httpd，被设计为一个独立运行


httpd

目录
  • httpd
    • 1.httpd简介
    • 2.httpd的特性
      • 2.1 httpd2.4版本型新添加的模块
    • 3.httpd基础
      • 3.1 httpd自带的工具程序
      • 3.2 rpm包安装的httpd程序环境
      • 3.3 web相关的命令
      • 3.4 httpd常用的配置文件
    • 4.编译安装httpd
      • 4.1准备环境
      • 4.2下载 apr apr-util httpd
      • 4.3 解压apr apr-util httpd
      • 4.4 安装apr apr-util httpd
      • 4.5 配置环境变量
      • 4.6 关闭防火墙和selinux服务
      • 4.7 开启apache服务,并看出是否能访问
      • 4.8 取消警告信息
      • 4.9 使用systemctl命令使用httpd
    • 5.访问控制权限
    • 6.配置三种不同的虚拟主机
      • 6.1 配置相同IP不同端口
      • 6.2 配置不同IP相同端口
      • 6.3 配置相同IP相同端口不同域名
      • 6.4 添加访问权限
    • 7.配置https
      • 7.1 安装ssl安全模块
      • 7.2 CA生成一对密钥
      • 7.3 CA生成自签署证书
      • 7.4 客户端生成密钥
      • 7.5 客户端生成证书签署请求
      • 7.6 CA签署客户端提交上来的证书
      • 7.7 修改ssl.conf配置文件
      • 7.8 查看效果

1.httpd简介

httpd是Apache超文本传输协议（HTTP）服务器的主程序。被设计为一个独立运行的后台进程，它会建立一个处理请求的子进程或线程的池。

通常，httpd不应该被直接调用，而应该在类Unix系统中由apachectl调用，在Windows中作为服务运行。

2.httpd的特性

httpd有很多特性，下面就分别来说说httpd-2.2版本和httpd-2.4版本各自的特性。

版本 特性
2.2 事先创建进程 按需维持适当的进程 模块化设计，核心比较小，各种功能通过模块添加（包括PHP），支持运行时配置，支持单独编译模块 支持多种方式的虚拟主机配置，如基于ip的虚拟主机，基于端口的虚拟主机，基于域名的虚拟主机等 支持https协议（通过mod_ssl模块实现） 支持用户认证 支持基于IP或域名的ACL访问控制机制 支持每目录的访问控制（用户访问默认主页时不需要提供用户名和密码，但是用户访问某特定目录时需要提供用户名和密码） 支持URL重写 支持MPM（Multi Path Modules，多处理模块）。用于定义httpd的工作模型（单进程、单进程多线程、多进程、多进程单线程、多进程多线程）
2.4 httpd-2.4的新特性： MPM支持运行DSO机制（Dynamic Share Object，模块的动态装/卸载机制），以模块形式按需加载 支持event MPM，eventMPM模块生产环境可用 支持异步读写 支持每个模块及每个目录分别使用各自的日志级别 每个请求相关的专业配置，使用来配置 增强版的表达式分析器 支持毫秒级的keepalive timeout 基于FQDN的虚拟主机不再需要NameVirtualHost指令 支持用户自定义变量 支持新的指令（AllowOverrideList） 降低对内存的消耗
工作模型 工作方式
prefork 多进程模型，预先生成进程，一个请求用一个进程响应 一个主进程负责生成n个子进程，子进程也称为工作进程 每个子进程处理一个用户请求，即使没有用户请求，也会预先生成多个空闲进程，随时等待请求到达，最大不会超过1024个
worker 基于线程工作，一个请求用一个线程响应（启动多个进程，每个进程生成多个线程）
event 基于事件的驱动，一个进程处理多个请求

2.1 httpd2.4版本型新添加的模块

添加了之后常用的几个模块

模块 功能
mod_proxy_fcgi 反向代理时支持apache服务器后端协议的模块
mod_ratelimit 提供速率限制功能的模块
mod_remoteip 基于ip的访问控制机制被改变，不再支持使用Order，Deny，Allow来做基于IP的访问控制

