Apache HTTP Server 2.4版本的源码安装配置及实现

一、Apache HTTP Server简介

Linux下最有名的、功能最丰富的WEB服务器就属Apache HTTP Server（简称Apache）。

Apache HTTP Server是Apache软件基金会最有名的开源项目之一，它可以在大多数操作系统上运行。

目前官网的主要版本为2.2和2.4。CentOS 6使用2.2版本，CentOS 7使用2.4版本。

目前生产环境中部署2.2版本的居多，但是2.4版本有很多新的特性，下面就简要说明以下：

（1）运行时动态可装载MPM

在2.4版本中，MPM可以被编程成可装载的模块。在运行时，只要配置使用什么MPM即可。

（2）支持Event MPM

正式支持Event MPM，之前是作为试验性的。

（3）更好的异步读写支持

（4）在每模块及每目录分别使用不同的日志级别

（5）基于每一个请求可以使用<If>、<ElseIf>和<Else>配置

（6）增强版的表达式分析器

（7）可以毫秒级控制KeepAliveTimeout

（8）不再需要NameVirtualHost指令

（9）可以在配置中使用自定义变量

（10）比2.2版本使用更少的内存

（11）增加了很多新的Module，例如mod_proxy_fcgi, mode_ratelimit, mod_request, mod_remoteip。同时还增强了很多Module

（12）访问控制的改变

2.2 configuration: 

Order deny,allow 

Deny from all 

2.4 configuration: 

Require all denied 

2.2 configuration: 

Order allow,deny 

Allow from all 

2.4 configuration: 

Require all granted 

2.2 configuration: 

Order Deny,Allow 

Deny from all 

Allow from example.org 

2.4 configuration: 

Require host example.org

鉴于V2.4引入了这么多新的功能，生产环境安装V2.4也是非常必要。

 

二、编译安装

（一）准备工作

1、开发库

源代码编译安装需要依赖众多开发库，请使用yum安装。将CentOS光盘挂载到/media/cdrom，配置本地yum源备用。配置yun请参看博主博文 《Linux的程序安装和包管理》，此类博文很多，这里不再赘述。使用下面的语句安装开发环境。

# yum groupinstall "Development tools" "Server Platform Development"

官网下载httpd-2.4.10.tar.bz2

实验环境是CentOS 6.5，默认已经安装了2.2版本，把V2.2停止掉。

[root@www named]# service httpd stop 

[root@www named]# chkconfig httpd off 

[root@www named]# chkconfig --list httpd 

httpd              0:off    1:off    2:off    3:off    4:off    5:off    6:off 

[root@www ~]# tar xf httpd-2.4.10.tar.bz2 

2、apr安装

httpd依赖apr（Apache Portable Runtime），且2.4版本依赖较新的apr版本，要求是1.4以上。CentOS 6安装的是1.3.9

去http://apr.apache.org下载apr-1.5.1.tar.bz2和apr-util-1.5.3.tar.bz2。

[root@www ~]# tar xf apr-1.5.1.tar.bz2 

[root@www ~]# tar xf apr-util-1.5.3.tar.bz2

[root@www ~]# cd apr-1.5.1

[root@www apr-1.5.1]# ./configure --prefix=/usr/local/apr15

[root@www apr-1.5.1]# make && make install

[root@www ~]# cd ~/apr-util-1.5.3

[root@www apr-util-1.5.3]# ./configure --prefix=/usr/local/aprutil15 --with-apr=/usr/local/apr15/

[root@www apr-util-1.5.3]# make && make install

3、安装httpd

configure常用选项

名称	说明	取值
--prefix	程序安装目录，默认安装在/usr/local/apache2	/usr/local/apache24
--sysconfdir	配置文件目录	/etc/httpd24
--enable-so	启用DSO功能
--enable-modules	空白字符分隔的module列表，也可以是"all" | "most" | "few" | "none" | "reallyall"	most
--enable-ssl	SSL/TLS支持(mod_ssl)
--enable-cgi	支持CGI
--enable-rewrite	服务器端重写
--with-pcre	使用PCRE库
--with-apr	指定apr路径	/usr/local/apr15/
--with-apr-util	指定apr-util路径	/usr/local/aprutil15/
--with-z	使用zlib库
--enable-mpms-shared	空白字符分隔的MPM Module动态加载列表，可以是用all	all
--with-mpm=MPM	Apache使用的默认处理模型，MPM={event|worker|prefork|winnt}	event

[root@www ~]# cd httpd-2.4.10 

[root@www httpd-2.4.10]# ./configure --prefix=/usr/local/apache24 --sysconfdir=/etc/httpd24 --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-z --with-pcre --with-apr=/usr/local/apr15/ --with-apr-util=/usr/local/aprutil15/ --enable-mpms-shared=all --with-mpm=event --enable-modules=most 

[root@www httpd-2.4.10]# make && make install

 

