HTTPD ( apache ) WEB 服务器——HTTP基本配置（三）

最新推荐文章于 2022-10-02 18:04:05 发布
最新推荐文章于 2022-10-02 18:04:05 发布
阅读量3.4k 收藏
点赞数
分类专栏： web基本配置 apache httpd
kaivi's blog
本文链接：https://blog.csdn.net/weixin_45651006/article/details/103516773
版权
httpd 同时被 3 个专栏收录
4 篇文章 0 订阅
订阅专栏
web基本配置
3 篇文章 0 订阅
订阅专栏
apache
3 篇文章 0 订阅
订阅专栏

续：HTTP基本配置二
指令快速索引官网

实验环境

使用 yum 安装 httpd 软件，配置一个默认的 index.html 页面，启动测试。这里用的是最小化安装的centos8系统。关闭防火墙以及selinux。主机位centos8，对应IP为192.168.32.8

[root@centos8 ~]#ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:a5:39:58 brd ff:ff:ff:ff:ff:ff
    inet 192.168.32.8/24 brd 192.168.32.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
       
[root@centos8 ~]#cat /etc/redhat-release 
CentOS Linux release 8.0.1905 (Core) 
[root@centos8 ~]#
[root@centos8 ~]#firewall-cmd --state
not running
[root@centos8 ~]#
[root@centos8 ~]#getenforce 
Disabled
[root@centos8 ~]#yum list httpd*
Last metadata expiration check: 3 days, 9:43:01 ago on Sun 08 Dec 2019 05:11:56 AM CST.
Available Packages
httpd.x86_64                                   2.4.37-12.module_el8.0.0+185+5908b0db                        centos8
httpd-devel.x86_64                             2.4.37-12.module_el8.0.0+185+5908b0db                        centos8
httpd-filesystem.noarch                        2.4.37-12.module_el8.0.0+185+5908b0db                        centos8
httpd-manual.noarch                            2.4.37-12.module_el8.0.0+185+5908b0db                        centos8
httpd-tools.x86_64                             2.4.37-12.module_el8.0.0+185+5908b0db                        centos8
[root@centos8 ~]#dnf install httpd -y

[root@centos8 ~]#rpm -qi httpd
Name        : httpd
Version     : 2.4.37
Release     : 12.module_el8.0.0+185+5908b0db
Architecture: x86_64
Install Date: Wed 11 Dec 2019 02:55:14 PM CST
Group       : System Environment/Daemons
Size        : 5148135
License     : ASL 2.0
Signature   : RSA/SHA256, Thu 10 Oct 2019 05:33:32 AM CST, Key ID 05b555b38483c65d
Source RPM  : httpd-2.4.37-12.module_el8.0.0+185+5908b0db.src.rpm
Build Date  : Tue 08 Oct 2019 05:42:59 AM CST
Build Host  : x86-01.mbox.centos.org
Relocations : (not relocatable)
Packager    : CentOS Buildsys <bugs@centos.org>
Vendor      : CentOS
URL         : https://httpd.apache.org/
Summary     : Apache HTTP Server
Description :
The Apache HTTP Server is a powerful, efficient, and extensible
web server.
[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*            
[root@centos8 ~]#systemctl start httpd
[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*      
[root@centos8 ~]#echo "This is a HTTPD(apache) test for kaivi" > /var/www/html/index.html

[root@centos8 ~]#curl 192.168.32.8
This is a HTTPD(apache) test for kaivi

在这里插入图片描述

禁止trace方法

TraceEnable [on|off|extended]

是否支持trace方法，默认on，基于安全风险，建议关闭
范例：关闭trace方法

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf
[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
TraceEnable off
[root@centos8 ~]#

[root@centos8 ~]#curl -IX OPTIONS http://127.0.0.1
HTTP/1.1 200 OK
Date: Thu, 12 Dec 2019 13:07:47 GMT
Server: Apache/2.4.37 (centos)
Allow: GET,POST,OPTIONS,HEAD,TRACE     #默认开启TRACE选项
Content-Length: 0
Content-Type: text/html; charset=UTF-8

