CentOS 7配置+xcache, php module

67543

CentOS7, apm+xcache, php module;
       a) 一个虚拟主机提供phpMyAdmin，另一个虚拟主机提供wordpress；
       b) 为phpMyAdmim提供https服务；
selinux处于关闭状态
httpd2.4
mariadb5.5
php5.4

安装：php-mysql phpmariadb-server httpd

1	yum-y install php-mysql php mariadb-server httpd

配置安装PHP组件

1	yum install php-mysql php-gd libjpeg* php-ldap php-odbc

安装https相关模块

1

mod_ssl

配置httpd虚拟主机

1

vim/etc/httpd/conf.d/FQDN.conf <VirtualHost*:80>     ServerName www. phpmyadmin.com     DocumentRoot /httpd/vhosts/phpmyadmin     <Directory "/httpd/vhosts/ phpmyadmin">         Options None         AllowOverride None         Require all granted     </Directory>     ErrorLog /var/log/httpd/ phpmyadmin /error.log     CustomLog /var/log/httpd/ phpmyadmin /access.logcombined </VirtualHost> <br><VirtualHost*:80>     ServerName www. wordpress.com    DocumentRoot /httpd/vhosts/wordpress     <Directory"/httpd/vhosts/wordpress">         Options None         AllowOverride None         Require all granted     </Directory>     ErrorLog /var/log/httpd/wordpress/error.log     CustomLog/var/log/httpd/wordpress/access.log combined </VirtualHost>

创建日志文件夹

1	[iyunv@localhost~]# mkdir /var/log/httpd/wordpress [iyunv@localhost~]# mkdir /var/log/httpd/phpmyadmin

创建根文件夹

1	[iyunv@localhost~]# mkdir -p /httpd/vhosts/wordpress [iyunv@localhost~]# mkdir -p /httpd/vhosts/phpMyAdmin

检查httpd语法，启动服务，设置开机自动启动服务

1	[iyunv@localhost~]# httpd -t SyntaxOK [iyunv@localhost~]# systemctl start httpd [iyunv@localhost~]# systemctl enable httpd

启动mariadb，并设置为开启

1	[iyunv@localhost~]# systemctl start mariadb.service [iyunv@localhost~]# systemctl enable mariadb.service

运行mariadb的安全配置

1

[root@localhostconf.d]# mysql_secure_installation /usr/bin/mysql_secure_installation:line 379: find_mysql_client: command not found NOTE:RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB       SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY! Inorder to log into MariaDB to secure it, we'll need the current passwordfor the root user.  If you've justinstalled MariaDB, and youhaven't set the root password yet, the password will be blank, soyou should just press enter here. Entercurrent password for root (enter for none): （回车） OK,successfully used password, moving on... Settingthe root password ensures that nobody can log into the MariaDB rootuser without the proper authorisation. Setroot password? [Y/n] Y Newpassword: Re-enternew password: Passwordupdated successfully! Reloadingprivilege tables.. ... Success! Bydefault, a MariaDB installation has an anonymous user, allowing anyone tolog into MariaDB without having to have a user account created for them.  This is intended only for testing, and tomake the installation go abit smoother.  You should remove thembefore moving into a productionenvironment. Removeanonymous users? [Y/n] y ... Success! Normally,root should only be allowed to connect from 'localhost'.  This ensuresthat someone cannot guess at the root password from the network. Disallowroot login remotely? [Y/n] y ... Success! Bydefault, MariaDB comes with a database named 'test' that anyone can access.  This is also intended only for testing, andshould be removed beforemoving into a production environment. Removetest database and access to it? [Y/n] y - Dropping test database... ... Success! - Removing privileges on test database... ... Success! Reloadingthe privilege tables will ensure that all changes made so far willtake effect immediately. Reloadprivilege tables now? [Y/n] y ... Success! Cleaningup... Alldone!  If you've completed all of theabove steps, your MariaDB installationshould now be secure. Thanksfor using MariaDB!

编辑mariadb的配置文件，在[mysqld]中添加配置

1	[iyunv@localhost~]#vim /etc/my.cnf innodb_file_per_table= ON skip_name_resolve= ON

进入mariadb数据库

1

[iyunv@localhost~]# mysql -u root -p Enterpassword: Welcometo the MariaDB monitor.  Commands endwith ; or \g. YourMariaDB connection id is 10 Serverversion: 5.5.47-MariaDB MariaDB Server Copyright(c) 2000, 2015, Oracle, MariaDB Corporation Ab and others Type'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB[(none)]>

创建wordpress用数据库

1	MariaDB[(none)]> grant all on wpdb.* to 'wpuser@192.168.%.%' identified by'password -> ; QueryOK, 0 rows affected (0.00 sec)

