M63.第十五周作业

第十五周作业：

一、实现基于MYSQL验证的vsftpd虚拟用户访问

源码包：pam_mysql-0.7RC1.tar.gz

10.0.0.7 FTP服务器

10.0.0.17 数据库服务器

1、在数据库服务上配置数据库支持vsftpd服务

#建立存储虚拟用户数据库和表

MariaDB [mysql]> CREATE DATABASE vsftpd;

MariaDB [mysql]> USE vsftpd;

MariaDB [vsftpd]> CREATE TABLE users (

-> id INT AUTO_INCREMENT NOT NULL PRIMARY KEY,

-> name CHAR(50) BINARY NOT NULL,

-> password CHAR(48) BINARY NOT NULL

-> );

#添加虚拟用户，为了安全应该使用PASSWORD函数加密其密码后存储

MariaDB [vsftpd]> INSERT INTO users(name,password) values('ftp_xiaoming',password('123456'));

MariaDB [vsftpd]> INSERT INTO users(name,password) values('ftp_xiaohong',password('654321'));

MariaDB [vsftpd]> select * from users;

+----+--------------+-------------------------------------------+

| id | name | password |

+----+--------------+-------------------------------------------+

| 1 | ftp_xiaoming | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |

| 2 | ftp_xiaohong | *2A032F7C5BA932872F0F045E0CF6B53CF702F2C5 |

+----+--------------+-------------------------------------------+

#创建连接的数据库用户

MariaDB [vsftpd]> GRANT SELECT ON vsftpd.* TO vsftpd@'10.0.0.%' IDENTIFIED BY '123456';

MariaDB [vsftpd]> FLUSH PRIVILEGES;

2、在FTP服务器上安装vsftpd 和 pam_mysql包

[root@centos7 ~]#yum -y install vsftpd

3、在FTP服务器上安装 pam_mysql

#下载pam-mysql源码包，并解包

[root@centos7 ~]#tar xvf pam_mysql-0.7RC1.tar.gz -C /usr/local/src

[root@centos7 ~]#cd /usr/local/src

[root@centos7 src]#ls

pam_mysql-0.7RC1

[root@centos7 src]#cd pam_mysql-0.7RC1/

#安装相关包

[root@centos7 pam_mysql-0.7RC1]#yum -y install vsftpd gcc gcc-c++ make mariadb-devel pam-devel

#编译安装

[root@centos7 pam_mysql-0.7RC1]#./configure --with-pam-mods-dir=/lib64/security

[root@centos7 pam_mysql-0.7RC1]#make install

[root@centos7 pam_mysql-0.7RC1]#ll /lib64/security/pam_mysql*

-rwxr-xr-x 1 root root 882 Mar 19 22:18 /lib64/security/pam_mysql.la

-rwxr-xr-x 1 root root 141720 Mar 19 22:18 /lib64/security/pam_mysql.so

4、在FTP服务器上建立pam认证所需文件

[root@centos7 pam_mysql-0.7RC1]#vim /etc/pam.d/vsftpd.mysql

#添加如下两行

auth required pam_mysql.so user=vsftpd passwd=123456 host=10.0.0.17 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

account required pam_mysql.so user=vsftpd passwd=123456 host=10.0.0.17 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

注意：以上参考 README文档

crypt 加密方式：

0表示不加密

1表示crypt(3)加密

2表示使用mysql password()函数加密

3表示md5加密

4表示sha1加密

配置字段说明：

auth 表示认证

account 验证账号密码正常使用

required 表示认证要通过

pam_mysql.so模块是默认的相对路径，是相对/lib64/security/路径而言，也可以写绝对路径；后

面为给此模块传递的参数

user=vsftpd为登录mysql的用户

passwd=123456 登录mysql的的密码

host=10.0.0.17 mysql服务器的主机名或ip地址

db=vsftpd 指定连接msyql的数据库名称

table=users 指定连接数据库中的表名

usercolumn=name 当做用户名的字段

passwdcolumn=password 当做用户名字段的密码

crypt=2 密码的加密方式为mysql password()函数加密

5、建立相应用户和修改vsftpd配置文件

#建立虚拟用户映射的系统用户及对应的目录

[root@centos7 pam_mysql-0.7RC1]#useradd -s /sbin/nologin -d /data/ftproot -r vuser

