基于安全与优化的LNMP

基于安全与优化的LNMP

一系统安装

为了安全，减少系统漏洞，所以最小化安装系统

二搭建LNMP环境

1安装nginx

需要的软件包：

libtool-ltdl-devel

libjpeg-devel

libpng-devel

libtiff-devel

fontconfig-devel

freetype-devel

libXpm-devel

gettext-devel

openldap-servers

openssl-devel

libX11-devel

libgcj

libXau-devel

libXdmcp-devel

xorg-x11-proto-devel

mesa-libGL-devel

安装pcre-8.10

[root@serverlnmp]#tar zxvf pcre-8.10.tar.bz2

[root@serverlnmp]#cd pcre-8.10

[root@serverlnmp]#./configure && make && make install

安装nginx

[root@serverlnmp]#useradd nginx

[root@serverlnmp]# tar xf nginx-0.8.46.tar.gz

[root@serverlnmp]# cd nginx-0.8.46

[[email protected]]# ./configure \

--user=nginx\

--group=nginx\

--prefix=/usr/local/nginx/\

--with-http_stub_status_module\

--with-http_ssl_module

[[email protected]]# make && make install

2编译安装mysql

[root@serverlnmp]# tar xf mysql-5.1.49.tar.gz

[root@serverlnmp]# cd mysql-5.1.49

[[email protected]]# ./configure \

"--prefix=/usr/local/mysql"\

"--localstatedir=/var/lib/mysql/"\

"--enable-assembler"\

"--with-extra-charsets=all"\

"--enable-thread-safe-client"\

"--with-client-ldflags=-all-static"\

"--with-mysqld-ldflags=-all-static"\

"--without-debug"\

"--with-big-tables"\

"--without-debug"\

"--with-ssl"

[[email protected]]# make && make install

[[email protected]]# useradd mysql

[[email protected]]# /usr/local/mysql/bin/mysql_install_db --user=mysql

[root@server~]# cd /usr/local/mysql

[root@servermysql]# chown -R root:mysql .

[root@servermysql]# chown mysql. /var/lib/mysql -R

[root@servermysql]# cp share/mysql/my-huge.cnf /etc/my.cnf

[root@servermysql]# cp share/mysql/mysql.server /etc/init.d/mysqld

[root@servermysql]# chmod 755 /etc/init.d/mysqld

[root@servermysql]# chkconfig --add mysqld

[root@servermysql]# service mysqld start

[root@servermysql]# echo 'export PATH=$PATH:/usr/local/mysql/bin' >>~/.bashrc

[root@servermysql]# . ~/.bashrc

mysql安装配置完成之后，可以根据实际情况，对mysql做下优化。

3.编译安装php

需要用到的包：

libiconv

libmcrypt

libltdl

mhash

spawn-fcgi

libevent

[[email protected]]# ./configure --prefix=/usr

[[email protected]]# make && make install

编译安装libmcrypt：

[[email protected]]# ./configure --prefix=/usr

[[email protected]]# make && make install

编译安装mhash：

[[email protected]]# ./configure --prefix=/usr/local/mhash

[[email protected]]# make && make install

编译安装spawn-fcgi:

[[email protected]]# ./configure

[[email protected]]# make && make install

编译安装ibevent:

[[email protected]]# ./configure --prefix=/usr

[[email protected]]# make && make install

编译安装php：

[[email protected]]# ./configure \

"--prefix=/usr/local/php"\

"--enable-fastcgi"\

"--enable-fpm"\

"--enable-discard-path"\

"--enable-force-cgi-redirect"\

"--with-config-file-path=/usr/local/php/etc"\

"--with-mysql=/usr/local/mysql"\

"--with-mysqli=/usr/local/mysql/bin/mysql_config"\

"--with-iconv-dir=/usr"\

"--with-freetype-dir"\

"--with-jpeg-dir"\

"--with-png-dir"\

"--with-gd"\

"--with-zlib"\

"--with-libxml-dir"\

"--with-curl"\

"--with-curlwrappers"\

"--with-openssl"\

--with-mhash=/usr/local/mhash/\

"--with-xmlrpc"\

"--with-mcrypt"\

"--with-ldap"\

"--with-ldap-sasl"\

"--enable-xml"\

"--disable-rpath"\

"--enable-discard-path"\

"--enable-safe-mode"\

"--enable-bcmath"\

"--enable-shmop"\

"--enable-sysvsem"\

"--enable-inline-optimization"\

"--enable-mbregex"\

"--enable-mbstring"\

"--enable-gd-native-ttf"\

"--enable-ftp"\

"--enable-pcntl"\

"--enable-sockets"\

"--enable-zip"\

"--disable-debug"\

"--disable-ipv6"