[root@centos8 ~]#systemctl reload httpd
[root@centos8 ~]#curl -IX OPTIONS http://127.0.0.1
HTTP/1.1 200 OK
Date: Thu, 12 Dec 2019 13:08:26 GMT
Server: Apache/2.4.37 (centos)
Allow: GET,POST,OPTIONS,HEAD        # 关闭了TRACE选项
Content-Length: 0
Content-Type: text/html; charset=UTF-8

[root@centos8 ~]#

多虚拟主机

httpd 支持在一台物理主机上实现多个网站，即多虚拟主机
网站的唯一标识：
IP相同，但端口不同
IP不同，但端口均为默认端口

FQDN不同：
多虚拟主机有三种实现方案：
基于ip：为每个虚拟主机准备至少一个ip地址
基于port：为每个虚拟主机使用至少一个独立的port
基于FQDN：为每个虚拟主机使用至少一个FQDN，请求报文中首部 Host: likai.tech
注意：httpd 2.4版本中，基于FQDN的虚拟主机不再需要NameVirutalHost指令
虚拟主机的基本配置方法：

<VirtualHost IP:PORT>
ServerName FQDN
DocumentRoot “/path"
</VirtualHost>

建议：上述配置存放在独立的配置文件中

其它常用可用指令：

ServerAlias：虚拟主机的别名；可多次使用
ErrorLog： 错误日志
CustomLog：访问日志
<Directory “/path"> </Directory>

范例：基于端口的虚拟主机

[root@centos8 ~]#mkdir /data/website{1,2,3}

[root@centos8 ~]#echo "This is NO.1 website!" > /data/website1/index.html
[root@centos8 ~]#echo "This is NO.2 website!" > /data/website2/index.html
[root@centos8 ~]#echo "This is NO.3 website!" > /data/website3/index.html
[root@centos8 ~]#tree /data/
/data/
├── website1
│   └── index.html
├── website2
│   └── index.html
└── website3
    └── index.html

3 directories, 3 files
[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf 

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
listen 8001                     
listen 8002
listen 8003
<virtualhost *:8001>      #指定端口                    
documentroot /data/website1/              #指定定义的路径
CustomLog logs/website1_access.log combined    #增加对应的日志
<directory /data/website1>              #对于文件给与访问权限
require all granted
</directory>

</virtualhost>
<virtualhost *:8002>
documentroot /data/website2/
CustomLog logs/website2_access.log combined
<directory /data/website2>
require all granted
</directory>
</virtualhost>

<virtualhost *:8003>
documentroot /data/website3/
CustomLog logs/website3_access.log combined
<directory /data/website3>
require all granted
</directory>
</virtualhost>

[root@centos8 ~]#systemctl restart httpd

[root@centos8 ~]#[root@centos8 ~]#ll /var/log/httpd/   #各有各的访问日志
total 24
-rw-r--r-- 1 root root 2084 Dec 12 21:41 access_log
-rw-r--r-- 1 root root 4441 Dec 12 21:40 error_log
-rw-r--r-- 1 root root  506 Dec 12 21:42 website1_access.log
-rw-r--r-- 1 root root  506 Dec 12 21:43 website2_access.log
-rw-r--r-- 1 root root  570 Dec 12 21:44 website3_access.log
[root@centos8 ~]#

[root@centos8 ~]#curl 192.168.32.8:8001
This is NO.1 website!
[root@centos8 ~]#curl 192.168.32.8:8002
This is NO.2 website!
[root@centos8 ~]#curl 192.168.32.8:8003
This is NO.3 website!
[root@centos8 ~]#