安装目录和文件说明

/etc/httpd24	配置主目录
/etc/httpd24/extra	额外配置目录
/etc/httpd24/httpd.conf	主配置文件
/usr/local/apache24/htdocs	站点根目录
/usr/local/apache24/error	预置的错误文档目录
/usr/local/apache24/cgi-bin	CGI目录
/usr/local/apache24/include	头文件目录，二次开发用，必要时可以导出
/usr/local/apache24/man	帮助手册，需要导出
/usr/local/apache24/modules	DSO模块目录
/usr/local/apache24/bin	可执行文件目录
/usr/local/apache24/logs	日志目录

导出bin目录

[root@www ~]# cd /etc/profile.d/ 

[root@www profile.d]# vim httpd24.sh 

PATH=/usr/local/apache24/bin:$PATH 

export PATH

然后重启连接会话

导出man目录

在/etc/man.config 中加入一条

MANPATH /usr/local/apache24/man

即可生效

导出头文件目录

[root@www /]# ln -s /usr/local/apache24/include/ /usr/include/apache

apachectl

apachectl是/usr/local/apache24/bin下的一个shell脚本。通过它可以控制httpd的启动、关闭、重启、优雅重启动、优雅关闭。

所谓优雅，就是不蛮横，重启或者关闭前如果有连接就不会立即终止连接。

第一次尝试启动

[root@www ~]# apachectl start

[root@www ~]# ss -tnlp | grep :80 

LISTEN     0      128                      :::80                      :::*      users:(("httpd",2308,4),("httpd",2309,4),("httpd",2310,4),("httpd",2311,4))

[root@www ~]# httpd -D DUMP_MODULES 

Loaded Modules: 

core_module (static) 

so_module (static) 

http_module (static) 

authn_file_module (shared) 

authn_core_module (shared) 

authz_host_module (shared) 

authz_groupfile_module (shared) 

authz_user_module (shared) 

authz_core_module (shared) 

access_compat_module (shared) 

auth_basic_module (shared) 

reqtimeout_module (shared) 

filter_module (shared) 

mime_module (shared) 

log_config_module (shared) 

env_module (shared) 

headers_module (shared) 

setenvif_module (shared) 

version_module (shared) 

mpm_event_module (shared) 

unixd_module (shared) 

status_module (shared) 

autoindex_module (shared) 

dir_module (shared) 

alias_module (shared)

浏览器测试一下

 

三、实验

实验规划

（一）虚拟主机

编辑/etc/httpd24/httpd.conf，启用虚拟主机

# Virtual hosts 

Include /etc/httpd24/extra/httpd-vhosts.conf

编辑/etc/httpd24/extra/httpd-vhosts.conf

<VirtualHost *:80>

    ServerAdmin webmaster@example.com 

    DocumentRoot "/web/vhosts/www.example.com" 

    ServerName www.example.com 

    ErrorLog "logs/www.example.com-error_log" 

    CustomLog "logs/www.example.com-access_log" common 

</VirtualHost>

<Directory "/web/vhosts/www.example.com">

        Require all granted 

</Directory>

<VirtualHost *:80>

    ServerAdmin admin@www.test.com 

    DocumentRoot "/web/vhosts/www.test.com" 

    ServerName www.test.com 

    ErrorLog "logs/www.test.com-error_log" 

    CustomLog "logs/www.test.com-access_log" common 

</VirtualHost>

<Directory "/web/vhosts/www.test.com">

    Require all granted 

</Directory> 

[root@www ~]# httpd -t 

Syntax OK 

[root@www ~]# apachectl restart

修改浏览器端Windows的C:\Windows\System32\drivers\etc\hosts文件，追加下面2句：

192.168.60.171 www.example.com
192.168.60.171 www.test.com

使用浏览器，分别测试www.example.com和www.test.com，成功。

 

（二）server-status处理器

这次在www.test.com中实现server-status

首先查看/etc/httpd24/httpd.conf，确保LoadModule status_module modules/mod_status.so启用。

再查看是否已经加载了该模块

[root@www ~]# httpd -D DUMP_MODULES | grep status 

status_module (shared)

编辑/etc/httpd24/extra/httpd-vhosts.conf

<VirtualHost *:80>

    ServerAdmin admin@www.test.com 

    DocumentRoot "/web/vhosts/www.test.com" 

    ServerName www.test.com 

    ErrorLog "logs/www.test.com-error_log" 

    CustomLog "logs/www.test.com-access_log" common 

    <Location /server-status>

        SetHandler server-status 

        Require all granted 

    </Location>

</VirtualHost>

使用浏览器查看

 

（三）基于用户的访问控制

使用apache提供的工具htpasswd生成密码文件

[root@www ~]# mkdir /usr/local/apache24/passwd/ -pv 

mkdir: created directory `/usr/local/apache24/passwd/' 

