Options None
AllowOverride None
Require all granted
创建/web/vhosts/www3和/web/vhosts/www4目录，分别在目录里面添加一个简单的测试页面：
$ mkdir -p /web/vhosts/www{3,4}
$ echo "This is www3.stuX.com" > /web/vhosts/www3/index.html
$ echo "This is www4.stuX.com" > /web/vhosts/www4/index.html
客户端测试
在客户端配置/etc/hosts文件，用来解析主机名
root@alternative:~# cat /etc/hosts | grep -i www
192.168.5.121 www1.stuX.com www2.stuX.com
192.168.5.181 www3.stuX.com www4.stuX.com通过客户端的测试，可以看到结果如下所示，完成了基于主机名的虚拟主机配置：
root@alternative:~# curl http://www1.stuX.com
This is www1.stuX.com
root@alternative:~# curl http://www2.stuX.com
This is www2.stuX.com
root@alternative:~# curl http://www3.stuX.com
This is www3.stuX.com
root@alternative:~# curl http://www4.stuX.com
This is www4.stuX.com
伪装客户端和跳转地址
root@alternative:~# curl -A "curl test" -e "http://www.baidu.com" http://www1.stuX.com
This is www1.stuX.com
root@alternative:~# curl -A "curl test2" -e "http://www.sina.com" http://www2.stuX.com
This is www2.stuX.com
root@alternative:~# curl -A "curl test3" -e "http://www.sohu.com" http://www3.stuX.com
This is www3.stuX.com
root@alternative:~# curl -A "curl test4" -e "http://www.163.com" http://www4.stuX.com
This is www4.stuX.com
Authorization Required
This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.
Apache/2.2.15 (CentOS) Server at www1.stux.com Port 80
Unauthorized
This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.
在192.168.5.121上面关闭mysql数据库，再测试认证，发现认证失败：
$ service mysqld stop
root@alternative:~# curl -u admin:admin http://www3.stuX.com/status
401 Unauthorized
Unauthorized
This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.
相关的错误日志文件输出：
[Sun Jun 04 19:23:22 2017] [error] [pid 16685] mod_auth_mysql.c(521): [client 192.168.5.180:55679] MySQL ERROR: Can't connect to MySQL server on '192.168.5.121' (111)实验三：基于IP的简单ACL控制
配置基于IP的简单认证规则，使得：
Order allow,deny
Allow from all
Deny from 192.168.5.180/32
重启httpd服务service httpd restart CentOS7 httpd2.4环境下
在实验二的virtualhost.conf配置文件的基础上，在里面添加标签，并配置IP访问权限，如下所示：
Forbidden
You don't have permission to access /index.html
on this server.
Apache/2.2.15 (CentOS) Server at www1.stux.com Port 80
root@alternative:~#
root@alternative:~# curl http://www3.stuX.com/index.html
This is www3.stuX.com在192.168.5.190这台机器上面用curl命令访问，发现www3.stuX.com访问失败，提示403 Forbidden错误，证明访问控制生效。www1.stuX.com可以正常访问。
root@ubuntu-node1:~# curl http://www3.stuX.com/index.html
403 Forbidden
Forbidden
You don't have permission to access /index.html
on this server.
root@ubuntu-node1:~# curl http://www1.stuX.com/index.html
This is www1.stuX.com实验四：基于虚拟主机的https服务
分别为www2.stuX.com和www4.stuX.com建立https服务，选用192.168.5.182这台机器作为CA。
首先需要将httpd2.2服务器、httpd2.4服务器、CA服务器、客户端进行时间同步，如果不同步的话，有可能会出现httpd服务器或者客户端的时间要早于CA根证书的有效起始时间，从而导致错误。使用ntpdate命令或者ntpd服务进行时间同步，详细步骤请参照linux的ntp服务及配置。
CA生成根证书
首先生成私钥:
$ cd /etc/pki/CA
$ (umask 077; openssl genrsa -out private/cakey.pem 2048)
$ ls -al private/
total 4
drwx------. 2 root root 22 Jun 4 20:16 .
drwxr-xr-x. 6 root root 57 Mar 20 06:43 ..
