httpd

  • httpd已关闭评论
  • 17 次浏览
  • A+
所属分类:linux技术
摘要

httpd是Apache超文本传输协议(HTTP)服务器的主程序。被设计为一个独立运行的后台进程,它会建立一个处理请求的子进程或线程的池。


Httpd

目录

1.httpd简介

httpd是Apache超文本传输协议(HTTP)服务器的主程序。被设计为一个独立运行的后台进程,它会建立一个处理请求的子进程或线程的池。

通常,httpd不应该被直接调用,而应该在类Unix系统中由apachectl调用,在Windows中作为服务运行。

2.httpd的特性

httpd有很多特性,下面就分别来说说httpd-2.2版本和httpd-2.4版本各自的特性。

版本 特性
2.2 事先创建进程 按需维持适当的进程 模块化设计,核心比较小,各种功能通过模块添加(包括PHP),支持运行时配置,支持单独编译模块 支持多种方式的虚拟主机配置,如基于ip的虚拟主机,基于端口的虚拟主机,基于域名的虚拟主机等 支持https协议(通过mod_ssl模块实现) 支持用户认证 支持基于IP或域名的ACL访问控制机制 支持每目录的访问控制(用户访问默认主页时不需要提供用户名和密码,但是用户访问某特定目录时需要提供用户名和密码) 支持URL重写 支持MPM(Multi Path Modules,多处理模块)。用于定义httpd的工作模型(单进程、单进程多线程、多进程、多进程单线程、多进程多线程)
2.4 httpd-2.4的新特性: MPM支持运行DSO机制(Dynamic Share Object,模块的动态装/卸载机制),以模块形式按需加载 支持event MPM,eventMPM模块生产环境可用 支持异步读写 支持每个模块及每个目录分别使用各自的日志级别 每个请求相关的专业配置,使用来配置 增强版的表达式分析器 支持毫秒级的keepalive timeout 基于FQDN的虚拟主机不再需要NameVirtualHost指令 支持用户自定义变量 支持新的指令(AllowOverrideList) 降低对内存的消耗
工作模型 工作方式
prefork 多进程模型,预先生成进程,一个请求用一个进程响应 一个主进程负责生成n个子进程,子进程也称为工作进程 每个子进程处理一个用户请求,即使没有用户请求,也会预先生成多个空闲进程,随时等待请求到达,最大不会超过1024个
worker 基于线程工作,一个请求用一个线程响应(启动多个进程,每个进程生成多个线程)
event 基于事件的驱动,一个进程处理多个请求

2.1httpd2.4版本型新添加的模块

添加了之后常用的几个模块

模块 功能
mod_proxy_fcgi 反向代理时支持apache服务器后端协议的模块
mod_ratelimit 提供速率限制功能的模块
mod_remoteip 基于ip的访问控制机制被改变,不再支持使用Order,Deny,Allow来做基于IP的访问控制

3.httpd基础

3.1httpd自带的工具程序

工具 功能
htpasswd basic认证基于文件实现时,用到的帐号密码生成工具
apachectl httpd自带的服务控制脚本,支持start,stop,restart
apxs 由httpd-devel包提供的,扩展httpd使用第三方模块的工具
rotatelogs 日志滚动工具
suexec 访问某些有特殊权限配置的资源时,临时切换至指定用户运行的工具
ab apache benchmark,httpd的压力测试工具

3.2 rpm包安装的httpd程序环境

文件/目录 对应的功能
/var/log/httpd/access.log 访问日志
/var/log/httpd/error_log 错误日志
/var/www/html/ 站点文档目录
/usr/lib64/httpd/modules/ 模块文件路径
/etc/httpd/conf/httpd.conf 主配置文件
/etc/httpd/conf.modules.d/*.conf 模块配置文件
/etc/httpd/conf.d/*.conf 辅助配置文件

4.web相关的命令

curl命令

curl是基于URL语法在命令行方式下工作的文件传输工具,它支持FTP,FTPS,HTTP,HTTPS,GOPHER,TELNET,DICT,FILE及LDAP等协议。

curl支持以下功能:

  • https认证
  • http的POST/PUT等方法
  • ftp上传
  • kerberos认证
  • http上传
  • 代理服务器
  • cookies
  • 用户名/密码认证
  • 下载文件断点续传
  • socks5代理服务器
  • 通过http代理服务器上传文件到ftp服务器
//语法:curl [options] [URL ...] //常用的options:     -A/--user-agent <string>    //设置用户代理发送给服务器     -basic              //使用Http基本认证     --tcp-nodelay       //使用TCP_NODELAY选项     -e/--referer <URL>      //来源网址     --cacert <file>     //CA证书(SSL)     --compressed        //要求返回时压缩的格式     -H/--header <line>  //自定义请求首部信息传递给服务器     -I/--head           //只显示响应报文首部信息     --limit-rate <rate>     //设置传输速度     -u/--user <user[:password]>     //设置服务器的用户和密码     -0/--http1      //使用http 1.0版本,默认使用1.1版本。这个选项是数字0而不是字母o     -o/--output     //把输出写到文件中     -#/--progress-bar       //进度条显示当前的传送状态 

httpd命令

//语法:httpd [options] //常用的options:     -l      //查看静态编译的模块,列出核心中编译了哪些模块。              //它不会列出使用LoadModule指令动态加载的模块     -M      //输出一个已经启用的模块列表,包括静态编译在服务              //器中的模块和作为DSO动态加载的模块     -v      //显示httpd的版本,然后退出     -V      //显示httpd和apr/apr-util的版本和编译参数,然后退出     -X      //以调试模式运行httpd。仅启动一个工作进程,并且              //服务器不与控制台脱离     -t      //检查配置文件是否有语法错误 

命令演示

[root@localhost ~]# httpd -t Syntax OK  [root@localhost ~]# httpd -l Compiled in modules:   core.c   mod_so.c   http_core.c  [root@localhost ~]# httpd -M Loaded Modules:  core_module (static)  so_module (static)  http_module (static)  access_compat_module (shared)  actions_module (shared)  alias_module (shared)  allowmethods_module (shared)  [root@localhost ~]# httpd -v			//小写v Server version: Apache/2.4.37 (centos) Server built:   Nov 12 2021 04:57:27  [root@localhost ~]# httpd -V			//大写V Server version: Apache/2.4.37 (centos) Server built:   Nov 12 2021 04:57:27 Server's Module Magic Number: 20120211:83 Server loaded:  APR 1.6.3, APR-UTIL 1.6.1 Compiled using: APR 1.6.3, APR-UTIL 1.6.1 Architecture:   64-bit Server MPM:     event   threaded:     yes (fixed thread count)     forked:     yes (variable process count) 

5.httpd常用的配置文件

NAME有三种,分别是:

  • prefork
  • event
  • worker

配置文件位置:

[root@localhost conf.modules.d]# pwd /etc/httpd/conf.modules.d [root@localhost conf.modules.d]# ls 00-base.conf  00-lua.conf  00-proxy.conf    01-cgi.conf 00-dav.conf   00-mpm.conf  00-systemd.conf [root@localhost conf.modules.d]# vim 00-mpm.conf # Select the MPM module which should be used by uncommenting exactly # one of the following LoadModule lines:  # prefork MPM: Implements a non-threaded, pre-forking web server # See: http://httpd.apache.org/docs/2.4/mod/prefork.html LoadModule mpm_prefork_module modules/mod_mpm_prefork.s 

访问控制法则:

法则 功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名的主机访问
Require not host HOSTNAME 拒绝指定来源主机名的主机访问
IPADDR的类型 HOSTNAME的类型
IP:192.168.1.1
Network/mask:192.168.1.0/255.255.255.0
Network/Length:192.168.1.0/24
Net:192.168
FQDN:特定主机的全名 DOMAIN:指定域内的所有主机

