CentOS编译httpd 2.4.43 http2报错处理

 未分类  No Responses »
7 月 282020
 

CentOS 8

编译报错（提示为nghttp2版本太旧）

[root@test httpd-2.4.43]# ./configure --enable-http2

checking for nghttp2... checking for user-provided nghttp2 base directory... none
checking for pkg-config along ... checking for nghttp2 version >= 1.2.1... FAILED
configure: WARNING: nghttp2 version is too old

启用仅CentOS 8支持的Power Tools软件源仓库

可供 CentOS 使用的软件库
https://wiki.centos.org/zh/AdditionalResources/Repositories

PowerTools —— 只供 CentOS8 使用，PowerTools 软件库提供了大量开发者用的工具。缺省是停用的。

[root@test httpd-2.4.43]# dnf config-manager --set-enabled PowerTools
[root@test httpd-2.4.43]# dnf makecache
CentOS-8 - AppStream                                           9.6 kB/s | 4.3 kB     00:00
CentOS-8 - Base                                                8.6 kB/s | 3.9 kB     00:00
CentOS-8 - Extras                                              4.4 kB/s | 1.5 kB     00:00
CentOS-8 - PowerTools                                          1.7 MB/s | 1.9 MB     00:01
Extra Packages for Enterprise Linux Modular 8 - x86_64          57 kB/s |  18 kB     00:00
Extra Packages for Enterprise Linux 8 - x86_64                  58 kB/s |  18 kB     00:00
Metadata cache created.
[root@test httpd-2.4.43]#

安装开发库

[root@test httpd-2.4.43]# dnf -y install libnghttp2-devel

===============================================================================================
 Package                   Architecture    Version                   Repository           Size
===============================================================================================
Installing:
 libnghttp2-devel          x86_64          1.33.0-3.el8_2.1          PowerTools           60 k

Transaction Summary
===============================================================================================
Install  1 Package

重新编译

[root@test httpd-2.4.43]# ./configure --enable-http2

checking whether to enable mod_http2... checking dependencies
checking for OpenSSL... (cached) yes
  setting MOD_LDFLAGS to "-lssl -lcrypto    -lpthread -ldl"
  setting MOD_CFLAGS to ""
  setting MOD_CPPFLAGS to "-DH2_OPENSSL"
checking for nghttp2... checking for user-provided nghttp2 base directory... none
checking for pkg-config along ...   setting MOD_CFLAGS to ""
checking for nghttp2 version >= 1.2.1... OK
  adding "-lnghttp2" to MOD_LDFLAGS
  setting LIBS to "-lnghttp2    -lpthread -ldl"
checking nghttp2/nghttp2.h usability... yes
checking nghttp2/nghttp2.h presence... yes
checking for nghttp2/nghttp2.h... yes
checking for nghttp2_session_server_new2... yes
checking for nghttp2_stream_get_weight... yes
checking for nghttp2_session_change_stream_priority... yes
  adding "-DH2_NG2_CHANGE_PRIO" to MOD_CPPFLAGS
checking for nghttp2_session_callbacks_set_on_invalid_header_callback... yes
  adding "-DH2_NG2_INVALID_HEADER_CB" to MOD_CPPFLAGS
checking for nghttp2_session_get_stream_local_window_size... yes
  adding "-DH2_NG2_LOCAL_WIN_SIZE" to MOD_CPPFLAGS
yes
  setting MOD_HTTP2_LDADD to "-export-symbols-regex http2_module"

Subversion使用MySQL作密码验证配置

 存储  No Responses »
6 月 102020
 

安装Apache及Subversion服务

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# yum install httpd subversion mod_dav_svn mariadb-server mariadb apr-util-mysql

Installed:
  apr-util-mysql.x86_64 0:1.5.2-6.el7                httpd.x86_64 0:2.4.6-93.el7.centos                 
  mariadb.x86_64 1:5.5.65-1.el7                      mariadb-server.x86_64 1:5.5.65-1.el7               
  mod_dav_svn.x86_64 0:1.7.14-14.el7                 subversion.x86_64 0:1.7.14-14.el7                  

