httpd
目錄
- httpd
- curl命令
- httpd命令
- 編譯安裝httpd-2.4.45
- 安裝編譯工具和開發工具包
- 安裝apr,apr-util,httpd三個原始碼包
- 安裝apr
- 安裝apr-util
- 安裝httpd
- 配置環境變數
- 關閉防火墻，開啟服務
- 設定開機自啟
- httpd配置三種虛擬主機
- 相同IP不同埠
- 不同IP相同埠
- 相同IP相同埠不同域名
- 配置拒絕指定ip訪問
- ssl
- CA生成一對密鑰
- CA生成自簽署證書
- 客戶端（例如httpd服務器）生成密鑰
- 客戶端生成證書簽署請求
- 客戶端把證書簽署請求檔案發送給CA
- CA簽署客戶端提交上來的證書
- CA把簽署好的證書httpd.crt發給客戶端
curl命令
[root@lnh ~]# curl -o myblog.html http://blog.51cto.com/itchentao
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 100 312 100 312 0 0 1937 0 --:--:-- --:--:-- --:--:-- 1937
[root@lnh ~]# ls
anaconda-ks.cfg myblog.html
//通過curl下載檔案
httpd命令
[root@lnh ~]# dnf -y install httpd
CentOS-8.5.2111 - Base - mirrors.aliyun.com 117 kB/s | 3.9 kB 00:00
CentOS-8.5.2111 - Extras - mirrors.aliyun.c 73 kB/s | 1.5 kB 00:00
CentOS-8.5.2111 - AppStream - mirrors.aliyu 200 kB/s | 4.3 kB 00:00
Dependencies resolved.
============================================================================
Package Arch Version Repo Size
=================================================================
.....
//下載httpd
[root@lnh ~]# httpd -l
Compiled in modules:
core.c
mod_so.c
http_core.c
//查看靜態編譯的模塊，列出核心中編譯了哪些模塊,它不會列出使用LoadModule指令動態加載的模塊
[root@lnh ~]# httpd -M
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::20c:29ff:fe05:f428. Set the 'ServerName' directive globally to suppress this message
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
access_compat_module (shared)
actions_module (shared)
alias_module (shared)
allowmethods_module (shared)
auth_basic_module (shared)
auth_digest_module (shared)
authn_anon_module (shared)
//輸出一個已經啟用的模塊串列，包括靜態編譯在服務,器中的模塊和作為DSO動態加載的模塊
[root@lnh ~]# httpd -v
Server version: Apache/2.4.37 (centos)
Server built: Nov 12 2021 04:57:27
//顯示httpd的版本，然后退出
[root@lnh ~]# httpd -V
Server version: Apache/2.4.37 (centos)
Server built: Nov 12 2021 04:57:27
Server's Module Magic Number: 20120211:83
Server loaded: APR 1.6.3, APR-UTIL 1.6.1
Compiled using: APR 1.6.3, APR-UTIL 1.6.1
Architecture: 64-bit
Server MPM: event
threaded: yes (fixed thread count)
forked: yes (variable process count)
Server compiled with....
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=256
-D HTTPD_ROOT="/etc/httpd"
-D SUEXEC_BIN="/usr/sbin/suexec"
-D DEFAULT_PIDLOG="run/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"
//顯示httpd和apr/apr-util的版本和編譯引數，然后退出
[root@lnh ~]# httpd -X
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::20c:29ff:fe05:f428. Set the 'ServerName' directive globally to suppress this message
//以除錯模式運行httpd，僅啟動一個作業行程，并且,服務器不與控制臺脫離
編譯安裝httpd-2.4.45
安裝編譯工具和開發工具包
[root@lnh ~]# dnf -y groupinstall "Development Tools"
.....
urw-base35-bookman-fonts-20170801-10.el8.noarch
urw-base35-d050000l-fonts-20170801-10.el8.noarch
urw-base35-fonts-common-20170801-10.el8.noarch
urw-base35-nimbus-mono-ps-fonts-20170801-10.el8.noarch
urw-base35-nimbus-sans-fonts-20170801-10.el8.noarch
urw-base35-standard-symbols-ps-fonts-20170801-10.el8.noarch
valgrind-1:3.17.0-5.el8.x86_64
xml-common-0.6.3-50.el8.noarch
xorg-x11-fonts-ISO8859-1-100dpi-7.5-19.el8.noarch
xz-devel-5.2.4-3.el8.x86_64
zlib-devel-1.2.11-17.el8.x86_64
Complete!
