使用httpd-2.2和httpd-2.4实现指定httpd服务

分别使用httpd-2.2和httpd-2.4实现

              1、建立httpd服务，要求：

                     (1)提供两个基于名称的虚拟主机www1, www2；有单独的错误日志和访问日志；

                     (2)通过www1的/server-status提供状态信息，且仅允许tom用户访问；

                     (3)www2不允许192.168.0.0/24网络中任意主机访问；

准备过程

1. 准备三台虚拟机，一台CentOS 7实现httpd-2.4 CentOS 6 实现httpd-2.2 另一台提供颁发CA认证和测试服务要求

2. 先关闭三台虚拟机的iptables selinux

3. 三台机器yum安装mod_ssl

CentOS 6 ip 172.16.55.6

CentOS 7 ip 172.16.55.7

CA方加测试 ip 172.16.55.11

第一小题

=========================

CentOS 6上提供的httpd服务是2.2版本

安装httpd-2.2

yum install-y httpd

修改配置文件，添加虚拟主机名

       vim/etc/httpd/conf/httpd.conf

       990行下

       NameVirtualHost172.16.55.6:80

添加虚拟主机配置文件,并添加日志文件信息

       vim/etc/httpd/conf.d/www1.conf

<VirtualHost 172.16.55.6:80>

   ServerName www1.magedu.com

   DocumentRoot /data/vhosts/www1

   ErrorLog logs/www1-error_log

   CustomLog logs/www1-access_log combined

</VirtualHost>

vim /etc/httpd/conf.d/www2.conf

<VirtualHost 172.16.55.6:80>

   ServerName www2.magedu.com

   DocumentRoot /data/vhosts/www2

   ErrorLog logs/www2-error_log

   CustomLog logs/www2-access_log combined

</VirtualHost>

在创建网站信息

mkdir /data/vhosts/www{1,2}

vim /data/vhosts/www1/index.html

       11111

vim /data/chosts/www2/index.html

       22222

修改hosts配置文件，添加域名解析

vim /etc/hosts

添加 172.16.55.6 www1.magedu.com www2.magedu.com

语法检查

httpd -t

在检查端口是否打开，服务是否启动

ss -ntl

ps aux

重启服务，然后在浏览器中检查172.16.55.7是否能解析

CentOS 7上提供的httpd服务是2.4版本

安装httpd-2.4

yum install-y httpd

查看配置文件，但不需要添加虚拟主机名

添加虚拟主机配置文件,并添加日志文件信息

       vim/etc/httpd/conf.d/www1.conf

<VirtualHost 172.16.55.7:80>

   ServerName www1.magedu.com

   DocumentRoot /data/vhosts/www1

   ErrorLog logs/www1-error_log

CustomLoglogs/www1-access_log combined

<Directory"/data/vhosts/www1">
      Options None
      AllowOverride None
       Require all granted
    </Directory>

</VirtualHost>

vim /etc/httpd/conf.d/www2.conf

<VirtualHost 172.16.55.6:80>

   ServerName www2.magedu.com

   DocumentRoot /data/vhosts/www2

   ErrorLog logs/www2-error_log

CustomLoglogs/www2-access_log combined

<Directory"/data/vhosts/www1">
      Options None
      AllowOverride None
      Require all granted
     </Directory>

</VirtualHost>

在创建网站信息

mkdir /data/vhosts/www{1,2}

vim /data/vhosts/www1/index.html

       11111

vim /data/chosts/www2/index.html

       22222

修改hosts配置文件，添加域名解析

vim /etc/hosts

添加 172.16.55.7 www1.magedu.com www2.magedu.com

语法检查

httpd -t

在检查端口是否打开，服务是否启动

ss -ntl

ps aux

重启服务，然后在浏览器中检查172.16.55.7是否能解析

第二题

============================

ip为172.16.55.6的CentOS 6上

先添加一个tom的虚拟用户

htpasswd -c -m /etc/httpd/conf/.htpasswdtom

修改虚拟主机www1的配置文件

vim /etc/httpd/conf.d/www1.conf

<VirtualHost 172.16.55.6:80>

   ServerName www1.magedu.com

   DocumentRoot /data/vhosts/www1

   ErrorLog logs/www1-error_log

   CustomLog logs/www1-access_log combined

</VirtualHost>

<Location /server-status>
    SetHandler server-status
    AuthType basic
    AuthName "For tom"
    AuthUserFile "/etc/httpd/conf/.htpasswd"
    Require user tom
</Location>  

