RHEL7.2 配置笔记 1-Http服务器Apache

参考文件

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/s1-httpd-secure-server

https://www.digitalocean.com/community/tutorials/how-to-create-an-ssl-certificate-on-apache-for-centos-7

 

1. root@localhost:~$ cat /proc/version 

Linux version 3.10.0-327.el7.x86_64 (mockbuild@x86-034.build.eng.bos.redhat.com) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Oct 29 17:29:29 EDT 2015 

 root@localhost:~$ cat  /etc/redhat-release  
Red Hat Enterprise Linux Server release 7.2 (Maipo)

[root@localhost ~]# rpm -qi httpd 
Name        : httpd
Version     : 2.4.6
Release     : 40.el7
Architecture: x86_64
Install Date: Tue 13 Jun 2017 10:24:45 PM EDT
Group       : System Environment/Daemons
Size        : 3876648
License     : ASL 2.0
Signature   : RSA/SHA256, Wed 30 Sep 2015 09:29:50 AM EDT, Key ID 199e2f91fd431d51
Source RPM  : httpd-2.4.6-40.el7.src.rpm
Build Date  : Thu 17 Sep 2015 09:08:35 AM EDT
Build Host  : x86-024.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://httpd.apache.org/
Summary     : Apache HTTP Server
Description :
The Apache HTTP Server is a powerful, efficient, and extensible
web server.

[root@localhost ~]# 

 

 

2.  ########## httpd / Apache set from systemctl 

[root@localhost Packages]# systemctl enable httpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /etc/systemd/system/httpd.service.
[root@localhost Packages]# systemctl status httpd.service 
\u25cf httpd.service - The Apache HTTP Server
   Loaded: loaded (/etc/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:httpd(8)
           man:apachectl(8)
[root@localhost Packages]#systemctl start httpd.service  

此时本地可以访问localhost的http默认页面，远程访问还需要配置防火墙 

Default Apache test page is set in  /etc/httpd/conf.d/welcome.conf

===================> 
Alias /.noindex.html /usr/share/httpd/noindex/index.html
[root@localhost httpd]# ls -al /usr/share/httpd/noindex/index.html 

-rw-r--r--. 1 root root 3985 Sep 17  2015 /usr/share/httpd/noindex/index.html

 

 

3. >>>>>>>>>>  set http access in firewall  ，允许本地网络192.168.137.0访问

[root@localhost ~]#  firewall-cmd  --permanent --add-rich-rule='rule family=ipv4 source address=192.168.137.0/24 service name=http accept'
success
[root@localhost ~]#  firewall-cmd --reload
success

[root@localhost ~]#  sudo  firewall-cmd  --list-all

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh dhcpv6-client
  ports:  80/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
注意AliYun2018需要在  https://ecs.console.aliyun.com/  安全组规则  设定开放80端口  

 

4. About TCP6/80 port 

[root@localhost ~]# netstat -an --tcp   |grep  80 
 
tcp6       0      0 :::80                   :::*                    LISTEN     
 # NOTE: Apache listening on tcp6/ipv6 80 but could accept both v4 and v6
 

注意Apache默认监听于IPv6的80端口，可以接受IPv4和IPv6的所有的web请求。 

 

 

5. SSL/HTTPS

[root@localhost apache-web-ssl-crt]# rpm -qa  |grep  mod_ssl

 

mod_ssl-2.4.6-40.el7.x86_64

 

Please rpm ivh mod_ssl-2.4.6-40.el7.x86_64.rpm 

[root@localhost apache-web-ssl-crt]# rpm -qa  |grep httpd
httpd-tools-2.4.6-40.el7.x86_64
httpd-2.4.6-40.el7.x86_64

[root@localhost apache-web-ssl-crt]#

check configuration file:  

[root@localhost apache-web-ssl-crt]# grep SSLCert      /etc/httpd/conf.d/ssl.conf
# Point SSLCertificateFile at a PEM encoded certificate.  If
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
#   Point SSLCertificateChainFile at a file containing the
#   the referenced file can be the same as SSLCertificateFile
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
[root@localhost apache-web-ssl-crt]#

 

Generate  private key/私钥：　

lake@localhost:~/OpenSSL$ openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

lake@localhost:~/OpenSSL$

## Generate private key/RSA 1024 bit 
lake@localhost:~/OpenSSL$ openssl genrsa -out privatekey.key 1024
Generating RSA private key, 1024 bit long modulus
..................................++++++
...................++++++

e is 65537 (0x10001)

[root@localhost apache-web-ssl-crt]#  openssl req -new -key ../privatekey.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanghai
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:LC
Organizational Unit Name (eg, section) []:LC
Common Name (eg, your name or your server's hostname) []:LC-webserver
Email Address []:longchang_elec@163.com


Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost apache-web-ssl-crt]# ls

server.csr

####10 year certification file /1０年有效期

[root@localhost apache-web-ssl-crt]# openssl x509 -days 3650 -req -in server.csr -signkey ../privatekey.key -out server.crt
Signature ok
subject=/C=CN/ST=Shanghai/L=Shanghai/O=LC/OU=LC/CN=LC-webserver/emailAddress=longchang_elec@163.com
Getting Private key
[root@localhost apache-web-ssl-crt]#

#### Copy file & restart httpd service  

[root@localhost apache-web-ssl-crt]# cp  ../privatekey.key     /etc/pki/tls/private/localhost.key
cp: overwrite \u2018/etc/pki/tls/private/localhost.key? y
[root@localhost apache-web-ssl-crt]# cp  server.crt     /etc/pki/tls/certs/localhost.crt 
[root@localhost apache-web-ssl-crt]# ls
readme-openssl-generate-crt.txt  server.crt  server.csr
[root@localhost apache-web-ssl-crt]#  cp  server.crt     /etc/pki/tls/certs/localhost.crt
cp: overwrite \u2018/etc/pki/tls/certs/localhost.crt\u2019? y

 

################ Open 443 in firewall###########

[lake@izuf6ad1jbc6ftdqtbuiquz ~]$  sudo  firewall-cmd --add-port=443/tcp   --permanent
success
[lake@izuf6ad1jbc6ftdqtbuiquz ~]$  sudo  firewall-cmd --reload
success
[lake@izuf6ad1jbc6ftdqtbuiquz ~]$  sudo  systemctl restart   firewalld
 

 

[root@localhost apache-web-ssl-crt]# systemctl restart httpd.service