CentOS7,apm+xcache,PHP module;
a) 一个虚拟主机提供PHPMyAdmin,另一个虚拟主机提供wordpress;
b) 为PHPMyAdmim提供https服务;
selinux处于关闭状态
httpd2.4
mariadb5.5
PHP5.4
安装:PHP-MysqL PHPmariadb-server httpd
yum-yinstallPHP-MysqLPHPmariadb-serverhttpd
配置安装PHP组件
yuminstallPHP-MysqLPHP-gdlibjpeg*PHP-ldapPHP-odbc
安装https相关模块
mod_ssl
配置httpd虚拟主机
vim/etc/httpd/conf.d/FQDN.conf
<VirtualHost*:80>
ServerNamewww.PHPmyadmin.com
DocumentRoot/httpd/vhosts/PHPmyadmin
<Directory"/httpd/vhosts/PHPmyadmin">
OptionsNone
AllowOverrideNone
Requireallgranted
</Directory>
ErrorLog/var/log/httpd/PHPmyadmin/error.log
CustomLog/var/log/httpd/PHPmyadmin/access.logcombined
</VirtualHost>
<VirtualHost*:80>
ServerNamewww.wordpress.com
DocumentRoot/httpd/vhosts/wordpress
<Directory"/httpd/vhosts/wordpress">
OptionsNone
AllowOverrideNone
Requireallgranted
</Directory>
ErrorLog/var/log/httpd/wordpress/error.log
CustomLog/var/log/httpd/wordpress/access.logcombined
</VirtualHost>
创建日志文件夹
[root@localhost~]#mkdir/var/log/httpd/wordpress
[root@localhost~]#mkdir/var/log/httpd/PHPmyadmin
创建根文件夹
[root@localhost~]#mkdir-p/httpd/vhosts/wordpress
[root@localhost~]#mkdir-p/httpd/vhosts/PHPMyAdmin
检查httpd语法,启动服务,设置开机自动启动服务
[root@localhost~]#httpd-t
SyntaxOK
[root@localhost~]#systemctlstarthttpd
[root@localhost~]#systemctlenablehttpd
启动mariadb,并设置为开启
[root@localhost~]#systemctlstartmariadb.service
[root@localhost~]#systemctlenablemariadb.service
运行mariadb的安全配置
[root@localhostconf.d]#MysqL_secure_installation
/usr/bin/MysqL_secure_installation:line379:find_MysqL_client:commandnotfound
NOTE:RUNNINGALLPARTSOFTHISSCRIPTISRECOMMENDEDFORALLMariaDB
SERVERSINPRODUCTIONUSE!PLEASEREADEACHSTEPCAREFULLY!
InordertologintoMariaDBtosecureit,we'llneedthecurrent
passwordfortherootuser.Ifyou'vejustinstalledMariaDB,and
youhaven'tsettherootpasswordyet,thepasswordwillbeblank,
soyoushouldjustpressenterhere.
Entercurrentpasswordforroot(enterfornone):(回车)
OK,successfullyusedpassword,movingon...
SettingtherootpasswordensuresthatnobodycanlogintotheMariaDB
rootuserwithouttheproperauthorisation.
Setrootpassword?[Y/n]Y
Newpassword:
Re-enternewpassword:
Passwordupdatedsuccessfully!
Reloadingprivilegetables..
...Success!
Bydefault,aMariaDBinstallationhasananonymoususer,allowinganyone
tologintoMariaDBwithouthavingtohaveauseraccountcreatedfor
them.Thisisintendedonlyfortesting,andtomaketheinstallation
goabitsmoother.Youshouldremovethembeforemovingintoa
productionenvironment.
Removeanonymoususers?[Y/n]y
...Success!
Normally,rootshouldonlybeallowedtoconnectfrom'localhost'.This
ensuresthatsomeonecannotguessattherootpasswordfromthenetwork.
Disallowrootloginremotely?[Y/n]y
...Success!
Bydefault,MariaDBcomeswithadatabasenamed'test'thatanyonecan
access.Thisisalsointendedonlyfortesting,andshouldberemoved
beforemovingintoaproductionenvironment.
Removetestdatabaseandaccesstoit?[Y/n]y
-Droppingtestdatabase...
...Success!
-Removingprivilegesontestdatabase...
...Success!
Reloadingtheprivilegetableswillensurethatallchangesmadesofar
willtakeeffectimmediately.
Reloadprivilegetablesnow?[Y/n]y
...Success!
Cleaningup...
Alldone!Ifyou'vecompletedalloftheabovesteps,yourMariaDB
installationshouldnowbesecure.
ThanksforusingMariaDB!
[root@localhost~]#vim/etc/my.cnf
innodb_file_per_table=ON
skip_name_resolve=ON
进入mariadb数据库
[root@localhost~]#MysqL-uroot-p
Enterpassword:
WelcometotheMariaDBmonitor.Commandsendwith;or\g.