Dependency Installed:
  apr.x86_64 0:1.4.8-5.el7                            apr-util.x86_64 0:1.5.2-6.el7                     
  centos-logos.noarch 0:70.0.6-3.el7.centos           gnutls.x86_64 0:3.3.29-9.el7_6                    
  httpd-tools.x86_64 0:2.4.6-93.el7.centos            libaio.x86_64 0:0.3.109-13.el7                    
  libmodman.x86_64 0:2.0.1-8.el7                      libproxy.x86_64 0:0.4.11-11.el7                   
  mailcap.noarch 0:2.1.41-2.el7                       neon.x86_64 0:0.30.0-4.el7                        
  nettle.x86_64 0:2.7.1-8.el7                         pakchois.x86_64 0:0.4-10.el7                      
  perl.x86_64 4:5.16.3-295.el7                        perl-Carp.noarch 0:1.26-244.el7                   
  perl-Compress-Raw-Bzip2.x86_64 0:2.061-3.el7        perl-Compress-Raw-Zlib.x86_64 1:2.061-4.el7       
  perl-DBD-MySQL.x86_64 0:4.023-6.el7                 perl-DBI.x86_64 0:1.627-4.el7                     
  perl-Data-Dumper.x86_64 0:2.145-3.el7               perl-Encode.x86_64 0:2.51-7.el7                   
  perl-Exporter.noarch 0:5.68-3.el7                   perl-File-Path.noarch 0:2.09-2.el7                
  perl-File-Temp.noarch 0:0.23.01-3.el7               perl-Filter.x86_64 0:1.49-3.el7                   
  perl-Getopt-Long.noarch 0:2.40-3.el7                perl-HTTP-Tiny.noarch 0:0.033-3.el7               
  perl-IO-Compress.noarch 0:2.061-2.el7               perl-Net-Daemon.noarch 0:0.48-5.el7               
  perl-PathTools.x86_64 0:3.40-5.el7                  perl-PlRPC.noarch 0:0.2020-14.el7                 
  perl-Pod-Escapes.noarch 1:1.04-295.el7              perl-Pod-Perldoc.noarch 0:3.20-4.el7              
  perl-Pod-Simple.noarch 1:3.28-4.el7                 perl-Pod-Usage.noarch 0:1.63-3.el7                
  perl-Scalar-List-Utils.x86_64 0:1.27-248.el7        perl-Socket.x86_64 0:2.010-5.el7                  
  perl-Storable.x86_64 0:2.45-3.el7                   perl-Text-ParseWords.noarch 0:3.29-4.el7          
  perl-Time-HiRes.x86_64 4:1.9725-3.el7               perl-Time-Local.noarch 0:1.2300-2.el7             
  perl-constant.noarch 0:1.27-2.el7                   perl-libs.x86_64 4:5.16.3-295.el7                 
  perl-macros.x86_64 4:5.16.3-295.el7                 perl-parent.noarch 1:0.225-244.el7                
  perl-podlators.noarch 0:2.5.1-3.el7                 perl-threads.x86_64 0:1.87-4.el7                  
  perl-threads-shared.x86_64 0:1.43-6.el7             subversion-libs.x86_64 0:1.7.14-14.el7            
  trousers.x86_64 0:0.3.14-2.el7                     

Dependency Updated:
  mariadb-libs.x86_64 1:5.5.65-1.el7

查看DBD MySQL驱动模块信息

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# yum info apr-util-mysql
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.keystealth.org
 * extras: repos-lax.psychz.net
 * updates: mirrors.xtom.com
Installed Packages
Name        : apr-util-mysql
Arch        : x86_64
Version     : 1.5.2
Release     : 6.el7
Size        : 24 k
Repo        : installed
From repo   : base
Summary     : APR utility library MySQL DBD driver
URL         : http://apr.apache.org/
License     : ASL 2.0
Description : This package provides the MySQL driver for the apr-util DBD
            : (database abstraction) interface.

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# rpm -lq apr-util-mysql
/usr/lib64/apr-util-1/apr_dbd_mysql-1.so
/usr/lib64/apr-util-1/apr_dbd_mysql.so
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

配置MySQL服务并新建数据库及表

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# systemctl enable mariadb
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@centos-s-1vcpu-1gb-sfo3-01 ~]# systemctl start mariadb
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

建库

MariaDB [(none)]> create database subversion;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> grant SELECT, INSERT, UPDATE, DELETE on subversion.* to apache@localhost;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> set password for apache@localhost=password('apachepwd');
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]>

建表

MariaDB [(none)]> use subversion;
Database changed
MariaDB [subversion]> use subversion;
Database changed
MariaDB [subversion]> create table authn (
    -> username varchar(255) not null,
    -> password varchar(255),
    -> status varchar(255),
    -> primary key (username)
    -> );
Query OK, 0 rows affected (0.01 sec)

MariaDB [subversion]>

写入测试数据
生成密码（可指定密码加密函数）

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# htpasswd -nb user1 123456
user1:$apr1$hyGT4jgm$xCWktYtKdOZ.y59Zo.t7C1

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# 

MariaDB [subversion]> INSERT INTO `authn` (`username`, `password`, `status`) 
    -> VALUES('user1', '$apr1$hyGT4jgm$xCWktYtKdOZ.y59Zo.t7C1', 'ok');
Query OK, 1 row affected (0.00 sec)