3.httpd基础

3.1 httpd自带的工具程序

工具 功能
htpasswd basic认证基于文件实现时，用到的帐号密码生成工具
apachectl httpd自带的服务控制脚本，支持start，stop，restart
apxs 由httpd-devel包提供的，扩展httpd使用第三方模块的工具
rotatelogs 日志滚动工具
suexec 访问某些有特殊权限配置的资源时，临时切换至指定用户运行的工具
ab apache benchmark，httpd的压力测试工具

3.2 rpm包安装的httpd程序环境

文件/目录 对应的功能
/var/log/httpd/access.log 访问日志
/var/log/httpd/error_log 错误日志
/var/www/html/ 站点文档目录
/usr/lib64/httpd/modules/ 模块文件路径
/etc/httpd/conf/httpd.conf 主配置文件
/etc/httpd/conf.modules.d/*.conf 模块配置文件
/etc/httpd/conf.d/*.conf 辅助配置文件

3.3 web相关的命令

curl命令

curl是基于URL语法在命令行方式下工作的文件传输工具，它支持FTP，FTPS，HTTP，HTTPS，GOPHER，TELNET，DICT，FILE及LDAP等协议。

curl支持以下功能：

  • https认证
  • http的POST/PUT等方法
  • ftp上传
  • kerberos认证
  • http上传
  • 代理服务器
  • cookies
  • 用户名/密码认证
  • 下载文件断点续传
  • socks5代理服务器
  • 通过http代理服务器上传文件到ftp服务器
//语法：curl [options] [URL ...]
//常用的options：
    -A/--user-agent <string>    //设置用户代理发送给服务器
    -basic              //使用Http基本认证
    --tcp-nodelay       //使用TCP_NODELAY选项
    -e/--referer <URL>      //来源网址
    --cacert <file>     //CA证书（SSL）
    --compressed        //要求返回时压缩的格式
    -H/--header <line>  //自定义请求首部信息传递给服务器
    -I/--head           //只显示响应报文首部信息
    --limit-rate <rate>     //设置传输速度
    -u/--user <user[:password]>     //设置服务器的用户和密码
    -0/--http1      //使用http 1.0版本，默认使用1.1版本。这个选项是数字0而不是字母o
    -o/--output     //把输出写到文件中
    -#/--progress-bar       //进度条显示当前的传送状态

httpd命令

//语法：httpd [options]
//常用的options：
    -l      //查看静态编译的模块，列出核心中编译了哪些模块。 \
            //它不会列出使用LoadModule指令动态加载的模块
    -M      //输出一个已经启用的模块列表，包括静态编译在服务 \
            //器中的模块和作为DSO动态加载的模块
    -v      //显示httpd的版本，然后退出
    -V      //显示httpd和apr/apr-util的版本和编译参数，然后退出
    -X      //以调试模式运行httpd。仅启动一个工作进程，并且 \
            //服务器不与控制台脱离
    -t      //检查配置文件是否有语法错误

命令演示

[root@localhost ~]# httpd -t
Syntax OK

[root@localhost ~]# httpd -l
Compiled in modules:
  core.c
  mod_so.c
  http_core.c

[root@localhost ~]# httpd -M
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 access_compat_module (shared)
 actions_module (shared)
 alias_module (shared)
 allowmethods_module (shared)

[root@localhost ~]# httpd -v			//小写v
Server version: Apache/2.4.37 (centos)
Server built:   Nov 12 2021 04:57:27

[root@localhost ~]# httpd -V			//大写V
Server version: Apache/2.4.37 (centos)
Server built:   Nov 12 2021 04:57:27
Server's Module Magic Number: 20120211:83
Server loaded:  APR 1.6.3, APR-UTIL 1.6.1
Compiled using: APR 1.6.3, APR-UTIL 1.6.1
Architecture:   64-bit
Server MPM:     event
  threaded:     yes (fixed thread count)
    forked:     yes (variable process count)

3.4 httpd常用的配置文件

NAME有三种，分别是：

  • prefork
  • event
  • worker

配置文件位置：

[root@localhost conf.modules.d]# pwd
/etc/httpd/conf.modules.d
[root@localhost conf.modules.d]# ls
00-base.conf  00-lua.conf  00-proxy.conf    01-cgi.conf
00-dav.conf   00-mpm.conf  00-systemd.conf
[root@localhost conf.modules.d]# vim 00-mpm.conf
# Select the MPM module which should be used by uncommenting exactly
# one of the following LoadModule lines:

# prefork MPM: Implements a non-threaded, pre-forking web server
# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
LoadModule mpm_prefork_module modules/mod_mpm_prefork.s

访问控制法则：

法则 功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名的主机访问
Require not host HOSTNAME 拒绝指定来源主机名的主机访问
IPADDR的类型 HOSTNAME的类型
IP：192.168.1.1
Network/mask：192.168.1.0/255.255.255.0
Network/Length：192.168.1.0/24
Net：192.168		 FQDN：特定主机的全名 DOMAIN：指定域内的所有主机

注意：httpd-2.4版本默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问

配置文件示例

<Directory "/var/www/html/www">
    <RequireAll>
        Require not ip 192.168.111.1
        Require all granted
    </RequireAll>
</Directory>

4.编译安装httpd

4.1准备环境

[root@localhost ~]# dnf -y groupinstall "Development Tools" --allowerasing
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 0:03:34 ago on Tue Jul 12 22:42:38 2022.
Dependencies resolved.
===============================================================================================================
 Package                                Arch     Version                                    Repository    Size
===============================================================================================================
Installing group/module packages:
Complete!
[root@localhost ~]# useradd -rMs /sbin/nologin apache 
[root@localhost ~]# id apache
uid=994(apache) gid=991(apache) groups=991(apache)
[root@localhost ~]# dnf -y install wget
[root@localhost ~]# dnf -y install openssl-devel pcre-devel expat-devel libtool libxml2-devel
[root@localhost ~]# dnf -y install gcc gcc-c++
[root@localhost ~]# dnf -y install make

4.2下载 apr apr-util httpd

[root@localhost ~]# wget http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
--2022-07-12 22:50:06--  http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.230, 58.49.248.232, 119.96.204.214, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.230|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/octet-stream]
Saving to: 'apr-1.7.0.tar.gz'
apr-1.7.0.tar.gz            100%[==========================================>]   1.04M  --.-KB/s    in 0.06s   
2022-07-12 22:50:06 (18.4 MB/s) - 'apr-1.7.0.tar.gz' saved [1093896/1093896]


[root@localhost ~]# wget https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
--2022-07-12 22:50:49--  https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.229, 119.96.204.215, 58.49.248.226, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.229|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/octet-stream]
Saving to: 'apr-util-1.6.1.tar.gz'
apr-util-1.6.1.tar.gz       100%[==========================================>] 541.31K  --.-KB/s    in 0.04s   
2022-07-12 22:50:49 (14.6 MB/s) - 'apr-util-1.6.1.tar.gz' saved [554301/554301]

[root@localhost ~]# wget https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
--2022-07-12 22:51:06--  https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 58.49.248.229, 119.96.204.215, 58.49.248.226, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|58.49.248.229|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9743277 (9.3M) [application/octet-stream]
Saving to: 'httpd-2.4.54.tar.gz'
httpd-2.4.54.tar.gz         100%[==========================================>]   9.29M  39.8MB/s    in 0.2s    
2022-07-12 22:51:07 (39.8 MB/s) - 'httpd-2.4.54.tar.gz' saved [9743277/9743277]
[root@localhost ~]# ls
anaconda-ks.cfg  apr-1.7.0.tar.gz  apr-util-1.6.1.tar.gz  httpd-2.4.54.tar.gz

4.3 解压apr apr-util httpd

[root@localhost ~]# tar -xf apr-util-1.6.1.tar.gz -C /usr/local/src/
[root@localhost ~]# tar -xf httpd-2.4.54.tar.gz -C /usr/local/src/
[root@localhost ~]# tar -xf apr-1.7.0.tar.gz -C /usr/local/src/
[root@localhost ~]# ls /usr/local/src/
apr-1.7.0  apr-util-1.6.1  httpd-2.4.54

4.4 安装apr apr-util httpd

安装apr

[root@localhost ~]# cd /usr/local/src/apr-1.7.0/
[root@localhost apr-1.7.0]# vi configure
cfgfile=${ofile}T
    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
    #$RM "$cfgfile"			//注释这行
[root@localhost apr-1.7.0]# ./configure --prefix=/usr/local/apr
[root@localhost apr-1.7.0]# make && make install
[root@localhost apr-1.7.0]# ls /usr/local/apr/
bin  build-1  include  lib

安装apr-util

[root@localhost apr-util-1.6.1]# cd /usr/local/src/apr-util-1.6.1/
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr/
[root@localhost apr-util-1.6.1]# make && make install
[root@localhost apr-util-1.6.1]# ls /usr/local/apr-util/
bin  include  lib

安装httpd

[root@localhost httpd-2.4.54]# cd /usr/local/src/httpd-2.4.54/
[root@localhost httpd-2.4.54]# ./configure --prefix=/usr/local/apache --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util/ --enable-modules=most --enable-mpms-shared=all --with-rpm=prefork
[root@localhost httpd-2.4.54]# make && make install
[root@localhost httpd-2.4.54]# ls /usr/local/apache/
bin    cgi-bin  error   icons    logs  manual
build  conf     htdocs  include  man   modules

4.5 配置环境变量

[root@localhost ~]# echo 'export PATH=/usr/local/apache/bin:$PATH' > /etc/profile.d/apache.sh
[root@localhost ~]# source /etc/profile.d/apache.sh 
[root@localhost ~]# which apachectl
/usr/local/apache/bin/apachectl
[root@localhost ~]# ln -s /usr/local/apache/include/ /usr/include/apache
[root@localhost ~]# ll /usr/include/ | grep apache
lrwxrwxrwx.  1 root root     26 Jul 12 23:15 apache -> /usr/local/apache/include/	
[root@localhost ~]# vi /etc/man_db.conf 	//使apache的man生效
#MANDATORY_MANPATH                      /usr/src/pvm3/man
#
MANDATORY_MANPATH                       /usr/man
MANDATORY_MANPATH                       /usr/share/man
MANDATORY_MANPATH                       /usr/local/share/man
MANDATORY_MANPATH                       /usr/local/apache/man	//添加此行

4.6 关闭防火墙和selinux服务

[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost ~]# setenforce 0

4.7 开启apache服务,并看出是否能访问

[root@localhost ~]# apachectl start
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
httpd (pid 147215) already running
[root@localhost ~]# ss -anltup | grep httpd
tcp   LISTEN 0      128                *:80              *:*    users:(("httpd",pid=147218,fd=4),("httpd",pid=147217,fd=4),("httpd",pid=147216,fd=4),("httpd",pid=147215,fd=4))

4.8 取消警告信息

[root@localhost ~]# cd /usr/local/apache/
[root@localhost apache]# ls
bin    cgi-bin  error   icons    logs  manual
build  conf     htdocs  include  man   modules
[root@localhost apache]# cd conf/
[root@localhost conf]# ls
extra  httpd.conf  magic  mime.types  original
[root@localhost conf]# vi httpd.conf 
#ServerName www.example.com:80		//删除注释
[root@localhost conf]# apachectl start			//此时没有警告
[root@localhost conf]# ss -anlt
State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process 
LISTEN  0       128            0.0.0.0:22          0.0.0.0:*            
LISTEN  0       128                  *:80                *:*            
LISTEN  0       128               [::]:22             [::]:*

4.9 使用systemctl命令使用httpd

[root@localhost ~]# cd /usr/lib/systemd/system
[root@localhost system]# ls sshd.service 
sshd.service
[root@localhost system]# cp sshd.service httpd.service
[root@localhost system]# vi httpd.service 
[Unit]
Description=OpenSSH server daemon		//修改成Description=httpd server daemon
Documentation=man:sshd(8) man:sshd_config(5)		//删除
After=network.target sshd-keygen.target
Wants=sshd-keygen.target		//删除

[Service]
Type=notify		//修改成Type=forking
EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config	//删除
EnvironmentFile=-/etc/sysconfig/sshd	//删除
ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY		//修改成ExecStart=/usr/local/apache/bin/apachectl start
ExecStop=/usr/local/apache/bin/apachectl stop  //添加此行用作停止
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process		//删除
Restart=on-failure		//删除
RestartSec=42s			//删除