[root@centos7 pam_mysql-0.7RC1]#mkdir -pv /data/ftproot/upload

mkdir: created directory ‘/data/ftproot’

mkdir: created directory ‘/data/ftproot/upload’

[root@centos7 pam_mysql-0.7RC1]#setfacl -m u:vuser:rwx /data/ftproot/upload

#确保/etc/vsftpd/vsftpd.conf中已经启用了以下选项

[root@centos7 pam_mysql-0.7RC1]#vim /etc/vsftpd/vsftpd.conf

#修改下面一项，原系统用户无法登录

pam_service_name=vsftpd.mysql

#添加下面两项

guest_enable=YES

guest_username=vuser

6、启动vsftpd服务

[root@centos7 pam_mysql-0.7RC1]#systemctl enable --now vsftpd

7、在FTP服务器上配置虚拟用户具有不同的访问权限

vsftpd可以在配置文件目录中为每个用户提供单独的配置文件以定义其ftp服务访问权限，每个虚拟用户的配置文件名同虚拟用户的用户名。配置文件目录可以是任意未使用目录，只需要在vsftpd.conf指定其路径及名称即可

#配置vsftpd为虚拟用户使用配置文件目录

[root@centos7 pam_mysql-0.7RC1]#vim /etc/vsftpd/vsftpd.conf

#添加如下选项

user_config_dir=/etc/vsftpd/conf.d/

#创建所需要目录，并为虚拟用户提供配置文件

[root@centos7 pam_mysql-0.7RC1]#mkdir /etc/vsftpd/conf.d/

#配置虚拟用户的访问权限

[root@centos7 pam_mysql-0.7RC1]#vim /etc/vsftpd/conf.d/ftp_xiaoming

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

#登录目录改变至指定的目录

local_root=/data/ftproot1

[root@centos7 pam_mysql-0.7RC1]#tree /etc/vsftpd/conf.d/

/etc/vsftpd/conf.d/

└── ftp_xiaoming

0 directories, 1 file

[root@centos7 pam_mysql-0.7RC1]#mkdir /data/ftproot1/upload -pv

mkdir: created directory ‘/data/ftproot1’

mkdir: created directory ‘/data/ftproot1/upload’

[root@centos7 pam_mysql-0.7RC1]#chown vuser.vuser /data/ftproot1/upload/

[root@centos7 pam_mysql-0.7RC1]#ll -d /data/ftproot1/upload/

drwxr-xr-x 2 vuser vuser 6 Mar 19 23:31 /data/ftproot1/upload/

[root@centos7 pam_mysql-0.7RC1]#systemctl restart vsftpd

[root@centos7 ~]#ftp 10.0.0.7

Connected to 10.0.0.7 (10.0.0.7).

220 (vsFTPd 3.0.2)

Name (10.0.0.7:root): ftp_xiaoming

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> cd upload

ftp> lcd /etc

ftp> put hosts

[root@centos7 pam_mysql-0.7RC1]#ll /data/ftproot1/upload/

total 4

-rw------- 1 vuser vuser 158 Mar 19 23:45 hosts

[root@centos7 pam_mysql-0.7RC1]#cd /etc/vsftpd/conf.d/

[root@centos7 conf.d]#ls

ftp_xiaoming

[root@centos7 conf.d]#cp ftp_xiaoming ftp_xiaohong

[root@centos7 conf.d]#vim ftp_xiaohong

local_root=/data/ftproot2

[root@centos7 conf.d]#mkdir /data/ftproot2/upload -pv

mkdir: created directory ‘/data/ftproot2’

mkdir: created directory ‘/data/ftproot2/upload’

[root@centos7 conf.d]#touch /data/ftproot2/xiaohong.txt

[root@centos7 ~]#ftp 10.0.0.7

Connected to 10.0.0.7 (10.0.0.7).

