阿帕奇配置虚拟主机

httpd -2.4版本默认拒绝所有主机访问，所以安装以后要做显示授权访问

1.进入 /etc/httpd/conf.modules.d/添加设置

[root@localhost ~]# vim /etc/httpd/conf.modules.d/
<Directory "/var/www/html/runtime">
    <RequireAll>
      Require not ip 192.168.194.1
      Require all grented
    <RequireAll>
</Directory>

[root@localhost ~]# httpd -t     //检测有没有语法错误
Syntax OK

[root@localhost ~]# systemctl restart httpd   //重启httpd 服务

3.用浏览器访问192.168.194.128/runtime/

虚拟主机配置

虚拟主机有三大类

• 相同ip不同端口
• 不通ip相同端口
• 相同ip相同端口不同域名

关闭防火墙和SElinux

[root@localhost ~]# systemctl disable firewalld
[root@localhost ~]# cat /etc/selinux/config 
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

重新启动httpd服务

[root@localhost ~]# systemctl restart httpd

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
设置主机名
......
#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80  //在此行取消注释

#
# Deny access to the entirety of your server's filesystem. You must
# explicitly permit access to web content directories in other 
# <Directory> blocks below.
#
<Directory />
    AllowOverride none
    Require all denied

相同IP不同端口设置虚拟主机

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
/usr/share/doc/httpd/httpd-vhosts.conf
<VirtualHost *:80>
    DocumentRoot "/var/www/html/ruost"
    ServerName runtime.example.com
    ErrorLog "/var/log/httpd/runtime.example.com-error_log"
    CustomLog "/var/log/httpd/runtime.example.com-access_log" common
</VirtualHost>

listen 81
<VirtualHost *:81>
 DocumentRoot "/var/www/html/showtime"
    ServerName showtime.example.com   
    ErrorLog "/var/log/httpd/showtime.example.com-error_log"    
    CustomLog "/var/log/httpd/showtime.example.com-access_log" common
</VirtualHost>

不同IP相同端口设置虚拟主机

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
<VirtualHost 192.168.194.128:80>
    DocumentRoot "/var/www/html/runtime"
    ServerName runtime.example.com
    ErrorLog "/var/log/httpd/runtime.example.com-error_log"
    CustomLog "/var/log/httpd/runtime.example.com-access_log" common
</VirtualHost>

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
listen 81
<VirtualHost 192.168.194.129:80>
 DocumentRoot "/var/www/html/showtime"
    ServerName showtime.example.com
    ErrorLog "/var/log/httpd/showtime.example.com-error_log"    CustomLog "/var/log/httpd/showtime.example.com-access_log" common
</VirtualHost>

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf

<VirtualHost *:80>
    DocumentRoot "/var/www/html/runtime"
    ServerName runtime.example.com
    ErrorLog "/var/log/httpd/runtime.example.com-error_log"
    CustomLog "/var/log/httpd/runtime.example.com-access_log" common
</VirtualHost>

listen 81
<VirtualHost *:80>
 DocumentRoot "/var/www/html/showtime"
    ServerName showtime.example.com
    ErrorLog "/var/log/httpd/showtime.example.com-error_log"    CustomLog "/var/log/httpd/showtime.example.com-access_log" common
</VirtualHost>


[root@localhost ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

[root@localhost ~]# yum -y install mod_ssl


[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) 
genrsa: Can't open "private/cakey.pem" for writing, No such file or directory
[root@localhost CA]# 
[root@localhost CA]# mkdir private
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)  //生成密钥，括号必须要
Generating RSA private key, 2048 bit long modulus (1 primes)
.+++++
...........................................................................................................+++++
e is 65537 (0x010001)

CA生成自签署证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:WH
Organization Name (eg, company) [Default Company Ltd]:runtime.example.com
Organizational Unit Name (eg, section) []:runtime.example.com
Common Name (eg, your name or your server's hostname) []:runtime.example.com
Email Address []:1@2.com

openssl x509 -text -in cacert.pem    #读出cacert.pem证书的内容




[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# ls
certs  crl  newcerts  private
[root@localhost CA]# 


客户端（例如httpd服务器）生成密钥
[root@localhost CA]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:word.example.com
Organizational Unit Name (eg, section) []:word.example.com
Common Name (eg, your name or your server's hostname) []:word.example.com
Email Address []:123@456.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@yzw ssl]# ls
httpd.csr  httpd.key
.................+++++
e is 65537 (0x010001)

CA签署客户端提交上来的证书

[root@localhost ~]# openssl ca -in ./httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Aug 25 14:16:46 2020 GMT
            Not After : Aug 25 14:16:46 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = word.example.com
            organizationalUnitName    = word.example.com
            commonName                = word.example.com
            emailAddress              = 123@456.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                10:CE:A4:5A:C9:F4:CD:B0:3F:A6:92:91:E7:1C:78:C3:FF:AF:79:39
            X509v3 Authority Key Identifier: 
                keyid:4C:F7:02:B7:DB:E1:01:FC:50:76:D8:77:0E:A0:70:23:7A:DF:83:93

Certificate is to be certified until Aug 25 14:16:46 2021 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated