http相关服务介绍（二）

一、之前介绍了CGI的机制，还有其他两种机制
1、Module

web不具备处理动态网站的能力的，那么怎么运行动态网站呢，之前所过了CGI的方式，这里就让动态网站进程在web进程中运行，而不单独启动个进程，也就是PHP的机制，把运行环境做成模块整合进web服务，这样就客户使web服务来处理动态网站了，不单独启动子进程了，直接在web进程空间中运行。

2、FastCGI

指的是CGI的时候是产生一个运行环境的进程，而这里是产生一个父进程，之后父进程产生N多空间的子进程，当web服务器要处理动态进程的时候，运行环境中的父进程就拿出一个空闲的子进程去处理，之后再回收销毁等，都是由运行环境的父进程执行的。而且这里运行环境可以单独做个FastCGI服务器，专门运行动态处理，叫做应用程序处理服务器

二、虚拟主机:可以用一台web服务器提供多个web站点,提供服务

(1)基于端口号的虚拟主机
(2)基于IP的虚拟主机
(3)基于域名的虚拟主机

1、基于端口号的虚拟主机
在配置文件中修改如下信息，首先要修改全局DocumentRoot，将他注释掉，之后再添加要监听不同的端口号
#DocumentRoot "/var/www/html"
Listen 8080

在最后增加2个虚拟主机，每个<VirtualHost>的容器中代表一个虚拟主机
<VirtuaHost *:80>
 ServerName test.com
 DocumentRoot "/web/vhosts/test.com"
</ViretuaHost>
<VirtuaHost *:8080>
 ServerName web.com
 DocumentRoot "/web/vhosts/web.com"
</ViretuaHost>

之后再通过浏览器访问的,默认访问的80端口

  

2、基于ip的虚拟主机,首先要有多个IP地址，这里我有个192.168.80.139的ip地址，定义信息如下
<VirtualHost 172.16.15.10:80>
  ServerName test.com
  DocumentRoot /vhost/test.com
</VirtualHost>
<VirtualHost 192.168.80.139:80>
  ServerName tom.com
  DocumentRoot /vhost/tom
</VirtualHost>

 

3、基于域名的虚拟主机，要修改NameVirtualHost *:80去掉#号，而且这里的*:80怎么写的<VirtualHost>中也要一样
（注意：这里我没做DNS解析，都是写的hosts解析的，后边的同理）

<VirtualHost *:80>
  ServerName bbs.peace.com
  DocumentRoot /vhost/bbs
</VirtualHost>
<VirtualHost *:80>
  ServerName bbs.jack.com
  DocumentRoot /vhost/jack
</VirtualHost>

 

当然我们也可以混合的使用，这里就多介绍了

4、另外这里，谁在上谁就是默认的访问页面，当然我们可以修改默认的一下是两种方式

<VirtuaHost 172.16.100.1:80>   (设置默认虚拟主机1)
 ServerName default
 DocumentRoot "/web/vhost/default"
 ErrorDocument 404 /sis_list.html  定义错误页面
</VirtualHost>
<VirtuaHost _default_:80>   (设置默认虚拟主机2)
 DocumentRoot "/web/vhost/default"
 ErrorDocument 404 /sis_list.html
</VirtualHost>

5、这里我们还可以指定自己的日志
 ErrorLog /vhosts/logs/www.test.net.error_log  定义错误日志
 CustomLog /vhosts/logs/www.test.net.access_log common  访问日志 common是日志格式

6、一个虚拟主机可以有两个名字，就需要
ServerAlias 名字  即可

路径别名在这里也是可以使用的。
例如

Alias /tobb "/web/vhost/tobb"

7、认证和访问控制也可以再这里添加，但是需要加<Directory>的容器
例如：
<VirtualHost 172.16.15.20:80>
        ServerName www.test.net
        DocumentRoot "/vhosts/test"
        ErrorLog /vhosts/logs/www.test.net.error_log
        CustomLog /vhosts/logs/www.test.net.access_log common
        <Directory "/vhosts/test">
        Options none
        AllowOverride AuthConfig
        AuthType Basic
        AuthName "test.net"
        AuthUserFile /etc/httpd/conf/.htpasswd
        Require valid-user
        </Directory>
</VirtualHost>

三、https

1、首先先了解下SSL/TLS会话建立的过程

 

SSL协商是基于IP实现的
https 不支持基于端口或名称虚拟主机

2试验步骤：
1）这里我们自己过CA服务器，所以先做CA
[root@localhost vhost]# cd /etc/pki/tls/

[root@localhost tls]# vim  openssl.cnf

……
[ CA_default ]

dir             = /etc/pki/CA           # Where everything is kept
certs           = $dir/certs
……