更新权限后退出

1	MariaDB[(none)]> flush privileges     -> ; QueryOK, 0 rows affected (0.00 sec) >MariaDB[(none)]> quit

安装WordPress

1	[iyunv@localhostwordpress]# yum -y install wordpress

将配置文件移动至/httpd/vhost/wordpress文件夹下

1	[iyunv@localhostwordpress]# mv /usr/share/wordpress /httpd/vhosts/wordpress/

配置相应wordpress配置文件

1

[iyunv@localhostwordpress]# vim wp-config.php // **MySQL settings - You can get this info from your web host ** // /**The name of the database for WordPress */ define('DB_NAME','wpdb'); >/**MySQL database username */ define('DB_USER','wpuser'); /**MySQL database password */ define('DB_PASSWORD','password'); /**MySQL hostname */ define('DB_HOST','192.168.1.10');

输入www.wordpress.com后进入主页


安装phpMyAdmin

1	[iyunv@wwwphpMyAdmin]# yum -y install phpMyAdmin

将安装文件复制至相应目录下

1	cp -r./ /httpd/vhosts/phpmyadmin/>

用浏览器打开


为phpMyAdmin配置https
使用192.186.1.7为192.168.1.10颁发CA证书
为192.168.1.7创建私有CA；切换至/etc/pki/CA/目录

1	[iyunv@bogon~]# cd /etc/pki/CA/ [iyunv@bogonCA]# (umask 077; openssl genrsa -out private/cakey.pem 1024) GeneratingRSA private key, 1024 bit long modulus .................++++++ ......................................++++++ e is65537 (0x10001

创建自签证书

1

[iyunv@bogonCA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem Youare about to be asked to enter information that will be incorporated intoyour certificate request. Whatyou are about to enter is what is called a Distinguished Name or a DN. Thereare quite a few fields but you can leave some blank Forsome fields there will be a default value, Ifyou enter '.', the field will be left blank. ----- CountryName (2 letter code) [XX]:CN Stateor Province Name (full name) []:beijing LocalityName (eg, city) [Default City]:beijing OrganizationName (eg, company) [Default Company Ltd]:phpmyadmin OrganizationalUnit Name (eg, section) []:phpmyadmin CommonName (eg, your name or your server's hostname) []:ca.admin.com EmailAddress []:caadmin@phpmyadmin.com

创建结构文件

1	[iyunv@bogonCA]# touch index.txt [iyunv@bogonCA]# echo 01 > serial

为服务端配置证书

1

[iyunv@wwwssl]# openssl req -new -key httpd.key -out httpd.csr Youare about to be asked to enter information that will be incorporated intoyour certificate request. Whatyou are about to enter is what is called a Distinguished Name or a DN. >Thereare quite a few fields but you can leave some blank Forsome fields there will be a default value, Ifyou enter '.', the field will be left blank. ----- CountryName (2 letter code) [XX]:CN >Stateor Province Name (full name) []:beijing LocalityName (eg, city) [Default City]:beijing OrganizationName (eg, company) [Default Company Ltd]:phpmyadmin OrganizationalUnit Name (eg, section) []:phpmyadmin CommonName (eg, your name or your server's hostname) []:www.phpmyadmin.com EmailAddress []:caadmin@phpmyadmin.com Pleaseenter the following 'extra' attributes to besent with your certificate request Achallenge password []: Anoptional company name []:

讲所需签名证书复制至CA服务器

1

[iyunv@wwwssl]# scp httpd.csr 192.168.1.7:/tmp Theauthenticity of host '192.168.1.7 (192.168.1.7)' can't be established. ECDSAkey fingerprint is 4b:8b:6d:c8:53:c4:7e:ff:dd:26:a2:b9:67:1d:ab:cd. Areyou sure you want to continue connecting (yes/no)? yes Warning:Permanently added '192.168.1.7' (ECDSA) to the list of known hosts.

给服务器签发证书

1

[iyunv@bogonCA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt Usingconfiguration from /etc/pki/tls/openssl.cnf Checkthat the request matches the signature Signatureok CertificateDetails:         Serial Number: 1 (0x1)         Validity            Not Before: Jul 17 02:49:36 2016GMT           Not After : Jul 17 02:49:36 2017GMT         Subject:             countryName               = CN            stateOrProvinceName       = beijing            organizationName          = phpmyadmin             organizationalUnitName    = phpmyadmin            commonName                = www.phpmyadmin.com            emailAddress              = caadmin@phpmyadmin.com        X509v3 extensions:             X509v3 Basic Constraints:                 CA:FALSE             Netscape Comment:                 OpenSSL Generated Certificate            X509v3 Subject Key Identifier:                97:05:5A:39:41:43:C0:61:6E:E1:23:18:98:78:02:0D:21:F3:2B:EE             X509v3 Authority Key Identifier:               keyid:0F:9B:41:AB:0F:47:89:C2:28:98:0F:59:61:BE:D3:4E:04:C9:51:81 Certificateis to be certified until Jul 17 02:49:36 2017 GMT (365 days) Signthe certificate? [y/n]:y 1 outof 1 certificate requests certified, commit? [y/n]y Writeout database with 1 new entries DataBase Updated