语法检查后无误后，重载服务配置

httpd -t                              
service httpd reload 

在浏览器这种输入172.16.55.6/server-status

如下图，只有输入账户tom的账户密码才可访问

ip为172.16.55.7的CentOS 7上

先添加一个tom的虚拟用户

htpasswd -c -m /etc/httpd/conf/.htpasswdtom

修改虚拟主机www1的配置文件

在后面直接添加

<Location /server-status>
    SetHandler server-status
    AuthType basic
    AuthName "For tom"
    AuthUserFile "/etc/httpd/conf/.htpasswd"
    Require user tom
</Location>  

语法检查后无误后，重载服务配置

httpd -t                              
service httpd reload 

在浏览器这种输入172.16.55.7/server-status

如图，只有输入账户tom的账户密码才可访问

第二题3小问

先在CentOS6上面做该操作

www2不允许192.168.0.0/24网络中任意主机访问

直接编辑www2的配置文件

vim /etc/httpd/conf.d/www2.conf

在后面添加一段代码即可

<VirtualHost 172.16.55.6:80>

   ServerName www1.magedu.com

   DocumentRoot /data/vhosts/www1

    <Directory /data/vhosts/www2>

       OptionsNone
     AllowOverride None
    Order deny,allow

Denyfrom 192.16.0.0/24
    </Directory>

</VirtualHost>

CentOS 7 上操作相同

第三da题

=====172.16.55.11=====

先创建公钥，颁发CA证书

yum install -y mod_ssl

cd /etc/pki/CA

(umask 077;openssl genrsa -outprivate/cakey.pem 2048)

openssl req -new -x509 -keyprivate/cakey.pem -out cacert.pem

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name)[]:beijing

Locality Name (eg, city) [DefaultCity]:beijing

Organization Name (eg, company) [DefaultCompany Ltd]:magedu

Organizational Unit Name (eg, section)[]:ops

Common Name (eg, your name or your server'shostname) []:ca.magedu.com

Email Address []:magedu@admin.com

创建补充文件

touch index.txt

echo 01> serial

然后在CentOS 6 上创建私钥

mkdir -pv /etc/httpd/ssl

cd /etc/httpd/ssl/

(umask 077; openssl genrsa -outhttpd.key 1024)

openssl req -new -key httpd.key -out httpd.csr

Country Name (2 letter code) [XX]:CN

State or Province Name (full name)[]:beijing

Locality Name (eg, city) [DefaultCity]:beijing

Organization Name (eg, company) [DefaultCompany Ltd]:magedu

Organizational Unit Name (eg, section)[]:ops

Common Name (eg, your name or yourserver's hostname) []:www2.magedu.com

Email Address []:www2@admin.com

scp 172.16.55.11:/tmp

然后在切换到172.16.55.11 CA上面签发证书

cd /etc/pki/CA

openssl ca -in /tmp/httpd.csr -out/etc/pki/CA/certs/httpd.crt

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches thesignature

Signature ok

Certificate Details:

       Serial Number: 1 (0x1)

       Validity

            Not Before: Jul 24 04:54:15 2016GMT

            Not After : Jul 24 04:54:15 2017GMT

       Subject:

            countryName               = CN

            stateOrProvinceName       = beijing

            organizationName          = magedu

            organizationalUnitName    = ops

            commonName                = www2.magedu.com

            emailAddress              = www2@admin.com

       X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

               2B:D6:FF:8B:84:2D:33:FD:48:8A:EC:A5:80:63:67:46:F5:D5:54:12

            X509v3 Authority Key Identifier:

               keyid:F2:32:D8:C5:E6:D9:04:B8:46:38:8D:D7:32:2B:E6:D5:90:56:3D:A1

Certificate is to be certified until Jul24 04:54:15 2017 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requestscertified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

把签署好的证书发还给请求者。
scp /certs/httpd.crt 172.16.55.6:/etc/httpd/ssl/

在回到172.16.55.6的CentOS上面修改ssl的配置文件

vim /etc/httpd/conf.d/ssl.conf

   <VirtualHost _default_:443>

   DocumentRoot "/data/vhosts/www2"

   ServerName www2.magedu.com:443

   SSLCertificateFile /etc/httpd/ssl/httpd.crt

   SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

</VirtualHost>

然后检查语法无误后，重载服务

httpd-t

servicereload httpd

CentOS 7 上面的操作过程和6的基本一致