# 练习题：分别使用httpd-2.2和httpd-2.4实现：
## 1、建立httpd服务，要求：
### （1）提供两个基于名称的虚拟主机：
#### www1.stux.com,页面文件目录为/web/vhosts/www1;错误日志为/var/log/httpd/www1/error_log,访问日志为/var/log/httpd/www1/access_log;
#### www2.stux.com,页面文件目录为/web/vhosts/www2;错误日志为/var/log/httpd/www2/error_log,访问日志为/var/log/httpd/www2/access_log;
### (2)通过www1.stux.com/server-status输出其状态信息，且要求只允许提供账号的用户访问；
### （3）www1不允许IP为192.168.10.20的主机访问；
## 2、为上面的第2个虚拟主机提供https服务，使得用户可以通过https安全的访问此web站点；
### （1）要求使用证书认证，证书中要求使用国家（CN），州（Beijing）,城市（Beijing）,组织为（MagEdu）;
### （2）设置部门为Ops,主机名为www2.stux.com;
httpd2.4配置：
第一步：提供三台服务器，一台为IP192.168.10.30作为测试机，一台IP为192.168.10.20作为httpd、DNS服务端，IP192.168.10.100作为CA机构
安装并启动httpd-2.4服务，关闭防火墙，防止端口被阻断
# yum -y install httpd
# systemctl start httpd
# systemctl enable httpd
# systemctl stop firewalld
创建目录及文件
# mkdir -p /web/vhosts/www1/
# mkdir -p /web/vhosts/www2/
# cd /var/log/httpd/
# mkdir {www1,www2}
# cd www1
# touch {error_log,access_log}
# cd ../www2
# touch {error_log,access_log}
分别创建两个测试网页页面/web/vhosts/www1/index.html和/web/vhosts/www2/index.html
# vim /web/vhosts/www1/index.html
www1.stux.com
# vim /web/vhosts/www2/index.html
www2.stux.com
创建用于httpd访问认证的用户账号密码文件
# htpasswd -bc /tmp/passwd text1 text1 创建一个文件，并且添加用户名为text1 密码为text1,默认为MD5加密
# htpasswd -b /tmp/passwd text2 text2 添加用户名text2,密码text2,MD5加密
# htpasswd -b /tmp/passwd text3 text3 添加用户名text3,密码text3，MD5加密
# cat /tmp/passwd
text1:$apr1$.n8kyAbr$HhkgNOBOnYSl4lVLsODmn.
text2:$apr1$WYHzv6AL$dTkFbeWaP3XMn6kaUvb0e1
text3:$apr1$NY3FzbAQ$.OsmtKj.4v2fbgGTzC64r.
在主配置文件中/etc/httpd/conf/httpd.conf中确保第56行Include conf.modules.d/*.conf和最后一行IncludeOptional conf.d/*.conf前面的#去掉，目的是让主配置文件内容包含这两个路径下的内容，以免与模块化修改配置文件；将第95行的 #ServerName www.example.com:80的#号注释掉或者直接修改为“ServerName 主机名:端口”，目的是确保httpd -t配置检查不报错。
# vim /etc/httpd/conf/httpd.conf
注意：需要关闭SELinux，否则只能访问默认页面：
# setenforce 0
# getenforce
Permissive
在/etc/httpd/conf.d/目录下创建vhosts.conf文件为www1的配置文件；完成一下要求：
#### www1.stux.com,页面文件目录为/web/vhosts/www1;错误日志为/var/log/httpd/www1/error_log,访问日志为/var/log/httpd/www1/access_log;
### (2)通过www1.stux.com/server-status输出其状态信息，且要求只允许提供账号的用户访问；
（3）www1不允许IP为192.168.10.30的主机访问；
# vim /etc/httpd/conf.d/vhosts.conf
ServerName www1.stux.com
DocumentRoot "/web/vhosts/www1/"
Options None
AllowOverride None
Require all granted
Require not ip 192.168.10.30
CustomLog "/var/log/httpd/www1/access_log" combined
ErrorLog "/var/log/httpd/www1/error_log"
SetHandler server-status
AuthType Basic
AuthName "please input passwd"
AuthUserFile "/etc/httpd/conf.d/.htpasswd"
Require valid-user
在/etc/httpd/conf.d/目录下创建vhosts2.conf文件为www1的配置文件；完成一下要求：
#### www2.stux.com,页面文件目录为/web/vhosts/www2;错误日志为/var/log/httpd/www2/error_log,访问日志为/var/log/httpd/www2/access_log;
# vim /etc/httpd/conf.d/vhosts2.conf
ServerName www2.stux.com
DocumentRoot "/web/vhosts/www2/"
Options None
AllowOverride None
Require all granted
CustomLog "/var/log/httpd/www2/access_log" combined
ErrorLog "/var/log/httpd/www2/error_log"
安装并配置DNS服务（这里为了省事直接用httpd服务所在的服务器做DNS服务），并将http客户端的DNS指向对应地址
# yum -y install bind
# systemctl start named
# systemctl enable named
# vim /etc/named.rfc1912.zones
zone "stux.com" IN {
type master;
file "stux.com.zone";
};
修改/etc/named.conf中监听的端口
options {
listen-on port 53 { any;}; 修改为any
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; }; 修改为any
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable no; 测试时建议修改为no
dnssec-validation no; 测试时建议修改为no
/* Path to ISC DLV key */
bindkeys-file "/etc/named.root.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
建立并编辑区域数据文件，用于正向解析stux.com域中的域名
# vim /var/named/stux.com.zone
$TTL 3600
$ORIGIN stux.com.