220 (vsFTPd 3.0.2)

Name (10.0.0.7:root): ftp_xiaohong

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> ls

227 Entering Passive Mode (10,0,0,7,131,227).

150 Here comes the directory listing.

drwxr-xr-x 2 0 0 6 Mar 19 16:04 upload

-rw-r--r-- 1 0 0 0 Mar 19 16:09 xiaohong.txt

226 Directory send OK.

二、配置samba共享，实现/www目录共享

1、在samba服务器上安装samba包

[root@samba-server ~]#yum -y install samba

2、创建samba用户和组

[root@samba-server ~]#groupadd -r admins

[root@samba-server ~]#useradd -s /sbin/nologin -G admins wang

[root@samba-server ~]#smbpasswd -a wang

New SMB password:

Retype new SMB password:

Added user wang.

[root@samba-server ~]#useradd -s /sbin/nologin zhang

[root@samba-server ~]#smbpasswd -a zhang

New SMB password:

Retype new SMB password:

Added user zhang.

3、创建samba共享目录,并设置SElinux

[root@samba-server ~]#mkdir /www

[root@samba-server ~]#chgrp admins /www

[root@samba-server ~]#chmod 2775 /www

4、samba服务器配置

[root@samba-server ~]#vim /etc/samba/smb.conf

[share]

path = /www

write list = @admins

[root@samba-server ~]#systemctl enable --now smb nmb

5、samba客户端配置

[root@samba-client ~]#yum -y install cifs-utils

6、用wang用户挂载smb共享并访问

[root@samba-client ~]#mkdir /mnt/wang -pv

[root@samba-client ~]#mount -o username=wang //10.0.0.7/share /mnt/wang

Password for wang@//10.0.0.7/share: ******

[root@samba-client ~]#df -h

Filesystem Size Used Avail Use% Mounted on

devtmpfs 980M 0 980M 0% /dev

tmpfs 991M 0 991M 0% /dev/shm

tmpfs 991M 9.6M 981M 1% /run

tmpfs 991M 0 991M 0% /sys/fs/cgroup

/dev/sda2 99G 2.6G 91G 3% /

/dev/sda3 50G 33M 50G 1% /data

/dev/sda1 1014M 133M 882M 14% /boot

tmpfs 199M 0 199M 0% /run/user/0

//10.0.0.7/share 99G 7.7G 91G 8% /mnt/wang

[root@samba-client ~]#echo "Hello wang" >/mnt/wang/wangfile.txt

7、用zhang用户挂载smb共享并访问

[root@samba-client ~]#mkdir /mnt/zhang -pv

[root@samba-client ~]#mount -o username=zhang //10.0.0.7/share /mnt/zhang

Password for zhang@//10.0.0.7/share: ******

[root@samba-client ~]#df -h

Filesystem Size Used Avail Use% Mounted on

devtmpfs 980M 0 980M 0% /dev

tmpfs 991M 0 991M 0% /dev/shm

tmpfs 991M 9.6M 981M 1% /run

tmpfs 991M 0 991M 0% /sys/fs/cgroup

/dev/sda2 99G 2.6G 91G 3% /

/dev/sda3 50G 33M 50G 1% /data

/dev/sda1 1014M 133M 882M 14% /boot

tmpfs 199M 0 199M 0% /run/user/0

//10.0.0.7/share 99G 7.7G 91G 8% /mnt/wang

//10.0.0.7/share 99G 7.7G 91G 8% /mnt/zhang

[root@samba-client ~]#touch /mnt/zhang/zhangfile.txt

三、使用rsync+inotify实现/www目录实时同步

#列出下面的文件，说明服务器内核支持inotify

[root@data ~]#ls -l /proc/sys/fs/inotify

total 0

-rw-r--r-- 1 root root 0 Mar 21 09:01 max_queued_events

-rw-r--r-- 1 root root 0 Mar 21 09:01 max_user_instances

-rw-r--r-- 1 root root 0 Mar 21 09:01 max_user_watches

[root@data ~]#cat /proc/sys/fs/inotify/max_queued_events

16384

[root@data ~]#cat /proc/sys/fs/inotify/max_user_instances

128

[root@data ~]#cat /proc/sys/fs/inotify/max_user_watches

8192

inotify 内核参数说明：

max_queued_events：inotify 事件队列最大长度，如值太小会出现 Event Queue Overflow 错误，默认值：16384, 生产环境建议调大，比如:327679

