httpd服務之虛擬主機、訪問控制、https配置
實驗要求：
建立httpd服務器，要求提供兩個基於名稱的虛擬主機:
(1)www.X.com，頁面文件目錄為/web/vhosts/x；錯誤日誌為/var/log/httpd/x.err，訪問日誌為/var/log/httpd/x.access
(2)www.Y.com，頁面文件目錄為/web/vhosts/y；錯誤日誌為/var/log/httpd/www2.err，訪問日誌為/var/log/httpd/y.access
(3)為兩個虛擬主機建立各自的主頁文件index.html，內容分別為其對應的主機名
(4)通過www.X.com/server-status輸出httpd工作狀態相關信息
2、為上面的第2個虛擬主機提供https服務，使得用戶可以通過
(1)要求使用證書認證，證書中要求使用的國家(CN)、州(Beijing)、城市(Beijing)和組織(MageEdu)
(2)設置部門為Ops，主機名為www.Y.com，郵件為[email protected]
實驗環境：
centos6
httpd2.2
httpd服務器---172.18.252.80
DNS服務器---172.18.253.55
根CA===172.18.252.36
實驗前準備：
在各個主機上關閉防火墻、SELinux
vim /etc/selinux/config
修改
SELINUX=enforcing
改成
SELINUX=disabled
防火墻設置
iptables -F
httpd服務器（172.18.252.80）
安裝httpd
[[email protected] httpd]# yuminstallhttpd -y
禁用默認的主機模式
[[email protected] ~]# vim /etc/httpd/conf/httpd.conf
註釋下面這行內容
#DocumentRoot "/var/www/html"
為主機添加IP
[[email protected] ~]# ip addr show dev eth0 #查看原有ip
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdiscpfifo_fast state UP qlen 1000
link/ether00:0c:29:66:45:e9 brd ff:ff:ff:ff:ff:ff
inet 172.18.252.80/16brd 172.18.255.255 scope global eth0
inet6fe80::20c:29ff:fe66:45e9/64 scope link
valid_lft foreverpreferred_lft forever
[[email protected] ~]# ip addr add 172.18.252.90/16 dev eth0 #添加一個ip
[[email protected] ~]# ip addr show dev eth0 #查看添加後的IP信息，此時有2個IP地址了。 80,90
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdiscpfifo_fast state UP qlen 1000
link/ether00:0c:29:66:45:e9 brd ff:ff:ff:ff:ff:ff
inet 172.18.252.80/16brd 172.18.255.255 scope global eth0
inet 172.18.252.90/16scope global secondary eth0
inet6fe80::20c:29ff:fe66:45e9/64 scope link
valid_lft foreverpreferred_lft forever
添加虛擬主機配置文件
[[email protected] ~]# mkdir -p /web/vhosts/{x,y} #創建頁面文件目錄
[[email protected] ~]# echo "www.X.com">/web/vhosts/x/index.html #創建域名為www.X.com主頁文件
[[email protected] ~]# echo "www.Y.com">/web/vhosts/y/index.html #創建域名為www.Y.com主頁文件
[[email protected] ~]# touch/var/log/httpd/{x.err,x.access,www2.err,y.access} #創建日誌文件
[[email protected] ~]# cd /etc/httpd/conf.d/ #進入配置目錄
[[email protected] conf.d]# vim test.conf #創建一個配置文件，編輯內容如下
[[email protected] conf.d]# cat test.conf
namevirtualhost 172.18.252.80:80 namevirtualhost 172.18.252.90:80 <virtualhost 172.18.252.80:80> documentroot "/web/vhosts/x" servername "www.X.com" ErrorLog "/var/log/httpd/x.err" CustomLog "/var/log/httpd/x.access" common <Directory "/web/vhosts/x"> Options Indexes FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> </VirtualHost>
<virtualhost 172.18.252.90:80> documentroot "/web/vhosts/y" servername "www.Y.com" # 主機名（域名） ErrorLog "/var/log/httpd/www2.err" CustomLog "/var/log/httpd/y.access" common <Directory "/web/vhosts/y"> Options Indexes FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> </VirtualHost> |
實現status頁面
在主配置文件/etc/httpd/conf/httpd.conf
取消註釋
LoadModule status_module modules/mod_status.so
這項，加載此模塊
添加如下內容
<Location /Server-status> SetHandler Server-status Order deny,allow Deny from all Allow from 172.18.252.80:80 </Location> |
[[email protected] conf.d]# httpd -t #檢查語法
[[email protected] conf.d]# service httpd reload #重啟服務
設置dns服務器地址
[[email protected] conf.d]# vim /etc/resolv.conf
nameserver 172.18.253.55
註：網卡eth0 配置文件中設置 PEERDNS=no
DNS服務器（172.18.253.55）
安裝named服務
[[email protected] ~]# yum -y install bind
啟動named服務
[[email protected] ~]# service named start
設置dns服務器地址
search X.com # 本機所在域dns服務器解析區域，包含X.com Y.com
search Y.com
nameserver 172.18.253.55 #本機ip為dns解析地址
註意：dns所在ip網卡配置文件設置PEERDNS=no
修改配置文件定義options
vim /etc/named.conf
options {*OPTIONS選項用來定義一些影響整個DNS服務器的環境
listen-on port 53 { any;}; ---any指監聽本機的所有ip，端口為53
directory "/var/named"; 指定的域名解析文件的路徑，如這裏的是將其指定到/var/named 下
