基于RPM包安装LAMP架构

trsgw 发表于 2015-5-7 08:30:29

一、拓扑图

二、架构说明
1）WordPress和phpMyAdmin简介
WordPress是用于搭建个人博客站点的，是一个开源的PHP程序，如果你懂PHP开发你可以在此基础上进行二次开发打造属于自己的有个性的个人博客站点；
phpMyAdmin也是一个开源的PHP程序，用于管理MySQL数据库，可以对MySQL数据库进行图形化的操作，轻松的管理MySQL数据库。
2）访问方式
客户端通过访问Web服务器上的网站，首先由DNS服务器解析网站的IP，客户端通过解析的IP地址找到服务器，由服务器分别提供不同的网站地址，服务器通过rpm包格式安装配置lamp架构，提供两个虚拟主仙，一个用于wordpress，一个用于phpMyAdmin，其中wordpress用于http://www.blog.com地址访问，phpMyAdmin提供的网站为https://www.phpadmin.com
Web服务器向CA服务器申请证书，以构建HTTPS通信，客户端把CA服务器的证书导出到浏览器受信任的根证书颁发机构中，以加密方式能Web服务器提供的HTTPS进行通信。
在访问www.phpadmin时将自动跳转到https://www.phpadmin.com，不用输入https，就能访问https://www.phpadmin.com站点，轻松的管理Mysql数据库了。

三、架构规划
1)主机规划

主机IP地址提供服务
客户端172.16.9.6-
DNS192.168.0.92DNS域名解析
Web服务器172.16.190.25http://www.blog.comhttps://www.phpmyadmin.com
CA192.168.0.197给Web服务器发证书
2）程序版本
bind-9.8.2-0.30.rc1.el6.x86_64
mariadb-5.5.43-linux-x86_64.tar.gz
httpd-2.2.15-39.el6.centos.x86_64
php-5.3.3-38.el6.x86_64

四、DNS配置
1）安装bind程序包
yum install bind -y
2）修改/etc/named.conf配置文件中Options中的内容，其它的不变

1
2
3
4
5
6
7
8
9
10
11
options {
directory"/var/named";
dump-file"/var/named/data/cache_dump.db";
statistics-file"/var/named/data/named_stats.txt";
allow-query { any; };
recursionyes;
forwardfirst;
forwarders{ 172.16.0.1; };
dnssec-enableno;
dnssec-validationno;
};

3）配置区域文件/etc/named.rfc1912.zones添加以下行

1
2
3
4
5
6
7
8
9
10
11
12
#用于指www.blog.com的解析库文件
zone "blog.com"IN {
typemaster;
file"blog.com.zone";
allow-update{ none; };
};
#用于指www.phpadmin.com的解析库文件
zone "phpadmin.com"IN {
typemaster;
file"phpadmin.com.zone";
allow-update{ none; };
};

4）创建区域解析库文件/var/named

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# cat blog.com.zone
$TTL 86400
@ INSOA ns1.blog.com. admin.blog.com. (
         2015050101
         3D
         7H
         4D
         1D)
INNSns1
ns1 INA 192.168.0.92
www INA 172.16.190.25
# cat phpadmin.com.zone
$TTL 86400
@ INSOA ns1.phpadmin.com. admin.phpadmin.com. (
         2015050101
         3D
         7H
         4D
         1D)
INNSns1
ns1 INA 192.168.0.92
www INA 172.16.190.25

5）启动bind服务
service named start

五、CA服务器配置
1）创建辅助文件

1
2
# touchindex.txt
# echo 01 > serial

2）创建CA私钥

1
2
3
4
5
6
7
# (umask 077;openssl genrsa-out private/cakey.pem 2048)
Generating RSA private key, 2048 bit longmodulus
......................+++
..................................................................................+++
e is 65537 (0x10001)
# ll private/cakey.pem
-rw------- 1 root root 1679 May1 20:53 private/cakey.pem

3）创建CA根证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# openssl req -new -x509 -keyprivate/cakey.pem-out cacert.pem -days3360
You are about to be asked to enterinformation that will be incorporated
into your certificate request.
What you are about to enter is what iscalled a Distinguished Name or a DN.
There are quite a few fields but you canleave some blank
For some fields there will be a defaultvalue,
If you enter '.', the field will be leftblank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) :BJ
Organization Name (eg, company) :WuDay
Organizational Unit Name (eg, section)[]:Ops
Common Name (eg, your name or your server'shostname) []:ca.com
Email Address []:admin@ca.com
# ll cacert.pem
-rw-r--r-- 1 root root 1350 May1 20:57 cacert.pem