注意:httpd-2.4版本默认是拒绝所有主机访问的,所以安装以后必须做显示授权访问

配置文件示例

<Directory "/var/www/html/www">     <RequireAll>         Require not ip 192.168.111.1         Require all granted     </RequireAll> </Directory> 

4.编译安装httpd

1.准备环境

[root@localhost ~]# dnf -y groupinstall "Development Tools" --allowerasing Failed to set locale, defaulting to C.UTF-8 Last metadata expiration check: 0:03:34 ago on Tue Jul 12 22:42:38 2022. Dependencies resolved. ===============================================================================================================  Package                                Arch     Version                                    Repository    Size =============================================================================================================== Installing group/module packages: Complete! [root@localhost ~]# useradd -rMs /sbin/nologin apache  [root@localhost ~]# id apache uid=994(apache) gid=991(apache) groups=991(apache) [root@localhost ~]# dnf -y install wget [root@localhost ~]# dnf -y install openssl-devel pcre-devel expat-devel libtool libxml2-devel [root@localhost ~]# dnf -y install gcc gcc-c++ [root@localhost ~]# dnf -y install make 

2.下载 apr apr-util httpd

[root@localhost ~]# wget http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz --2022-07-12 22:50:06--  http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.230, 58.49.248.232, 119.96.204.214, ... Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.230|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1093896 (1.0M) [application/octet-stream] Saving to: 'apr-1.7.0.tar.gz' apr-1.7.0.tar.gz            100%[==========================================>]   1.04M  --.-KB/s    in 0.06s    2022-07-12 22:50:06 (18.4 MB/s) - 'apr-1.7.0.tar.gz' saved [1093896/1093896]   [root@localhost ~]# wget https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz --2022-07-12 22:50:49--  https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.229, 119.96.204.215, 58.49.248.226, ... Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.229|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 554301 (541K) [application/octet-stream] Saving to: 'apr-util-1.6.1.tar.gz' apr-util-1.6.1.tar.gz       100%[==========================================>] 541.31K  --.-KB/s    in 0.04s    2022-07-12 22:50:49 (14.6 MB/s) - 'apr-util-1.6.1.tar.gz' saved [554301/554301]  [root@localhost ~]# wget https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz --2022-07-12 22:51:06--  https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.229, 119.96.204.215, 58.49.248.226, ... Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.229|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 9743277 (9.3M) [application/octet-stream] Saving to: 'httpd-2.4.54.tar.gz' httpd-2.4.54.tar.gz         100%[==========================================>]   9.29M  39.8MB/s    in 0.2s     2022-07-12 22:51:07 (39.8 MB/s) - 'httpd-2.4.54.tar.gz' saved [9743277/9743277] [root@localhost ~]# ls anaconda-ks.cfg  apr-1.7.0.tar.gz  apr-util-1.6.1.tar.gz  httpd-2.4.54.tar.gz 

3.解压apr apr-util httpd

[root@localhost ~]# tar -xf apr-util-1.6.1.tar.gz -C /usr/local/src/ [root@localhost ~]# tar -xf httpd-2.4.54.tar.gz -C /usr/local/src/ [root@localhost ~]# tar -xf apr-1.7.0.tar.gz -C /usr/local/src/ [root@localhost ~]# ls /usr/local/src/ apr-1.7.0  apr-util-1.6.1  httpd-2.4.54 

4.安装apr apr-util httpd

安装apr

[root@localhost ~]# cd /usr/local/src/apr-1.7.0/ [root@localhost apr-1.7.0]# vi configure cfgfile=${ofile}T     trap "$RM "$cfgfile"; exit 1" 1 2 15     #$RM "$cfgfile"			//注释这行 [root@localhost apr-1.7.0]# ./configure --prefix=/usr/local/apr [root@localhost apr-1.7.0]# make && make install [root@localhost apr-1.7.0]# ls /usr/local/apr/ bin  build-1  include  lib 

安装apr-util

[root@localhost apr-util-1.6.1]# cd /usr/local/src/apr-util-1.6.1/ [root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr/ [root@localhost apr-util-1.6.1]# make && make install [root@localhost apr-util-1.6.1]# ls /usr/local/apr-util/ bin  include  lib 

