在AWS-EC2上安装LAMP环境

在EC2 实例上安装来自 Extras 库的软件包

教程：https://aws.amazon.com/cn/premiumsupport/knowledge-center/ec2-install-extras-library-software/

使用 which 命令确认已经安装了 amazon-linux-extras 软件包：

$ which amazon-linux-extras
/usr/bin/amazon-linux-extras

 如果没安装，执行下面命令安装：

$ sudo yum install -y amazon-linux-extras

---

安装LAMP

教程：在 Amazon Linux 2 上安装 LAMP Web 服务器，https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/ec2-lamp-amazon-linux-2.html

$ sudo amazon-linux-extras install -y lamp-mariadb10.2-php7.2 php7.2   // 安装完成后，会显示一个完成列表。
$ sudo yum install -y httpd mariadb-server   // 安装了 httpd 2.4.8 和 mariadb-server 10.2.38
$ sudo yum install php-gd   // 图形处理需要，如验证码

安装完成后查看版本

$ php -v
PHP 7.2.34 (cli) (built: Oct 21 2020 18:03:20) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies

$ httpd -v
Server version: Apache/2.4.51 ()
Server built:   Oct  8 2021 22:03:47

$ mysql -V
mysql  Ver 15.1 Distrib 10.2.38-MariaDB, for Linux (x86_64) using  EditLine wrapper

---

不显示目录结构

$ sudo vim /etc/httpd/conf/httpd.conf
查找Options Indexes FollowSymLinks 修改为 Options -Indexes +FollowSymLinks 

下载上传限制

$ sudo vim /etc/php.ini
upload_max_filesize = 2M	改为   upload_max_filesize = 50M
post_max_size = 8M			改为   post_max_size = 50M

启动apache2.4

$ sudo systemctl start httpd; sudo systemctl enable httpd; sudo systemctl is-enabled httpd

---

 启动数据库

$ sudo systemctl start mariadb; sudo systemctl enable mariadb

首次配置数据库

$ sudo mysql_secure_installation

Set root password? [Y/n] y
New password: 
Re-enter new password: 
Password updated successfully!
Reloading privilege tables..
 ... Success!

Remove anonymous users? [Y/n] y
 ... Success!

Disallow root login remotely? [Y/n] y
 ... Success!

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

Thanks for using MariaDB!

---

改www权限及所有权

$ sudo usermod -a -G apache ec2-user   // 将您的用户 (这里指 ec2-user) 添加到 apache
$ sudo chown -R apache:apache /var/www   // 将 /var/www 及其内容的组所有权更改到 apache 组
$ sudo chmod 2775 /var/www && find /var/www -type d -exec sudo chmod 2775 {} \;
$ find /var/www -type f -exec sudo chmod 0664 {} \;

构建devs

$ cd /var/www/html; sudo mkdir devs;
$ sudo vim /etc/httpd/conf.d/devs.conf
Listen 18081
 // ip要写EC2的私有ip
	ServerAdmin [email protected]
	DocumentRoot "/var/www/html/devs"
	ServerName devs
	ServerAlias devs
	CustomLog "|/usr/sbin/rotatelogs /etc/httpd/logs/devs-access-%Y%m%d.log 86400 480" common
	ErrorLog "logs/devs-error.log"
	
		Options FollowSymLinks
		AllowOverride All
		Order Deny,Allow
		Allow from All
		DirectoryIndex index.html index.php
	


$ echo "" > /var/www/html/devs/phpinfo.php
$ rm /var/www/html/devs/phpinfo.php

可以在浏览器中访问：http://1.2.3.4:18081/phpinfo.php

---

安装phpmyadmin

https://www.phpmyadmin.net/downloads/

$ cd /var/www/html; sudo mkdir devs; cd devs;
$ sudo yum install php-mbstring php-xml -y   // 安装所需的依赖项
$ sudo systemctl restart php-fpm
$ sudo wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.tar.gz
$ sudo mkdir phpmy-202108141142 && sudo tar -xvzf phpMyAdmin-latest-all-languages.tar.gz -C phpmy-202108141142 --strip-components 1
$ sudo rm phpMyAdmin-latest-all-languages.tar.gz
$ cd phpmy-202108141142
$ sudo vim config.sample.inc.php   // 修改$cfg['blowfish_secret'] = '';
$ sudo vim ./libraries/config.default.php