[root@localhost tls]# cd ../CA/

[root@localhost CA]# ls
private
[root@localhost CA]# (umask 077 ; openssl genrsa -out private/cakey.pem 2048)

[root@localhost CA]# ls private/
cakey.pem
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:BJ
Locality Name (eg, city) [Newbury]:beijing
Organization Name (eg, company) [My Company Ltd]:Peace
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ca.peace.com
Email Address []:[email protected]  
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt
[root@localhost CA]# echo 01 > serial

2）CA自签 
[root@localhost CA]# cd /etc/httpd/conf

[root@localhost conf]# mkdir ssl

[root@localhost conf]# cd ssl/

[root@localhost ssl]# (umask 077 ; openssl genrsa 1024 > httpd.key)

[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:BJ
Locality Name (eg, city) [Newbury]:beijing
Organization Name (eg, company) [My Company Ltd]:Peace
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:www.peace.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3）签发证书
[root@localhost ssl]# openssl ca -in httpd.csr -out httpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul  1 06:11:10 2012 GMT
            Not After : Jul  1 06:11:10 2013 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = BJ
            organizationName          = Peace
            organizationalUnitName    = Tech
            commonName                = www.peace.com
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                67:99:8E:9D:5F:C0:D5:CF:DC:0A:74:78:0A:AF:9F:35:64:9F:A8:07
            X509v3 Authority Key Identifier:
                keyid:A0:FC:9E:C8:AE:3B:2B:B3:6A:07:26:71:5E:E7:3A:0B:F3:45:40:D9

Certificate is to be certified until Jul  1 06:11:10 2013 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost ssl]# ls
httpd.crt  httpd.csr  httpd.key

4）安装配置https
[root@localhost ~]# yum install mod_ssl
cd /etc/httpd/conf.d/

[root@localhost conf.d]# ls
proxy_ajp.conf  README  ssl.conf  welcome.conf

[root@localhost conf.d]# vim ssl.conf  修改如下配置
<VirtualHost _default_:443>
DocumentRoot "/web/vhosts/peace.com

ServerName www.peace.com

SSLCertificateFile /etc/httpd/conf/ssl/httpd.crt

SSLCertificateKeyFile /etc/httpd/conf/ssl/httpd.key

[root@localhost conf.d]# mkdir -p /web/vhosts/peace.com

[root@localhost conf.d]# echo "www.peace.com" > /web/vhosts/peace.com/index.html

[root@localhost conf.d]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
[root@localhost conf.d]# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
tcp        0      0 127.0.0.1:2208              0.0.0.0:*                   LISTEN      3016/./hpiod       
tcp        0      0 0.0.0.0:780                 0.0.0.0:*                   LISTEN      2718/rpc.statd     
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      2677/portmap       
tcp        0      0 0.0.0.0:8080                0.0.0.0:*                   LISTEN      5485/httpd         
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      5485/httpd         
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      3041/sshd          
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      3057/cupsd         
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      3113/sendmail      
tcp        0      0 127.0.0.1:6010              0.0.0.0:*                   LISTEN      3555/sshd          
tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      5485/httpd         
tcp        0      0 127.0.0.1:2207              0.0.0.0:*                   LISTEN      3021/python     

5）检查建立过程  
[root@localhost conf.d]# openssl s_client -host www.peace.com -port 443
  Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 0942EA47AFA198537A8CD81894E9018B0560CC5120D32C4CE0C7FFEEBFFBF2F2
    Session-ID-ctx:
    Master-Key: FD9B3D5723F825210F4732E02C9E661A5ABCA479FCBA97C16A1E5FA533B38E9DEA71E5E1FFEEBA08A6D6C06B24561D9D
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1341123568
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate) //发现有问题，没指定证书位置的原因
---

所以指定下证书位置就OK了。

[root@localhost conf.d]# openssl s_client -host www.peace.com -port 443 -CAfile /etc/pki/CA/cacert.pem

 Cipher    : DHE-RSA-AES256-SHA
    Session-ID: E410F13CEF49580C3B6C5502D5D4ED673FE5027532FFB6BC52871201357515EB
    Session-ID-ctx:
    Master-Key: A45A819878076E41E42C1DE4A8ACB6FAF5EFEE8EB2A6ACFD2EAFACA787AB97DF44DB8AEEB9127E60AE97EC317793D2A8
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1341123592
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

访问下看看，发现是不信任的

 

我们要导入CA证书，将/etc/pki/CA/cacert.pem考到本地改名cacert.crt导入浏览器中，之后再访问如下,发现已经是加密的了