系统运维-21-2-httpd编译安装

最新推荐文章于 2025-01-16 11:07:47 发布

原创最新推荐文章于 2025-01-16 11:07:47 发布 · 211 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#log #htpasswd #directory #virtualhost #httpd.conf

DEVOPS 专栏收录该内容

42 篇文章

订阅专栏

本文详细介绍了Apache HTTPD服务器的配置，包括日志设置、路径别名、默认字符集、用户访问控制（基本认证）及虚拟主机的配置方法。内容涵盖了ErrorLog和CustomLog的设置，以及如何使用htpasswd管理用户账号和密码，实现基于组的认证。此外，还讨论了基于IP、端口和主机名的虚拟主机配置，并展示了如何进行日志定向以区分不同虚拟主机的访问记录。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

日志设定

   错误日志（使用相对路径，/etc/httpd）
       [root@lab1 conf]# grep ^ErrorLog httpd.conf
       ErrorLog "logs/error_log"
       [root@lab1 conf]# grep ^LogLevel httpd.conf -B 3
       # Possible values include: debug, info, notice, warn, error, crit,
       # alert, emerg.
       #
       LogLevel warn

   访问日志
       [root@lab1 conf]# grep CustomLog httpd.conf
       # a CustomLog directive (see below).
       #CustomLog "logs/access_log" common
       CustomLog "logs/access_log" combined
       [root@lab1 conf]# grep LogFormat httpd.conf
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
       LogFormat "%h %l %u %t \"%r\" %>s %b" common
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

       %h：客户端IP地址
       %l：用户登录时的用户名，-表示为空
       %u：用户认证时的用户名
       %t：服务器收到请求时的时间
       %r：请求报文的首行信息（方法网址版本）
       %>s：响应状态码
       $b：响应报文的大小，单位是字节，不包含响应报文首部
       %[referer]i：请求报文当中"referer"首部的值，当前资源的访问入口，即来自于哪个页面的超链接请求跳转而来
       %[User-Agent]i：请求报文当中"User-Agent"首部的值，即发出请求用到的应用程序

       详情
           [root@lab1 conf]# tail /var/log/httpd/access_log | tail -1
           172.20.0.1 - - [03/May/2019:11:39:00 -0400] "GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1" 404 240 "http://172.20.0.131:8080/noindex/css/open-sans.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"

路径别名
   使用路径别名配置访问路径的实例：
       [root@lab1 ~]# cd /www/htdocs
       [root@lab1 htdocs]# mkdir bbs
       [root@lab1 htdocs]# cd bbs
       [root@lab1 bbs]# vim index.html
       [root@lab1 bbs]# cat index.html
       Page at /www/htdocs/bbs
       [root@lab1 conf]# curl 172.20.0.131/bbs/
       Page at /www/htdocs/bbs
       [root@lab1 bbs]# pwd
       /www/htdocs/bbs
       [root@lab1 bbs]# cd ..
       [root@lab1 htdocs]# mkdir /forum
       [root@lab1 htdocs]# vim /forum/index.html
       [root@lab1 htdocs]# cat /forum/index.html
       Page at /forum
       [root@lab1 conf]# vim httpd.conf
       [root@lab1 conf]# grep ^Alias httpd.conf
       Alias /bbs/ "/forum/"
       [root@lab1 conf]# systemctl restart httpd
       [root@lab1 conf]# curl 172.20.0.131/bbs/
       Page at /forum

设定默认字符集
AddDefaultCharset

基于用户的访问控制
认证质询
WWW-Authenticat：响应码为401，拒绝客户端请求，并说明要求客户端提供账号和密码

   认证
       Authoriztion：客户端用户填入账号和密码后再次发送请求报文，认证通过，则服务器发送响应的资源
       认证类型
           basic明文
           digest消息摘要
   安全域：需要用户认证后方能访问的路径
       应该通过名称对其进行标识，并用于告知用户认证的原因

   用户的账号和密码存储位置
       虚拟账号：仅仅用于访问某些服务器用到的认证标识
       存储：
           文本文件
           SQL数据库
           LDAP
           NIS

   basic认证
       （1）定义安全域
           <Directory >
               Options None
               AllowOverride None
               AuthType Basic
               AuthName ...
               AuthUserFile ...
               Require user username1 username2 ...
           </Directory>
           允许账号文件中的所有用户登录访问
               Require valid-user