[root@lnh ~]# dnf -y install openssl-devel pcre-devel expat-devel libtool libxml2-devel
....
Installed:
cmake-filesystem-3.20.2-4.el8.x86_64
expat-devel-2.2.5-4.el8.x86_64
keyutils-libs-devel-1.5.10-9.el8.x86_64
krb5-devel-1.18.2-14.el8.x86_64
libcom_err-devel-1.45.6-2.el8.x86_64
libkadm5-1.18.2-14.el8.x86_64
libselinux-devel-2.9-5.el8.x86_64
libsepol-devel-2.9-3.el8.x86_64
libverto-devel-0.3.0-5.el8.x86_64
libxml2-devel-2.9.7-9.el8_4.2.x86_64
openssl-devel-1:1.1.1k-5.el8_5.x86_64
pcre-cpp-8.42-6.el8.x86_64
pcre-devel-8.42-6.el8.x86_64
pcre-utf16-8.42-6.el8.x86_64
pcre-utf32-8.42-6.el8.x86_64
pcre2-devel-10.32-2.el8.x86_64
pcre2-utf16-10.32-2.el8.x86_64
pcre2-utf32-10.32-2.el8.x86_64
Complete!
[root@lnh ~]# useradd -rMs /sbin/nologin apache
[root@lnh ~]# id apache
uid=48(apache) gid=48(apache) groups=48(apache)
//創建一個系統用戶，用來管理Apache行程
安裝apr,apr-util,httpd三個原始碼包
[root@lnh ~]# dnf -y install wget
//安裝wget
[root@lnh ~]# cd /usr/local/src/
[root@lnh src]# wget https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
--2022-07-21 21:04:23-- https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.204.210, 119.96.204.211, 119.96.138.214, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.204.210|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9743277 (9.3M) [application/octet-stream]
Saving to: ‘httpd-2.4.54.tar.gz’
httpd-2.4.54.tar.g 100%[================>] 9.29M 12.6MB/s in 0.7s
2022-07-21 21:04:24 (12.6 MB/s) - ‘httpd-2.4.54.tar.gz’ saved [9743277/9743277]
[root@lnh src]# wget https://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
--2022-07-21 21:05:08-- https://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.204.210, 119.96.204.211, 119.96.138.214, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.204.210|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/octet-stream]
Saving to: ‘apr-1.7.0.tar.gz’
apr-1.7.0.tar.gz 100%[================>] 1.04M --.-KB/s in 0.07s
2022-07-21 21:05:08 (14.0 MB/s) - ‘apr-1.7.0.tar.gz’ saved [1093896/1093896]
[root@lnh src]# wget https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
--2022-07-21 21:05:36-- https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.204.210, 119.96.204.211, 119.96.138.214, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.204.210|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/octet-stream]
Saving to: ‘apr-util-1.6.1.tar.gz’
apr-util-1.6.1.tar 100%[================>] 541.31K --.-KB/s in 0.08s
2022-07-21 21:05:36 (6.40 MB/s) - ‘apr-util-1.6.1.tar.gz’ saved [554301/554301]
[root@lnh src]# ls
apr-1.7.0.tar.gz apr-util-1.6.1.tar.gz httpd-2.4.54.tar.gz
//查看
安裝apr
[root@lnh src]# tar -xf apr-1.7.0.tar.gz
[root@lnh src]# cd apr-1.7.0/
[root@lnh apr-1.7.0]# vim configure
cfgfile=${ofile}T
trap "$RM \"$cfgfile\"; exit 1" 1 2 15
# $RM "$cfgfile" //將此行加上注釋，或者洗掉此行
[root@lnh apr-1.7.0]# ./configure --prefix=/usr/local/apr
....
config.status: creating Makefile
config.status: creating include/apr.h
config.status: creating build/apr_rules.mk
config.status: creating build/pkg/pkginfo
config.status: creating apr-1-config
config.status: creating apr.pc
config.status: creating test/Makefile
config.status: creating test/internal/Makefile
config.status: creating include/arch/unix/apr_private.h
config.status: executing libtool commands
config.status: executing default commands
[root@lnh apr-1.7.0]# make && make install
....