[root@www ~]# htpasswd -cmb /usr/local/apache24/passwd/passwds admin admin 

Adding password for user admin 

[root@www ~]# htpasswd -mb /usr/local/apache24/passwd/passwds test test 

Adding password for user test

[root@www ~]# cat /usr/local/apache24/passwd/passwds 

admin:$apr1$GTF5UfZ2$Y66fn/HsTFWBNKRVGVyql/ 

test:$apr1$wGS5AyJJ$dCx6XjHj3LsK3bZG4BZ/k0

对server-status进行控制，修改/etc/httpd24/extra/httpd-vhosts.conf文件

<VirtualHost *:80>

    ServerAdmin admin@www.test.com 

    DocumentRoot "/web/vhosts/www.test.com" 

    ServerName www.test.com 

    ErrorLog "logs/www.test.com-error_log" 

    CustomLog "logs/www.test.com-access_log" common 

    <Location /server-status>

        SetHandler server-status 

#        Require all granted 

        AuthType Basic 

        AuthName "Restricted Files" 

        # (Following line optional) 

        AuthBasicProvider file 

        AuthUserFile /usr/local/apache24/passwd/passwds 

        Require user admin 

    </Location>

</VirtualHost>

重启httpd服务，验证配置

http://192.168.60.171/server-status，返回404错误

http://www.example.com/server-status，返回404错误

http://www.test.com/server-status，提示输入用户名和密码。

由于只允许admin用户登录，输入后，打开server-status网页，不再演示。

 

（四）HTTPS配置

LoadModule ssl_module modules/mod_ssl.so

# Secure (SSL/TLS) connections 

Include /etc/httpd24/extra/httpd-ssl.conf

然后编辑/etc/httpd24/extra/httpd-ssl.conf，其中<Directory>指令很重要，指定目录的访问权限。否则即使以下所有步骤成功，也无法登录页面，返回403错误。

Listen 443

<VirtualHost _default_:443>

#   General setup for the virtual host

DocumentRoot "/web/vhosts/www.ssl.com"

ServerName www.ssl.com

ServerAdmin master@ssl.com

ErrorLog "/usr/local/apache24/logs/ssl_error_log"

TransferLog "/usr/local/apache24/logs/ssl_access_log"

<Directory "/web/vhosts/www.ssl.com">

        Require all granted

</Directory>

SSLCertificateFile "/etc/httpd24/server.crt"

SSLCertificateKeyFile "/etc/httpd24/server.key"

本地已经搭好了一个CA中心，使用openssl生成密钥，同时生成证书申请，CA来签发。放在指定的目录

[root@www ~]# cd /etc/httpd24/

[root@www httpd24]# (umask 077;openssl genrsa -out /etc/httpd24/server.key 2048)

Generating RSA private key, 2048 bit long modulus

.............................................................................................+++

............................................................................+++

e is 65537 (0x10001)

[root@www httpd24]# openssl req -new -key server.key -out server.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [CN]:CN

State or Province Name (full name) [JS]:JS

Locality Name (eg, city) [NJ]:NJ

Organization Name (eg, company) [NJU]:NJU

Organizational Unit Name (eg, section) [Heyuan]:Heyuan

Common Name (eg, your name or your server's hostname) []:www.ssl.com

Email Address []:webmaster@ssl.com 

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@www httpd24]# openssl ca -in server.csr -out server.crt -days 1500

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 3 (0x3)

        Validity

            Not Before: Aug 10 05:03:20 2014 GMT

            Not After : Sep 18 05:03:20 2018 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = JS

            organizationName          = NJU

            organizationalUnitName    = Heyuan

            commonName                = www.ssl.com

            emailAddress              = webmaster@ssl.com

        X509v3 extensions:

            X509v3 Basic Constraints: 

                CA:FALSE

            Netscape Comment: 

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier: 

                40:8C:41:3D:C2:A6:AA:4E:05:54:D8:A0:4C:84:B6:1F:60:70:6B:83

            X509v3 Authority Key Identifier: 

                keyid:96:FC:F0:32:D4:A4:47:D0:77:D3:1D:C1:A4:56:44:4D:48:01:7A:B6 

Certificate is to be certified until Sep 18 05:03:20 2018 GMT (1500 days)

Sign the certificate? [y/n]:y 

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

证书和密钥放到了指定的位置，下面做配置文件的语法检查，出错了。mod_socache_shmcb模块没有安装，启用LoadModule socache_shmcb_module modules/mod_socache_shmcb.so。重启服务，OK通过。

[root@www ~]# httpd -t

AH00526: Syntax error on line 73 of /etc/httpd24/extra/httpd-ssl.conf:

SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you need to load the appropriate socache module (mod_socache_shmcb?).

[root@www ~]# httpd -t

Syntax OK

[root@www ~]# apachectl restart

[root@www httpd24]# httpd -D DUMP_MODULES | grep ssl

 ssl_module (shared)

同样配置本地Windows的C:\Windows\System32\drivers\etc\hosts文件，追加如下记录：

192.168.60.171 www.ssl.com

好了，现在开始测试一下。已经安装过CA证书。

 

至此，所有实验完成。

转载于:https://blog.51cto.com/me2xp/1538324