Apache的部署管理及优化

---

1、基于用户的访问认证

[root@node1_5 conf]# htpasswd -cm .htpasswd admin     ##第一次需要用-c进行创建，-m用于指定用户，当已有了.htpasswd后就不需要用-c了
[root@node1_5 conf]# htpasswd -m .htpasswd lee
New password: 
Re-type new password: 
Adding password for user lee
[root@node1_5 conf]# cat .htpasswd 
admin:$apr1$WQclfpJC$mCdH63a7PppEhnSpk6a.n/
lee:$apr1$nd0CH3CZ$7GYWbbSGbS1KRIbEcfEpG0
[root@node1_5 conf]# vim httpd.conf      ##配置主配置文件

	<Directory "/var/www/html/westos/">     ##在html下的发布目录中进行
		AuthUserFile /etc/httpd/conf/.htpasswd    ##认证使用的文件绝对路径
		AuthName "Please input username and passewd!!"
		AuthType basic              ##使用基础认证方式
	#       Require user  admin
		Require valid-user          ##允许.htpasswd文件中的所有用户(认证成功后)
	</Directory>
[root@node1_5 conf]# systemctl restart httpd  ##重启服务

---

[root@westos_student5 ~]# whatis htpasswd 
htpasswd: nothing appropriate.
[root@westos_student5 ~]# mandb  ##更新man数据库
...
[root@westos_student5 ~]# whatis htpasswd 
htpasswd (1)         - Manage user files for basic authentication

---

2、Apache虚拟机的部署

[root@node1_5 ~]# mkdir -p /var/www/virtual/westos.com/{linux,lee}
[root@node1_5 lee]# vim index.html
[root@node1_5 westos.com]# vim linux/index.html
[root@node1_5 ~]#vim /etc/httpd/conf.d/westos.conf
[root@node1_5 ~]#cat /etc/httpd/conf.d/westos.conf
     <VirtualHost _default_:80>
             DocumentRoot /var/www/html
             CustomLog logs/default.log combined
     </VirtualHost>
     
     <VirtualHost *:80>
             ServerName lee.westos.com
             DocumentRoot /var/www/virtual/westos.com/lee
             CustomLog logs/lee.log combined
     </VirtualHost>
     
     <VirtualHost *:80>
             ServerName linux.westos.com
             DocumentRoot /var/www/virtual/westos.com/linux
             CustomLog logs/linux.log combined
     </VirtualHost>
     
[root@node1_5 westos.com]# systemctl restart httpd

在浏览器所在主机中配置本地解析:
[root@westos_student5 ~]# vim /etc/hosts

至此Apache虚拟机就部署好了

3、PHP语言部署

[root@node1_5 conf]# dnf install php
[root@node1_5 conf]# cd /var/www/html/    ##访问www.westos.com/index.php
[root@node1_5 html]# vim index.php
[root@node1_5 html]# cat index.php
	<?php
		phpinfo()
	?>
	
[root@node1_5 html]# systemctl restart httpd

访问www.westos.com/index.php

4、perl语言部署

[root@node1_5 html]# dnf install httpd-manual -y  ##访问www.westos.com/manual/ 可以查看apache手册
[root@node1_5 html]# systemctl restart httpd

[root@node1_5 html]# mkdir cgi-scripts      ##将所有 .cgi 脚本放在此文件夹中
[root@node1_5 html]# cd cgi-scripts/
[root@node1_5 cgi-scripts]# vim index.cgi   ##编写脚本
	#!/usr/bin/perl
	print "Content-type: text/html\n\n";
	print "Hello, Mark!";

[root@node1_5 cgi-scripts]# vim /etc/httpd/conf.d/westos.conf
	<Directory "/var/www/html/cgi-scripts/">
	    Options +ExecCGI
	    AddHandler cgi-script .cgi
	</Directory>

[root@node1_5 cgi-scripts]# chmod +x index.cgi   ##给脚本执行权限
[root@node1_5 cgi-scripts]# systemctl restart httpd

5、wsgi语言部署

[root@node1_5 html]# mkdir wsgi-scripts
[root@node1_5 html]# cd wsgi-scripts/
[root@node1_5 wsgi-scripts]# vim index.wsgi
[root@node1_5 wsgi-scripts]# cat index.wsgi 
def application(env, westos):
	westos('200 ok',[('Content-Type', 'text/html')])
	return [b'hey guy!']
[root@node1_5 wsgi-scripts]# chmod +x index.wsgi 
[root@node1_5 wsgi-scripts]# python3 index.wsgi   ##检查语法有没有问题
[root@node1_5 wsgi-scripts]# vim /etc/httpd/conf.d/westos.conf 
<VirtualHost *:80>
        ServerName www.westos.com
        WSGIScriptAlias /  /var/www/html/wsgi-scripts/index.wsgi
</VirtualHost>