安装httpd

[root@localhost httpd-2.4.54]# cd /usr/local/src/httpd-2.4.54/ [root@localhost httpd-2.4.54]# ./configure --prefix=/usr/local/apache --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util/ --enable-modules=most --enable-mpms-shared=all --with-rpm=prefork [root@localhost httpd-2.4.54]# make && make install [root@localhost httpd-2.4.54]# ls /usr/local/apache/ bin    cgi-bin  error   icons    logs  manual build  conf     htdocs  include  man   modules 

5.配置环境变量

[root@localhost ~]# echo 'export PATH=/usr/local/apache/bin:$PATH' > /etc/profile.d/apache.sh [root@localhost ~]# source /etc/profile.d/apache.sh  [root@localhost ~]# which apachectl /usr/local/apache/bin/apachectl [root@localhost ~]# ln -s /usr/local/apache/include/ /usr/include/apache [root@localhost ~]# ll /usr/include/ | grep apache lrwxrwxrwx.  1 root root     26 Jul 12 23:15 apache -> /usr/local/apache/include/	 [root@localhost ~]# vi /etc/man_db.conf 	//使apache的man生效 #MANDATORY_MANPATH                      /usr/src/pvm3/man # MANDATORY_MANPATH                       /usr/man MANDATORY_MANPATH                       /usr/share/man MANDATORY_MANPATH           /usr/local/share/man MANDATORY_MANPATH                       /usr/local/apache/man	//添加此行 

6.关闭防火墙和selinux服务

[root@localhost ~]# systemctl stop firewalld [root@localhost ~]# systemctl disable firewalld Removed /etc/systemd/system/multi-user.target.wants/firewalld.service. Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service. [root@localhost ~]# setenforce 0 

7.开启apache服务,并看出是否能访问

8.取消警告信息

[root@localhost ~]# cd /usr/local/apache/ [root@localhost apache]# ls bin    cgi-bin  error   icons    logs  manual build  conf     htdocs  include  man   modules [root@localhost apache]# cd conf/ [root@localhost conf]# ls extra  httpd.conf  magic  mime.types  original [root@localhost conf]# vi httpd.conf  #ServerName www.example.com:80		//删除注释 [root@localhost conf]# apachectl start			//此时没有警告 [root@localhost conf]# ss -anlt State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  LISTEN  0       128            0.0.0.0:22          0.0.0.0:*             LISTEN  0       128                  *:80                *:*             LISTEN  0       128               [::]:22             [::]:*             

9.使用systemctl命令使用httpd

[root@localhost ~]# cd /usr/lib/systemd/system [root@localhost system]# ls sshd.service  sshd.service [root@localhost system]# cp sshd.service httpd.service [root@localhost system]# vi httpd.service  [Unit] Description=OpenSSH server daemon		//修改成Description=httpd server daemon Documentation=man:sshd(8) man:sshd_config(5)		//删除 After=network.target sshd-keygen.target Wants=sshd-keygen.target		//删除  [Service] Type=notify		//修改成Type=forking EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config	//删除 EnvironmentFile=-/etc/sysconfig/sshd	//删除 ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY		//修改成ExecStart=/usr/local/apache/bin/apachectl start ExecStop=/usr/local/apache/bin/apachectl stop  //添加此行用作停止 ExecReload=/bin/kill -HUP $MAINPID KillMode=process		//删除 Restart=on-failure		//删除 RestartSec=42s			//删除  [Install] WantedBy=multi-user.target  [root@localhost system]# cat httpd.service  [Unit] Description=httpd server daemon After=network.target sshd-keygen.target  [Service] Type=forking ExecStart=/usr/local/apache/bin/apachectl start ExecStop=/usr/local/apache/bin/apachectl stop ExecReload=/bin/kill -HUP $MAINPID  [Install] WantedBy=multi-user.target  [root@localhost system]# systemctl daemon-reload [root@localhost system]# cd [root@localhost ~]# systemctl status httpd ● httpd.service - httpd server daemon    Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; ven>    Active: inactive (dead) lines 1-3/3 (END) [root@localhost ~]# systemctl start httpd [root@localhost ~]# ss -anlt 		//查看80端口已开启 State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  LISTEN  0       128            0.0.0.0:22          0.0.0.0:*             LISTEN  0       128                  *:80                *:*             LISTEN  0       128               [::]:22             [::]:*             [root@localhost ~]# systemctl status httpd ● httpd.service - httpd server daemon    Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; ven>    Active: active (running) since Wed 2022-07-13 19:26:50 CST; 7s ago   Process: 145364 ExecStart=/usr/local/apache/bin/apachectl start (code>  Main PID: 145367 (httpd)     Tasks: 82 (limit: 23457)    Memory: 21.6M    CGroup: /system.slice/httpd.service            ├─145367 /usr/local/apache/bin/httpd -k start            ├─145368 /usr/local/apache/bin/httpd -k start            ├─145369 /usr/local/apache/bin/httpd -k start            └─145370 /usr/local/apache/bin/httpd -k start  Jul 13 19:26:50 localhost.localdomain systemd[1]: Starting httpd server> Jul 13 19:26:50 localhost.localdomain systemd[1]: Started httpd server > 