for f in make_exports.awk make_var_export.awk; do \
/usr/bin/install -c -m 644 /usr/local/src/apr-1.7.0/build/${f} /usr/local/apr/build-1; \
done
/usr/bin/install -c -m 644 build/apr_rules.out /usr/local/apr/build-1/apr_rules.mk
/usr/bin/install -c -m 755 apr-config.out /usr/local/apr/bin/apr-1-config
[root@lnh apr-1.7.0]# ls /usr/local/apr/
bin build-1 include lib
安裝apr-util
[root@lnh apr-1.7.0]# cd ..
[root@lnh src]# tar -xf apr-util-1.6.1.tar.gz
[root@lnh src]# cd apr-util-1.6.1/
[root@lnh apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr/
....
config.status: creating build/pkg/pkginfo
config.status: creating apr-util.pc
config.status: creating apu-1-config
config.status: creating include/private/apu_select_dbm.h
config.status: creating include/apr_ldap.h
config.status: creating include/apu.h
config.status: creating include/apu_want.h
config.status: creating test/Makefile
config.status: creating include/private/apu_config.h
config.status: executing default commands
[root@lnh apr-util-1.6.1]# make && make install
....
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
/usr/bin/install -c -m 644 aprutil.exp /usr/local/apr-util/lib
/usr/bin/install -c -m 755 apu-config.out /usr/local/apr-util/bin/apu-1-config
[root@lnh apr-util-1.6.1]# ls /usr/local/apr-util/
bin include lib
安裝httpd
[root@lnh apr-util-1.6.1]# cd ..
[root@lnh src]# tar -xf httpd-2.4.54.tar.gz
[root@lnh src]# cd httpd-2.4.54/
[root@lnh httpd-2.4.54]# ./configure --prefix=/usr/local/apache --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util/ --enable-modules=most --enable-mpms-shared=all --with-mpm=prefork
....
Server Version: 2.4.54
Install prefix: /usr/local/apache
C compiler: gcc
CFLAGS: -g -O2 -pthread
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE
LDFLAGS:
LIBS:
C preprocessor: gcc -E
//動態共享庫 //ssl加密 //通用網關介面，主要為了動態網頁 //url重寫
//zlib壓縮 //正則運算式的庫檔案，不指定路徑自動尋找 //安裝most模塊
//啟用mpm所有支持模式 //使用prefork模式：一個請求，一個執行緒；反應快，不支持高并發，消耗大量記憶體
[root@lnh httpd-2.4.54]# make && make install
....
mkdir /usr/local/apache/build
Installing man pages and online manual
mkdir /usr/local/apache/man
mkdir /usr/local/apache/man/man1
mkdir /usr/local/apache/man/man8
mkdir /usr/local/apache/manual
make[1]: Leaving directory '/usr/local/src/httpd-2.4.54'
[root@lnh httpd-2.4.54]# ls /usr/local/apache/
bin cgi-bin error icons logs manual
build conf htdocs include man modules
配置環境變數
[root@lnh ~]# echo 'export PATH=/usr/local/apache/bin:$PATH' >/etc/profile.d/apache.sh
[root@lnh ~]# source /etc/profile.d/apache.sh //使配置生效
[root@lnh ~]# which apachectl //查看
/usr/local/apache/bin/apachectl
[root@lnh ~]# ln -s /usr/local/apache/include/ /usr/include/apache // 做個軟鏈接，映射個頭檔案
[root@lnh ~]# ll /usr/include/ |grep apache
lrwxrwxrwx. 1 root root 26 Jul 21 21:38 apache -> /usr/local/apache/include/
[root@lnh ~]# ll /usr/include/apache
lrwxrwxrwx. 1 root root 26 Jul 21 21:38 /usr/include/apache -> /usr/local/apache/include/
[root@lnh ~]# vim /etc/man_db.conf //將apache的man生效
#MANDATORY_MANPATH /usr/src/pvm3/man
#
MANDATORY_MANPATH /usr/man
MANDATORY_MANPATH /usr/share/man
MANDATORY_MANPATH /usr/local/share/man
MANDATORY_MANPATH /usr/local/apache/man //添加這一行
關閉防火墻，開啟服務
[root@lnh ~]# systemctl stop firewalld.service
[root@lnh ~]# setenforce 0
[root@lnh ~]# apachectl start
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::20c:29ff:fe05:f428%ens33. Set the 'ServerName' directive globally to suppress this message
[root@lnh ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
[root@lnh ~]# ss -anltup |grep httpd
tcp LISTEN 0 128 *:80 *:* users:(("httpd",pid=62729,fd=4),("httpd",pid=62728,fd=4),("httpd",pid=62727,fd=4),("httpd",pid=62726,fd=4),("httpd",pid=62725,fd=4),("httpd",pid=62724,fd=4))
訪問埠
設定開機自啟
[root@lnh ~]# cd /usr/lib/systemd/system
[root@lnh system]# cp sshd.service httpd.service
cp: overwrite 'httpd.service'?