[Install]
WantedBy=multi-user.target

[root@localhost system]# cat httpd.service 
[Unit]
Description=httpd server daemon
After=network.target sshd-keygen.target

[Service]
Type=forking
ExecStart=/usr/local/apache/bin/apachectl start
ExecStop=/usr/local/apache/bin/apachectl stop
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

[root@localhost system]# systemctl daemon-reload
[root@localhost system]# cd
[root@localhost ~]# systemctl status httpd
● httpd.service - httpd server daemon
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; ven>
   Active: inactive (dead)
lines 1-3/3 (END)
[root@localhost ~]# systemctl start httpd
[root@localhost ~]# ss -anlt 		//查看80端口已开启
State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process 
LISTEN  0       128            0.0.0.0:22          0.0.0.0:*            
LISTEN  0       128                  *:80                *:*            
LISTEN  0       128               [::]:22             [::]:*            
[root@localhost ~]# systemctl status httpd
● httpd.service - httpd server daemon
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; ven>
   Active: active (running) since Wed 2022-07-13 19:26:50 CST; 7s ago
  Process: 145364 ExecStart=/usr/local/apache/bin/apachectl start (code>
 Main PID: 145367 (httpd)
    Tasks: 82 (limit: 23457)
   Memory: 21.6M
   CGroup: /system.slice/httpd.service
           ├─145367 /usr/local/apache/bin/httpd -k start
           ├─145368 /usr/local/apache/bin/httpd -k start
           ├─145369 /usr/local/apache/bin/httpd -k start
           └─145370 /usr/local/apache/bin/httpd -k start

Jul 13 19:26:50 localhost.localdomain systemd[1]: Starting httpd server>
Jul 13 19:26:50 localhost.localdomain systemd[1]: Started httpd server >

5.访问控制权限

访问当前虚拟机的IP

[root@localhost ~]# dnf -y install httpd
[root@localhost ~]# cd /var/www/html/
[root@localhost html]# ls
[root@localhost html]# echo "123" > index.html
[root@localhost html]# systemctl restart httpd
[root@localhost html]# systemctl stop firewalld
[root@localhost html]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost html]# setenforce 0

在/var/www/html下新建一个zxr目录，在zxr目录下创建一个a.html文件，进行访问测试

[root@localhost ~]# cd /var/www/html/
[root@localhost html]# ls
index.html
[root@localhost html]# mkdir zxr
[root@localhost html]# ls
index.html  zxr
[root@localhost html]# cd zxr/
[root@localhost zxr]# echo "abc" > a.html
[root@localhost zxr]# ls
a.html
[root@localhost zxr]# systemctl restart httpd

设置物理机不允许访问/var/www/html/zxr/a.html

[root@localhost ~]# vi /etc/httpd/conf/httpd.conf 
<Directory "/var/www/html/zxr">
    <RequireAll>
        Require not ip 192.168.111.1
        Require all granted
    </RequireAll>
</Directory>
[root@localhost ~]# httpd -t
Syntax OK
[root@localhost ~]# systemctl restaer httpd
[root@localhost ~]# curl http://192.168.111.135
123
[root@localhost ~]# curl http://192.168.111.135/zxr/a.html
abc

设置物理机可以访问虚拟机访问不了

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf 
<Directory "/var/www/html/zxr">
    <RequireAll>
        Require not ip 192.168.111.135
        Require all granted
    </RequireAll>
</Directory>
[root@localhost ~]# httpd -t
Syntax OK


[root@localhost ~]# curl http://192.168.111.135/zxr/a.html			//访问失败
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