-rw------- 1 root root 1675 Jun 4 20:16 cakey.pem然后通过私钥生成自签名证书：
$ openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:BJ
Organization Name (eg, company) [Default Company Ltd]:CA
Organizational Unit Name (eg, section) []:caexec
Common Name (eg, your name or your server's hostname) []:ca.caexec.com
Email Address []:
$ touch index.txt serial
$ echo 01 > serial
$ ls /etc/pki/CA
cacert.pem certs crl index.txt newcerts private serial
httpd2.2服务器生成证书请求并到CA签名
首先生成私钥
$ mkdir /web/vhosts/www2/ssl
$ cd /web/vhosts/www2/ssl/
$ (umask 077; openssl genrsa -out www2.key 2048)根据私钥生成证书申请请求
$ openssl req -new -key www2.key -out www2.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:BJ
Organization Name (eg, company) [Default Company Ltd]:CA
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:www2.stuX.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:将证书申请请求发送到CA服务器上面，CA进行签名，签完之后再返回给httpd2.2服务器
$ openssl ca -in www2.csr -out www2.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 4 14:23:12 2017 GMT
Not After : Jun 4 14:23:12 2018 GMT
Subject:
countryName = CN
stateOrProvinceName = BJ
organizationName = CA
organizationalUnitName = ops
commonName = www2.stuX.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
99:13:92:93:B4:64:FF:15:70:6A:FF:6A:E0:C1:AA:E9:C1:28:13:47
X509v3 Authority Key Identifier:
keyid:D0:3B:30:3D:AF:76:F3:47:7D:83:FA:F1:19:F9:1D:29:11:9C:42:E1
Certificate is to be certified until Jun 4 14:23:12 2018 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated确保httpd2.2服务器上面安装有mod_ssl模块，如果没有的话，用yum install mod_ssl安装，或者编译安装。
$ httpd -M | grep ssl
ssl_module (shared)
Syntax OK创建一个测试页面ssl.html
echo "This is ssl page for www2.stuX.com." > /web/vhosts/www2/ssl.html在原有的virtualhost.conf文件上面配置一个新的，提供https服务，并将服务器私钥和CA签发的证书配置上去，配置完毕之后，重启httpd服务service httpd restart：
ServerName www2.stuX.com
DocumentRoot "/web/vhosts/www2"
DirectoryIndex ssl.html
ErrorLog /web/vhosts/www2/ssl_error_log
LogLevel info
TransferLog /web/vhosts/www2/ssl_access_log
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /web/vhosts/www2/ssl/www2.crt
SSLCertificateKeyFile /web/vhosts/www2/ssl/www2.key
Order allow,deny
Allow from all
httpd2.4服务器生成证书请求并到CA签名
生成私钥
$ mkdir /web/vhosts/www4/ssl
$ cd /web/vhosts/www4/ssl/
$ (umask 077; openssl genrsa -out www4.key 2048)根据私钥生成证书申请请求
$ openssl req -new -key www4.key -out www4.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:BJ
Organization Name (eg, company) [Default Company Ltd]:CA
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:www4.stuX.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:将证书申请请求发送到CA服务器上面，CA进行签名，签完之后再返回给httpd2.2服务器
$ openssl ca -in www4.csr -out www4.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Jun 4 16:14:45 2017 GMT
Not After : Jun 4 16:14:45 2018 GMT
Subject:
countryName = CN
stateOrProvinceName = BJ
organizationName = CA
organizationalUnitName = ops
commonName = www4.stuX.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DE:84:D5:8C:11:7F:F8:C4:F4:26:49:A3:C2:0E:1A:07:62:00:06:8F
X509v3 Authority Key Identifier:
keyid:D0:3B:30:3D:AF:76:F3:47:7D:83:FA:F1:19:F9:1D:29:11:9C:42:E1
Certificate is to be certified until Jun 4 16:14:45 2018 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated确保httpd2.4服务器上面安装有mod_ssl模块，如果没有的话，用yum install mod_ssl安装，或者编译安装。
$ httpd -M | grep ssl
ssl_module (shared)创建一个测试页面ssl.html
echo "This is ssl page for www4.stuX.com." > /web/vhosts/www4/ssl.html在原有的virtualhost.conf文件上面配置一个新的，提供https服务，并将服务器私钥和CA签发的证书配置上去，配置完毕之后，重启httpd服务systemctl restart httpd.service：
ServerName www4.stuX.com
DocumentRoot "/web/vhosts/www4"
DirectoryIndex ssl.html
ErrorLog /web/vhosts/www4/ssl_error_log
LogLevel info
TransferLog /web/vhosts/www4/ssl_access_log
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /web/vhosts/www4/ssl/www4.crt
SSLCertificateKeyFile /web/vhosts/www4/ssl/www4.key
Options None
AllowOverride None
Require all granted
客户端测试
将CA服务器的自签名证书拷贝到客户端上面，用curl工具进行测试，分别访问httpd2.2服务器和httpd2.4服务器的https服务页面：
root@alternative:~# curl --cacert cacert.pem https://www2.stuX.com
This is ssl page for www2.stuX.com.
root@alternative:~# curl --cacert cacert.pem https://www4.stuX.com
This is ssl page for www4.stuX.com.
QQ群⑧：
窥视卡
雷达卡
发表于 2018-11-18 12:36:06
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