[root@lnh system]# vim httpd.service
[Unit]
Description=httpd server daemon
After=network.target sshd-keygen.target
[Service]
Type=forking
ExecStart=/usr/local/apache/bin/apachectl
ExecStop=/usr/local/apache/bin/apachectl stop
ExecReload=/bin/kill -HUP $MAINPID
[Install]
WantedBy=multi-user.target
[root@lnh system]# systemctl daemon-reload //此處要確保80埠關閉
[root@lnh ~]# systemctl start httpd.service
[root@lnh ~]# systemctl status httpd.service
● httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor p>
Active: active (running) since Thu 2022-07-21 23:18:31 CST; 2s ago
Process: 63436 ExecStart=/usr/local/apache/bin/apachectl (code=exited, sta>
Main PID: 63439 (httpd)
Tasks: 6 (limit: 12221)
Memory: 5.7M
CGroup: /system.slice/httpd.service
├─63439 /usr/local/apache/bin/httpd
├─63440 /usr/local/apache/bin/httpd
├─63441 /usr/local/apache/bin/httpd
├─63442 /usr/local/apache/bin/httpd
├─63443 /usr/local/apache/bin/httpd
└─63444 /usr/local/apache/bin/httpd
Jul 21 23:18:31 lnh systemd[1]: Starting httpd server daemon...
Jul 21 23:18:31 lnh systemd[1]: Started httpd server daemon.
[root@lnh ~]# systemctl stop httpd.service
[root@lnh ~]# systemctl status httpd.service
● httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor p>
Active: inactive (dead)
Jul 21 23:03:00 lnh httpd[63206]: no listening sockets available, shutting d>
Jul 21 23:03:00 lnh httpd[63206]: AH00015: Unable to open logs
Jul 21 23:03:00 lnh systemd[1]: httpd.service: Main process exited, code=exi>
Jul 21 23:03:00 lnh systemd[1]: httpd.service: Failed with result 'exit-code>
Jul 21 23:03:00 lnh systemd[1]: Failed to start The Apache HTTP Server.
Jul 21 23:18:31 lnh systemd[1]: Starting httpd server daemon...
Jul 21 23:18:31 lnh systemd[1]: Started httpd server daemon.
Jul 21 23:19:01 lnh systemd[1]: Stopping httpd server daemon...
Jul 21 23:19:01 lnh systemd[1]: httpd.service: Succeeded.
Jul 21 23:19:01 lnh systemd[1]: Stopped httpd server daemon.
[root@lnh ~]# systemctl disable httpd.service
//取消開機自啟
httpd配置三種虛擬主機
這是用yum下載的httpd
相同IP不同埠
[root@lnh ~]# find / -name *vhosts.conf //在根目錄下面找虛擬主機的模板組態檔
/usr/share/doc/httpd/httpd-vhosts.conf
[root@lnh ~]# cd /etc/httpd/
[root@lnh httpd]# ls
conf(主組態檔) conf.d(輔助組態檔) conf.modules.d(輔助組態檔，以模塊組態檔為主) logs modules run state
[root@lnh httpd]# cd conf.d/
[root@lnh conf.d]# ls
autoindex.conf README userdir.conf welcome.conf
[root@lnh conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf .
//將模板組態檔復制到當前目錄
[root@lnh conf.d]# ls
autoindex.conf httpd-vhosts.conf README userdir.conf welcome.conf
[root@lnh conf.d]# vim httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/var/www/html/zhuawawa" //網站的根目錄(yum默認安裝的)
ServerName www.zhuawawa.com //域名
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log" //錯誤日志
CustomLog "/var/log/httpd/www.zhuawawa.com-access_log" common
</VirtualHost> //訪問日志
Listen 81 //因為沒有所以添加一個
<VirtualHost *:81> *//表示相同ip
DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com
ErrorLog "/var/log/httpd/www.tanke.com-error_log"
CustomLog "/var/log/httpd/www.tanke.com-access_log" common
</VirtualHost>
虛擬主機示例
服務的郵箱
網站的根目錄(yum默認安裝的)
域名
域名的別名
錯誤日志
訪問日志
[root@lnh conf.d]# cd ..
[root@lnh httpd]# ls
conf conf.d conf.modules.d logs modules run state
[root@lnh httpd]# cd conf
[root@lnh conf]# ls
httpd.conf magic
[root@lnh conf]# vim httpd.conf
DocumentRoot "/var/www/html" //yum安裝的主組態檔默認網站的根目錄
[root@lnh conf]# cd ..
[root@lnh httpd]# ls
conf conf.d conf.modules.d logs modules run state
[root@lnh httpd]# cd conf.d
[root@lnh conf.d]# ls
autoindex.conf httpd-vhosts.conf README userdir.conf welcome.conf
[root@lnh html]# mkdir zhuawawa
[root@lnh html]# mkdir tanke
[root@lnh html]# ls
tanke zhuawawa
[root@lnh html]# cd zhuawawa/
[root@lnh zhuawawa]# rz
[root@lnh zhuawawa]# dnf -y install zip
[root@lnh zhuawawa]# unzip zhuawawaji.zip
[root@lnh zhuawawa]# ls
jQuery抓娃娃機游戲代碼 zhuawawaji.zip
[root@lnh zhuawawa]# mv jQuery抓娃娃機游戲代碼/* .
[root@lnh zhuawawa]# ls
images img index.html jQuery抓娃娃機游戲代碼 js zhuawawaji.zip
[root@lnh zhuawawa]# rm -rf zhuawawaji.zip
[root@lnh zhuawawa]# ls
images img index.html jQuery抓娃娃機游戲代碼 js
[root@lnh zhuawawa]# cd ..
[root@lnh html]# cd tanke/
[root@lnh tanke]# rz
[root@lnh tanke]# ls
坦克.zip
[root@lnh tanke]# ls
Battle_City 坦克.zip
[root@lnh tanke]# mv Battle_City/* .
[root@lnh tanke]# ls
audio Battle_City css images index.html js 坦克.zip
[root@lnh tanke]# rm -rf 坦克.zip
[root@lnh tanke]# ls
audio Battle_City css images index.html js
[root@lnh html]# httpd -t
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::20c:29ff:fe05:f428. Set the 'ServerName' directive globally to suppress this message
Syntax OK //如果閑出現的太繁雜可以作下面的修改
[root@lnh conf]# vim httpd.conf //在主組態檔里面修改
ServerName www.example.com:80 //取消注釋
[root@lnh html]# httpd -t
Syntax OK //組態檔沒有問題
[root@lnh html]# systemctl restart httpd.service //重啟服務
[root@lnh html]# ss -antl //查看埠
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 *:81 *:*
[root@lnh html]# systemctl stop firewalld.service
[root@lnh html]# setenforce 0
//關閉防火墻
80埠:
81埠:
不同IP相同埠
[root@lnh ~]# ip addr add 192.168.222.252/24 dev ens33
[root@lnh ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:05:f4:28 brd ff:ff:ff:ff:ff:ff
inet 192.168.222.250/24 brd 192.168.222.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet 192.168.222.252/24 scope global secondary ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe05:f428/64 scope link
valid_lft forever preferred_lft forever
//添加一個臨時的同網段ip
[root@lnh ~]# cd /etc/httpd/
[root@lnh httpd]# ls
conf conf.d conf.modules.d logs modules run state