6.配置三种不同的虚拟主机

虚拟主机有三类：

  • 相同IP不同端口
  • 不同IP相同端口
  • 相同IP相同端口不同域名

6.1 配置相同IP不同端口

先将需要使用的上传到/var/www/html下

[root@localhost ~]# dnf -y install httpd
[root@localhost ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@localhost ~]# cd /etc/httpd/
[root@localhost httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run  state
[root@localhost httpd]# cd conf.d/
[root@localhost conf.d]# ls
README  autoindex.conf  userdir.conf  welcome.conf
[root@localhost conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf /etc/httpd/conf.d/
[root@localhost conf.d]# ls
README  autoindex.conf  httpd-vhosts.conf  userdir.conf  welcome.conf
[root@localhost conf.d]# cd /var/www/html/
[root@localhost html]# ls
doudizhu.zip  zhuawawaji.zip		//需要将自己要使用的上传至文件夹内
[root@localhost html]# dnf -y install unzip			//没有unzip解压需要下载一个
[root@localhost html]# unzip doudizhu.zip
[root@localhost html]# unzip zhuawawaji.zip 
[root@localhost html]# ls
 doudizhu.zip  'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji.zip
[root@localhost html]# rm -rf doudizhu.zip zhuawawaji.zip 
[root@localhost html]# ls
'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码
[root@localhost html]# mkdir doudizhu zhuawawaji
[root@localhost html]# mv 'HTML5 canvas移动端斗地主小游戏'/* doudizhu/
[root@localhost html]# cd doudizhu/
[root@localhost doudizhu]# ls
DJDDZ.js  img  index.html  JControls.js  Prototype.js  ResourceData.js
[root@localhost html]# mv jQuery抓娃娃机游戏代码/* zhuawawaji/
[root@localhost html]# cd zhuawawaji/
[root@localhost zhuawawaji]# ls
images  img  index.html  js
[root@localhost html]# ls
 doudizhu  'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji
[root@localhost html]# rm -rf jQuery抓娃娃机游戏代码 HTML5\ canvas移动端斗地主小游戏/
[root@localhost html]# ls
doudizhu  zhuawawaji
[root@localhost html]# cd /etc/httpd/conf.d/
[root@localhost conf.d]# vim  httpd-vhosts.conf 	//修改配置文件
<VirtualHost 192.168.111.135:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>

listen 81
<VirtualHost 192.168.111.135:81>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl stop firewalld		//没关闭防火墙需要关闭防火墙
[root@localhost conf.d]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost conf.d]# systemctl restart httpd

查看效果

6.2 配置不同IP相同端口

[root@localhost conf.d]# ip addr add 192.168.111.140/24 dev ens33
[root@localhost conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:6d:53:62 brd ff:ff:ff:ff:ff:ff
    inet 192.168.111.135/24 brd 192.168.111.255 scope global dynamic noprefixroute ens33
       valid_lft 1088sec preferred_lft 1088sec
    inet 192.168.111.140/24 scope global secondary ens33	//添加成功
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe6d:5362/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

<VirtualHost 192.168.111.135:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# vim httpd-vhosts.conf 
<VirtualHost 192.168.111.140:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd

查看效果

6.3 配置相同IP相同端口不同域名

windows hosts文件位置：

C:\windows\system32\drivers\etc\下

打开方式选择记事本

添加IP和域名并保存

[root@localhost conf.d]# dnf -y install bind-utils
[root@localhost conf.d]# vim httpd-vhosts.conf 
<VirtualHost 192.168.111.135:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>

<VirtualHost 192.168.111.135:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd

查看效果

6.4 添加访问权限

[root@localhost conf.d]# vim httpd-vhosts.conf 
<Directory /var/www/html/zhuawawaji>
    <RequireAll>
        Require not ip 192.168.111.1
        Require all granted
    </RequireAll>
</Directory>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd

查看效果

7.配置https

7.1 安装ssl安全模块

[root@localhost ~]# dnf -y install mod_ssl
Last metadata expiration check: 0:36:22 ago on Sat 23 Jul 2022 03:23:44 PM CST.
Dependencies resolved.
===========================================================================================================================
 Package             Architecture       Version                                                Repository             Size
===========================================================================================================================
Installing:
 mod_ssl             x86_64             1:2.4.37-43.module_el8.5.0+1022+b541f3b1               AppStream             136 k
Installing dependencies:
 sscg                x86_64             2.3.3-14.el8                                           AppStream              49 k

Transaction Summary
===========================================================================================================================
Install  2 Packages

