第十次笔记

http

https

 

vim /var/www/html/index.html

 

对http://172.25.254.128进行编辑

 

lamp=linux+apache+mysql+php

 

Apache主配置文件: /etc/httpd/conf/httpd.conf

ServerRoot "/etc/httpd" 用于指定Apache的运行目录

Listen 80 监听端口

User apache 运行apache程序的用户和组

Group apache

ServerAdmin root@localhost 管理员邮箱

DocumentRoot "/var/www/html" 网页文件的存放目录

<Directory "/var/www/html"> <Directory>语句块自定义目录权限

Require all granted

</Directory>

ErrorLog "logs/error_log" 错误日志存放位置

AddDefaultCharset UTF-8 默认支持的语言

IncludeOptional conf.d/*.conf 加载其它配置文件

DirectoryIndex index.html 默认主页名称

 

####默认发布目录DocumentRoot

[root@apache html]# pwd

/www/html

 

修改配置文件

#DocumentRoot "/var/www/html"

DocumentRoot "/www/html"

#

# Relax access to content within /var/www.

#

<Directory "/www/html">

        require all granted

</Directory>

 

若开启了selinux 需要更改目录安全上下文

semanage fcontext -a -t httpd_sys_content_t "/www(/.*)?"

restorecon -RvvF /www

 

 

######端口的修改##########

[root@apache ~]# vim /etc/httpd/conf/httpd.conf

[root@apache ~]# systemctl restart httpd

[root@apache html]# firewall-cmd --permanent --add-port=8080/tcp

success

[root@apache html]# firewall-cmd --reload

success

 

 

 

[root@apache html]# cd /var/www/html/

[root@apache html]# vim westos

 

 

##############虚拟主机############

虚拟主机允许您从一个httpd服务器同时为多个网站提供服务。在本节中,我们将了解基于名称的虚

拟主机其中多个主机名都指向同一个IP地址,但是Web服务器根据用于到达站点的主机名提供具有不

同内容的不同网站。

 

 

[root@apache conf.d]# vim default.conf

[root@apache conf.d]# mkdir /var/www/news

[root@apache conf.d]# mkdir /var/www/music

[root@apache conf.d]# echo new.lalala.com >/var/www/news/westos

[root@apache conf.d]# echo news.lalala.com >/var/www/news/westos

[root@apache conf.d]# echo music.lalala.com >/var/www/news/westos

 

 

vim /etc/httpd/conf.d/default.conf

<Virtualhost _default_:80>

        Documentroot /var/www/html

        customlog "logs/default.log" combined

</Virtualhost>

 

<Directory /var/www/html>

        require all granted

</Directory>

                 

vim /etc/httpd/conf.d/news.conf

<Virtualhost *:80>

        Servername news.westos.com

        Documentroot /var/www/news

        customlog "logs/news.log" combined

</Virtualhost>

 

<Directory /var/www/news>

        require all granted

</Directory>

 

 

vim /etc/httpd/conf.d/music.conf

 

<Virtualhost *:80>

        Servername music.westos.com

        Documentroot /var/www/music

        customlog "logs/music.log" combined

</Virtualhost>

 

<Directory /var/www/music>

        require all granted

</Directory>

 

 

mkdir /var/www/news/admin

用户的通过

 

<Directory /var/www/news/admin>

        Order allow,deny

        allow from 172.25.254.247

        deny from all

</Directory>

 

设置加密，用户认证

 

htpasswd -cm /etc/httpd/conf/apacheusr user1

htpasswd -m /etc/httpd/conf/apacheusr admin

 

vim /etc/httpd/conf.d/news.conf

 

<Virtualhost *:80>

        Servername news.westos.com

        Documentroot /var/www/news

        customlog "logs/news.log" combined

</Virtualhost>

 

<Directory /var/www/news>

        require all granted

</Directory>

 

<Directory /var/www/news>

        Authuserfile /etc/httpd/conf/apacheusr

        Authname  "Please input your name and passwor"

        Authtype basic

        Require user admin                           ###限制只有admin用户才可以访问

Require valid-user                                ###所有用户都可以访问

</Directory>

 

