CentOS 6.5上部署Haproxy
前端之家收集整理的这篇文章主要介绍了
CentOS 6.5上部署Haproxy,
前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。
环境说明:
@H_403_7@
主机名 |
角色 |
IP地址 |
mylinux1.contoso.com |
Haproxy |
eth0:192.168.100.121@H_403_7@ eth1:172.16.100.121@H_403_7@ |
mylinux3.contoso.com |
ssh server(做tcp实验用) |
eth0:192.168.100.181 |
mylinux4.contoso.com |
ssh server(做tcp实验用) |
eth1:192.168.100.182 |
一、环境准备@H_403_7@
以下配置基本上是每一次都要提前准备的,所以准备的命令我就不详细列出了,前面有一个一键优化的脚本,可以使用脚本进行自动化的处理,避免多次重复操作的困扰。@H_403_7@
@H_
301_80@
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[root@mylinux1~]
ChainINPUT(policyACCEPT)
targetprotopt
source
destination
ChainFORWARD(policyACCEPT)
destination
ChainOUTPUT(policyACCEPT)
destination
#getenforce
Disabled
#crontab-l
0****
/usr/sbin/ntpdate
210.72.145.4464.147.116.229
time
.nist.gov
mkdir
-p
/etc/yum
.repos.d
/bak
mv
.repos.d/*.*
/bak/
wget-O
/CentOS-Base
.repohttp:
//mirrors
.aliyun.com
/repo/Centos-6
.repo
yumcleanall
yummakecache
sed
-i
'/^HOSTNAME/s/^/#/'
/etc/sysconfig/network
'/#HOSTNAME/aHOSTNAME=[主机名]'
/etc/sysconfig/network
hostname
[主机名]
|
二、安装Haproxy@H_403_7@
24
25
26
27
28
#mkdir-p/opt/tools
#cd/opt/tools/
[root@mylinux1tools]
total2608
-rw-r--r--1rootroot1360582Sep3011:02haproxy-1.5.18.
tar
.gz
#tar-zxfhaproxy-1.5.18.tar.gz
#cdhaproxy-1.5.18
[root@mylinux1haproxy-1.5.18]
CHANGELOGCONTRIBUTINGebtreeincludeMakefileROADMAPSUBVERSVERDATE
contribdocexamplesLICENSEREADMEsrctestsVERSION
#mkdir-p/usr/local/haproxy
#makeTARGET=linux26ARCH=x86_64PREFIX=/usr/local/haproxy/
#makeinstallPREFIX=/usr/local/haproxy
#cd/usr/local/haproxy/
[root@mylinux1haproxy]
├──doc
│└──haproxy
│├──architecture.txt
│├──configuration.txt
│├──haproxy-en.txt
│└──haproxy-fr.txt
├──sbin
│└──haproxy
└──share
└──
man
└──man1
└──haproxy.1
6directories,6files
三、修改haproxy相关系统配置@H_403_7@
1、生成配置文件
@H_403_7@
2
#mkdir-p/usr/local/haproxy/conf
#cpexamples/haproxy.cfg/usr/local/haproxy/conf/
2、开启IPv4转发@H_403_7@
#sysctl-p
net.ipv4.ip_forward=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.accept_source_route=0
kernel.sysrq=0
kernel.core_uses_pid=1
net.ipv4.tcp_syncookies=1
kernel.msgmnb=65536
kernel.msgmax=65536
kernel.shmmax=68719476736
kernel.shmall=4294967296
fs.