@ IN SOA ns1.stux.com. dnsadmin.stux.com. (
2019122001
1H
10M
3D
1D )
IN NS ns1
IN MX 10 mx1
ns1 IN A 192.168.10.20
mx1 IN A 192.168.10.20
www1 IN A 192.168.10.20
www2 IN A 192.168.10.20
配置完后做语法检查
named-checkzone stux.com /var/named/stux.com.zone
named-checkconf
权限及属组修改
chgrp named /var/named/stux.com.zone
chmod o= /var/named/stux.com.zone
让服务器重载配置文件和区域数据文件
rndc reload
在CA服务器192.168.10.100上私建CA服务器，生成私钥
# cd /etc/pki/CA/
# (umask 077; openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 4096 bit long modulus
...++
.++
e is 65537 (0x10001)
# ll private/cakey.pem
-rw-------. 1 root root 3247 Dec 23 01:03 private/cakey.pem
生成自签证书
# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:MageEdu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:
为CA提供所需的目录及文件（根据实际情况选择是否要手动创建）
# mkdir - pv /etc/pki/CA/{certs,crl,newcerts}
# touch index.txt serial
# echo 01 > /etc/pki/CA/serial
要用到证书进行安全通信的服务器，需要向CA请求签署证书
用到证书的主机生成私钥：以httpd服务器自己访问为例
# mkdir /etc/httpd/ssl/
# cd /etc/httpd/ssl/
# (umask 007; openssl genrsa -out httpd_key.pem 1024)
Generating RSA private key, 2048 bit long modulus
........................................+++
..+++
e is 65537 (0x10001)
# ll
total 4
-rw-rw----. 1 root root 1679 Dec 16 18:17 httpd_key.pem
# chmod 600 httpd_key.pem 确保权限为400或600，安全
生成证书签署请求
# openssl req -new -key httpd_key.pem -out httpd_csr.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:MageEdu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www2.stux.com 这里的主机名需要与键入浏览器的地址一致
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# ll
total 8
-rw-r--r--. 1 root root 1005 Dec 16 18:26 httpd_crt.pem
-rw-------. 1 root root 1679 Dec 16 18:17 httpd_key.pem
将请求发给CA主机
# scp httpd_csr.pem [email protected]:/tmp
The authenticity of host '192.168.10.100 (192.168.10.100)' can't be established.
ECDSA key fingerprint is SHA256:Ss9puEjAq4gLKA1kXy7EC/WoHUwQvSoc+Kvfb9LsMEE.
ECDSA key fingerprint is MD5:24:68:b3:56:47:64:b1:1a:f5:f3:74:5a:7b:8b:0a:89.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.100' (ECDSA) to the list of known hosts.
[email protected]'s password:
httpd_csr.pem 100% 1005 1.0MB/s 00:00
在CA主机上签署证书
# openssl ca -in /tmp/httpd_csr.pem -out /etc/pki/CA/certs/httpd_crt.pem
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Dec 23 06:39:57 2019 GMT
Not After : Dec 22 06:39:57 2020 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = MageEdu
organizationalUnitName = Ops
commonName = www2.stux.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
24:61:06:4D:F9:47:F6:BA:06:2B:87:AC:FF:AC:E9:BE:1B:4D:61:4F
X509v3 Authority Key Identifier:
keyid:A2:16:B8:0A:86:A9:16:73:7A:20:98:BC:01:35:0E:6A:03:2C:E1:87
Certificate is to be certified until Dec 22 06:39:57 2020 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
# ll certs/
total 8
-rw-r--r--. 1 root root 5717 Dec 23 01:40 httpd_crt.pem
CA主机将签好的证书发送给客户端：
# scp certs/httpd_crt.pem [email protected]:/etc/httpd/ssl
The authenticity of host '192.168.10.20 (192.168.10.20)' can't be established.
ECDSA key fingerprint is e2:d4:22:10:8a:be:88:8f:83:d9:a8:a6:37:4b:2c:82.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.20' (ECDSA) to the list of known hosts.
[email protected]'s password:
httpd_crt.pem 100% 5717 5.6KB/s 00:00
在httpd服务器配置http工作在https，查看是否有mod_ssl模块
# httpd -M | grep ssl
# yum -y install mod_ssl
# httpd -M | grep ssl
ssl_module (shared)
编辑mod_ssl对应的配置模块
# vim /etc/httpd/conf.d/ssl.conf
对应的证书修改为httpd服务器上的已经经过CA验证的证书以及私钥路径
修改对应需要通过https访问的域名和网页路径
登陆测试机192.168.10.30，将CA的证书复制测试机
# scp [email protected]:/etc/pki/CA/cacert.pem /tmp
在测试机192.168.10.30测试：
# openssl s_client -connect www2.stux.com:443 -CAfile /tmp/cacert.pem
结果