将签发好的证书复制至phpMyAdmin服务器

1

[iyunv@bogonCA]# scp /tmp/httpd.crt 192.168.1.10:/etc/httpd/ssl Theauthenticity of host '192.168.1.10 (192.168.1.10)' can't be established. ECDSAkey fingerprint is d3:71:51:da:74:25:b2:af:b6:d2:d4:98:9a:cd:f4:ee. Areyou sure you want to continue connecting (yes/no)? yes Warning:Permanently added '192.168.1.10' (ECDSA) to the list of known hosts. root@192.168.1.10'spassword: httpd.crt                                                      100% 3317     3.2KB/s   00:00

编辑ssl.conf文件，

1	[iyunv@www ssl]# cd ../conf.d [iyunv@www conf.d]# vim ssl.conf

将页面文件路径修改至phpMyAdmin页面路径

1

#General setup for the virtual host, inherited from global configuration #DocumentRoot"/var/www/html" #ServerNamewww.example.com:443 DocumentRoot"/httpd/vhosts/phpmyadmin" ServerNamewww.phpmyadmin.com:443#   Server Certificate: #Point SSLCertificateFile at a PEM encoded certificate.  If # thecertificate is encrypted, then you will be prompted for a #pass phrase.  Note that a kill -HUP willprompt again.  A new #certificate can be generated using the genkey(1) command. SSLCertificateFile/etc/httpd/ssl/httpd.crt

修改证书文件路径

1

#   Server Certificate: #Point SSLCertificateFile at a PEM encoded certificate.  If # thecertificate is encrypted, then you will be prompted for a >#pass phrase.  Note that a kill -HUP willprompt again.  A new #certificate can be generated using the genkey(1) command. SSLCertificateFile/etc/httpd/ssl/httpd.crt #   Server Private Key: #   If the key is not combined with thecertificate, use this #   directive to point at the key file.  Keep in mind that if #   you've both a RSA and a DSA private key youcan configure #   both in parallel (to also allow the use ofDSA ciphers, etc.) SSLCertificateKeyFile/etc/httpd/ssl/httpd.key

重启httpd服务

1	[root@wwwconf.d]# systemctl restart httpd

访问https://www.phpmuadmin.com


安装xcache后重启httpd服务

1 2	[root@bogonconf.d]# yum -y install php-xcache [iyunv@bogonvhosts]# systemctl restart httpd

使用ab命令进行压力测试（进行10次）

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

[iyunv@bogonvhosts]# ab -c 100 -n 1000 http://www.xcache.com/index.php Timeper request:       132.352 [ms] (mean) Timeper request:       1.324 [ms] (mean,across all concurrent requests) Transferrate:          34763.10 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 200 -n 2000 http://www.xcache.com/index.php Timeper request:       334.702 [ms] (mean) Timeper request:       1.674 [ms] (mean,across all concurrent requests) Transferrate:          27492.89 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 300 -n 3000 http://www.xcache.com/index.php Timeper request:       1513.902 [ms] (mean) Timeper request:       5.046 [ms] (mean,across all concurrent requests) Transferrate:          9117.43 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 400 -n 4000 http://www.xcache.com/index.php Timeper request:       5866.443 [ms] (mean) Timeper request:       14.666 [ms] (mean,across all concurrent requests) Transferrate:          3039.11 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 500 -n 5000 http://www.xcache.com/index.php Timeper request:       5984.272 [ms] (mean) Timeper request:       11.969 [ms] (mean,across all concurrent requests) Transferrate:          3681.99 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 600 -n 6000 http://www.xcache.com/index.php Timeper request:       6207.417 [ms] (mean) Timeper request:       10.346 [ms] (mean,across all concurrent requests) Transferrate:          4296.02 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 700 -n 7000 http://www.xcache.com/index.php Timeper request:       1901.629 [ms] (mean) Timeper request:       2.717 [ms] (mean,across all concurrent requests) Transferrate:          16936.40 [Kbytes/sec]received、 [iyunv@bogonvhosts]# ab -c 800 -n 8000 http://www.xcache.com/index.php Timeper request:       3199.896 [ms] (mean) Timeper request:       4.000 [ms] (mean,across all concurrent requests) Transferrate:          11224.73 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 900 -n 9000 http://www.xcache.com/index.php Timeper request:       3335.247 [ms] (mean) Timeper request:       3.706 [ms] (mean, across all concurrentrequests) Transferrate:          12321.67 [Kbytes/sec]received [iyunv@bogonvhosts]# ab -c 1000 -n 10000 http://www.xcache.com/index.php Timeper request:       4754.311 [ms] (mean) Timeper request:       4.754 [ms] (mean,across all concurrent requests) Transferrate:          9507.14 [Kbytes/sec]received