max_user_instances：每个用户创建inotify实例最大值，默认值：128

max_user_watches：可以监视的文件的总数量（inotifywait 单进程），默认值：8192，建议调大

[root@data ~]#vim /etc/sysctl.conf

fs.inotify.max_queued_events=66666

fs.inotify.max_user_watches=100000

[root@data ~]#sysctl -p

fs.inotify.max_queued_events = 66666

fs.inotify.max_user_watches = 100000

[root@data ~]#cat /proc/sys/fs/inotify/*

66666

128

100000

1、安装inotify-tools：基于epel源

[root@data ~]#yum -y install inotify-tools

[root@data ~]#rpm -ql inotify-tools

/usr/bin/inotifywait

/usr/bin/inotifywatch

/usr/lib64/libinotifytools.so.0

/usr/lib64/libinotifytools.so.0.4.1

/usr/share/doc/inotify-tools-3.14

/usr/share/doc/inotify-tools-3.14/AUTHORS

/usr/share/doc/inotify-tools-3.14/COPYING

/usr/share/doc/inotify-tools-3.14/ChangeLog

/usr/share/doc/inotify-tools-3.14/NEWS

/usr/share/doc/inotify-tools-3.14/README

/usr/share/man/man1/inotifywait.1.gz

/usr/share/man/man1/inotifywatch.1.gz

inotify-tools包主要工具：

inotifywait：在被监控的文件或目录上等待特定文件系统事件（open ，close，delete等）发生，常用于实时同步的目录监控

inotifywatch：收集被监控的文件系统使用的统计数据，指文件系统事件发生的次数统计

2、创建rsync服务器的配置文件

[root@backup ~]#rpm -q rsync

rsync-3.1.2-10.el7.x86_64

[root@backup ~]#vim /etc/rsyncd.conf

uid = root #提定以哪个用户来访问共享目录，将之指定为生成的文件所有者，默认为nobody

gid = root #默认为nobody

max connections = 0

ignore errors

log file = /var/log/rsyncd.log

pid file = /var/run/rsyncd.pid

exclude = lost+found/

lock file = /var/run/rsyncd.lock

reverse lookup = no

[backup] #每个模块名对应一个不同的path目录，如果同名后面模块生效

path = /data/backup/

comment = backup dir

read only = no #默认是yes,即只读

auth users = rsyncuser #默认anonymous可以访问rsync服务器

secrets file = /etc/rsync.pas

3、准备备份目录

[root@backup ~]#mkdir -pv /data/backup

4、生成验证文件

[root@backup ~]#echo "rsyncuser:xiaoming" > /etc/rsync.pas

[root@backup ~]#chmod 600 /etc/rsync.pas

5、启动rsyncd服务

[root@backup ~]#systemctl enable --now rsyncd

[root@backup ~]#ss -ntl

State Recv-Q Send-Q Local Address:Port Peer Address:Port

LISTEN 0 128 *:22 *:*

LISTEN 0 100 127.0.0.1:25 *:*

LISTEN 0 5 *:873 *:*

LISTEN 0 128 [::]:22 [::]:*

LISTEN 0 100 [::1]:25 [::]:*

LISTEN 0 5 [::]:873 [::]:*

6、数据服务器配置密码文件

[root@data ~]#echo "xiaoming" > /etc/rsync.pas

[root@data ~]#chmod 600 /etc/rsync.pas

7、查看远程rsync服务器的模块信息

[root@data ~]#rsync rsync://10.0.0.17

backup backup dir

8、交互式验证查看具体模块内的文件

[root@data ~]#rsync rsync://[email protected]/backup

Password:

9、非交互式查看共享目录

[root@data ~]#rsync --password-file=/etc/rsync.pas rsync://[email protected]/backup

10、客户端测试同步数据

[root@backup ~]#mkdir /data/www/

[root@data ~]#rsync -avz --delete --password-file=/etc/rsync.pas [email protected]::backup /data/www/

[root@data ~]#ll /data/

total 0

drwxr-xr-x 2 root root 6 Mar 21 10:26 www

[root@backup ~]#touch /data/www/a.txt

[root@data ~]#rsync -avz --delete --password-file=/etc/rsync.pas [email protected]::backup /data/www/a.txt

[root@data ~]#ll /data/www/

total 0

drwxr-xr-x 2 root root 6 Mar 21 10:26 a.txt

[root@backup ~]#touch /data/www/test.txt

[root@data ~]#rsync -avz --delete --password-file=/etc/rsync.pas [email protected]::backup /data/www/test.txt

[root@data ~]#ll /data/www/

total 0

drwxr-xr-x 2 root root 6 Mar 21 10:26 a.txt

drwxr-xr-x 2 root root 6 Mar 21 10:26 test.txt

11、shell 脚本实现实时数据同步

注意: 此脚本执行前先确保两主机初始数据处于同步状态，此脚本实现后续的数据同步

#数据服务器上创建inotify_rsync.sh脚本

[root@data ~]#vim inotify_rsync.sh

#!/bin/bash

SRC='/data/www/' #注意最后的/

DEST='[email protected]::backup'

rpm -q rsync &> /dev/null || yum -y install rsync

inotifywait -mrq --exclude=".*\.swp" --timefmt '%Y-%m-%d %H:%M:%S' --format '%T %w %f' -e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE TIME DIR FILE;do

FILEPATH=${DIR}${FILE}

rsync -az --delete --password-file=/etc/rsync.pas $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log

done

[root@data ~]#bash -n inotify_rsync.sh

[root@data ~]#ls /data/www/

a.txt test.txt

[root@data ~]#cd /data/www/

[root@data www]#ls

a.txt test.txt

[root@data www]#rm -rf *.txt

[root@data www]#touch b.txt

[root@data www]#touch a.txt

[root@data www]#ls

a.txt b.txt

[root@data www]#dd if=/dev/zero of=f1.img bs=1M count=1000

1000+0 records in

1000+0 records out

1048576000 bytes (1.0 GB) copied, 65.0319 s, 16.1 MB/s

[root@data www]#ll f1.img

-rw-r--r-- 1 root root 1048576000 Mar 21 12:42 f1.img

[root@data www]#chown chen f1.img

[root@data www]#ll f1.img

-rw-r--r-- 1 chen root 1048576000 Mar 21 12:42 f1.img

[root@data www]#mv f1.img f2.img

[root@data www]#ll f2.img

-rw-r--r-- 1 chen root 1048576000 Mar 21 12:42 f2.img

[root@backup ~]#watch -n0.5 ls -l /data/backup/

Every 0.5s: ls -l /data/backup/ Mon Mar 21 12:53:42 2022

total 1024000

-rw-r--r-- 1 root root 0 Mar 21 12:32 a.txt

-rw-r--r-- 1 root root 0 Mar 21 12:31 b.txt

-rw-r--r-- 1 chen root 1048576000 Mar 21 12:42 f2.img

#查看文件传输日志

[root@data www]#tail -f /var/log/changelist.log

At 12:31:59 on 2022-03-21, file /data/www/b.txt was backuped up via rsync

At 12:31:59 on 2022-03-21, file /data/www/b.txt was backuped up via rsync

At 12:31:59 on 2022-03-21, file /data/www/b.txt was backuped up via rsync

At 12:32:52 on 2022-03-21, file /data/www/a.txt was backuped up via rsync

At 12:32:52 on 2022-03-21, file /data/www/a.txt was backuped up via rsync

At 12:32:52 on 2022-03-21, file /data/www/a.txt was backuped up via rsync

At 12:41:19 on 2022-03-21, file /data/www/f1.img was backuped up via rsync

At 12:42:24 on 2022-03-21, file /data/www/f1.img was backuped up via rsync

At 12:48:39 on 2022-03-21, file /data/www/f1.img was backuped up via rsync

At 12:51:24 on 2022-03-21, file /data/www/f2.img was backuped up via rsync

四、LVS调度算法总结

LVS调度算法总结

ipvs scheduler：根据其调度时是否考虑各RS当前的负载状态

分为两种：静态方法和动态方法

静态方法

仅根据算法本身进行调度

1、RR：Round Robin，轮询，较常用

2、WRR：Weighted RR，加权轮询，较常用

3、SH：Source Hashing，源地址散列调度算法，实现session sticky，源IP地址hash；将来自于同一个IP地址的请求始终发往第一次挑中的RS，从而实现会话绑定

