一、配置使用ssl完成https访问apache服务器
[root@localhost conf.d]# systemctl status firewalld
[root@localhost conf.d]# systemctl stop firewalld
[root@localhost conf.d]# setenforce 0
[root@localhost ~]# yum install mod_ssl -y
[root@localhost ~]# mkdir /www/myssl
[root@localhost www]# echo ‘this is my first https page.’ > ./myssl/index.html
[root@localhost ~]# cd /etc/httpd/conf.d
[root@localhost conf.d]# vim myssl.conf
[root@localhost conf.d]# systemctl restart httpd
二、配置访问apache的cgi程序
[root@localhost conf.d]# cd /var/www/cgi-bin/
[root@localhost cgi-bin]# vim test.cgi
[root@localhost cgi-bin]# chmod +x test.cgi
三、nfs挂载
a.开放/nfs/shared目录,供所有用户查询资料
服务端:
#首先关闭防火墙和SELINUX的状态
RPC主程序:rpcbind
NFS主程序:nfs-utils
[root@localhost conf.d]# yum install rpcbind nfs-utils -y
[root@localhost conf.d]# systemctl restart nfs-server.service
[root@localhost conf.d]# vim /etc/exports
[root@localhost ~]# mkdir /nfs/shared -p
[root@localhost ~]# touch /nfs/shared/file{a…e}
[root@localhost shared]# exportfs -r
客户端:
[root@localhost ~]# showmount -e 192.168.30.133
[root@localhost ~]# mount 192.168.30.133:/nfs/shared /mnt
[root@localhost ~]# cd /mnt
[root@localhost mnt]# ll
total 0
-rw-r–r–. 1 root root 0 Jul 29 22:24 filea
-rw-r–r–. 1 root root 0 Jul 29 22:24 fileb
-rw-r–r–. 1 root root 0 Jul 29 22:24 filec
-rw-r–r–. 1 root root 0 Jul 29 22:24 filed
-rw-r–r–. 1 root root 0 Jul 29 22:24 filee
[root@localhost mnt]# touch 1
touch: cannot touch ‘1’: Read-only file system
b.开放/nfs/upload目录,该目录为192.168.xxx.0/24网段的主机的数据上传目录
服务端:
[root@localhost shared]# vim /etc/exports
[root@localhost shared]# mkdir /nfs/upload -p
[root@localhost nfs]# chmod o+w /nfs/upload/
[root@localhost nfs]# ll
total 0
drwxr-xr-x. 2 root root 71 Jul 29 22:24 shared
drwxr-xrwx. 2 root root 6 Jul 29 22:38 upload
[root@localhost nfs]# touch /nfs/upload/test{a…c}
[root@localhost nfs]# cd upload/
[root@localhost upload]# ll
total 0
-rw-r–r–. 1 root root 0 Jul 29 22:41 testa
-rw-r–r–. 1 root root 0 Jul 29 22:41 testb
-rw-r–r–. 1 root root 0 Jul 29 22:41 testc
[root@localhost upload]# useradd -u 2001 nfs-upload
[root@localhost upload]# groupmod -g 2001 nfs-upload
[root@localhost upload]# id nfs-upload
uid=2001(nfs-upload) gid=2001(nfs-upload) groups=2001(nfs-upload)
[root@localhost upload]# exportfs -r
客户端:
[root@localhost mnt]# showmount -e 192.168.30.133
Export list for 192.168.30.133:
/nfs/upload 192.168.30.0/24
[root@localhost mnt]# useradd -u 2001 nfs-upload
[root@localhost mnt]# groupmod -g 2001 nfs-upload
[root@localhost mnt]# mount 192.168.30.133:/nfs/upload /media/
[root@localhost mnt]# cd /media/
[root@localhost media]# ll
total 0
-rw-r–r–. 1 root root 0 Jul 29 22:41 testa
-rw-r–r–. 1 root root 0 Jul 29 22:41 testb
-rw-r–r–. 1 root root 0 Jul 29 22:41 testc
c.将/home/tom (该目录为uid=111, gid=111的tom用户的家目录)目录仅共享给192…168.xxx.128这台主机上的Jerry用户,Jerry对该目录具有访问、新建和删除文件的权限
服务端:
[root@localhost shared]# vim /etc/exports
[root@localhost upload]# useradd -u 1111 tom
[root@localhost upload]# id tom
uid=1111(tom) gid=1111(tom) groups=1111(tom)
[root@localhost upload]# touch /home/tom/tm{a…c}
[root@localhost upload]# exportfs -r
客户端:
[root@localhost media]# showmount -e 192.168.30.133
Export list for 192.168.30.133:
/nfs/upload 192.168.30.0/24
/home/tom 192.168.30.137
[root@localhost media]# useradd -u 1111 tom
[root@localhost media]# id tom
uid=1111(tom) gid=1111(tom) groups=1111(tom)
[root@localhost media]# mount 192.168.30.133:/home/tom /mnt
四、autofs自动挂载
远程nfs服务器要的目录为/nfs/autofs
客户端的挂载目录/data/autofs
且设置自动卸载时间为60秒
服务端:
[root@localhost upload]# mkdir /nfs/autofs -p
[root@localhost upload]# chmod o+w /nfs/autofs/
[root@localhost upload]# vim /etc/exports
客户端:
[root@localhost media]# yum install autofs -y
[root@localhost media]# mkdir /data/autofs -p
[root@localhost media]# vim /etc/auto.master
[root@localhost etc]# vim /etc/auto.data
[root@localhost etc]# vim /etc/auto.data
[root@localhost etc]# vim /etc/autofs.conf
[root@localhost etc]# systemctl restart autofs
五、使用https来访问的web服务器:要求使用自签名的CA签名证书(openssl. x.509).crt 以及私钥
5.1. 生成证书
生成私钥
openssl genrsa -des3 -out myCA.key 2048
##openssl genrsa 用于生成RSA私钥,不会生成公钥,因为公钥提取自私钥
##-des3为加密方式
##2048为生成秘钥长度
##可以加上-nodes参数,禁止进行加密,即可不运行下面的消除密码
消除私钥key的密码
openssl rsa -in myCA.key -out myCA.key
生成pem文件
openssl req -utf8 -x509 -new -nodes -key myCA.key -sha256 -days 825 -out myCA.pem
5.2. 创建CA签名证书
生成私钥
openssl genrsa -out server.key 2048
创建证书签名请求
openssl req -new -key server.key -out server.csr
##Common Name应该与域名保持一致,否则会引起浏览器警告
为扩展创建一个配置文件
server.ext cat <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.baidu.com # Be sure to include the domain name here because Common Name is not so commonly honoured by itself
DNS.2 = www.sougou.com # Optionally, add additional domains (I’ve added a subdomain here)
IP.1 = 192.168.1.1 # Optionally, add an IP address (if the connection which you have planned requires it) EOF
##chrome 会查看当前域名是否在证书中声明,该声明由 subjectAltName 字段设置。上述的生成步骤默认未设置该字段