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
不会让用户每次都会输入端口号，所以适合内部员工使用。

范例：基于IP的虚拟主机

[root@centos8 ~]#ip a a 192.168.32.18/24 dev eth0 
[root@centos8 ~]#ip a a 192.168.32.28/24 dev eth0 
[root@centos8 ~]#ip a a 192.168.32.38/24 dev eth0 
[root@centos8 ~]#ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:a5:39:58 brd ff:ff:ff:ff:ff:ff
    inet 192.168.32.8/24 brd 192.168.32.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet 192.168.32.18/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
    inet 192.168.32.28/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
    inet 192.168.32.38/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
[root@centos8 ~]#

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf 

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
<virtualhost *:80>
ServerName www.aaa.com
documentroot /data/website1/
CustomLog logs/website1_access.log combined
<directory /data/website1>
require all granted
</directory>

</virtualhost>
<virtualhost *:80>
ServerName www.bbb.com
documentroot /data/website2/
CustomLog logs/website2_access.log combined
<directory /data/website2>
require all granted
</directory>
</virtualhost>

<virtualhost *:80>
ServerName www.ccc.com
documentroot /data/website3/
CustomLog logs/website3_access.log combined
<directory /data/website3>
require all granted
</directory>
</virtualhost>


[root@centos8 ~]#systemctl reload httpd

[root@centos8 ~]#curl 192.168.32.18
This is NO.1 website!
[root@centos8 ~]#curl 192.168.32.28
This is NO.2 website!
[root@centos8 ~]#curl 192.168.32.38
This is NO.3 website!

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

范例：基于FQDN虚拟主机

这里用相同子域的192.168.32.7主机来访问主机centos8
在主机192.168.32.7中配置对应的/etc/hosts文件

[root@centos7 ~]#vim /etc/hosts
[root@centos7 ~]#cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.32.18 www.aaa.com
192.168.32.28 www.bbb.com
192.168.32.38 www.ccc.com

[root@centos7 ~]#curl 192.168.32.8
This is a HTTPD(apache) test for kaivi

[root@centos7 ~]#curl www.aaa.com
This is NO.1 website!
[root@centos7 ~]#curl www.bbb.com
This is NO.2 website!
[root@centos7 ~]#curl www.ccc.com
This is NO.3 website!
[root@centos7 ~]#

[root@centos7 ~]#

可以看出访问能够正常访问，但是不可能存在一个页面站点就用一个特定的ip来访问，这个也不现实。所以可以用同一个IP，用DNS解析进行区分，用报文头部的主机头信息。每一个浏览器输入的域名会有一个键值对HOST，主机头不一样。用主机头来区分。

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf 

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
<virtualhost *:80>
ServerName www.aaa.com            #增加主机头验证信息
documentroot /data/website1/
CustomLog logs/website1_access.log combined
<directory /data/website1>
require all granted
</directory>

</virtualhost>
<virtualhost *:80>
ServerName www.bbb.com
documentroot /data/website2/
CustomLog logs/website2_access.log combined
<directory /data/website2>
require all granted
</directory>
</virtualhost>

<virtualhost *:80>
ServerName www.ccc.com
documentroot /data/website3/
CustomLog logs/website3_access.log combined
<directory /data/website3>
require all granted
</directory>
</virtualhost>

[root@centos8 ~]#systemctl reload httpd

在centos7：192.168.32.7主机中验证
[root@centos7 ~]#curl www.aaa.com
This is NO.1 website!
[root@centos7 ~]#curl www.bbb.com
This is NO.2 website!
[root@centos7 ~]#curl www.ccc.com
This is NO.3 website!
[root@centos7 ~]#
#用telnet命令验证
[root@centos7 ~]#telnet 192.168.32.8 80
Trying 192.168.32.8...
Connected to 192.168.32.8.
Escape character is '^]'.
GET / HTTP/1.1
HOST: www.aaa.com    

HTTP/1.1 200 OK
Date: Fri, 13 Dec 2019 01:39:38 GMT
Server: Apache/2.4.37 (centos)
Last-Modified: Fri, 13 Dec 2019 01:25:50 GMT
ETag: "16-5998bbdffe7d0"
Accept-Ranges: bytes
Content-Length: 22
Content-Type: text/html; charset=UTF-8

This is NO.1 website!  #访问对应的网页内容

Connection closed by foreign host.