[root@lnh httpd]# cd conf.d/
[root@lnh conf.d]# ls
autoindex.conf httpd-vhosts.conf README userdir.conf welcome.conf
[root@lnh conf.d]# vim httpd-vhosts.conf
<VirtualHost 192.168.222.250:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/www.zhuawawa.com-access_log" common
</VirtualHost>
<VirtualHost 192.168.222.252:80>
DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com
ErrorLog "/var/log/httpd/www.tanke.com-error_log"
CustomLog "/var/log/httpd/www.tanke.com-access_log" common
</VirtualHost>
//更改ip 同埠
[root@lnh conf.d]# httpd -t
Syntax OK
//檢查配置是否有啥子問題
[root@lnh conf.d]# systemctl restart httpd.service
//重啟服務
250:
252:
相同IP相同埠不同域名
在電腦桌面我的電腦里面搜索C:\Windows\System32\drivers\etc這個路徑修改hosts檔案
添加后保存hosts檔案
[root@lnh conf.d]# vim httpd-vhosts.conf
<VirtualHost 192.168.222.250:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/www.zhuawawa.com-access_log" common
</VirtualHost>
<VirtualHost 192.168.222.250:80>
DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com
ErrorLog "/var/log/httpd/www.tanke.com-error_log"
CustomLog "/var/log/httpd/www.tanke.com-access_log" common
</VirtualHost>
[root@lnh conf.d]# httpd -t
Syntax OK
//檢查配置
[root@lnh conf.d]# systemctl restart httpd.service
//重啟服務
www.zhuawawa.com:
www.tanke.com:
配置拒絕指定ip訪問
[root@lnh conf.d]# vim httpd-vhosts.conf
<VirtualHost 192.168.222.250:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/www.zhuawawa.com-access_log" common
<Directory /var/www/html/zhuawawa>
<RequireAll>
Require not ip 192.168.222.1
Require all granted
</RequireAll>
</Directory>
</VirtualHost>
<VirtualHost 192.168.222.250:80>
DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com
ErrorLog "/var/log/httpd/www.tanke.com-error_log"
CustomLog "/var/log/httpd/www.tanke.com-access_log" common
</VirtualHost>
[root@lnh conf.d]# httpd -t
Syntax OK
[root@lnh conf.d]# systemctl restart httpd.service
192.168.222.250:
192.168.222.250/zhuawawa
ssl
CA生成一對密鑰
[root@lnh ~]# dnf -y install mod_ssl
[root@lnh ~]# systemctl restart httpd.service
[root@lnh ~]# httpd -M |grep ssl
ssl_module (shared)
[root@lnh ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:80 *:*
啟用模塊：編輯/etc/httpd/conf.modules.d/00-base.conf檔案，添加下面這行，如果已經有了但是注釋了，則取消注釋即可
[root@lnh ~]# vim /etc/httpd/conf.modules.d/00-base.conf
LoadModule ssl_module modules/mod_ssl.so
[root@lnh ~]# cd /etc/pki/
[root@lnh pki]# ls
ca-trust consumer entitlement java product product-default rpm-gpg rsyslog tls
[root@lnh pki]# mkdir CA
[root@lnh pki]# cd CA/
[root@lnh CA]# pwd
/etc/pki/CA
[root@lnh CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) //生成密鑰，括號必須要
genrsa: Can't open "private/cakey.pem" for writing, No such file or directory //沒有private這個目錄
[root@lnh CA]# mkdir private //創建目錄
[root@lnh CA]# ls
private
[root@lnh CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) //生成密鑰，括號必須要
Generating RSA private key, 2048 bit long modulus (2 primes)
.............+++++
....................................................................................................+++++
e is 65537 (0x010001)
[root@lnh CA]# cd private/
[root@lnh private]# ls
cakey.pem
//這里面就是秘鑰
[root@lnh private]# cd ..
