httpd.2.4虚拟主机配置测试

erwewwe

测试目标：

三个虚拟主机，要求如下

vhost1： phpMyAdmin, 同时提供https服务；

vhost2: wordpress

配置过程：

一、配置vhost1

1、首先配置vhost1，先搭建私有CA

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

在172.16.20.242上搭建私有CA： (1) 创建私钥，公钥无需处理 [iyunv@ca ~]# cd /etc/pki/CA/ [iyunv@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus .....+++ .......+++ e is 65537 (0x10001) (2) 生成自签证书，填写相关证书信息 [iyunv@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus .....+++ .......+++ e is 65537 (0x10001) [iyunv@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Hubei Locality Name (eg, city) [Default City]:Hubei Organization Name (eg, company) [Default Company Ltd]:Gump Ltd Organizational Unit Name (eg, section) []:Ops    Common Name (eg, your name or your server's hostname) []:ca.gump.com Email Address []:caadmin@gump.com [iyunv@ca CA]# // 需要注意的是，证书格式必须为pem格式 （3）创建签署证书环境 [iyunv@ca CA]# touch /etc/pki/CA/index.txt [iyunv@ca CA]# touch /etc/pki/CA/serial [iyunv@ca CA]# echo 01 > /etc/pki/CA/serial

2、在web主机上生成证书请求，并发送证书请求到CA主机

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

在172.16.20.244生成证书请求： （1）生成密钥，并保存到应用此证书的服务的配置文件目录下 [iyunv@web ~]#  mkdir /etc/httpd/ssl [iyunv@web ~]#  cd /etc/httpd/ssl [iyunv@web ssl]# (umask 077;openssl genrsa -out httpd.key 2048) Generating RSA private key, 2048 bit long modulus ..........+++ ....................................................................+++ e is 65537 (0x10001) [iyunv@web ssl]# ls httpd.key (2) 生成证书签署请求，填写相关信息需要注意的是，除了主机地址和邮箱地址，其它需要保持一致 [iyunv@web ssl]# openssl req -new -key httpd.key -out httpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Hubei Locality Name (eg, city) [Default City]:Hubei Organization Name (eg, company) [Default Company Ltd]:Gump Ltd Organizational Unit Name (eg, section) []:Ops Common Name (eg, your name or your server's hostname) []:web.gump.com Email Address []:webadmin@gump.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [iyunv@web ssl]# ls httpd.csr  httpd.key [iyunv@web ssl]# scp httpd.csr root@172.16.20.242:/tmp/ root@172.16.20.242's password: httpd.csr                                                          100% 1050     1.0KB/s   00:00    [iyunv@web ssl]#

3、签署证书请求，将证书请求发送回web主机

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

（1）签署证书请求 [iyunv@ca CA]# openssl ca -in /tmp/httpd.csr -out /tmp/web.gump.com.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details:         Serial Number: 1 (0x1)         Validity             Not Before: Aug 23 10:55:56 2017 GMT             Not After : Aug 23 10:55:56 2018 GMT         Subject:             countryName               = CN             stateOrProvinceName       = Hubei             organizationName          = Gump Ltd             organizationalUnitName    = Ops             commonName                = web.gump.com             emailAddress              = webadmin@gump.com         X509v3 extensions:             X509v3 Basic Constraints:                 CA:FALSE             Netscape Comment:                 OpenSSL Generated Certificate             X509v3 Subject Key Identifier:                 7A:D2:B5:60:3D:13:27:33:C4:F5:02:DC:AC:44:BB:0F:F9:32:00:71             X509v3 Authority Key Identifier:                 keyid:5A:9A:54:2F:9C:91:3E:D6:BE:CC:22:68:50:C6:83:EB:23:AD:AC:AF Certificate is to be certified until Aug 23 10:55:56 2018 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [iyunv@ca CA]# （2）将证书传回请求者 [iyunv@ca CA]# scp /tmp/web.gump.com.crt root@172.16.20.244:/etc/httpd/ssl The authenticity of host '172.16.20.244 (172.16.20.244)' can't be established. RSA key fingerprint is 5a:10:33:a2:bf:5b:06:82:25:01:fb:c2:74:93:34:95. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '172.16.20.244' (RSA) to the list of known hosts. root@172.16.20.244's password: web.gump.com.crt                                                   100% 4595     4.5KB/s   00:00    [iyunv@ca CA]#