###php

 

yum install php -y

 

vim /etc/httpd/conf.d/php.conf

 

<FilesMatch \.php$>

SetHandler application/x-httpd-php

</FilesMatch>

DirectoryIndex index.php

 

root@apache html]# vim index.php

 

<?php

        phpinfo ();

?>

 

vim /etc/httpd/conf/httpd.conf

 

DirectoryIndex index.php 默认主页名称

###########cgi通用网关接口##############

通用网关接口(CGI)是网站上放置动态内容的最简单的方法。CGI脚本可用于许多目

的,但是谨慎控制使用哪个CGI脚本以及允许谁添加和运行这些脚本十分重要。编写质量差的CGI

脚本可能为外部攻击者提供了破坏网站及其内容安全性的途径。因此,在Web服务器级别和

SELinux策略级别,都存在用于限制CGI脚本使用的设置。

 

1.在目录/var/www/news中建立目录cgi并创建index.cgi

#!/usr/bin/perl

print "Content-type: text/html\n\n";

print `date`;

 

2.修改/etc/httpd/conf.d/news.conf

<Virtualhost *:80>

        Servername news.westos.com

        Documentroot /var/www/news

        customlog "logs/news.log" combined

</Virtualhost>

 

<Directory /var/www/news>

        require all granted

</Directory>

 

<Directory /var/www/news/cgi>

        Options +ExecCGI

        AddHandler cgi-script .cgi

</Directory>

3.测试

 

#######自定义自签名证书##########

 

如果加密的通信非常重要,而经过验证的身份不重要,管理员可以通过生成self-signed certificate来避免与认证机构进行交互所带来的复杂性。使用genkey实用程序(通过crypto-utils软件包分发),生成自签名证书及其关联的私钥。为了简化起见,genkey将在“正确”的位置(/etc/pki/tls目录)创建证书及其关联的密钥。相应地,必须以授权用户(root)身份运行该实用程序。

 

生成自签名证书

1. 确保已安装crypto-utils软件包。

[root@server0 ~]# yum install crypto-utils mod_ssl

2. 调用genkey,同时为生成的文件指定唯一名称(例如,服务器的主机全名)。

--days可以指定证书有效期

[root@server0 ~]# genkey server0.example.com

 

 

output will be written to /etc/pki/tls/certs/apache.example.com.crt

output key written to /etc/pki/tls/private/apache.example.com.key

 

vim /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/tls/certs/apache.example.com.crt

SSLCertificateKeyFile /etc/pki/tls/private/apache.example.com.key

 

vim /etc/httpd/conf.d/login.conf

 

<Virtualhost *:443>

        Servername login.westos.com

        Documentroot /var/www/login

        Customlog  "logs/login.log" combined

        SSLEngine on

        SSLCertificateFile /etc/pki/tls/certs/apache.example.com.crt

        SSLCertificateKeyFile /etc/pki/tls/private/apache.example.com.key

</Virtualhost>

 

<Directory "/var/www/login">

        Require all granted

</Directory>

 

<Virtualhost *:80>

        Servername login.westos.com

        RewriteEngine on

        RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=301]

</Virtualhost>

该为网页重写。，使其自动访问https

 

mkdir /var/www/login

vim /var/www/login/index.html

login.westos.com

 

                        

####################数据库######################

 

yum install  mariadb-server  -y

systemctl start mariadb

 

[root@apache ~]# netstat -antlpe | grep mysql

tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      27         121617     5764/mysqld       

 

[root@apache ~]# vim /etc/my.cnf                     ##关掉端口

 

编辑/etc/my.cnf文件,在[mysqld]中加入以下参数:

skip-networking=1

# systemctl restart mariadb

# ss -antlp |grep mysql

此时只允许通过套接字文件进行本地连接,阻断所有来自网络的tcp/ip连接。

[root@apache ~]# systemctl restart mariadb

[root@apache ~]# netstat -antlpe | grep mysqld

[root@apache ~]# mysql

使用mysql_secure_installation工具进行数据库安全设置,根据提示完成操作:

# mysql_secure_installation

登录数据库

mysqladmin -uroot -predhat password westos 修改本地mysql root密码

mysqladmin -uroot -predhat -h 192.168.0.188 password westos 修改远程192.168.0.188 mysql服务器 root密码

mysql_secure_installation 第一次安装mysql以后通过这条命令可以对mysql进行设置

 

mysql -uroot -predhat 从本机登录mysql数据库

 

show databases; 显示数据库

+--------------------+

| Database           |

+--------------------+

| information_schema |

| mysql              |

| performance_schema |

+--------------------+

3 rows in set (0.00 sec)

 

use mysql; 进入数据库

MariaDB [mysql]>

 

show tables; 显示数据库中的表

+---------------------------+

| Tables_in_mysql           |

+---------------------------+

| columns_priv              |

| db                        |

| event                     |

| func                      |

| general_log               |

| help_category             |

| help_keyword              |

| help_relation             |

| help_topic                |

| host                      |

| ndb_binlog_index          |

| plugin                    |

| proc                      |

| procs_priv                |

| proxies_priv              |

| servers                   |

| slow_log                  |

| tables_priv               |

| time_zone                 |

| time_zone_leap_second     |

| time_zone_name            |

| time_zone_transition      |

| time_zone_transition_type |

| user                      |

+---------------------------+

24 rows in set (0.00 sec)

 

desc user; 查看user表的数据结构

+------------------------+-----------------------------------+------+-----+---------+-------+

| Field                  | Type                              | Null | Key | De

MariaDB [mysql]> flush privileges;

Query OK, 0 rows affected (0.00 sec)

                刷新数据库信息

select host,user,password from user; 查询user表中的host，user，password字段

+-----------+------+-------------------------------------------+

| host      | user | password                                  |

+-----------+------+-------------------------------------------+

| localhost | root | *28C1E2BE21B45562A34B6CC34A19CFAFC2F88F96 |

| 127.0.0.1 | root | *28C1E2BE21B45562A34B6CC34A19CFAFC2F88F96 |

| ::1       | root | *28C1E2BE21B45562A34B6CC34A19CFAFC2F88F96 |

+-----------+------+-------------------------------------------+

3 rows in set (0.00 sec)

create database westos; 创建westos数据库

use westos;

create table linux( 创建表，username，password字段

username varchar(15) not null,

password varchar(15) not null

);

select * from mysql.user; 查询mysql库下的user表中的所以

alter table linux add age varchar(4); 添加age字段到linux表中

ALTER TABLE linux DROP age;         删除age字段

ALTER TABLE linux ADD age  VARCHAR(5)  AFTER name; 在username字段后添加字段age

 

show tables;

desc linux;

 

insert into linux values ('user1','passwd1'); 在linux表中插入值为username = user1，password = password1

update linux set password=password('passwd2') where username=user1; 更新linux表中user1 的密码为password2

delete from linux where username=user1; 删除linux表中user1的所以内容

 

 

grant select on  *.* to user1@localhost identified by 'passwd1'; 授权user1 密码为passwd1  并且只能在本地 查询数据库的所以内容

grant all on mysql.* to user2@'%' identified by 'passwd2'; 授权user2 密码为passwd2  可以从远程任意主机登录mysql 并且可以对mysql数据库任意操作

 

 

备份

/var/lib/mysql

mysqldump -uroot -predhat mysql > mysql.bak 备份mysql库到mysql.bak

 

mysql -uroot -predhat westos < mysql.bak 恢复mysql.bak 到westos库

 

 

 

mysql 密码恢复

/etc/init.d/mysqld stop

 

mysqld_safe --skip-grant-tables & 跳过grant-tables授权表  不需要认证登录本地mysql数据库

 

update mysql.user set password=password('westos') where user='root'; 更新mysql.user 表中条件为root用户的密码为加密westos

 

/etc/init.d/mysql restart

 

 

 

phpmyadmin

yum install php php-mysql httpd mysql mysql-server

 

tar jxf phpmyadmin-*.tar.bz2 -C /var/www/html

mv phpmyadmin phpadmin

cp config.sample.inc.php config.inc.php

vim config.inc.php

add

$cfg['blowfish_secret'] = 'test';

 

/etc/init.d/httpd start

http://192.168.0.188/phpadmin