[root@lnh CA]# pwd
/etc/pki/CA
[root@lnh CA]# ls
private
[root@lnh CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAytGtkYX/kizIGjBflTyZ
ZRhOX85EgHo/HLub0YvURuZzmtuASKyf54K4OJzfUzXYPsPOPIuNKElbDYhflxaI
oKNyLDhkjZ60DVPHzGLFVg3CGOim7zrqF14HwCM27ZmV3b6ngnaLAIDfftDmrF33
J2J33NW3/yM6Fbpz7zrAa81W518wHYy7UjvUPhD5Z83EYvOpWAKJLMswl2B3RcCU
xTCWoQ7InD0JOHj0xj97Onj3l4PtHQqcfUK+FQoiAV9OfCfr/w536wzNXZeSbSLS
eN5LeFjGuy0qbF1qZuwJYQWQ2GNRQIi1De88XWJoew1E3z8dCoHzSo/dFNeo0ItY
DQIDAQAB
-----END PUBLIC KEY-----
//提取秘鑰查看
CA生成自簽署證書
[root@lnh CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 //成自簽署證書
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn //國家
State or Province Name (full name) []:hb //省份
Locality Name (eg, city) [Default City]:wh //城市
Organization Name (eg, company) [Default Company Ltd]:runtime //公司
Organizational Unit Name (eg, section) []:peixun //部門
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com //域名，只是暫時寫一個，后面也可以訪問其他的
Email Address []:[email protected] //郵箱
[root@lnh CA]# openssl x509 -text -in cacert.pem
//讀出cacert.pem證書的內容
[root@lnh CA]# mkdir certs newcerts crl //創建目錄
[root@lnh CA]# touch index.txt && echo 01 > serial //創建檔案
[root@lnh CA]# ls
cacert.pem certs crl index.txt newcerts private serial
[root@lnh CA]# cat serial
01 //查看
客戶端（例如httpd服務器）生成密鑰
生成的秘鑰想給哪個用哪個就是客戶端
[root@lnh CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@lnh ssl]# pwd
/etc/httpd/ssl
[root@lnh ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
......................+++++
...........................+++++
e is 65537 (0x010001)
[root@lnh ssl]# ls
httpd.key
客戶端生成證書簽署請求
[root@lnh ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
//簽署證書
客戶端把證書簽署請求檔案發送給CA
我這里是一臺機子做的使用不用操作
scp httpd.csr root@CA端IP:/root
CA簽署客戶端提交上來的證書
[root@lnh ssl]# openssl ca -in /etc/httpd/ssl/httpd.csr -out httpd.crt -days 365
([root@lnh ssl]# openssl ca -in ./httpd.csr -out httpd.crt -days 365
)//當前目錄下
([root@lnh ssl]# openssl ca -in httpd.csr -out httpd.crt -days 365
)//當前這個路徑下
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 24 08:13:02 2022 GMT
Not After : Jul 24 08:13:02 2023 GMT
Subject:
countryName = cn
stateOrProvinceName = hb
organizationName = runtime
organizationalUnitName = peixun
commonName = www.zhuawawa.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
65:A6:53:8F:B4:F5:2F:1B:BD:B0:5F:0F:FA:E8:B2:5B:EC:61:18:AF
X509v3 Authority Key Identifier:
keyid:7E:29:4C:F8:13:87:53:16:46:98:2B:E6:A0:9D:42:1D:68:27:00:10
Certificate is to be certified until Jul 24 08:13:02 2023 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@lnh ssl]# ls
httpd.crt httpd.csr httpd.key
CA把簽署好的證書httpd.crt發給客戶端
scp httpd.crt root@客戶端IP:/etc/httpd/ssl/
[root@lnh ssl]# pwd
/etc/httpd/ssl
[root@lnh ssl]# cd /etc/httpd/conf.d/
[root@lnh conf.d]# ls
'\' httpd-vhosts.conf ssl.conf welcome.conf
autoindex.conf README userdir.conf
[root@lnh conf.d]# vim ssl.conf
SSLCertificateFile /etc/httpd/ssl/httpd.crt //修改路徑
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key//修改路徑
<VirtualHost _default_:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/tanke" //取消注釋和指定哪個使用
ServerName www.tanke.com:443 //指定域名
[root@lnh conf.d]# httpd -t
Syntax OK //檢查配置
[root@lnh conf.d]# systemctl restart httpd //重啟服務
[root@lnh conf.d]# ss -antl //查看埠
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:80 *:*
訪問
成功配置https安全加密模塊
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/500159.html
標籤：Linux
上一篇：Linux一些錯誤總結