5.访问控制权限

访问当前虚拟机的IP

[root@localhost ~]# dnf -y install httpd [root@localhost ~]# cd /var/www/html/ [root@localhost html]# ls [root@localhost html]# echo "123" > index.html [root@localhost html]# systemctl restart httpd [root@localhost html]# systemctl stop firewalld [root@localhost html]# systemctl disable firewalld Removed /etc/systemd/system/multi-user.target.wants/firewalld.service. Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service. [root@localhost html]# setenforce 0 

httpd

在/var/www/html下新建一个zxr目录,在zxr目录下创建一个a.html文件,进行访问测试

[root@localhost ~]# cd /var/www/html/ [root@localhost html]# ls index.html [root@localhost html]# mkdir zxr [root@localhost html]# ls index.html  zxr [root@localhost html]# cd zxr/ [root@localhost zxr]# echo "abc" > a.html [root@localhost zxr]# ls a.html [root@localhost zxr]# systemctl restart httpd 

httpd

设置物理机不允许访问/var/www/html/zxr/a.html

[root@localhost ~]# vi /etc/httpd/conf/httpd.conf  <Directory "/var/www/html/zxr">     <RequireAll>         Require not ip 192.168.111.1         Require all granted     </RequireAll> </Directory> [root@localhost ~]# httpd -t Syntax OK [root@localhost ~]# systemctl restaer httpd [root@localhost ~]# curl http://192.168.111.135 123 [root@localhost ~]# curl http://192.168.111.135/zxr/a.html abc 

httpd

设置物理机可以访问虚拟机访问不了

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf  <Directory "/var/www/html/zxr">     <RequireAll>         Require not ip 192.168.111.135         Require all granted     </RequireAll> </Directory> [root@localhost ~]# httpd -t Syntax OK   [root@localhost ~]# curl http://192.168.111.135/zxr/a.html			//访问失败 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> </body></html> 

httpd

6.配置三种不同的虚拟主机

虚拟主机有三类:

  • 相同IP不同端口
  • 不同IP相同端口
  • 相同IP相同端口不同域名

6.1 配置相同IP不同端口

先将需要使用的上传到/var/www/html下

[root@localhost ~]# dnf -y install httpd [root@localhost ~]# find / -name *vhosts.conf /usr/share/doc/httpd/httpd-vhosts.conf [root@localhost ~]# cd /etc/httpd/ [root@localhost httpd]# ls conf  conf.d  conf.modules.d  logs  modules  run  state [root@localhost httpd]# cd conf.d/ [root@localhost conf.d]# ls README  autoindex.conf  userdir.conf  welcome.conf [root@localhost conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf /etc/httpd/conf.d/ [root@localhost conf.d]# ls README  autoindex.conf  httpd-vhosts.conf  userdir.conf  welcome.conf [root@localhost conf.d]# cd /var/www/html/ [root@localhost html]# ls doudizhu.zip  zhuawawaji.zip		//需要将自己要使用的上传至文件夹内 [root@localhost html]# dnf -y install unzip			//没有unzip解压需要下载一个 [root@localhost html]# unzip doudizhu.zip [root@localhost html]# unzip zhuawawaji.zip  [root@localhost html]# ls  doudizhu.zip  'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji.zip [root@localhost html]# rm -rf doudizhu.zip zhuawawaji.zip  [root@localhost html]# ls 'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码 [root@localhost html]# mkdir doudizhu zhuawawaji [root@localhost html]# mv 'HTML5 canvas移动端斗地主小游戏'/* doudizhu/ [root@localhost html]# cd doudizhu/ [root@localhost doudizhu]# ls DJDDZ.js  img  index.html  JControls.js  Prototype.js  ResourceData.js [root@localhost html]# mv jQuery抓娃娃机游戏代码/* zhuawawaji/ [root@localhost html]# cd zhuawawaji/ [root@localhost zhuawawaji]# ls images  img  index.html  js [root@localhost html]# ls  doudizhu  'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji [root@localhost html]# rm -rf jQuery抓娃娃机游戏代码 HTML5 canvas移动端斗地主小游戏/ [root@localhost html]# ls doudizhu  zhuawawaji [root@localhost html]# cd /etc/httpd/conf.d/ [root@localhost conf.d]# vim  httpd-vhosts.conf 	//修改配置文件 <VirtualHost 192.168.111.135:80>     DocumentRoot "/var/www/html/zhuawawaji"     ServerName www.zhuawawaji.com     ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"     CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common </VirtualHost>  listen 81 <VirtualHost 192.168.111.135:81>     DocumentRoot "/var/www/html/doudizhu"     ServerName www.doudizhu.com     ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"     CustomLog "/var/log/httpd/doudizhu.com-access_log" common </VirtualHost> [root@localhost conf.d]# httpd -t Syntax OK [root@localhost conf.d]# systemctl stop firewalld		//没关闭防火墙需要关闭防火墙 [root@localhost conf.d]# systemctl disable firewalld Removed /etc/systemd/system/multi-user.target.wants/firewalld.service. Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service. [root@localhost conf.d]# systemctl restart httpd 

查看效果

httpd

httpd

6.2 配置不同IP相同端口

[root@localhost conf.d]# ip addr add 192.168.111.140/24 dev ens33 [root@localhost conf.d]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo        valid_lft forever preferred_lft forever     inet6 ::1/128 scope host         valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000     link/ether 00:0c:29:6d:53:62 brd ff:ff:ff:ff:ff:ff     inet 192.168.111.135/24 brd 192.168.111.255 scope global dynamic noprefixroute ens33        valid_lft 1088sec preferred_lft 1088sec     inet 192.168.111.140/24 scope global secondary ens33	//添加成功        valid_lft forever preferred_lft forever     inet6 fe80::20c:29ff:fe6d:5362/64 scope link noprefixroute         valid_lft forever preferred_lft forever  <VirtualHost 192.168.111.135:80>     DocumentRoot "/var/www/html/zhuawawaji"     ServerName www.zhuawawaji.com     ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"     CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common </VirtualHost> [root@localhost conf.d]# vim httpd-vhosts.conf  <VirtualHost 192.168.111.140:80>     DocumentRoot "/var/www/html/doudizhu"     ServerName www.doudizhu.com     ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"     CustomLog "/var/log/httpd/doudizhu.com-access_log" common </VirtualHost> [root@localhost conf.d]# httpd -t Syntax OK [root@localhost conf.d]# systemctl restart httpd 

查看效果

httpd

httpd

6.3 配置相同IP相同端口不同域名

windows hosts文件位置:

C:windowssystem32driversetc下

httpd

打开方式选择记事本

httpd

添加IP和域名并保存

httpd

[root@localhost conf.d]# dnf -y install bind-utils [root@localhost conf.d]# vim httpd-vhosts.conf  <VirtualHost 192.168.111.135:80>     DocumentRoot "/var/www/html/zhuawawaji"     ServerName www.zhuawawaji.com     ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"     CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common </VirtualHost>  <VirtualHost 192.168.111.135:80>     DocumentRoot "/var/www/html/doudizhu"     ServerName www.doudizhu.com     ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"     CustomLog "/var/log/httpd/doudizhu.com-access_log" common </VirtualHost> [root@localhost conf.d]# httpd -t Syntax OK [root@localhost conf.d]# systemctl restart httpd 

查看效果

httpd

httpd

6.4 添加访问权限

[root@localhost conf.d]# vim httpd-vhosts.conf  <Directory /var/www/html/zhuawawaji>     <RequireAll>         Require not ip 192.168.111.1         Require all granted     </RequireAll> </Directory> [root@localhost conf.d]# httpd -t Syntax OK [root@localhost conf.d]# systemctl restart httpd 

查看效果

httpd

7.配置https

7.1 安装ssl安全模块

[root@localhost ~]# dnf -y install mod_ssl Last metadata expiration check: 0:36:22 ago on Sat 23 Jul 2022 03:23:44 PM CST. Dependencies resolved. ===========================================================================================================================  Package             Architecture       Version                                                Repository             Size =========================================================================================================================== Installing:  mod_ssl             x86_64             1:2.4.37-43.module_el8.5.0+1022+b541f3b1               AppStream             136 k Installing dependencies:  sscg                x86_64             2.3.3-14.el8                                           AppStream              49 k  Transaction Summary =========================================================================================================================== Install  2 Packages  Total download size: 185 k Installed size: 364 k Downloading Packages: (1/2): sscg-2.3.3-14.el8.x86_64.rpm                                                        109 kB/s |  49 kB     00:00     (2/2): mod_ssl-2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64.rpm                           205 kB/s | 136 kB     00:00     --------------------------------------------------------------------------------------------------------------------------- Total                                                                                      279 kB/s | 185 kB     00:00      Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction   Preparing        :                                                                                                   1/1    Installing       : sscg-2.3.3-14.el8.x86_64                                                                          1/2    Installing       : mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           2/2    Running scriptlet: mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           2/2    Verifying        : mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           1/2    Verifying        : sscg-2.3.3-14.el8.x86_64                                                                          2/2   Installed:   mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                     sscg-2.3.3-14.el8.x86_64                      Complete! [root@localhost ~]# systemctl restart httpd [root@localhost ~]# httpd -M | grep ssl  ssl_module (shared) 

7.2 CA生成一对密钥

[root@localhost ~]# cd /etc/pki/ [root@localhost pki]# ls ca-trust  java  rpm-gpg  rsyslog  tls [root@localhost pki]# mkdir CA [root@localhost pki]# cd CA/ [root@localhost CA]# pwd /etc/pki/CA [root@localhost CA]# mkdir private [root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus (2 primes) ..................................................+++++ ...................+++++ e is 65537 (0x010001) [root@localhost CA]# openssl rsa -in private/cakey.pem -pubout writing RSA key -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Rk5ctGrccaHpgdm9luZ ZKnskqUCjEVby2ftNgPiiPfvXaXZTVtydngnc8KJM3vUj+Ci2FlxTV28xiz+MTQJ 73M1eDwV4KG0Fh6H+vt9G7HPLpjt66vPPfQBnyjbUgxOL1rhRVeLRi86x9EV5NMF dhxjXk30dCbeluz+EXLnVjf2mYDDeF43ShngME56D1qU70+iJkopnV5AB1XkKEKw SmK13IHc/h1TfaoSuwHw8vNSJanz8Wk5vVG8uyJUDFCPg/eMuj59sSJue+1xZRkr vjbA6g7hkY5BIhSJiuv7yzmpHsEj4lD0et0c9+xgZCy21mkVlAcoQPe0chKgM7O0 MQIDAQAB -----END PUBLIC KEY----- 