allow-query { any; }; ---允許所有主機查詢本機的dns，也可以額指定某個ip
recursion yes; ---表示允許遞歸叠代，改為no就是不到根上去查找了
dnssec-enable no;
dnssec-validation no;
}；
修改區域解析庫的配置文件
vim /etc/named.rfc1912.zone或者
vim /etc/named.conf
[[email protected] ~]# cat /etc/named.rfc1912.zones
zone "X.com" IN { type master; file "X.com.zone"; };
zone "Y.com" IN { type master; file "Y.com.zone"; }; |
[[email protected] ~]# named-checkconf #檢查語法錯誤
配置解析域文件
[[email protected] ~]# vim /var/named/Y.com.zone
[[email protected] ~]# cat /var/named/Y.com.zone
$TTL 1D @ IN SOA dns admin ( 2017092111 1D 1H 1W 3H) NS dns.Y.com. dns A 172.18.253.55 www A 172.18.252.90 |
[[email protected] ~]# vim /var/named/X.com.zone
[[email protected] ~]# cat /var/named/X.com.zone
$TTL 1D
@ IN SOA dns admin ( 2017092918 1D 1H 1W 3H) NS dns.X.com. dns A 172.18.253.55 www A 172.18.252.80 |
檢查語法錯誤
[[email protected] ~]# named-checkzone "Y.com"/var/named/Y.com.zone
zone Y.com/IN: loaded serial 2017092111
OK
[[email protected] ~]# named-checkzone "X.com"/var/named/X.com.zone
zone X.com/IN: loaded serial 2017092918
OK
測試
[[email protected] ~]# elinks -source http://www.X.com
www.X.com
[[email protected] ~]# elinks -source http://www.Y.com
www.Y.com
在httpd服務器(172.18.252.80)上查看日誌
[[email protected] ~]# cat /var/log/httpd/x.access
172.18.252.90 - - [27/Sep/2017:01:42:36 +0800] "GET /HTTP/1.1" 200 10
172.18.253.55 - - [27/Sep/2017:01:45:25 +0800] "GET /HTTP/1.1" 200 10
CA根證書搭建(172.18.252.36)
安裝openssl包
[[email protected] ~]# yum -y install openssl
生成證書索引文件，指定第一個頒發證書的序列號
[[email protected] ~]# touch /etc/pki/CA/index.txt
[[email protected] ~]# echo 01 >/etc/pki/CA/serial
[[email protected] ~]# cat /etc/pki/CA/serial
01
生成私鑰
[[email protected] CA]# (umask 066;openssl genrsa -outprivate/cakey.pem 2048)
生成自簽名證書
[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem-out cacert.pem -days 7300
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:magedu.com
查看證書信息
[[email protected] CA]# openssl x509 -in cacert.pem -noout -subject
subject= /C=CN/ST=beijing/L=beijing/O=magedu.com/OU=ops
httpd服務器（172.18.252.80）上為虛擬主機（172.18.252.90）www.Y.com配置支持https
安裝httpd支持ssl模塊
[[email protected] ~]#yum install mod_ssl -y
安裝openssl包
[[email protected] ~]# yum install openssl
生成私鑰
[[email protected] ~]# cd /etc/httpd/conf
[[email protected] conf]# mkdir ssl
[[email protected] conf]# cd ssl
[[email protected] ssl]# (umask 077;openssl genrsa -out httpd.key 1024)
生成證書申請
[[email protected] ssl]# openssl req -new -key httpd.key -out httpd.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:magedu.com
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server‘s hostname) []:www.Y.com
Email Address []:[email protected]
向根CA證書（172.18.252.36）發起簽證請求
[[email protected] ssl]# scp httpd.csr 172.18.252.36:/etc/pki/CA
在根CA所在主機上（172.18.252.36）完成簽證
[[email protected] CA]# ls
cacert.pem certs crl httpd.csr index.txt newcerts private serial
[[email protected] CA]# openssl ca -in httpd.csr -out certs/httpd.crt-days 720
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
[[email protected] CA]# scp certs/httpd.crt172.18.252.80:/etc/httpd/conf/ssl
在httpd服務器（172.18.252.80）上
[[email protected] ssl]# ls
httpd.crt httpd.csr httpd.key #證書
修改httpd的ssl配置文件
vim /etc/httpd/conf.d/ssl.conf
DocumentRoot "/web/vhosts/y/"
ServerName www.Y.com
SSLCertificateFile /etc/httpd/conf/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl/httpd.key
[[email protected] ssl]# httpd -t
Syntax OK
[[email protected] ssl]# service httpd restart
將ca證書導入到客戶端可信任證書服務器，並驗證
在windows的c:/windows/system32/drivers/etc/hosts文件中加入
測試
本文出自 “13147015” 博客，請務必保留此出處http://13157015.blog.51cto.com/13147015/1970049
httpd服務之虛擬主機、訪問控制、https配置