[root@node1_5 wsgi-scripts]# dnf install python3-mod_wsgi.x86_64 -y  ##安装wsgi插件
[root@node1_5 wsgi-scripts]# systemctl restart httpd

• 浏览器访问 www.westos.com/wsgi-scripts/index.wsgi

若利用ip进行访问需要将 "WSGIScriptAlias /  /var/www/html/wsgi-scripts/index.wsgi" 写在虚拟主机中如下(/etc/httpd/conf.d/westos.conf)

        DocumentRoot /var/www/html
        CustomLog logs/default.log combined

6、Apache的加密访问

[root@node1_5 wsgi-scripts]# dnf install mod_ssl.x86_64 -y   ##安装https加密服务
[root@node1_5 ~]# firewall-cmd --permanent --add-service=https ##在防火墙中添加https
success
[root@node1_5 ~]# firewall-cmd --reload 
success
[root@node1_5 ~]# firewall-cmd --permanent --list-all
[root@node1_5 ~]# openssl genrsa -out /etc/pki/tls/private/www.westos.com.key 2048                                              ##生成私钥
Generating RSA private key, 2048 bit long modulus (2 primes)
...................................+++++
..........................+++++
e is 65537 (0x010001)
[root@node1_5 ~]# openssl req -new -key /etc/pki/tls/private/www.westos.com.key -out /etc/pki/tls/certs/www.westos.com.csr   ##生成证书签名文件
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN                ##填写信息
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:linux
Organizational Unit Name (eg, section) []:westos
Common Name (eg, your name or your server's hostname) []:www.westos.com
Email Address []:admin@gamil

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@node1_5 ~]# openssl x509 -req -days 365 -in /etc/pki/tls/certs/www.westos.com.csr -signkey /etc/pki/tls/private/www.westos.com.key -out /etc/pki/tls/certs/www.westos.com.crt      ##生成证书
Signature ok
subject=C = CN, ST = Shaanxi, L = xi'an, O = linux, OU = westos, CN = www.westos.com, emailAddress = admin@gamil
Getting Private key

x509  # 证书格式
-req  # 请求
-in   # 加载签证名称
-signkey /etc/pki/tls/private/www.westos.com.key # 用私钥签名

[root@node1_5 conf.d]# vim ssl.conf          ##编写配置文件
SSLCertificateFile /etc/pki/tls/certs/www.westos.com.crt    #更改其中文件名
SSLCertificateKeyFile /etc/pki/tls/private/www.westos.com.key
 
[root@node1_5 conf.d]# systemctl restart httpd     ##重启服务

在浏览器中用 https://www.westos.com/ 访问

$$对重要网页自动加密，输入网址自动跳转为https://
在浏览器中访问之前安装的manual(Apache手册)http://www.westos.com/manual/ssl/ 可以得知Apache虚拟机主配置文件westos.conf如何更改

[root@node1_5 conf.d]# vim westos.conf 
	<VirtualHost *:443>
	        ServerName login.westos.com
	        DocumentRoot /var/www/virtual/westos.com/login
	        CustomLog logs/login.log combined
	        SSLEngine on
	        SSLCertificateFile /etc/pki/tls/certs/www.westos.com.crt
	        SSLCertificateKeyFile /etc/pki/tls/private/www.westos.com.key
	</VirtualHost>
	
	<VirtualHost *:80>
	        ServerName login.westos.com
	        RewriteEngine on
	        RewriteRule ^(/.*)$ https://%{
     HTTP_HOST}$1
	</VirtualHost>
[root@node1_5 conf.d]# systemctl restart httpd

在浏览器中输入 login.westos.com 自动跳转为 https://login.westos.com

7、squid+Apache （腾讯使用）

squid 正向代理：

[root@westos_student5 ~]# dnf install squid -y   #安装squid
[root@westos_student5 ~]# cd /etc/squid/
[root@westos_student5 squid]# vim squid.conf
	line59 http_access allow all
	line68 coredump_dir /var/spool/squid 100 16 256
[root@westos_student5 squid]# systemctl restart squid.service #重启squid服务
[root@westos_student5 squid]# firewall-cmd --permanent --add-port=3128/tcp
[root@westos_student5 squid]# firewall-cmd --reload 

#在一台不能上网但是有ip的虚拟机中设置浏览器的preferences中的network为squid代理机的ip port=3128

squid 反向代理：

[root@westos_student5 squid]# vim squid.conf
http_port 80 vhost vport
cache_dir 172.25.254.113 parent 80 0 proxy-only  #有Apache的主机

[root@westos_student5 squid]# systemctl restart squid.service