7.3 CA生成自签署证书

[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:cn State or Province Name (full name) []:hb Locality Name (eg, city) [Default City]:wh Organization Name (eg, company) [Default Company Ltd]:runtime Organizational Unit Name (eg, section) []:peixun Common Name (eg, your name or your server's hostname) []:www.doudizhu.com Email Address []:1@2.com [root@localhost CA]# openssl x509 -text -in cacert.pem [root@localhost CA]# mkdir certs newcerts crl [root@localhost CA]# touch index.txt && echo 01 > serial [root@localhost CA]# ls cacert.pem  certs  crl  index.txt  newcerts  private  serial [root@localhost CA]# cat serial  01 

7.4 客户端生成密钥

[root@localhost CA]# cd /etc/httpd && mkdir ssl && cd ssl [root@localhost ssl]# pwd /etc/httpd/ssl [root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048) Generating RSA private key, 2048 bit long modulus (2 primes) ...................................................................................+++++ ..........................+++++ e is 65537 (0x010001) [root@localhost ssl]# ls httpd.key 

7.5 客户端生成证书签署请求

[root@localhost ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr  Ignoring -days; not generating a certificate You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:cn State or Province Name (full name) []:hb Locality Name (eg, city) [Default City]:wu Organization Name (eg, company) [Default Company Ltd]:runtime Organizational Unit Name (eg, section) []:peixun Common Name (eg, your name or your server's hostname) []:www.duodizhu.com Email Address []:1@2.com  Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@localhost ssl]# ls httpd.csr  httpd.key 

7.6 CA签署客户端提交上来的证书

[root@localhost ssl]# openssl ca -in ./httpd.csr -out httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details:         Serial Number: 1 (0x1)         Validity             Not Before: Jul 23 08:37:51 2022 GMT             Not After : Jul 23 08:37:51 2023 GMT         Subject:             countryName               = cn             stateOrProvinceName       = hb             organizationName          = runtime             organizationalUnitName    = peixun             commonName                = www.duodizhu.com             emailAddress              = 1@2.com         X509v3 extensions:             X509v3 Basic Constraints:                  CA:FALSE             Netscape Comment:                  OpenSSL Generated Certificate             X509v3 Subject Key Identifier:                  27:23:14:CB:51:6C:E0:8E:D8:8C:B1:D2:EF:BB:62:1F:EB:A1:97:E5             X509v3 Authority Key Identifier:                  keyid:C8:13:CA:71:2C:58:9B:16:6B:84:4F:71:41:9C:FA:B9:19:49:25:76  Certificate is to be certified until Jul 23 08:37:51 2023 GMT (365 days) Sign the certificate? [y/n]:y   1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@localhost ssl]# ls httpd.crt  httpd.csr  httpd.key 

7.7 修改ssl.conf配置文件

[root@localhost ssl]# pwd /etc/httpd/ssl [root@localhost ssl]# cd /etc/httpd/conf.d/ [root@localhost conf.d]# ls autoindex.conf  httpd-vhosts.conf  README  ssl.conf  userdir.conf  welcome.conf [root@localhost conf.d]# vim ssl.conf 	  <VirtualHost _default_:443>  # General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html/zhuawawaji"		 ServerName www.zhuawawaji.com:443  SSLCertificateFile /etc/httpd/ssl/httpd.crt		//修改位置 SSLCertificateKeyFile /etc/httpd/ssl/httpd.key	//修改位置 [root@localhost conf.d]# httpd -t Syntax OK [root@localhost conf.d]# systemctl restart httpd [root@localhost conf.d]# ss -anlt | grep 443 LISTEN 0      128                *:443             *:*           

7.8 查看效果

httpd

httpd

httpd

  • 版权声明:本站原创文章,于2022年7月24日15:54:54,由 发表,共 24795 字。
  • 转载请注明:httpd - 张拓的天空