YourMariaDBconnectionidis10
Serverversion:5.5.47-MariaDBMariaDBServer
Copyright(c)2000,2015,Oracle,MariaDBCorporationAbandothers.
Type'help;'or'\h'forhelp.Type'\c'toclearthecurrentinputstatement.
MariaDB[(none)]>
MariaDB[(none)]>grantallonwpdb.*to'wpuser@192.168.%.%'identifiedby'password'
->;
QueryOK,0rowsaffected(0.00sec)
更新权限后退出
MariaDB[(none)]>flushprivileges
->;
QueryOK,0rowsaffected(0.00sec)
MariaDB[(none)]>quit
Bye
[root@localhostwordpress]#yum-yinstallwordpress
将配置文件移动至/httpd/vhost/wordpress文件夹下
[root@localhostwordpress]#mv/usr/share/wordpress/httpd/vhosts/wordpress/
[root@localhostwordpress]#vimwp-config.php
//**MysqLsettings-Youcangetthisinfofromyourwebhost**//
/**Thenameofthedatabaseforwordpress*/
define('DB_NAME','wpdb');
/**MysqLdatabaseusername*/
define('DB_USER','wpuser');
/**MysqLdatabasepassword*/
define('DB_PASSWORD','password');
/**MysqLhostname*/
define('DB_HOST','192.168.1.10');
输入www.wordpress.com后进入主页
安装PHPMyAdmin
[root@wwwPHPMyAdmin]#yum-yinstallPHPMyAdmin
将安装文件复制至相应目录下
cp-r.//httpd/vhosts/PHPmyadmin/
为PHPMyAdmin配置https使用192.186.1.7为192.168.1.10颁发CA证书为192.168.1.7创建私有CA;切换至/etc/pki/CA/目录
[root@bogon~]#cd/etc/pki/CA/
[root@bogonCA]#(umask077;opensslgenrsa-outprivate/cakey.pem1024)
GeneratingRSAprivatekey,1024bitlongmodulus
.................++++++
......................................++++++
eis65537(0x10001
创建自签证书
[root@bogonCA]#opensslreq-new-x509-keyprivate/cakey.pem-outcacert.pem
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter'.',thefieldwillbeleftblank.
-----
CountryName(2lettercode)[XX]:CN
StateorProvinceName(fullname)[]:beijing
LocalityName(eg,city)[DefaultCity]:beijing
OrganizationName(eg,company)[DefaultCompanyLtd]:PHPmyadmin
OrganizationalUnitName(eg,section)[]:PHPmyadmin
CommonName(eg,yournameoryourserver'shostname)[]:ca.admin.com
EmailAddress[]:caadmin@PHPmyadmin.com
创建结构文件
[root@bogonCA]#touchindex.txt
[root@bogonCA]#echo01>serial
为服务端配置证书
[root@wwwssl]#opensslreq-new-keyhttpd.key-outhttpd.csr
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,yournameoryourserver'shostname)[]:www.PHPmyadmin.com
EmailAddress[]:caadmin@PHPmyadmin.com
Pleaseenterthefollowing'extra'attributes
tobesentwithyourcertificaterequest
Achallengepassword[]:
Anoptionalcompanyname[]:
讲所需签名证书复制至CA服务器
[root@wwwssl]#scphttpd.csr192.168.1.7:/tmp
Theauthenticityofhost'192.168.1.7(192.168.1.7)'can'tbeestablished.
ECDSAkeyfingerprintis4b:8b:6d:c8:53:c4:7e:ff:dd:26:a2:b9:67:1d:ab:cd.
Areyousureyouwanttocontinueconnecting(yes/no)?yes
Warning:Permanentlyadded'192.168.1.7'(ECDSA)tothelistofknownhosts.
给服务器签发证书
[root@bogonCA]#opensslca-in/tmp/httpd.csr-out/tmp/httpd.crt
Usingconfigurationfrom/etc/pki/tls/openssl.cnf
Checkthattherequestmatchesthesignature
Signatureok
CertificateDetails:
SerialNumber:1(0x1)
Validity
NotBefore:Jul1702:49:362016GMT
NotAfter:Jul1702:49:362017GMT
Subject:
countryName=CN
stateOrProvinceName=beijing
organizationName=PHPmyadmin
organizationalUnitName=PHPmyadmin
commonName=www.PHPmyadmin.com
emailAddress=caadmin@PHPmyadmin.com
X509v3extensions:
X509v3BasicConstraints:
CA:FALSE
NetscapeComment:
OpenSSLGeneratedCertificate
X509v3SubjectKeyIdentifier:
97:05:5A:39:41:43:C0:61:6E:E1:23:18:98:78:02:0D:21:F3:2B:EE
X509v3AuthorityKeyIdentifier:
keyid:0F:9B:41:AB:0F:47:89:C2:28:98:0F:59:61:BE:D3:4E:04:C9:51:81
CertificateistobecertifieduntilJul1702:49:362017GMT(365days)
Signthecertificate?[y/n]:y
1outof1certificaterequestscertified,commit?[y/n]y
Writeoutdatabasewith1newentries
DataBaseUpdated
将签发好的证书复制至PHPMyAdmin服务器
[root@bogonCA]#scp/tmp/httpd.crt192.168.1.10:/etc/httpd/ssl
Theauthenticityofhost'192.168.1.10(192.168.1.10)'can'tbeestablished.