MariaDB [subversion]>

查看表数据

MariaDB [subversion]> select * from authn;
+----------+---------------------------------------+--------+
| username | password                              | status |
+----------+---------------------------------------+--------+
| user1    | $apr1$hyGT4jgm$xCWktYtKdOZ.y59Zo.t7C1 | ok     |
+----------+---------------------------------------+--------+
1 row in set (0.00 sec)

MariaDB [subversion]>

密码加密函数参考

https://dev.mysql.com/doc/refman/5.6/en/encryption-functions.html#function_password

创建仓库

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# mkdir /var/www/svn
[root@centos-s-1vcpu-1gb-sfo3-01 ~]# cd /var/www/svn/
[root@centos-s-1vcpu-1gb-sfo3-01 svn]# svnadmin create test
[root@centos-s-1vcpu-1gb-sfo3-01 svn]#

配置Apache环境
查看已安装相关模块

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# ls /etc/httpd/modules/ |grep dbd
mod_authn_dbd.so
mod_authz_dbd.so
mod_dbd.so
[root@centos-s-1vcpu-1gb-sfo3-01 ~]# ls /etc/httpd/modules/ |grep socache
mod_authn_socache.so
mod_cache_socache.so
mod_socache_dbm.so
mod_socache_memcache.so
mod_socache_shmcb.so
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

模块mod_authn_dbd配置参考

http://httpd.apache.org/docs/2.4/mod/mod_authn_dbd.html
http://httpd.apache.org/docs/2.4/mod/mod_dbd.html
http://httpd.apache.org/docs/2.4/mod/mod_authn_socache.html

设置主机名

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# vi /etc/httpd/conf/httpd.conf
ServerName 64.227.106.245

新增配置文件

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# vi /etc/httpd/conf.d/repository.conf
# mod_dbd configuration
# UPDATED to include authentication caching
DBDriver mysql
DBDParams "host=localhost port=3306 dbname=subversion user=apache pass=apachepwd"

DBDMin  4
DBDKeep 8
DBDMax  20
DBDExptime 300

<Location /repos>
  DAV svn
  SVNParentPath /var/www/svn

  # mod_authn_core and mod_auth_basic configuration
  # for mod_authn_dbd
  AuthType Basic
  AuthName "Subversion repository"
  
  # To cache credentials, put socache ahead of dbd here
  AuthBasicProvider socache dbd

  # Also required for caching: tell the cache to cache dbd lookups!
  AuthnCacheProvideFor dbd
  AuthnCacheContext my-server
  
  SVNPathAuthz off

  # Authorization: Authenticated users only
  Require valid-user
  
  # mod_authn_dbd SQL query to authenticate a user
  AuthDBDUserPWQuery "SELECT password FROM authn WHERE username = %s"
</Location>
[root@centos-s-1vcpu-1gb-sfo3-01 ~]# apachectl -t
Syntax OK
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

启动Apache服务

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@centos-s-1vcpu-1gb-sfo3-01 ~]# systemctl start httpd
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

查看端口监听

[root@centos-s-1vcpu-1gb-sfo3-01 ~]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      969/master          
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      1586/mysqld         
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1018/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      969/master          
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::80                   :::*                    LISTEN      12198/httpd         
tcp6       0      0 :::22                   :::*                    LISTEN      1018/sshd           
[root@centos-s-1vcpu-1gb-sfo3-01 ~]#

使用浏览器访问仓库进行登录验证

http://64.227.106.245/repos/test

Apache Tomcat非root权限加固配置

 未分类  No Responses »
7 月 222017
 

Apache Tomcat非root权限加固配置

[root@www_cluster1 ~]# cd /data/
[root@www_cluster1 data]# chown -R root.opsuser apache-tomcat-7.0.79/
[root@www_cluster1 data]# cd apache-tomcat-7.0.79/
[root@www_cluster1 apache-tomcat-7.0.79]# chmod -R g+w logs/ temp/ work/ webapps/
[root@www_cluster1 apache-tomcat-7.0.79]# chmod -R g+r conf/*
[root@www_cluster1 apache-tomcat-7.0.79]#

Nginx与Apache并行处理web请求

 未分类  No Responses »
5 月 062013
 

编译安装apache

[root@localhost ~]# yum install perl gcc make
[root@localhost ~]# groupadd -r apache
[root@localhost ~]# useradd -r -M -g apache apache
[root@localhost ~]# tar xzf httpd-2.2.24.tar.gz
[root@localhost ~]# cd httpd-2.2.24
[root@localhost httpd-2.2.24]# ./configure --prefix=/usr/local/apache \
 > --enable-so --enable-rewrite
[root@localhost httpd-2.2.24]# make
[root@localhost httpd-2.2.24]# make install