[[email protected]]# make ZEND_EXTRA_LIBS='-liconv'

[[email protected]]# make install

[[email protected]]# cp php.ini-dist /usr/local/php/etc/php.ini

其中"--enable-discard-path"打开这个选项，用户就不能透过浏览器读取.htaccess等和系统安全相关的文件。

"--enable-force-cgi-redirect"若使用CGI VERSION 模式来执行PHP 的设，打开

本选项会增加安全性。

例如用户读http://my.host/cgi-bin/php/secret/doc.html遇到比较了解PHP 系统的黑客级用户可能会自已输入以下网址http://my.host/secret/doc.html来读取相关信息。若PHP 和Apache 编译在一起，让PHP 变成Apache 的一部份，则不需要加入本选项。

"--disable-rpath"rpath 是和动态库的加载运行相关。

"--enable-bcmath"高精度数学运算组件。

"--enable-shmop"和"--enable-sysvsem"使得你的PHP系统可以处理相关的IPC

函数。IPC是一个Unix标准通讯机制，它提供了使得在同一台主机不同进程之间可以互相通讯的方法。

"--enable-inline-optimization"栈堆指针和优化线程。

"--enable-pcntl"多线程优化。

安装Zend Optimizer

# tar xzvfZendOptimizer-3.2.8-linux-glibc21-i386.tar.gz

#./ZendOptimizer-3.2.8-linux-glibc21-i386/install.sh

安装php扩展插件

需要安装如下扩展：

memcache

eaccelerator

PDO_MYSQL

ImageMagick

memcache是一个高性能的分布式的内存对象缓存系统，通过在内存里维护一个统一的巨大的hash表，它能够用来存储各种格式的数据，包括图像、视频、文件以及数据库检索的结果等。

eAccelerator加速引擎是基于mmcache开发的PHP加速优化软件。通过编译和缓存来增加PHP脚本的性能，使得PHP脚本在编译的状态下降低服务器负载，对服务器的开销几乎完全消除。它还对脚本起优化作用，能加快其执行效率，提高PHP应用执行速度最高达10倍。

PDO_MYSQL是一个php的扩展模块。

ImageMagick是一个用于查看、编辑位图文件以及进行图像格式转换的开放源代码软件套装。

编译安装memcache:

[root@servertmp]# tar -zxf memcache-3.0.4.tgz

[root@servertmp]# cd memcache-3.0.4

[[email protected]]# /usr/local/php/bin/phpize

[[email protected]]#./configure--with-php-config=/usr/local/php/bin/phpconfig

[[email protected]]# make && make install

编译安装eaccelerator:

[[email protected]]# /usr/local/php/bin/phpize

[[email protected]]# ./configure --enable-eaccelerator=shared--withphp-

config=/usr/local/php/bin/php-config

[[email protected]]# make && make install

编译安装PDO_MYSQL:

[root@serverPDO_MYSQL-1.0.2]# /usr/local/php/bin/phpize

[root@serverPDO_MYSQL-1.0.2]# ./configure --prefix=/usr/local/pdo-mysql--with-phpconfig=/

usr/local/php/bin/php-config--with-pdo-mysql=/usr/local/mysql

[root@serverPDO_MYSQL-1.0.2]# make && make install

编译安装ImageMagick:

[[email protected]]# ./configure \

--enable-shared\

--with-modules\

--without-x\

--with-gs-font-dir=default\

--with-perl=yes\

--with-zlib=yes\

--with-jpeg=yes

[[email protected]]# make && make install

编译安装imagick:

[[email protected]]# /usr/local/php/bin/phpize

[[email protected]]# ./configure--with-php-config=/usr/local/php/bin/phpconfig

--with-imagick=/usr/local/imagemagick/

[[email protected]]# make && make install

使PHP扩展生效

修改php主配置文件，以使php支持扩展插件

[root@server~]# cat >> /usr/local/php/etc/php.ini << ENDF

[eAccelerator]

zend_extension="/usr/local/php/lib/php/extensions/no-debug-non-zts-

20060613/eaccelerator.so"

eaccelerator.shm_size="32"

eaccelerator.cache_dir="/usr/local/cache/ea"

eaccelerator.enable="1"

eaccelerator.optimizer="1"

eaccelerator.check_mtime="1"

eaccelerator.debug="0"

eaccelerator.filter=""

eaccelerator.shm_max="0"

eaccelerator.shm_ttl="0"

eaccelerator.shm_prune_period="0"

eaccelerator.shm_only="0"

eaccelerator.compress="1"

eaccelerator.compress_level="9"

ENDF

[root@server~]# mkdir -p /usr/local/cache/ea

[root@server~]# vi /usr/local/php/etc/php.ini

将

expose_php= On

改为

expose_php= Off

找到

extension_dir

改为

extension_dir= "/usr/local/php/lib/php/extensions/no-debug-non-zts-20060613/"

并在其下面追加三行内容

extension= "memcache.so"

extension= "pdo_mysql.so"

extension= "imagick.so"

将

output_buffering= Off

改为

output_buffering= On

整合Nginx与php

在http{} 全局配置部分加入如下内容:

http

{

...

fastcgi_connect_timeout300;

fastcgi_send_timeout300;

fastcgi_read_timeout300;

fastcgi_buffer_size128k;

fastcgi_buffers4 128k;

fastcgi_busy_buffers_size128k;

fastcgi_temp_file_write_size128k;

fastcgi_intercept_errorson;

proxy_temp_path/dev/shm/proxy_temp;

fastcgi_temp_path/dev/shm/fastcgi_temp;

client_body_temp_path/dev/shm/client_body_temp;

#spawn-fcgi开启9000跟9001两个端口，利用nginx的upstream负载均衡php程序到不同的

fcgi端口上面

upstreamspawn {

server127.0.0.1:9000 max_fails=0 fail_timeout=30s;

server127.0.0.1:9001 max_fails=0 fail_timeout=30s;

}

...

}

修改监听８０端口的虚拟主机"location ~ \.php { ...}" 的配置

server

{

....

location ~\.php$ {

root html;

#fastcgi_pass 127.0.0.1:9000;

fastcgi_passspawn;

fastcgi_indexindex.php;

fastcgi_paramSCRIPT_FILENAME /scripts$fastcgi_script_name;

# includefastcgi_params;

includespawn_php5.conf;

}

...

}

创建spawn_php5.conf

[root@server~]# vi /usr/local/nginx/conf/spawn_php5.conf

fastcgi_paramGATEWAY_INTERFACE CGI/1.1;

fastcgi_paramSERVER_SOFTWARE nginx;

fastcgi_paramQUERY_STRING $query_string;

fastcgi_paramREQUEST_METHOD $request_method;

fastcgi_paramCONTENT_TYPE $content_type;

fastcgi_paramCONTENT_LENGTH $content_length;

fastcgi_paramSCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_paramSCRIPT_NAME $fastcgi_script_name;

fastcgi_paramREQUEST_URI $request_uri;

fastcgi_paramDOCUMENT_URI $document_uri;

fastcgi_paramDOCUMENT_ROOT $document_root;

fastcgi_paramSERVER_PROTOCOL $server_protocol;

fastcgi_paramREMOTE_ADDR $remote_addr;

fastcgi_paramREMOTE_PORT $remote_port;

fastcgi_paramSERVER_ADDR $server_addr;

fastcgi_paramSERVER_PORT $server_port;

fastcgi_paramSERVER_NAME $server_name;

配置spawn-fcgi启动脚本

[root@server~]# vi /usr/local/php/sbin/spawn-fcgi

#! /bin/sh

set -e

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

DESC="spawn-fcgidaemon"

NAME=spawn-fcgi

DAEMON=/usr/local/bin/$NAME

#Gracefully exit if the package has been removed.

test -x$DAEMON || exit 0

d_start(){

$DAEMON -a127.0.0.1 -p 9000 -C 128 -u nginx -g nginx -f/usr/local/php/bin/php-cgi

>/dev/null 2>&1

$DAEMON -a127.0.0.1 -p 9001 -C 128 -u nginx -g nginx -f/usr/local/php/bin/php-cgi

>/dev/null 2>&1 || echo -n " already running"

}

d_stop() {

/usr/bin/killall-9 php-cgi > /dev/null 2>&1 || echo -n " not running"

}

case "$1"in

start)

echo -n"Starting $DESC: $NAME"

d_start

echo "."