Total download size: 185 k
Installed size: 364 k
Downloading Packages:
(1/2): sscg-2.3.3-14.el8.x86_64.rpm                                                        109 kB/s |  49 kB     00:00    
(2/2): mod_ssl-2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64.rpm                           205 kB/s | 136 kB     00:00    
---------------------------------------------------------------------------------------------------------------------------
Total                                                                                      279 kB/s | 185 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                   1/1 
  Installing       : sscg-2.3.3-14.el8.x86_64                                                                          1/2 
  Installing       : mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           2/2 
  Running scriptlet: mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           2/2 
  Verifying        : mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                                           1/2 
  Verifying        : sscg-2.3.3-14.el8.x86_64                                                                          2/2 

Installed:
  mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                     sscg-2.3.3-14.el8.x86_64                    

Complete!
[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# httpd -M | grep ssl
 ssl_module (shared)

7.2 CA生成一对密钥

[root@localhost ~]# cd /etc/pki/
[root@localhost pki]# ls
ca-trust  java  rpm-gpg  rsyslog  tls
[root@localhost pki]# mkdir CA
[root@localhost pki]# cd CA/
[root@localhost CA]# pwd
/etc/pki/CA
[root@localhost CA]# mkdir private
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..................................................+++++
...................+++++
e is 65537 (0x010001)
[root@localhost CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Rk5ctGrccaHpgdm9luZ
ZKnskqUCjEVby2ftNgPiiPfvXaXZTVtydngnc8KJM3vUj+Ci2FlxTV28xiz+MTQJ
73M1eDwV4KG0Fh6H+vt9G7HPLpjt66vPPfQBnyjbUgxOL1rhRVeLRi86x9EV5NMF
dhxjXk30dCbeluz+EXLnVjf2mYDDeF43ShngME56D1qU70+iJkopnV5AB1XkKEKw
SmK13IHc/h1TfaoSuwHw8vNSJanz8Wk5vVG8uyJUDFCPg/eMuj59sSJue+1xZRkr
vjbA6g7hkY5BIhSJiuv7yzmpHsEj4lD0et0c9+xgZCy21mkVlAcoQPe0chKgM7O0
MQIDAQAB
-----END PUBLIC KEY-----

7.3 CA生成自签署证书

[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.doudizhu.com
Email Address []:1@2.com
[root@localhost CA]# openssl x509 -text -in cacert.pem
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt && echo 01 > serial
[root@localhost CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@localhost CA]# cat serial 
01

7.4 客户端生成密钥

[root@localhost CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
...................................................................................+++++
..........................+++++
e is 65537 (0x010001)
[root@localhost ssl]# ls
httpd.key

7.5 客户端生成证书签署请求

[root@localhost ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr 
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wu
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.duodizhu.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost ssl]# ls
httpd.csr  httpd.key

7.6 CA签署客户端提交上来的证书

[root@localhost ssl]# openssl ca -in ./httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 23 08:37:51 2022 GMT
            Not After : Jul 23 08:37:51 2023 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = hb
            organizationName          = runtime
            organizationalUnitName    = peixun
            commonName                = www.duodizhu.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                27:23:14:CB:51:6C:E0:8E:D8:8C:B1:D2:EF:BB:62:1F:EB:A1:97:E5
            X509v3 Authority Key Identifier: 
                keyid:C8:13:CA:71:2C:58:9B:16:6B:84:4F:71:41:9C:FA:B9:19:49:25:76

Certificate is to be certified until Jul 23 08:37:51 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost ssl]# ls
httpd.crt  httpd.csr  httpd.key

7.7 修改ssl.conf配置文件

[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]# cd /etc/httpd/conf.d/
[root@localhost conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  ssl.conf  userdir.conf  welcome.conf
[root@localhost conf.d]# vim ssl.conf 	

<VirtualHost _default_:443>

# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/zhuawawaji"		
ServerName www.zhuawawaji.com:443

SSLCertificateFile /etc/httpd/ssl/httpd.crt		//修改位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key	//修改位置
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd
[root@localhost conf.d]# ss -anlt | grep 443
LISTEN 0      128                *:443             *:*

7.8 查看效果

相关内容

    暂无相关文章