file
-max=2097152
fs.nr_open=2097152
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_tw_recycle=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=1200
net.ipv4.ip_local_port_range=102465000
net.ipv4.tcp_max_syn_backlog=81920
@H_403_7@
3、创建haproxy相关目录@H_403_7@
#mkdir-p/usr/local/haproxy/logs
#mkdir-p/usr/local/haproxy/var/{run,chroot}
4、创建haproxy用户@H_403_7@
id
:haproxy:Nosuchuser
#useraddhaproxy-s/sbin/nologin
#idhaproxy
uid=606(haproxy)gid=606(haproxy)
groups
=606(haproxy)
5、配置rsyslog记录haproxy日志
@H_403_7@
在haproxy.cfg中global区域添加下面一行:@H_403_7@
log 127.0.0.1 local0 warning@H_403_7@
然后修改rsyslog配置文件rsyslog.conf:@H_403_7@
5
#echo-e"#Haproxylogsetting\nlocal0.*/usr/local/haproxy/logs/haproxy.log\n#End">>/etc/rsyslog.conf
#tail-3/etc/rsyslog.conf
local0.*
/usr/local/haproxy/logs/haproxy
.log
再修改rsyslog的设置:@H_403_7@
11
#cp/etc/sysconfig/rsyslog/etc/sysconfig/rsyslog.bak$(date+%F)
#vi/etc/sysconfig/rsyslog
#tail-2/etc/sysconfig/rsyslog
SYSLOGD_OPTIONS=
"-c2-m0-r-x"
#diff/etc/sysconfig/rsyslog.bak2016-09-30/etc/sysconfig/rsyslog
5c5,6
<SYSLOGD_OPTIONS=
"-c5"
---
>
>SYSLOGD_OPTIONS=
"-c2-m0-r-x"
此时,我们发现在CentOS 6.5上使用netstat命令无法显示514端口的监听状态,而使用lsof命令也无法查看端口514上的服务,如下:@H_403_7@
#lsof-i:514
#
然后还需要修改rsyslog.conf中的一个配置:
@H_403_7@
6
#sed-i'/imudp/s/^#//'/etc/rsyslog.conf
#sed-i'/UDPServerRun514/s/^#//'/etc/rsyslog.conf
#grepimudp/etc/rsyslog.conf
$ModLoadimudp
#grepUDPServerRun/etc/rsyslog.conf
$UDPServerRun514
最后重启rsyslog服务:@H_403_7@
#/etc/init.d/rsyslogrestart
Shuttingdownsystemlogger:[OK]
Startingsystemlogger:[OK]
再次尝试去看一下514端口的监听状态和服务:@H_403_7@
@H_403_7@
COMMANDPIDUSERFDTYPEDEVICESIZE
/OFF
NODENAME
rsyslogd2436root3uIPv4249570t0UDP*:syslog
rsyslogd2436root4uIPv6249580t0UDP*:syslog
#netstat-tunlp|grep514
udp000.0.0.0:5140.0.0.0:*2436
/rsyslogd
udp00:::514:::*2436
/rsyslogd
四、编辑haproxy配置文件
@H_403_7@
下面给出基于tcp的haproxy代理的配置文件内容:@H_403_7@
global
log127.0.0.1local0
log127.0.0.1:514local0warning
pidfile
/usr/local/haproxy/var/run/haproxy
.pid
daemon
maxconn20480
chroot
/usr/local/haproxy/var/chroot
userhaproxy
grouphaproxy
spread-checks3
nbproc1
defaults
logglobal
retries3
optionredispatch
maxconn2000
timeoutconnect5000
timeoutclient50000
timeoutserver50000
listenssh
bind172.16.100.121:80
modetcp
balanceroundrobin
timeoutserver15s
timeoutconnect30s
servermylinux3192.168.100.181:22checkport22
servermylinux4192.168.100,182:22checkport22
五、启动haproxy并测试
@H_403_7@
1、启动haproxy@H_403_7@
使用以下命令测试haproxy的配置文件是否可用:@H_403_7@
#/usr/local/haproxy/sbin/haproxy-fhaproxy.cfg-c
Configuration
isvalid
然后使用如下命令启动haproxy:
@H_403_7@
1
#/usr/local/haproxy/sbin/haproxy-fhaproxy.cfg-D
可以通过下面的方法检查haproxy是否启动:@H_403_7@
#ps-ef|grephaproxy
haproxy15501018:25?00:00:00
/usr/local/haproxy/sbin/haproxy
-fhaproxy.cfg-D
root15531015018:26pts
/1
00:00:00
grep
haproxy
#lsof-i:80
NODENAME
haproxy1550haproxy4uIPv4120880t0TCP172.16.100.121:http(LISTEN)
2、测试haproxy代理ssh@H_403_7@
上面的配置文件中,使用haproxy的eth1的地址172.16.100.121的80端口来代理后端mylinux3和mylinux4上的22端口,也就是ssh服务,这样只要客户端使用ssh 172.16.100.121的80端口就可以远程访问后端两台服务器的ssh服务了,下面来测试一下是否如预想的那样。@H_403_7@
#ssh-p80172.16.100.121
Theauthenticityofhost
'[172.16.100.121]:80([172.16.100.121]:80)'
can'tbeestablished.
RSAkeyfingerprintisea:b0:45:d6:fa:48:60:41:a9:e4:f7:30:b9:ed:16:a4.
Areyousureyouwantto
continue
connecting(
yes
/no
)?
yes
Warning:Permanentlyadded
'[172.16.100.121]:80'
(RSA)tothelistofknownhosts.
root@172.16.100.121'spassword:
Lastlogin:FriSep3012:42:122016from192.168.100.1
[root@mylinux4~]
mylinux4.contoso.com
#ipa|grep192.168.100
inet192.168.100.182
/24
brd192.168.100.255scopeglobaleth0
好的,成功的通过haproxy代理远程到了mylinux4这一台主机上。@H_403_7@
再进行第二次测试之前,需要先清空known_hosts中的内容,不然会提示加密私钥改变,使用下面的命令处理一下:@H_403_7@
然后再次ssh 172.16.100.121的80端口,结果如下:@H_403_7@
RSAkeyfingerprintis99:05:e5:e4:d3:78:bd:cf:94:e9:80:36:b5:5d:cc:11.
Lastlogin:FriSep3018:29:102016from192.168.100.121
[root@mylinux3~]