizational Unit Name (eg, section) []:#Operations Departments

Common Name (eg, your name or your server's hostname) []:CSK Global Root CA

Email Address []:

[root@appsrv csk-rootca]#

申请网站证书秘钥和请求证书：

代码语言：javascript
复制
[root@appsrv csk-rootca]# openssl genrsa -out httpd.key 2048

Generating RSA private key, 2048 bit long modulus

.............................................................+++

............+++

e is 65537 (0x10001)

[root@appsrv csk-rootca]# openssl req -new -key httpd.key -out httpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:#CN

State or Province Name (full name) []:#China

Locality Name (eg, city) [Default City]:#BeiJing

Organization Name (eg, company) [Default Company Ltd]:#skills

Organizational Unit Name (eg, section) []:#Operations Departments

Common Name (eg, your name or your server's hostname) []:*.chinaskills.cn

Email Address []:


Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@appsrv csk-rootca]#

给证书签名：

代码语言：javascript
复制
[root@appsrv csk-rootca]# openssl x509 -req -in httpd.csr -CA /csk-rootca/csk-ca.pem -CAkey /csk-rootca/private/cakey.pem -CAcreateserial -out httpd.crt

Signature ok

subject=/C=CN/ST=China/L=BeiJing/O=skills/OU=Operations Departments/CN=*.chinaskills.cn

Getting CA Private Key

[root@appsrv csk-rootca]#

挂载apache目录以及上传内容：

代码语言：javascript
复制
[root@appsrv ~]# cd /csk-rootca/

[root@appsrv csk-rootca]# mkdir /webdata/

[root@appsrv csk-rootca]# mount -t nfs 192.168.100.200:/webdata /webdata

#查看挂载

[root@appsrv webdata]# df -h

文件系统                  容量  已用  可用 已用% 挂载点

devtmpfs                  475M     0  475M    0% /dev

tmpfs                     487M     0  487M    0% /dev/shm

tmpfs                     487M  7.7M  479M    2% /run

tmpfs                     487M     0  487M    0% /sys/fs/cgroup

/dev/mapper/centos-root    37G  1.6G   36G    5% /

/dev/sr0                  4.4G  4.4G     0  100% /media/CentOS

/dev/sda1                1014M  138M  877M   14% /boot

tmpfs                      98M     0   98M    0% /run/user/0

192.168.100.200:/webdata   37G  1.4G   36G    4% /webdata  #得得这就是新挂载

#上传worpress压缩包到/webdata

#上传好之后查看

[root@appsrv webdata]# ls

test.mp3  wordpress-4.6.18.tar.gz

#进行解压

[root@appsrv webdata]# tar -zxf wordpress-4.6.18.tar.gz

#查看

[root@appsrv webdata]# ls

test.mp3  wordpress  wordpress-4.6.18.tar.gz

#创建一个pdf文件

[root@appsrv webdata]# touch test.pdf

#执行

[root@appsrv webdata]# dd if=/dev/zero of=test.mp4 bs=100M count=1

记录了1+0 的读入

记录了1+0 的写出

104857600字节(105 MB)已复制，1.5661 秒，67.0 MB/秒

配置数据库连接：

代码语言：javascript
复制
#启动数据库服务

[root@appsrv ~]# systemctl restart mariadb

[root@appsrv ~]# systemctl enable mariadb.service

#登录数据库（初次没有密码）

[root@appsrv webdata]# mysql

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 2

Server version: 5.5.68-MariaDB MariaDB Server


Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.


Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.


MariaDB [(none)]> create database wordpress;

Query OK, 1 row affected (0.00 sec)


MariaDB [(none)]> GRANT ALL PRIVILEGES ON . TO 'root'@'%' IDENTIFIED BY 'Chinaskill22!' WITH GRANT OPTION;

Query OK, 0 rows affected (0.00 sec)


MariaDB [(none)]> flush privileges;

Query OK, 0 rows affected (0.00 sec)


MariaDB [(none)]> exit

Bye

创建虚拟主机文件：

代码语言：javascript
复制
[root@appsrv webdata]# vim /etc/httpd/conf.d/welcome.conf

#添加

<Virtualhost *:80>

redirect    permanent    /    https://www.chinaskills.cn    #http的跳转https(永久)

servername   www.chinaskills.cn                         #访问域名

</Virtualhost>


<Virtualhost *:443>

servername   www.chinaskills.cn

documentroot   /webdata/wordpress

<directory  /webdata/wordpress>

require  all  granted

</directory>

sslengine   on

sslcertificatefile         /csk-rootca/httpd.crt

sslcertificatekeyfile     /csk-rootca/httpd.key

</Virtualhost>


<Virtualhost *:80>

redirect  permanent  /  https://download.chinaskills.cn

servername  download.chinaskills.cn

</Virtualhost>


<Virtualhost *:443>

servername  download.chinaskills.cn

documentroot  /webdata/download/

<directory  /webdata/download/>

options  indexes  followsymlinks

require  all  granted

</directory>

sslengine   on

sslcertificatefile         /csk-rootca/httpd.crt

sslcertificatekeyfile     /csk-rootca/httpd.key

</Virtualhost>
代码语言：javascript
复制
[root@appsrv ~]# htpasswd -c /var/passwd zsuser

New password: #ChinaSkill22！

Re-type new password: #ChinaSkill22！

Adding password for user zsuser

[root@appsrv ~]#

#删除默认主页

[root@appsrv webdata]# rm /etc/httpd/conf.d/welcome.conf

rm：是否删除普通文件 "/etc/httpd/conf.d/welcome.conf"？y

[root@appsrv webdata]# htpasswd -c /var/passwd zsuser

New password:

Re-type new password:

htpasswd: password verification error

[root@appsrv webdata]# htpasswd -c /var/passwd zsuser

New password:

Re-type new password:

Adding password for user zsuser

[root@appsrv webdata]#

重启服务：

代码语言：javascript
复制
[root@appsrv webdata]# systemctl restart httpd

将根证书拷贝到客户端上面：

代码语言：javascript
复制
[root@appsrv webdata]# scp /csk-rootca/csk-ca.pem root@192.168.0.190:/root

The authenticity of host '192.168.0.190 (192.168.0.190)' can't be established.

ECDSA key fingerprint is SHA256:7xsUDRDvnVsiuwjjjsuSbDksox+WpR/BOX8WZRIGOB0.

ECDSA key fingerprint is MD5:37:ed:a8:ff:8f:fd:46:a9:47:8d:20:38:1a:a0:05:11.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.0.190' (ECDSA) to the list of known hosts.

root@192.168.0.190's password:

csk-ca.pem                                                               100% 1383   915.8KB/s   00:00

客户端IN配置：

网络系统管理Linux环境——11.AppSrv之APACHE2_服务器
网络系统管理Linux环境——11.AppSrv之APACHE2_服务器_02

#linux#apache2#root#服务#管理