           配置管理员页面实例：
               [root@lab1 htdocs]# mkdir admin
               [root@lab1 htdocs]# vim admin/index.html
               [root@lab1 htdocs]# cat admin/index.html
               Page of Admin
               [root@lab1 ~]# cd /etc/httpd/conf/
               [root@lab1 conf]# ll
               total 40
               -rw-r--r--. 1 root root 11801 May 3 21:30 httpd.conf
               -rw-r--r--. 1 root root 11745 May 3 09:56 httpd.conf.bak
               -rw-r--r--. 1 root root 13077 Nov 4 20:47 magic
               [root@lab1 conf]# vim httpd.conf
               [root@lab1 conf]# tail -8 httpd.conf
               <Directory "/www/htdocs/admin">
               Options None
               AllowOverride None
               AuthType Basic
               AuthName "Administator private"
               AuthUserFile "/etc/httpd/conf.d/.htpasswd"
               Require valid-user
               </Directory>
               [root@lab1 conf]# systemctl reload httpd

       （2）提供账号和密码存储（文本文件）
           使用htpasswd命令进行管理
               htpasswd
                   -c 自动创建passwordfile，仅仅在添加第一个用户时使用
                   -m md5加密用户密码
                   -s sha1加密用户密码
                   -D 删除指定用户

           配置用户密码访问实例：
               [root@lab1 htdocs]# htpasswd -c -m /etc/httpd/conf.d/.htpasswd tom
               New password:
               Re-type new password:
               Adding password for user tom
               [root@lab1 htdocs]# htpasswd -m /etc/httpd/conf.d/.htpasswd jerry
               New password:
               Re-type new password:
               Adding password for user jerry
               [root@lab1 htdocs]# tail /etc/httpd/conf.d/.htpasswd
               tom:$apr1$8nO6W7nq$dDJD8Q/sOsbYM1nwsG5Aj/
               jerry:$apr1$bIlzg4yu$lI9dwP0qAmWJw43Crcyau0
               [root@lab1 htdocs]# systemctl reload httpd

           限制特定用户密码登录实例：
               [root@lab1 conf]# vim httpd.conf
               [root@lab1 conf]# tail -8 httpd.conf
               Options None
               AllowOverride None
               AuthType Basic
               AuthName "Administator private"
               AuthUserFile "/etc/httpd/conf.d/.htpasswd"
               # Require valid-user
               Require user tom
               </Directory>
               [root@lab1 conf]# systemctl reload httpd

       （3）实现基于组进行认证
           <Directory >
               Options None
               AllowOverride None
               AuthType Basic
               AuthName ...
               AuthUserFile ...
               AuthGroupFile ...
               Require group groupname1 groupname2 ...
           </Directory>

           要提供用户账号文件和组文件
               组文件：每一行定义一个组
                   GROUP_NAME ： user1 user2 ...

           配置基于组的访问控制实例：
               [root@lab1 htdocs]# htpasswd -m /etc/httpd/conf.d/.htpasswd obama
               New password:
               Re-type new password:
               Adding password for user obama
               [root@lab1 htdocs]# vim /etc/httpd/conf.d/.htgroup
               [root@lab1 htdocs]# cat /etc/httpd/conf.d/.htgroup
               webadmin: jerry obama
               [root@lab1 conf]# vim httpd.conf
               [root@lab1 conf]# tail -10 httpd.conf
               Options None
               AllowOverride None
               AuthType Basic
               AuthName "Administator private"
               AuthUserFile "/etc/httpd/conf.d/.htpasswd"
               AuthGroupFile "/etc/httpd/conf.d/.htgroup"
               # Require valid-user
               # Require user tom
               Require group webadmin
               </Directory>
               [root@lab1 conf]# systemctl reload httpd

虚拟主机
   三种实现方案
       1）基于IP，为每个虚拟主机准备至少一个IP地址
       2）基于端口，为每个虚拟主机准备至少一个专用端口，实践中比较少使用
       3）基于主机名，为每个虚拟主机准备至少一个专用主机名
       可混合使用三种方式中的任意方式
       注意：一般虚拟不要与中心主机混用，使用虚拟主机先禁用中心主机

   每个虚拟主机有专用配置
       <VirtualHost "IP:PORT">
           ServerName
           DocumentRoot
       </VirtualHost>

           ServerAlias:虚拟主机的别名
           ErrorLog
           CustomLog

   基于IP的配置实例：
       [root@lab1 conf]# vim httpd.conf
       [root@lab1 conf]# tail -10 httpd.conf

       <VirtualHost 172.20.0.131:80>
       ServerName web1.example.com
       DocumentRoot "/vhosts/web1/htdocs"
       </VirtualHost>