ECDSAkeyfingerprintisd3:71:51:da:74:25:b2:af:b6:d2:d4:98:9a:cd:f4:ee.
Areyousureyouwanttocontinueconnecting(yes/no)?yes
Warning:Permanentlyadded'192.168.1.10'(ECDSA)tothelistofknownhosts.
root@192.168.1.10'spassword:
httpd.crt100%33173.2KB/s00:00
编辑ssl.conf文件,
[root@www ssl]# cd ../conf.d
[root@www conf.d]# vim ssl.conf
#General setup for the virtual host,inherited from global configuration
#DocumentRoot"/var/www/html"
#ServerNamewww.example.com:443
DocumentRoot"/httpd/vhosts/PHPmyadmin"
ServerNamewww.PHPmyadmin.com:443# Server Certificate:
#Point SSLCertificateFile at a PEM encoded certificate. If
# thecertificate is encrypted,then you will be prompted for a
#pass phrase. Note that a kill -HUP willprompt again. A new
#certificate can be generated using the genkey(1) command.
SSLCertificateFile/etc/httpd/ssl/httpd.crt
# Server Certificate:
#Point SSLCertificateFile at a PEM encoded certificate. If
# thecertificate is encrypted,then you will be prompted for a
#pass phrase. Note that a kill -HUP willprompt again. A new
#certificate can be generated using the genkey(1) command.
SSLCertificateFile/etc/httpd/ssl/httpd.crt
# Server Private Key:
# If the key is not combined with thecertificate,use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key youcan configure
# both in parallel (to also allow the use ofDSA ciphers,etc.)
SSLCertificateKeyFile/etc/httpd/ssl/httpd.key
重启httpd服务
[root@wwwconf.d]#systemctlrestarthttpd
安装xcache后重启httpd服务
[root@bogonconf.d]#yum-yinstallPHP-xcache [root@bogonvhosts]#systemctlrestarthttpd
使用ab命令进行压力测试(进行10次)
[root@bogonvhosts]#ab-c100-n1000http://www.xcache.com/index.PHP Timeperrequest:132.352[ms](mean) Timeperrequest:1.324[ms](mean,acrossallconcurrentrequests) Transferrate:34763.10[Kbytes/sec]received [root@bogonvhosts]#ab-c200-n2000http://www.xcache.com/index.PHP Timeperrequest:334.702[ms](mean) Timeperrequest:1.674[ms](mean,acrossallconcurrentrequests) Transferrate:27492.89[Kbytes/sec]received [root@bogonvhosts]#ab-c300-n3000http://www.xcache.com/index.PHP Timeperrequest:1513.902[ms](mean) Timeperrequest:5.046[ms](mean,acrossallconcurrentrequests) Transferrate:9117.43[Kbytes/sec]received [root@bogonvhosts]#ab-c400-n4000http://www.xcache.com/index.PHP Timeperrequest:5866.443[ms](mean) Timeperrequest:14.666[ms](mean,acrossallconcurrentrequests) Transferrate:3039.11[Kbytes/sec]received [root@bogonvhosts]#ab-c500-n5000http://www.xcache.com/index.PHP Timeperrequest:5984.272[ms](mean) Timeperrequest:11.969[ms](mean,acrossallconcurrentrequests) Transferrate:3681.99[Kbytes/sec]received [root@bogonvhosts]#ab-c600-n6000http://www.xcache.com/index.PHP Timeperrequest:6207.417[ms](mean) Timeperrequest:10.346[ms](mean,acrossallconcurrentrequests) Transferrate:4296.02[Kbytes/sec]received [root@bogonvhosts]#ab-c700-n7000http://www.xcache.com/index.PHP Timeperrequest:1901.629[ms](mean) Timeperrequest:2.717[ms](mean,acrossallconcurrentrequests) Transferrate:16936.40[Kbytes/sec]received、 [root@bogonvhosts]#ab-c800-n8000http://www.xcache.com/index.PHP Timeperrequest:3199.896[ms](mean) Timeperrequest:4.000[ms](mean,acrossallconcurrentrequests) Transferrate:11224.73[Kbytes/sec]received [root@bogonvhosts]#ab-c900-n9000http://www.xcache.com/index.PHP Timeperrequest:3335.247[ms](mean) Timeperrequest:3.706[ms](mean,acrossallconcurrentrequests) Transferrate:12321.67[Kbytes/sec]received [root@bogonvhosts]#ab-c1000-n10000http://www.xcache.com/index.PHP Timeperrequest:4754.311[ms](mean) Timeperrequest:4.754[ms](mean,acrossallconcurrentrequests) Transferrate:9507.14[Kbytes/sec]received