4、DH：Destination Hashing，目标地址散列调度算法，目标地址哈希，第一次轮询调度至RS，后续将发往同一个目标地址的请求始终转发至第一次挑中的RS，典型使用场景是正向代理缓存场景中的负载均衡，如：Web缓存

动态方法

主要根据每RS当前的负载状态及调度算法进行调度Overhead=value 较小的RS将被调度

1、LC：least connections，最少连接，适用于长连接应用

Overhead=activeconns*256+inactiveconns

2、WLC：Weighted LC，加权最少连接，默认调度方法，较常用

Overhead=(activeconns*256+inactiveconns)/weight

3、SED：Shortest Expection Delay，最短延迟调度，初始连接高权重优先，只检查活动连接，而不考虑非活动连接

Overhead=(activeconns+1)*256/weight

4、NQ：Never Queue，永不排队调度，第一轮均匀分配，后续SED

5、LBLC：Locality-Based LC，基于局部性的最少链接，动态的DH算法，使用场景：根据负载状态实现正向代理，实现Web Cache等

6、LBLCR：LBLC with Replication，带复制的基于局部性最少连接，带复制功能的LBLC，解决LBLC负载不均衡问题，从负载重的复制到负载轻的RS，实现Web Cache等

内核版本 4.15 版本后新增调度算法：FO和OVF

FO（Weighted Fail Over）调度算法，加权故障转移，在此FO算法中，遍历虚拟服务所关联的真实服务器链表，找到还未过载（未设置IP_VS_DEST_F_OVERLOAD标志）的且权重最高的真实服务器，进行调度，属于静态算法

OVF（Overflow-connection）调度算法，溢出连接，基于真实服务器的活动连接数量和权重值实现。将新连接调度到权重值最高的真实服务器，直到其活动连接数量超过权重值，之后调度到下一个权重值最高的真实服务器，在此OVF算法中，遍历虚拟服务相关联的真实服务器链表，找到权重值最高的可用真实服务器。属于动态算法

一个可用的真实服务器需要同时满足以下条件：

未过载（未设置IP_VS_DEST_F_OVERLOAD标志）

真实服务器当前的活动连接数量小于其权重值

其权重值不为零

五、LVS的跨网络DR实现

环境：五台主机

一台：客户端 eth0：仅主机 192.168.10.6/24 GW：192.168.10.200

一台：ROUTER

eth0：NAT 10.0.0.200/24

eth0:1 172.16.0.200/24

eth1：仅主机 192.168.10.200/24

启用 IP_FORWARD

一台：LVS

eth0：NAT：DIP：10.0.0.8/24 GW：10.0.0.200

lo：VIP：172.16.0.100/32

两台RS：

RS1：eth0：NAT：10.0.0.7/24 GW：10.0.0.200

lo：VIP：172.16.0.100/32

RS2：eth0：NAT：10.0.0.17/24 GW：10.0.0.200

lo：VIP：172.16.0.100/32

1、客户端

[root@internet ~]#hostname -I

192.168.10.6

[root@internet ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

NAME="eth0"

DEVICE="eth0"

BOOTPROTO="static"

IPADDR="192.168.10.6"

PREFIX="24"

DNS1="223.5.5.5"

DNS2="180.76.76.76"

GATEWAY="192.168.10.200"

ONBOOT="yes"

[root@internet ~]#route -n

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

0.0.0.0 192.168.10.200 0.0.0.0 UG 100 0 0 eth0

192.168.10.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0

[root@internet ~]#ping 192.168.10.200 -c1

PING 192.168.10.200 (192.168.10.200) 56(84) bytes of data.

64 bytes from 192.168.10.200: icmp_seq=1 ttl=64 time=2.30 ms

2、路由器

[root@router ~]#echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

[root@router ~]#sysctl -p

net.ipv4.ip_forward = 1

[root@router ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

NAME="eth0"

DEVICE="eth0"

BOOTPROTO="static"

IPADDR="10.0.0.200"

PREFIX="24"

ONBOOT="yes"

[root@router ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth1

NAME="eth1"

DEVICE="eth1"

BOOTPROTO="static"

IPADDR="192.168.10.200"

PREFIX="24"

ONBOOT="yes"

