Apache的常用配置
Apache的常用配置
源码安装时，httpd命令不能够直接使用，因为找不到httpd命令，我们需要在/etc/profile.d/目录下创建一个httpd.sh脚本，在里面写上apache安装时的绝对路径（配置环境变量）。
切换使用MPM（编辑/etc/httpd/conf.modules.d/00-mpm.conf文件）
工作模式有三种分别是：
- prefork
- event
- worker
编译安装时，模型已经定下了不能够更改，但是可以更改配置
[root@localhost /]# vim /etc/httpd24/extra/httpd-mpm.conf
……
StartServers 5 //启动时候启动五个进程
MinSpareServers 5 //启动进程最少五个
MaxSpareServers 10 //启动进程最多十个
MaxRequestWorkers 250 //请求进程连接数最多250个
MaxConnectionsPerChild 0 //每个子进程最大的连接数，0表示没有限制
……
访问控制法则：
| 法则 | 功能 |
|---|---|
| Require all granted | 允许所有主机访问 |
| Require all deny | 拒绝所有主机访问 |
| Require ip IPADDR | 授权指定来源地址的主机访问 |
| Require not ip IPADDR | 拒绝指定来源地址的主机访问 |
| Require host HOSTNAME | 授权指定来源主机名的主机访问 |
| Require not host HOSTNAME | 拒绝指定来源主机名的主机访问 |
| IPADDR的类型 | HOSTNAME的类型 |
|---|---|
| IP：192.168.1.1 Network/mask：192.168.1.0/255.255.255.0 Network/Length：192.168.1.0/24 Net：192.168 |
FQDN：特定主机的全名 DOMAIN：指定域内的所有主机 |
注意：httpd-2.4版本默认是拒绝所有主机访问的，所以安装以后时必须要做显示授权访问
示例：
//目录地址
Require not ip 192.168.1.20 //拒绝192.168.1.20的ip访问
Require all granted //允许所有主机访问
//httpd的网站的根目录
Options Indexes FollowSymLinks
Require all granted //允许所有主机访问
虚拟主机的配置
虚拟主机有三类：
- 相同ip不同端口
- 不同ip相同端口
- 相同ip相同端口不同域名（常用方式）
在配置虚拟主机之前配置
首先将在主配置文件中的vhosts.conf这一行内容的注释取消掉，使apache的httpd-vhosts.conf启用
[root@localhost htdocs]# vim /etc/httpd24/httpd.conf
Include /etc/httpd24/extra/httpd-vhosts.conf
httpd-vhosts.conf配置参数的含义
//虚拟主机地址和端口号
ServerAdmin [email protected] //管理员邮箱
DocumentRoot "/usr/local/apache/docs/dummy-host.example.com" //网站的根目录
ServerName dummy-host.example.com //网站的域名
ServerAlias www.dummy-host.example.com //网站的别名
ErrorLog "logs/dummy-host.example.com-error_log" //错误日志存放地址，logs在apache的根目录下
CustomLog "logs/dummy-host.example.com-access_log" common（固定写法） //正常访问的日志存放地址
相同ip不通端口的配置方式：
配置相同ip不同端口的虚拟主机
DocumentRoot "/usr/local/apache/htdocs/test1"
ServerName test1.com
ErrorLog "logs/test1.com-error_log"
CustomLog "logs/test1.com-access_log" common
listen 81
DocumentRoot "/usr/local/apache/htdocs/test2"
ServerName test2.com
ErrorLog "logs/test2.com-error_log"
CustomLog "logs/test2.com-access_log" common
重启服务然后通过相同的ip和不同的端口访问
[root@localhost htdocs]# systemctl restart httpd
[root@localhost htdocs]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 *:81 *:*
LISTEN 0 128 [::]:22 [::]:*
测试页面：
不同ip相同端口的配置方式：
首先给网卡配置两个ip，然后重启网卡
[root@localhost htdocs]# cd /etc/sysconfig/network-scripts/
[root@localhost network-scripts]# ls
ifcfg-ens33
[root@localhost network-scripts]# vim ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR1=192.168.247.137
PREFIX1=24
GATEWAY=192.168.247.2
DNS1=114.114.114.114
IPADDR2=192.168.247.100
PREFIX2=24
[root@localhost network-scripts]# ifdown ens33;ifup ens33
[root@localhost network-scripts]# ip a
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:4b:b2:69 brd ff:ff:ff:ff:ff:ff
inet 192.168.247.137/24 brd 192.168.247.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet 192.168.247.100/24 brd 192.168.247.255 scope global secondary noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe4b:b269/64 scope link
valid_lft forever preferred_lft forever
配置不同ip相同端口的虚拟主机，然后重启服务
[root@localhost htdocs]# vim /etc/httpd24/extra/httpd-vhosts.conf
DocumentRoot "/usr/local/apache/htdocs/test1"
ServerName test1.com
ErrorLog "logs/test1.com-error_log"
CustomLog "logs/test1.com-access_log" common
DocumentRoot "/usr/local/apache/htdocs/test2"
ServerName test2.com
ErrorLog "logs/test2.com-error_log"
CustomLog "logs/test2.com-access_log" common
root@localhost htdocs]# systemctl restart httpd
测试页面：
相同ip相同端口不通域名的配置方式：
相同ip相同端口不通域名的配置：
[root@localhost htdocs]# vim /etc/httpd24/extra/httpd-vhosts.conf
