//生成秘钥
[root@lvs ~]# mkdir /etc/pki/CA/[root@lvs ~]# cd /etc/pki/CA/[root@lvs CA]# mkdir private[root@lvs CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)...............+++++
..+++++
e is 65537(0x010001)
//生成自签署证书
[root@DR CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code)[XX]:CN
State or Province Name (full name)[]:HB
Locality Name (eg, city)[Default City]:WH
Organization Name (eg, company)[Default Company Ltd]:www.hzy.com
Organizational Unit Name (eg, section)[]:www.hzy.com
Common Name (eg, your name or your server's hostname) []:www.hzy.com
Email Address []:123@qq.com
//在RS生成证书签署请求，并发送给DR
[root@r1 ~]# mkdir /etc/httpd/ssl
[root@r1 ~]# cd /etc/httpd/ssl
[root@r1 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
........+++++
...........+++++
e is 65537 (0x010001)
[root@r1 ssl]# openssl req -new -key httpd.key -days 1024 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.hzy.com
Organizational Unit Name (eg, section) []:www.hzy.com
Common Name (eg, your name or your server's hostname)[]:www.hzy.com
Email Address []:123@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@r1 ssl]# scp httpd.csr root@192.168.207.131:/root/
root@192.168.207.131's password:
httpd.csr 100% 1025324.0KB/s 00:00
//CA签署证书
[root@lvs ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0(0x0)
Validity
Not Before: Jun 14 09:21:44 2021 GMT
Not After : Jun 14 09:21:44 2022 GMT
Subject:
countryName = CN
stateOrProvinceName = HB
organizationName = www.hzy.com
organizationalUnitName = www.hzy.com
commonName = www.hzy.com
emailAddress =123@qq.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
0C:A3:12:64:2F:69:79:F8:E7:20:11:7E:7C:7F:FF:61:9E:9C:92:0C
X509v3 Authority Key Identifier:
keyid:1C:3D:8F:18:95:EB:03:58:E5:7A:B8:83:61:D4:93:B0:B3:17:7C:3F
Certificate is to be certified until Nov 1115:51:55 2021 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@lvs ~]# ls
anaconda-ks.cfg httpd.crt httpd.csr
[root@r1 apache]# mkdir /etc/pki/CA[root@r1 apache]# cd /etc/pki/CA[root@r1 CA]# mkdir private[root@r1 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)........+++++
....................................................+++++
e is 65537(0x010001)[root@r1 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code)[XX]:CN
State or Province Name (full name)[]:HB
Locality Name (eg, city)[Default City]:WH
Organization Name (eg, company)[Default Company Ltd]:hzy
Organizational Unit Name (eg, section)[]:com
Common Name (eg, your name or your server's hostname) []:hzy.com
Email Address []:123@qq.com
[root@r1 CA]# mkdir certs newcerts crl
[root@r1 CA]# touch index.txt && echo 01 > serial
[root@r1 CA]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................+++++
.................+++++
e is 65537 (0x010001)
[root@r1 CA]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:hzy
Organizational Unit Name (eg, section) []:com
Common Name (eg, your name or your server's hostname)[]:hzy.com
Email Address []:123@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@R1 CA]# openssl ca -in httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1(0x1)
Validity
Not Before: Jun 1412:21:17 2021 GMT
Not After : Jun 1412:21:17 2022 GMT
Subject:
countryName = CN
stateOrProvinceName = HB
organizationName = hzy
organizationalUnitName = com
commonName = hzy.com
emailAddress =123@qq.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
B1:16:DF:69:E3:BE:CC:DA:F7:46:6F:98:33:4F:2F:52:87:47:D6:FC
X509v3 Authority Key Identifier:
keyid:DC:5C:6E:05:C8:3A:37:ED:74:81:D8:C1:66:52:2A:AB:F0:80:8A:78
Certificate is to be certified until Jun 12 06:14:14 2022 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@r1 CA]# mv httpd.key httpd.crt /etc/httpd/[root@r1 CA]# scp /etc/httpd/httpd.key 192.168.207.136:/etc/httpd/
root@192.168.207.136's password:
httpd.key 100% 1675 624.7KB/s 00:00
[root@r1 CA]# scp /etc/httpd/httpd.crt 192.168.207.137:/etc/httpd/
root@192.168.207.137's password:
httpd.crt 100% 44951.5MB/s 00:00
[root@r1 ~]# echo "<h1>r1_test</h1>" >/usr/local/apache/htdocs/index.html [root@r2 ~]# echo "<h1>r2_test</h1>" >/usr/local/apache/htdocs/index.html
本文档详细介绍了Linux Virtual Server（LVS）集群的配置过程，包括NAT模式和DR模式。首先，通过关闭防火墙、创建证书并分发以确保安全通信。接着，在NAT模式下，配置了IPVSadm，添加了VIP并开启了IP转发。在DR模式中，重点在于RS上的ARP设置，配置VIP和DIP，并添加规则。整个过程详细展示了每个步骤，为LVS集群搭建提供了清晰的指南。
扫一扫
786
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