[root@centos7 ~]#telnet 192.168.32.8 80
Trying 192.168.32.8...
Connected to 192.168.32.8.
Escape character is '^]'.
GET / HTTP/1.1
HOST: www.bbb.com

HTTP/1.1 200 OK
Date: Fri, 13 Dec 2019 01:40:21 GMT
Server: Apache/2.4.37 (centos)
Last-Modified: Fri, 13 Dec 2019 01:25:59 GMT
ETag: "16-5998bbe80f2f7"
Accept-Ranges: bytes
Content-Length: 22
Content-Type: text/html; charset=UTF-8

This is NO.2 website!         #访问对应的网页内容
Connection closed by foreign host.

[root@centos7 ~]#telnet 192.168.32.8 80
Trying 192.168.32.8...
Connected to 192.168.32.8.
Escape character is '^]'.
GET / HTTP/1.1
HOST: www.ccc.com

HTTP/1.1 200 OK
Date: Fri, 13 Dec 2019 01:40:39 GMT
Server: Apache/2.4.37 (centos)
Last-Modified: Fri, 13 Dec 2019 01:26:07 GMT
ETag: "16-5998bbf030ba7"
Accept-Ranges: bytes
Content-Length: 22
Content-Type: text/html; charset=UTF-8

This is NO.3 website!           #访问对应的网页内容
Connection closed by foreign host.
[root@centos7 ~]#

注意：
任意目录下的页面只有显式授权才能被访问
三种方式的虚拟主机可以混和使用

压缩

压缩简介

使用mod_deflate模块压缩页面优化传输速度

LoadModule deflate_module modules/mod_deflate.so SetOutputFilter

适用场景：
(1) 节约带宽，额外消耗CPU；同时，可能有些较老浏览器不支持
(2) 压缩适于压缩的资源，例如文本文件

确认是否加载浏览器压缩模块：

[root@centos8 ~]#httpd -M |grep deflate
 deflate_module (shared)
[root@centos8 ~]#
源码编译的时候可能不支持，需要检查。有着模块代表支持压缩功能

压缩指令

#可选项
SetOutputFilter DEFLATE

# 指定对哪种MIME类型进行压缩，必须指定项
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE text/css

#压缩级别 (Highest 9 - Lowest 1) ，默认gzip  默认级别是有库决定
DeflateCompressionLevel 9
#排除特定旧版本的浏览器，不支持压缩
#Netscape 4.x 只压缩text/html
BrowserMatch ^Mozilla/4 gzip-only-text/html
#Netscape 4.06-08 三个版本 不压缩
BrowserMatch ^Mozilla/4\.0[678] no-gzip
#Internet Explorer标识本身为“Mozilla / 4”，但实际上是能够处理请求的压缩。如果用户代理首部
匹配字符串“MSIE”（“B”为单词边界”），就关闭之前定义的限制
BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html

压缩对比实验

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf 
<virtualhost *:80>
        documentroot /data/website1/
        servername www.aaa.com
        <directory /data/website1/>
                require all granted
        </directory>
                CustomLog "logs/a_access_log" combined
                AddOutputFilterByType DEFLATE text/plain     #增加压缩机制
                AddOutputFilterByType DEFLATE text/html      #增加压缩机制
                DeflateCompressionLevel 9                    #选择默认压缩比
</virtualhost>

<virtualhost *:80>
        documentroot /data/website2/
        servername www.bbb.com
        <directory /data/website2/>
                require all granted
        </directory>
                CustomLog "logs/a_access_log" combined
                #AddOutputFilterByType DEFLATE text/plain    #注释掉 形成对比
                #AddOutputFilterByType DEFLATE text/html     #注释掉 形成对比
                #DeflateCompressionLevel 9                   #注释掉 形成对比
</virtualhost>