DocumentRoot "/usr/local/apache/htdocs/test1"
ServerName test1.com
ErrorLog "logs/test1.com-error_log"
CustomLog "logs/test1.com-access_log" common
DocumentRoot "/usr/local/apache/htdocs/test2"
ServerName test2.com
ErrorLog "logs/test2.com-error_log"
CustomLog "logs/test2.com-access_log" common
DocumentRoot "/usr/local/apache/htdocs/test3"
ServerName test3.com
ErrorLog "logs/test3.com-error_log"
CustomLog "logs/test3.com-access_log" common
[root@localhost htdocs]# systemctl restart httpd
修改hosts文件在本地解析虚拟主机的域名：
将C:\windows\system32\drivers\etc\hosts文件拖到桌面上，以管理员身份打开，用以下格式写上对应的域名和ip
192.168.247.100 test2.com test3.com
最后把hosts文件拖回原来目录
测试页面：
CA证书的配置（https）
启用ssl模块：
编辑/etc/httpd24/httpd.conf 文件，找到以下这两行取消注释
LoadModule ssl_module modules/mod_ssl.so
Include /etc/httpd24/extra/httpd-ssl.conf
httpd-ssl.conf文件参数的含义
# General setup for the virtual host
DocumentRoot "/usr/local/apache/htdocs" //https网站的根目录
ServerName www.example.com:443 //域名
ServerAdmin [email protected] //管理员邮箱
ErrorLog "/usr/local/apache/logs/error_log" //错误日志文件路径
TransferLog "/usr/local/apache/logs/access_log" //正确日志文件路径
修改httpd-ssl.conf配置文件
# General setup for the virtual host
DocumentRoot "/usr/local/apache/htdocs/test2"
ServerName test2.com:443
ErrorLog "/usr/local/apache/logs/test2.com-error_log"
TransferLog "/usr/local/apache/logs/test2.com-access_log"
……
SSLCertificateFile "/etc/httpd24/httpd.crt" //设置证书放置地址
……
SSLCertificateKeyFile "/etc/httpd24/httpd.key" //设置证书放置地址
……
修改完后检查有没有语法错误
[root@localhost network-scripts]# apachectl -t
AH00526: Syntax error on line 92 of /etc/httpd24/extra/httpd-ssl.conf:
SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you need to load the appropriate socache module (mod_socache_shmcb?).
[root@localhost network-scripts]# vim /etc/httpd24/extra/httpd-ssl.conf
#SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache
(512000)"
//因为没有/usr/local/apache/logs/ssl_scache文件注释掉就行了
//再次编译又有报错因为我们的证书还没有生成到目标目录
CA生成密钥
[root@localhost CA]# mkdir private
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
........................+++++
...............+++++
e is 65537 (0x010001)
CA生成自签署证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:ha
Organizational Unit Name (eg, section) []:ha
Common Name (eg, your name or your server's hostname) []:test2.com
Email Address []:[email protected]
客户端生成密钥
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt && echo 01 > serial
[root@localhost CA]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.............................+++++
..........................................................................................................................................+++++
e is 65537 (0x010001)
客户端生成证书签署请求
[root@localhost CA]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:ha
Organizational Unit Name (eg, section) []:ha
Common Name (eg, your name or your server's hostname) []:test2.com
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
CA签署客户端提交上来的证书
[root@localhost CA]# openssl ca -in httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Apr 27 09:28:43 2021 GMT
Not After : Apr 27 09:28:43 2022 GMT
Subject:
countryName = CN
stateOrProvinceName = HB
organizationName = ha
organizationalUnitName = ha
commonName = test2.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
70:0C:C7:BB:B4:AB:09:53:3D:2A:97:CA:3A:C9:78:F9:C5:7B:99:3E
X509v3 Authority Key Identifier:
keyid:B0:D2:2C:1C:EE:3D:D5:75:E8:A7:09:DF:04:DA:48:50:50:DE:42:6E
Certificate is to be certified until Apr 27 09:28:43 2022 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
将证书移动到设置的目录下
[root@localhost CA]# mv httpd.key httpd.crt /etc/httpd24/
[root@localhost CA]# systemctl restart httpd
测试页面：