       <VirtualHost 172.20.0.132:80>
       ServerName web2.example.com
       DocumentRoot "/vhosts/web2/htdocs"
       </VirtualHost>
       [root@lab1 conf]# service httpd configtest
       AH00112: Warning: DocumentRoot [/vhosts/web1/htdocs] does not exist
       AH00112: Warning: DocumentRoot [/vhosts/web2/htdocs] does not exist
       Syntax OK
       [root@lab1 conf]# httpd -t
       AH00112: Warning: DocumentRoot [/vhosts/web1/htdocs] does not exist
       AH00112: Warning: DocumentRoot [/vhosts/web2/htdocs] does not exist
       Syntax OK
       [root@lab1 conf]# mkdir -pv /vhosts/{web1,web2,web3,web4}/htdocs
       mkdir: created directory ‘/vhosts’
       mkdir: created directory ‘/vhosts/web1’
       mkdir: created directory ‘/vhosts/web1/htdocs’
       mkdir: created directory ‘/vhosts/web2’
       mkdir: created directory ‘/vhosts/web2/htdocs’
       mkdir: created directory ‘/vhosts/web3’
       mkdir: created directory ‘/vhosts/web3/htdocs’
       mkdir: created directory ‘/vhosts/web4’
       mkdir: created directory ‘/vhosts/web4/htdocs’
       [root@lab1 conf]# vim /vhosts/web1/htdocs/index.html
       [root@lab1 conf]# vim /vhosts/web2/htdocs/index.html
       [root@lab1 conf]# httpd -t
       Syntax OK
       [root@lab1 conf]# ip addr add 172.20.0.132/24 dev ens33
       [root@lab1 conf]# ip addr list
       1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
       2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
       link/ether 00:0c:29:b0:6e:59 brd ff:ff:ff:ff:ff:ff
       inet 172.20.0.131/24 brd 172.20.0.255 scope global dynamic ens33
       valid_lft 1368sec preferred_lft 1368sec
       inet 172.20.0.132/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
       inet6 fe80::3e66:b2a:5133:93d1/64 scope link
       valid_lft forever preferred_lft forever
       [root@lab1 conf]# systemctl reload httpd

   基于端口的配置实例：
       [root@lab1 conf]# vim httpd.conf
       [root@lab1 conf]# tail -4 httpd.conf
       <VirtualHost 172.20.0.132:8080>
       ServerName web3.example.com
       DocumentRoot "/vhosts/web3/htdocs"
       </VirtualHost>
       [root@lab1 conf]# grep ^Listen httpd.conf
       Listen 80
       Listen 8080
       [root@lab1 conf]# vim /vhosts/web3/htdocs/index.html
       [root@lab1 conf]# httpd -t
       Syntax OK
       [root@lab1 conf]# systemctl reload httpd

   基于主机名的配置实例：
       [root@lab1 conf]# vim httpd.conf
       [root@lab1 conf]# httpd -t
       Syntax OK
       [root@lab1 conf]# tail -15 httpd.conf

       <VirtualHost 172.20.0.132:80>
       ServerName web1.example.com
       DocumentRoot "/vhosts/web1/htdocs"
       </VirtualHost>

       <VirtualHost 172.20.0.132:80>
       ServerName web2.example.com
       DocumentRoot "/vhosts/web2/htdocs"
       </VirtualHost>

       <VirtualHost 172.20.0.132:80>
       ServerName web3.example.com
       DocumentRoot "/vhosts/web3/htdocs"
       </VirtualHost>
       [root@lab2 ~]# vim /etc/hosts
       [root@lab2 ~]# tail -1 /etc/hosts
       172.20.0.132 web1.example.com web2.example.com web3.example.com
       [root@lab2 ~]# curl http://web1.example.com
       page web1
       [root@lab2 ~]# curl http://web2.example.com
       page web2
       [root@lab2 ~]# curl http://web3.example.com
       page web3

   日志操作实例：
       [root@lab1 conf]# vim httpd.conf
       [root@lab1 conf]# tail -18 httpd.conf

       <VirtualHost 172.20.0.132:80>
       ServerName web1.example.com
       DocumentRoot "/vhosts/web1/htdocs"
       CustomLog logs/web1_access_log combined
       </VirtualHost>

       <VirtualHost 172.20.0.132:80>
       ServerName web2.example.com
       DocumentRoot "/vhosts/web2/htdocs"
       CustomLog logs/web2_access_log combined
       </VirtualHost>

       <VirtualHost 172.20.0.132:80>
       ServerName web3.example.com
       DocumentRoot "/vhosts/web3/htdocs"
       CustomLog logs/web3_access_log combined
       </VirtualHost>
       [root@lab1 conf]# httpd -t
       Syntax OK
       [root@lab1 conf]# systemctl reload httpd
       [root@lab2 ~]# curl http://web1.example.com
       page web1
       [root@lab2 ~]# curl http://web2.example.com
       page web2
       [root@lab2 ~]# curl http://web3.example.com
       page web3
       [root@lab1 conf]# ll /var/log/httpd/ | grep web
       -rw-r--r-- 1 root root 88 May 4 12:02 web1_access_log
       -rw-r--r-- 1 root root 88 May 4 12:02 web2_access_log
       -rw-r--r-- 1 root root 88 May 4 12:02 web3_access_log