[root@router ~]#ip a a 172.16.0.200/24 dev eth0 label eth0:1

[root@router ~]#ip a

1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

valid_lft forever preferred_lft forever

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

link/ether 00:50:56:21:52:92 brd ff:ff:ff:ff:ff:ff

inet 10.0.0.200/24 brd 10.0.0.255 scope global noprefixroute eth0

valid_lft forever preferred_lft forever

inet 172.16.0.200/24 scope global eth0:1

valid_lft forever preferred_lft forever

inet6 fe80::250:56ff:fe21:5292/64 scope link

valid_lft forever preferred_lft forever

3: eth1: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

link/ether 00:0c:29:68:dc:18 brd ff:ff:ff:ff:ff:ff

inet 192.168.10.200/24 brd 192.168.10.255 scope global noprefixroute eth1

valid_lft forever preferred_lft forever

inet6 fe80::20c:29ff:fe68:dc18/64 scope link

valid_lft forever preferred_lft forever

[root@router ~]#hostname -I

10.0.0.200 172.16.0.200 192.168.10.200

[root@router ~]#route -n

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

10.0.0.0 0.0.0.0 255.255.255.0 U 102 0 0 eth0

172.16.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

192.168.10.0 0.0.0.0 255.255.255.0 U 103 0 0 eth1

[root@router ~]#arp -n

Address HWtype HWaddress Flags Mask Iface

10.0.0.8 ether 00:50:56:3b:17:bf C eth0

172.16.0.100 ether 00:50:56:3b:17:bf C eth0

10.0.0.17 ether 00:50:56:3d:cb:17 C eth0

192.168.10.6 ether 00:50:56:32:62:97 C eth1

10.0.0.7 ether 00:0c:29:33:b7:af C eth0

10.0.0.1 ether 00:50:56:c0:00:08 C eth0

3.LVS

[root@lvs ~]#hostname -I

10.0.0.8

[root@lvs ~]#route -n

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

0.0.0.0 10.0.0.200 0.0.0.0 UG 100 0 0 eth0

10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0

[root@lvs ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

NAME="eth0"

DEVICE="eth0"

BOOTPROTO="static"

IPADDR="10.0.0.8"

PREFIX="24"

GATEWAY="10.0.0.200"

ONBOOT="yes"

[root@lvs ~]#curl 10.0.0.17

10.0.0.17

[root@lvs ~]#curl 10.0.0.7

10.0.0.7

#在LVS主机运行的脚本

#注意:VIP如果配置在LO网卡上,必须使用32bit子网掩码

#如果VIP绑定在eth0上,可以使用其它netmask

[root@lvs ~]#cat lvs_dr_vs.sh

#!/bin/bash

vip='172.16.0.100'

iface='lo:1'

mask='255.255.255.255'

port='80'

rs1='10.0.0.7'

rs2='10.0.0.17'

scheduler='wrr'

type='-g'

rpm -q ipvsadm &> /dev/null || yum -y install ipvsadm &> /dev/null

case $1 in

start)

ifconfig $iface $vip netmask $mask #broadcast $vip up

iptables -F

ipvsadm -A -t ${vip}:${port} -s $scheduler

ipvsadm -a -t ${vip}:${port} -r ${rs1} $type -w 1

ipvsadm -a -t ${vip}:${port} -r ${rs2} $type -w 1

echo "The VS Server is Ready!"

;;

stop)

ipvsadm -C

ifconfig $iface down

echo "The VS Server is Canceled!"

;;

*)

echo "Usage: $(basename $0) start|stop"

exit 1

;;

esac

[root@lvs ~]#bash -n lvs_dr_vs.sh

[root@lvs ~]#bash lvs_dr_vs.sh start

The VS Server is Ready!

[root@lvs ~]#ip a

1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

valid_lft forever preferred_lft forever

inet 172.16.0.100/32 scope global lo:1

valid_lft forever preferred_lft forever

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

link/ether 00:50:56:3b:17:bf brd ff:ff:ff:ff:ff:ff

inet 10.0.0.8/24 brd 10.0.0.255 scope global noprefixroute eth0

valid_lft forever preferred_lft forever

inet6 fe80::250:56ff:fe3b:17bf/64 scope link

valid_lft forever preferred_lft forever

[root@lvs ~]#ipvsadm -Ln

IP Virtual Server version 1.2.1 (size=4096)

Prot LocalAddress:Port Scheduler Flags

-> RemoteAddress:Port Forward Weight ActiveConn InActConn

TCP 172.16.0.100:80 wrr

-> 10.0.0.7:80 Route 1 0 0

-> 10.0.0.17:80 Route 1 0 0

4、RS1

[root@rs1 ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

NAME="eth0"

DEVICE="eth0"

BOOTPROTO="static"

IPADDR="10.0.0.7"

PREFIX="24"

GATEWAY="10.0.0.200"

ONBOOT="yes"

[root@rs1 ~]#hostname -I

10.0.0.7

[root@rs1 ~]#route -n

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

0.0.0.0 10.0.0.200 0.0.0.0 UG 100 0 0 eth0

10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0

[root@rs1 ~]#yum -y install httpd

[root@rs1 ~]#systemctl enable --now httpd

[root@rs1 ~]#hostname -I > /var/www/html/index.html

[root@rs1 ~]#curl 10.0.0.7

10.0.0.7

[root@rs1 ~]#cat lvs_dr_rs.sh

#!/bin/bash

vip=172.16.0.100

mask='255.255.255.255'

dev=lo:1

case $1 in

start)

echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore

echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore

echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce

echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce

ifconfig $dev $vip netmask $mask

echo "The RS Server is Ready!"

;;

stop)

ifconfig $dev down

echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore

echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore

echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce

echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce

echo "The RS Server is Canceled!"

;;

*)

echo "Usage: $(basename $0) start|stop"

exit 1

;;

esac

[root@rs1 ~]#bash -n lvs_dr_rs.sh

[root@rs1 ~]#bash lvs_dr_rs.sh start

The RS Server is Ready!

[root@rs1 ~]#ip a

1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

valid_lft forever preferred_lft forever

inet 172.16.0.100/32 scope global lo:1

valid_lft forever preferred_lft forever

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

link/ether 00:0c:29:33:b7:af brd ff:ff:ff:ff:ff:ff

inet 10.0.0.7/24 brd 10.0.0.255 scope global noprefixroute eth0

valid_lft forever preferred_lft forever

inet6 fe80::20c:29ff:fe33:b7af/64 scope link

valid_lft forever preferred_lft forever

[root@rs1 ~]#scp lvs_dr_rs.sh 10.0.0.17:

5、RS2

[root@rs2 ~]#hostname -I

10.0.0.17

[root@rs2 ~]#route -n

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

0.0.0.0 10.0.0.200 0.0.0.0 UG 100 0 0 eth0

10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0

[root@rs2 ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

NAME="eth0"

DEVICE="eth0"

BOOTPROTO="static"

IPADDR="10.0.0.17"

PREFIX="24"

GATEWAY="10.0.0.200"

ONBOOT="yes"

[root@rs2 ~]#yum -y install httpd

[root@rs2 ~]#systemctl enable --now httpd

[root@rs2 ~]#hostname -I > /var/www/html/index.html

[root@rs2 ~]#curl 10.0.0.17

10.0.0.17

[root@rs2 ~]#bash lvs_dr_rs.sh start

[root@rs2 ~]#ip a

1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

valid_lft forever preferred_lft forever

inet 172.16.0.100/32 scope global lo:1

valid_lft forever preferred_lft forever

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

link/ether 00:50:56:3d:cb:17 brd ff:ff:ff:ff:ff:ff

inet 10.0.0.17/24 brd 10.0.0.255 scope global noprefixroute eth0

valid_lft forever preferred_lft forever

inet6 fe80::250:56ff:fe3d:cb17/64 scope link

valid_lft forever preferred_lft forever

[root@rs2 ~]#cat /proc/sys/net/ipv4/conf/all/arp_ignore

1

[root@rs2 ~]#cat /proc/sys/net/ipv4/conf/all/arp_announce

2

6、测试访问

[root@internet ~]#curl 172.16.0.100

10.0.0.17

[root@internet ~]#curl 172.16.0.100

10.0.0.7

[root@internet ~]#curl 172.16.0.100

10.0.0.17

[root@internet ~]#curl 172.16.0.100

10.0.0.7