六、Web服务器lamp程序包安装
1）安装开发组件包

1
yum groupinstall "Developmenttools" "Server Platform Development" -y

2）安装httpd程序包

1
yum install httpd -y

3）安装mysql程序包

1
2
3
yum install mysql -y
yum install mysql-server -y
yum install php-mysql -y

4）安装php程序包

1
2
3
yum install php -y
yum install php-mbstring -y
yum install php-mcrypt -y

5）安装ssl模块

1
yum install mod_ssl -y

七、Web服务器httpd配置
1）创建用于存放站点程序的目录
mkdir /web/{wordpress,phpadmin} -p
2）修改/etc/httpd/conf/httpd.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#DocumentRoot "/var/www/html"    #注释DocumentRoot
DirectoryIndexindex.php index.html index.html.var#添加index.php为Web的首页
NameVirtualHost *:80          #开启虚拟主机
<VirtualHost *:80>
ServerAdmin admin@blog.com
DocumentRoot /web/wordpress #站点www.blog.com的程序存放路径
ServerName www.blog.com       #域名
ErrorLog logs/error-blog.com #错误日志
CustomLog logs/access-blog.com.log combined #访问日志
<Directory "/web/wordpress"> #定义站点访问属性
   Options None
   AllowOverride None
   Order allow,deny
   Allow from all
</Directory>
</VirtualHost>
<VirtualHost *:80>
ServerAdmin admin@phpadmin.com
DocumentRoot /web/phpadmin
ServerName www.phpadmin.com
ErrorLog logs/error-phpadmin.com
CustomLoglogs/access-phpadmin.com.log combined
RedirectMatch^/$ https://www.phpadmin.com    #重定向站点到https://www.phpadmin.com
<Directory "/web/phpadmin">
   Options None
   AllowOverride None
   Order allow,deny
   Allow from all
</Directory>
</VirtualHost>

八、Web服务器SSL配置
1）创建证书和私钥存放目录

1
mkkdir /etc/httpd/ssl

cd /etc/httpd/ssl

2）创建私钥

1
2
3
4
5
# (umask 077;opensslgenrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit longmodulus
.+++
..........................................+++
e is 65537 (0x10001)

3）创建证书申请

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# openssl req -new-key httpd.key -out httpd.csr -days 3360
You are about to be asked to enterinformation that will be incorporated
into your certificate request.
What you are about to enter is what iscalled a Distinguished Name or a DN.
There are quite a few fields but you canleave some blank
For some fields there will be a defaultvalue,
If you enter '.', the field will be leftblank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) :BJ
Organization Name (eg, company) :WuDay
Organizational Unit Name (eg, section)[]:Ops
Common Name (eg, your name or your server'shostname) []:www.phpadmin.com
Email Address []:admin@phpadmin.com

Please enter the following 'extra'attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

4）把证书申请发送给CA服务器

1
2
3
4
5
6
7
# scp httpd.csrroot@192.168.0.197:/tmp
The authenticity of host '192.168.0.197(192.168.0.197)' can't be established.
RSA key fingerprint is2e:bb:a7:50:d4:26:f7:5d:82:46:ad:9f:97:31:4f:82.
Are you sure you want to continueconnecting (yes/no)? yes
Warning: Permanently added '192.168.0.197'(RSA) to the list of known hosts.
root@192.168.0.197's password:
httpd.csr                                           100% 1041 1.0KB/s 00:00

4）CA服务器验证证书申请并签发

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# opensslca -in /tmp/httpd.csr-out /tmp/httpd.crt
Using configuration from/etc/pki/tls/openssl.cnf
Check that the request matches thesignature
Signature ok
Certificate Details:
   Serial Number: 1 (0x1)
   Validity
      Not Before: May1 14:29:08 2015GMT
      Not After : Apr 30 14:29:08 2016 GMT
   Subject:
      countryName       = CN
      stateOrProvinceName    = BJ
      organizationName    = WuDay
      organizationalUnitName    = Ops
      commonName       = www.phpadmin.com
      emailAddress       =admin@phpadmin.com
   X509v3 extensions:
      X509v3 Basic Constraints:
            CA:FALSE
      Netscape Comment:
            OpenSSL Generated Certificate
      X509v3 Subject Key Identifier:
            D2:9E:1D:5E:9B:FF:9B:F9:21:62:9A:78:CE:57:63:04:14:56:63:0F
      X509v3 Authority Key Identifier:
            keyid:93:E3:5C:A2:2C:66:DE:BF:53:02:64:64:09:6D:95:D1:4F:92:BF:56

Certificate is to be certified until Apr 3014:29:08 2016 GMT (365 days)
Sign the certificate? :y
1 out of 1 certificate requests certified,commit? y
Write out database with 1 new entries
Data Base Updated

