配置虚拟主机和https

配置虚拟主机和https

---

配置虚拟主机

相同IP不同端口

• 设置主机名

[root@192 ~]# vim /etc/httpd/conf/httpd.conf 
ServerAdmin root@localhost

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
ServerName www.example.com:80  //取消这一行的注释

• 配置虚拟机

//将虚拟主机的主配置文件复制到/etc/httpd/conf.d/目录下
[root@192 ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@192 ~]# cp /usr/share/doc/httpd/httpd-vhosts.conf /etc/httpd/conf.d/
[root@192 ~]# ls /etc/httpd/conf.d/
autoindex.conf  httpd-vhosts.conf  README  userdir.conf  welcome.conf

• 下载源码包并解压

[root@192 ~]# cd /var/www/html/
[root@192 html]# ls
坦克.zip  斗地主.zip
[root@192 html]# unzip 斗地主.zip 
[root@192 html]# unzip 坦克.zip
[root@192 html]# ls
 Battle_City  'HTML5 canvas移动端斗地主小游戏'   坦克.zip   斗地主.zip
[root@192 html]# mv 'HTML5 canvas移动端斗地主小游戏' doudizhu
[root@192 html]# mv Battle_City tanke
[root@192 html]# rm -rf 坦克.zip 斗地主.zip 
[root@192 html]# ls
doudizhu  tanke
[root@192 html]# ls doudizhu
DJDDZ.js  img  index.html  JControls.js  Prototype.js  ResourceData.js
[root@192 html]# ls tanke
audio  css  images  index.html  js

• 相同IP不同端口

[root@192 ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf  *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>

Listen 81
<VirtualHost *:81>
    DocumentRoot "/var/www/html/tanke"
    ServerName www.tanke.com
    ErrorLog "/var/log/httpd/tanke.com-error_log"
    CustomLog "/var/log/httpd/tanke.com-access_log" common
</VirtualHost>

[root@192 ~]# httpd -t   //检查配置文件语法
Syntax OK
[root@192 ~]# systemctl restart httpd.service   //重启服务
[root@192 ~]# ss -anlt             //查看端口
State      Recv-Q     Send-Q          Local Address:Port           Peer Address:Port     Process     
LISTEN     0          128                   0.0.0.0:22                  0.0.0.0:*                    
LISTEN     0          128                         *:80                        *:*                    
LISTEN     0          128                         *:81                        *:*                    
LISTEN     0          128                      [::]:22                     [::]:*  

[root@192 ~]# systemctl stop firewalld.service  //关闭防火墙，临时关闭
[root@192 ~]# setenforce 0

• 测试访问
  //访问192.168.174.164的80端口，默认为80端口
  
  //访问192.168.174.164的81端口
  

不同IP相同端口

• 临时添加一块网卡

[root@192 ~]# ip addr add 192.168.174.166/24 dev ens33 
[root@192 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:88:ff:e9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.174.164/24 brd 192.168.174.255 scope global dynamic noprefixroute ens33
       valid_lft 1769sec preferred_lft 1769sec
    inet 192.168.174.166/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe88:ffe9/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

• 不同IP相同端口

[root@192 ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf 
<VirtualHost 192.168.174.164:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>

<VirtualHost 192.168.174.166:80>
    DocumentRoot "/var/www/html/tanke"
    ServerName www.tanke.com
    ErrorLog "/var/log/httpd/tanke.com-error_log"
    CustomLog "/var/log/httpd/tanke.com-access_log" common
</VirtualHost>

[root@192 ~]# httpd -t
Syntax OK
[root@192 ~]# systemctl restart httpd.service 

• 测试访问
  //访问192.168.174.164的80端口
  
  //访问192.168.174.166的80端口
  

相同IP不同域名

• 相同IP不同域名

[root@192 ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf 
<VirtualHost *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/doudizhu.com-error_log"
    CustomLog "/var/log/httpd/doudizhu.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot "/var/www/html/tanke"
    ServerName www.tanke.com
    ErrorLog "/var/log/httpd/tanke.com-error_log"
    CustomLog "/var/log/httpd/tanke.com-access_log" common
</VirtualHost>

[root@192 ~]# httpd -t
Syntax OK
[root@192 ~]# systemctl restart httpd.service 

• 本地域名映射
  //在本地windows C:\Windows\System32\drivers\etc\hosts下做域名映射，先将文件拉到桌面，否则没有权限修改，修改完成之后，再拉回去
  

• 测试访问
  //访问www.doudizhu.com
  
  //访问www.tanke.com
  

配置https

//下载mod_ssl模块
[root@192 ~]# dnf -y install mod_ssl
[root@192 ~]# systemctl restart httpd.service 
[root@192 ~]# httpd -t
Syntax OK
[root@192 ~]# httpd -M | grep ssl
 ssl_module (shared)
[root@192 ~]# cat /etc/httpd/conf.modules.d/00-ssl.conf 
LoadModule ssl_module modules/mod_ssl.so

//CA生成一对密钥
[root@192 ~]# cd /etc/pki/
[root@192 pki]# mkdir CA
[root@192 pki]# ls
CA  ca-trust  java  rpm-gpg  rsyslog  tls
[root@192 pki]# cd CA/
[root@192 CA]# mkdir private
[root@192 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
...................................................................................................+++++
.....................................................................+++++
e is 65537 (0x010001)

//生成自签证书
[root@192 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:jiaoyu
Common Name (eg, your name or your server's hostname) []:www.doudizhu.com
Email Address []:1@2.com
[root@192 CA]# mkdir certs newcerts crl  //创建三个目录
[root@192 CA]# touch index.txt && echo 01 > serial //创建文件

// 客户端（例如httpd服务器）生成密钥
[root@192 CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@192 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.......................................+++++
.........................+++++
e is 65537 (0x010001)
[root@192 ssl]# 

//CA签署客户端提交上来的证书
[root@192 ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:jiaoyu
Common Name (eg, your name or your server's hostname) []:www.doudizhu.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

//CA签署客户端提交上来的证书
[root@192 ~]# openssl ca -in /etc/httpd/ssl/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 23 05:04:08 2022 GMT
            Not After : Jul 23 05:04:08 2023 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = hb
            organizationName          = runtime
            organizationalUnitName    = jiaoyu
            commonName                = www.doudizhu.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                07:B0:75:02:09:E7:DE:C4:6C:AD:58:DF:34:BD:1C:BF:0E:B0:A6:D5
            X509v3 Authority Key Identifier: 
                keyid:00:7B:8F:78:72:DD:9E:42:B4:8E:0F:41:59:B8:F0:C4:7E:23:CA:97

Certificate is to be certified until Jul 23 05:04:08 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

//修改配置文件
[root@192 ~]# cd /etc/httpd/conf.d/
[root@192 conf.d]# vim ssl.conf 
<VirtualHost _default_:443>

# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com:443
LogLevel warn

SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

• 测试访问
  

the virtual host, inherited from global configuration
DocumentRoot “/var/www/html/tanke”
ServerName www.tanke.com:443
LogLevel warn

SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

- 测试访问
[外链图片转存中...(img-igxNhbHu-1658556425042)]