;;

stop)

echo -n"Stopping $DESC: $NAME"

d_stop

echo "."

;;

restart)

echo -n"Restarting $DESC: $NAME"

d_stop

sleep 1

d_start

echo "."

;;

*)

echo"Usage: $SCRIPTNAME {start|stop|restart}" >&2

exit 3

;;

esac

exit 0

启动Nginx服务

先启动spawn-fcgiCGI服务：

[root@server~]# /usr/local/php/sbin/spawn-fcgi start

然后测试Nginx服务配置是否正确：

[root@server~]# /usr/local/nginx/sbin/nginx -t

如果返回如下信息，说明配置正确

theconfiguration file /usr/local/nginx//conf/nginx.conf syntax is ok

configurationfile /usr/local/nginx//conf/nginx.conf test is successful

正式启动Nginx服务：

[root@server~]# /usr/local/nginx/sbin/nginx

到这里我们的LNMP环境就搭建好了

下面就可以用discuz像LAMP一样搭建论坛程序了。。这里步骤就省略了！

三系统优化与安全

1关闭所有不需要的服务

用命令ntsysv 只留下以下服务：

crond firstboot  gpm  iptables kudzu network sshd  syslog  sysstat  mysqld

其他服务如果需要可以临时开启。（此命令只对当前运行级别有效）

2启用selinux

开启selinux并把网站根目录/www 加上httpd_sys_content_t权限

Chcon  �Ct httpd_sys_content_t  /www

3配置iptables

如下是我的配置文件：

Vi /etc/sysconfig/iptables

-A INPUT-j RH-Firewall-1-INPUT

-A FORWARD-j RH-Firewall-1-INPUT

-ARH-Firewall-1-INPUT -i lo -j ACCEPT

-ARH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT

-ARH-Firewall-1-INPUT -p tcp -m state  --syn �Cstate NEW --dport 80 -jACCEPT

-ARH-Firewall-1-INPUT -p tcp --dport 80 -m connlimit --connlimit-above20 --connlimit-mask 32 -j DROP

-ARH-Firewall-1-INPUT -p tcp --dport 22 -j TARPIT

-ARH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-ARH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 212 -jACCEPT

-ARH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

要用到connlimit与tarpit参数需要编译内核模块。

这里通过修改ssh端口为212，并设置22端口为黑洞，提高了安全性

并把web访问每个IP连接数限制为20，防止sysfoold及dos攻击等。

4. 修改内核参数

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_syncookies

1

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_syn_retries

3

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_synack_retries

3

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_fin_timeout

15

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_max_syn_backlog

1024

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_rmem

4096   87380   4194304

[root@LNMPwww]# cat /proc/sys/net/ipv4/tcp_wmem

4096   16384   4194304

[root@LNMPwww]# cat /proc/sys/net/core/rmem_max

131071

[root@LNMPwww]# cat /proc/sys/net/core/wmem_max

131071

[root@LNMPwww]# cat /proc/sys/kernel/sem

2500    320000   100      128

这样我们的经过优化与安全处理的LNMP服务器就搭建好了，当然这只是简单

的做了一些优化与安全处理，如果你需要更多的优化与安全，需要更具自己

的实际情况来处理，比如增加硬件防火墙，增加服务器内存，磁盘容量等等。

记得备份/etc/ nginx 配置文件

四日志滚动

下载软件包cronolog-1.6.2.tar.gz

Tar zxvf cronolog-1.6.2.tar.gz

cdcronolog-1.62

./configure

Make;makeinstall

备份或移动原来的目录，然后执行以下下的命令，创建管道：

Mkfifo /usr/local/nging/logs/accecc.log

cronolog  usr/local/nging/logs/access.log.%Y%m%d%H%M </usr/local/nginx/logs/access.log