编译安装php

[root@localhost ~]# tar xzf php-5.2.17.tar.gz
[root@localhost ~]# cd php-5.2.17
[root@localhost php-5.2.17]# yum install libxml2-devel
[root@localhost php-5.2.17]# yum install gd-devel libpng-devel libjpeg-devel
[root@localhost php-5.2.17]# ./configure --prefix=/usr/local/php \
 > --with-apxs2=/usr/local/apache/bin/apxs \
 > --enable-fastcgi --enable-mbstring \
 > --with-gd=/usr/ --with-png-dir=/usr/ --with-jpeg-dir=/usr/
[root@localhost php-5.2.17]# make
[root@localhost php-5.2.17]# make install
[root@localhost php-5.2.17]# cp php.ini-dist /usr/local/php/lib/php.ini

编译安装nginx

[root@localhost ~]# tar xzf nginx-1.4.0.tar.gz
[root@localhost ~]# tar xzf openssl-1.0.1e.tar.gz
[root@localhost ~]# tar xzf zlib-1.2.8.tar.gz
[root@localhost ~]# tar xzf pcre-8.32.tar.gz
[root@localhost nginx-1.4.0]# cd nginx-1.4.0
[root@localhost nginx-1.4.0]# yum install gcc-c++
[root@localhost nginx-1.4.0]# ./configure --prefix=/usr/local/nginx \
 > --with-http_stub_status_module --with-http_ssl_module \
 > --with-pcre=../pcre-8.32/ --with-zlib=../zlib-1.2.8 \
 > --with-openssl=../openssl-1.0.1e
[root@localhost nginx-1.4.0]# make
[root@localhost nginx-1.4.0]# make install

修改nginx配置文件

#location ~ \.php$ {
 #    proxy_pass   http://127.0.0.1;
 #}
location ~ \.php$ {
 proxy_pass   http://127.0.0.1:8080;
 }

修改apache配置文件

[root@localhost ~]# vi /usr/local/apache/conf/httpd.conf
 Listen 8080
User apache
Group apache
ServerName 127.0.0.1:8080
<IfModule dir_module>
 DirectoryIndex index.php
</IfModule>
AddType application/x-httpd-php .php
#DocumentRoot "/usr/local/apache/htdocs"
DocumentRoot "/usr/local/nginx/html"
#<Directory "/usr/local/apache/htdocs">
#    Options Indexes FollowSymLinks
#    AllowOverride None
#    Order allow,deny
#    Allow from all
#</Directory>
<Directory "/usr/local/nginx/html">
 Options Indexes FollowSymLinks
 AllowOverride None
 Order allow,deny
 Allow from all
</Directory>

启动apache并查看监听

[root@localhost ~]# /usr/local/apache/bin/apachectl start
[root@localhost ~]# netstat -lutn |grep 8080
 tcp        0      0 :::8080                     :::*                        LISTEN
[root@localhost ~]#

启动nginx并查看监听

[root@localhost ~]# /usr/local/nginx/sbin/nginx
[root@localhost ~]# netstat -lut |grep http
 tcp        0      0 *:http                      *:*                         LISTEN
[root@localhost ~]#

创建php测试文件

[root@localhost ~]# vi /usr/local/nginx/html/hello.php
 <?php phpinfo(); ?>

nginx-apache-0201

访问http://192.168.244.135/index.html后的nginx日志记录

[root@localhost ~]# cat /usr/local/nginx/logs/access.log
192.168.244.1 - - [06/May/2013:16:53:22 +0800] "GET / HTTP/1.1" 200 612 "-"
 "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0"

nginx-apache-0202

访问http://192.168.244.135/hello.php后的apache日志记录

[root@localhost ~]# cat /usr/local/apache/logs/access_log
 127.0.0.1 - - [06/May/2013:19:09:00 +0800] "GET /hello.php HTTP/1.0" 200 43026
 127.0.0.1 - - [06/May/2013:19:09:00 +0800] "GET
 /hello.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 HTTP/1.0" 200 2524
 127.0.0.1 - - [06/May/2013:19:09:00 +0800] "GET
 /hello.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42 HTTP/1.0" 200 2146

Postfix Admin虚拟邮件帐户管理系统

 邮件系统  No Responses »
3 月 142013
 

安装Apache服务

安装perl(编译apache模块依赖)

[root@mail httpd-2.2.24]# yum install perl

添加用户

[root@mail httpd-2.2.24]# groupadd -r apache 
[root@mail httpd-2.2.24]# useradd -r -M -g apache apache

编译安装

[root@mail httpd-2.2.24]# ./configure --prefix=/usr/local/apache \
 > --enable-so --enable-rewrite 
[root@mail httpd-2.2.24]# make 
[root@mail httpd-2.2.24]# make install

Continue reading »