4、配置httpd支持使用ssl

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

（1）查看当前web主机是否已安装mod_ssl模块，如果没有安装，则必须先安装mod_ssl模块 （2）配置ssl配置文件 [iyunv@web ssl]# vim /etc/httpd/conf.d/ssl.conf 修改如下选项: <VirtuaHost 172.16.20.244:443> // 因为ssl会话是基于IP地址建立的，若有多个IP地址，则需指定地址，若只有一个地址，则无需修 改，保持"*"即可； DocumentRoot "/www/htdocs" // 此目录为虚拟主机vhost1的中心目录，即网页文件存放位置 ServerName web.gump.com:443 // 当前主机名 ErrorLog /logs/pma_error_log // 错误日志存放位置 Transferlog logs/pma_access_log // 访问日志存放目录 SSLCertificateFile /etc/httpd/ssl/web.gump.com.crt // 服务器证书存放目录 SSlCertificateKeyFile /etc/httpd/ssl/httpd.key // 证书私钥存放目录 (3)配置phpMyadmin网页文件 [iyunv@localhost  ~]#    mkdir -pv /www/htdocs/vhosts{1,2,3} [iyunv@localhost ~]#  unzip phpMyAdmin-4.0.10.20-all-languages.zip [iyunv@localhost ~]#  cp phpMyAdmin-4.0.10.20-all-languages /www/htdocs/vhosts1/ [iyunv@localhost  ~]#    ln -sv phpMyAdmin-4.0.10.20-all-languages pma (4)配置httpd.conf [iyunv@localhost conf]# vim httpd.conf ServerName Localhost:80 DocumentRoot "/www/htdocs" <Directory "/www/htdocs"> // Directory 指定的目录要和DocumentRoot一致 (5)配置虚拟主机配置文件 [iyunv@localhost ~]#  vim /etc/httpd/conf.d/httpd-vhost1.conf <VirtualHost 172.16.20.244:80>   ServerAdmin web.gump.com   DocumentRoot "/www/htdocs"   <Directory "/www/htdocs/vhosts1/pma">     Options None     AllowOverride None     Require all granted   </Directory> </VirtualHost> [iyunv@localhost ~]#   systemctl reload httpd.service

查看配置效果

https://s3.51cto.com/oss/201711/03/9636ca53f93f639bd10f773ee0f6dcae.png

二、配置虚拟主机2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

1、配置虚拟主机2的配置文件 [iyunv@localhost ~]#   vim /etc/httpd/conf.d/httpd-vhost2.conf <VirtualHost 172.16.20.245:80>   ServerAdmin web2.gump.com   DocumentRoot "/www/htdocs"   <Directory "/www/htdocs/vhosts2">     Options None     AllowOverride None     Require all granted   </Directory> </VirtualHost> 2、为虚拟主机2配置IP地址 由于是虚拟机，没有多张网卡使用ip命令添加地址达到多IP效果 [iyunv@localhost ~]#   ip addr add 172.16.20.245/24 dev ens33 [iyunv@localhost ~]#   ip addr show dev ens33 [iyunv@localhost ~]# ip add show dev ens33 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000     link/ether 00:0c:29:44:e2:e3 brd ff:ff:ff:ff:ff:ff     inet 172.16.20.244/24 brd 172.16.20.255 scope global ens33        valid_lft forever preferred_lft forever     inet 172.16.20.245/24 scope global secondary ens33        valid_lft forever preferred_lft forever     inet6 fe80::d846:2237:6188:97fe/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever     inet6 fe80::a0de:8503:69c8:5595/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever     inet6 fe80::9a1a:88f0:c9cf:41bd/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever 3、配置虚拟主机2的网页文件 [iyunv@localhost ~]#  unzip wordpress-4.7.4-zh_CH.zip [iyunv@localhost ~]#  cp wordpress /www/htdocs/vhosts2/ 4、配置虚拟主机2的wordpress的配置文件 [iyunv@localhost ~]# mysql MariaDB [(none)]> CREATE DATABASE mydb1; MariaDB [(none)]> exit // 连接wordpress必须要配置正确的数据库及用户名密码，所以需要实现创建好数据库 [iyunv@localhost ~]#   cd /www/htdocs/vhost2/wordpress [iyunv@localhost ~]#   cp wp-config-sample.php wp-config.php [iyunv@localhost ~]#   vim wp-config.php define('DB_NAME','mydb1');  // 数据库为事先创建好的mydb1 define('DB_USER','root');   // 用户名为root define('DB_PASSWORD','');   // root密码默认为空

5、查看配置效果

https://s3.51cto.com/oss/201711/03/deaa95b4893b0a5ed6308cd1f3aa07b2.png

写的比较潦草，如有遗漏错误和争议之处，欢迎大家的批评指正和讨论，谢谢。