5）从CA服务器拉回证书

1
2
3
4
5
6
7
8
# scp root@192.168.0.197:/tmp/httpd.crt./
root@192.168.0.197's password:
httpd.crt                                              100% 4547 4.4KB/s00:00
# ll
total 16
-rw-r--r-- 1 root root 4547 May1 22:23 httpd.crt
-rw-r--r-- 1 root root 1041 May1 22:18 httpd.csr
-rw------- 1 root root 1675 May1 22:16 httpd.key

6）修改/etc/httpd/conf.d/ssl.conf配置文件

1
2
3
4
5
<VirtualHost 172.16.190.25:443> #443端口监听在172.16.190.25
DocumentRoot "/web/phpadmin"
ServerName www.phpadmin.com:443
SSLCertificateFile /etc/httpd/ssl/httpd.crt #指定站点证书存放位置
SSLCertificateKeyFile/etc/httpd/ssl/httpd.key#指定私钥文件存放位置

九、启动httpd和mysqld服务
service httpd start
service mysqld start

十、安装wordpass和phpMyAdmin程序
1）下载wordpass和phpMyAdmin程序包

2）解压文件wordpass和phpMyAdmin程序包

1
2
3
4
5
6
# unzipwordpress-3.3.1-zh_CN.zip
# cd wordpress
# cp -aR ./*/web/wordpress/
# tar xfphpMyAdmin-3.5.1-all-languages.tar.bz2
# cd phpMyAdmin-3.5.1-all-languages
[root@Web-ServerphpMyAdmin-3.5.1-all-languages]# cp -aR ./* /web/phpadmin/

十一、创建wordpass数据库和用户和用于登录很管理数据库phpMyAdmin的root密码

1
2
3
4
5
6
7
8
9
10
11
12
13
# mysql
mysql> CREATE DATABASE wordpress;    #创建数据库wordpress
Query OK, 1 row affected (0.00 sec)
mysql> GRANT ALL ON wordpress.* TO'wpuser'@'localhost' IDENTIFIED BY 'wordpass'; #创建用户wpuser设置密码为wordpress并授权管理wordpress库中所有表
Query OK, 0 rows affected (0.00 sec)

mysql> SET PASSWORD FOR'root'@'localhost'=PASSWORD('mysql'); #修改root用户的密码为mysql
Query OK, 0 rows affected (0.00 sec)
mysql> SET PASSWORD FOR'root'@'127.0.0.1'=PASSWORD('mysql');
Query OK, 0 rows affected (0.00 sec)

mysql> FLUSH PRIVILEGES;    #刷新数据库，让内存中的数据存回磁盘中
Query OK, 0 rows affected (0.00 sec)

十二、配置wordpass程序的wp-config.php

1
2
3
4
5
6
7
8
/** WordPress 数据库的名称 */
define('DB_NAME', 'wordpress');

/** MySQL 数据库用户名 */
define('DB_USER', 'wpuser');

/** MySQL 数据库密码 */
define('DB_PASSWORD', 'wordpass');

十三、客户端IP设置

十四、客户端安装根证书
通过CA服务器把自己的证书共享出来，客户端安装CA证书，用于验证www.phpadmin.com和加密通信。通过Xshell自带的lftp功能把证书下载到本地的操作系统上，并把cacert.pem的扩展名改为.crt,然后进行安装证书。

1）在没有安装根证书之前的访问

2）点击“继续浏览此网站（不推荐）”，虽然可以继续访问，但浏览器会提示不受信任的证书，因为我们是私建的证书，所以要把根证书导入到浏览器中，这个过程就是你访问www.12306.cn一样，你懂的噻！

3）安装根证书

安装完之后重启浏览器就能以https加密通信访问www.phpadmin.com站点了。

十五、访问www.blog.com
第一次访问www.blog.com需要进行安装，输入站点标明，用户名，密码及电子邮件后，点击安装“安装WordPress”，安装后访问就是以上效果，你可以进行登录，登录的用户名和密码就是安装wordpress输入的用户名和密码，登录就可以进行发表属于自己的个人博客站点。

十六、访问www.phpadmin.com
在访问www.phpadmin时不用输入https://www.phpadmin.com，直接输入www.phpadmin.com,Web服务器会自动的跳转至https://www.phpadmin.com,就能访问https://www.phpadmin.com站点，轻松的管理Mysql数据库了。
这个过程就像访问百度一下，百度会自动的跳转至https://www.baidu.com。

登录后轻松的管理MySQL数据库；

页: [1]

运维网's Archiver

基于RPM包安装LAMP架构