---

构建网站

在服务器上启用 TLS，https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html
安装 Apache 模块 mod_ssl 以添加 TLS 支持。

$ sudo yum install -y mod_ssl

证书的生成

首先，在EC2服务器上生成CSR证书和KEY（私钥），使用CSR证书审核通过后，会生成CRT证书（有时还会另含一个链式CRT）。

$ cd ~
$ sudo openssl req -days 365 -nodes -newkey rsa:2048 -keyout abcde_com.key -out abcde_com.csr

Generating a 2048 bit RSA private key
...............................+++
............+++
writing new private key to 'abcde_com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US   // 国家
State or Province Name (full name) []:VA   // 省或者州
Locality Name (eg, city) [Default City]:Norfolk   // 城市
Organization Name (eg, company) [Default Company Ltd]:abcde   // 组织名
Organizational Unit Name (eg, section) []:IT   // 部门
Common Name (eg, your name or your server's hostname) []:abcde.com   // 域名
Email Address []:[email protected]   // 邮箱

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:   // 密码可以为空
An optional company name []:   // 可选公司名

当前目录下会生成2个文件，abcde_com.csr 、abcde_com.key

使用 abcde_com.csr 去审核生成 abcde_com.crt 和 abcde_com_chain.crt 文件，获得文件后，放入相应目录下。

$ cd /etc/pki/tls/certs
$ sudo vim abcde_com.crt
$ sudo vim abcde_com_chain.crt
$ sudo chown root:root *.crt && sudo chmod 600 *.crt

$ cd /etc/pki/tls/private
$ sudo vim abcde_com.key
$ sudo chown root:root abcde_com.key && sudo chmod 600 abcde_com.key

配置 abcde.conf 文件：

$ cd /var/www/html; sudo mkdir abcde_com;
$ sudo vim /etc/httpd/conf.d/abcde_com.conf

	ServerAdmin [email protected]
	DocumentRoot "/var/www/html/abcde_com/public"
	ServerName www.abcde.com
	ServerAlias *.abcde.com
	CustomLog "|/usr/sbin/rotatelogs /etc/httpd/logs/abcde_com-access-%Y%m%d.log 86400 480" common
	ErrorLog "logs/abcde_com-error_log"
	
		Options FollowSymLinks
		AllowOverride All
		Order Deny,Allow
		Allow from All
		DirectoryIndex index.html index.php
	



	
	    ServerAdmin [email protected]
	    DocumentRoot "/var/www/html/abcde_com/public"
	    ServerName www.abcde.com
	    ServerAlias *.abcde.com
	    CustomLog "|/usr/sbin/rotatelogs /etc/httpd/logs/abcde_com443-access-%Y%m%d.log 86400 480" common
		ErrorLog "logs/abcde_com443-error_log"
	    SSLEngine on
	    SSLCertificateFile "/etc/pki/tls/certs/abcde_com.crt"
	    SSLCertificateKeyFile "/etc/pki/tls/private/abcde_com.key"
	    SSLCertificateChainFile "/etc/pki/tls/certs/abcde_com_chain.crt"
	    SSLProtocol all -SSLv3
		# SSLProtocol -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
	    
	        Options FollowSymLinks
	        AllowOverride All
	        Order Deny,Allow
	        Allow from All
	        DirectoryIndex index.html index.php
	    
	

---

重启所有服务

$ sudo systemctl restart httpd && sudo systemctl restart mariadb && sudo systemctl restart php-fpm

---

压力测试

$ ab -V
This is ApacheBench, Version 2.3 <$Revision: 1879490 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

$ ab -c 1000 -n 10000 http://1.2.3.4:18081/phpinfo.php   // 1000个客户，10000个并发