[root@centos8 ~]#vim /etc/hosts

[root@centos8 ~]#cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6


192.168.32.8 www.aaa.com  www.bbb.com      #新增DNS解析

[root@centos8 ~]#
[root@centos8 ~]#cp blog.txt /data/website1/blog_test1.html  #拷贝一个测试文件到网页
[root@centos8 ~]#cp blog.txt /data/website2/blog_test2.html
[root@centos8 ~]#cd /data/website1
[root@centos8 website1]#ll
total 20
-rw-r--r-- 1 root root 15422 Dec 13 10:14 blog_test1.html   #注意大小为15422
-rw-r--r-- 1 root root    22 Dec 13 09:25 index.html
[root@centos8 website1]#cd /data/website2
[root@centos8 website2]#ll
total 20
-rw-r--r-- 1 root root 15422 Dec 13 10:14 blog_test2.html   #注意大小为15422
-rw-r--r-- 1 root root    22 Dec 13 09:25 index.html

如果文件的权限不是644则需要增加对应的权限：
chmod 644 blog_testX.html 
[root@centos8 website2]#cd
[root@centos8 ~]#systemctl restart httpd

[root@centos8 ~]#curl www.aaa.com
This is NO.1 website!
[root@centos8 ~]#curl www.bbb.com
This is NO.2 website!

[root@centos8 ~]#curl -I --compressed www.aaa.com/blog_test1.html  #默认curl没有压缩，需要加参数--compressed
HTTP/1.1 200 OK
Date: Fri, 13 Dec 2019 02:22:29 GMT
Server: Apache/2.4.37 (centos)
Last-Modified: Fri, 13 Dec 2019 02:14:32 GMT
ETag: "3c3e-5998c6c2c195b-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip     #压缩机制工具gzip
Content-Length: 2155       #压缩后的大小
Content-Type: text/html; charset=UTF-8

[root@centos8 ~]#curl -I --compressed www.bbb.com/blog_test2.html
HTTP/1.1 200 OK
Date: Fri, 13 Dec 2019 02:22:45 GMT
Server: Apache/2.4.37 (centos)
Last-Modified: Fri, 13 Dec 2019 02:14:45 GMT
ETag: "3c3e-5998c6ce8741a"
Accept-Ranges: bytes         
Content-Length: 15422       #没有压缩的大小，配置文件中website2压缩被注释
Content-Type: text/html; charset=UTF-8

通过对比发现，只有 website1实现了压缩功能

实现 https（443端口）

(1) 客户端发送可供选择的加密方式，并向服务器请求证书
(2) 服务器端发送证书以及选定的加密方式给客户端
(3) 客户端取得证书并进行证书验证，如果信任给其发证书的CA

(1) 验证证书来源的合法性；用CA的公钥解密证书上数字签名
(2) 验证证书的内容的合法性：完整性验证
（3）检查证书的有效期限
(4) 检查证书是否被吊销
(5) 证书中拥有者的名字，与访问的目标主机要一致

(4) 客户端生成临时会话密钥（对称密钥），并使用服务器端的公钥加密此数据发送给服务器，完成密钥交换
(5) 服务用此密钥加密用户请求的资源，响应给客户端

注意：SSL是基于IP地址实现,单IP的httpd主机，仅可以使用一个https虚拟主机

安装 mod_ssl 软件包

[root@centos8 ~]#yum install mod_ssl
Last metadata expiration check: 1:14:34 ago on Fri 13 Dec 2019 09:38:41 AM CST.
Dependencies resolved.
===================================================================================================================
 Package            Arch              Version                                             Repository          Size
===================================================================================================================
Installing:
 mod_ssl            x86_64            1:2.4.37-12.module_el8.0.0+185+5908b0db             centos8            130 k
Installing dependencies:
 sscg               x86_64            2.3.3-6.el8                                         centos8             43 k

Transaction Summary
===================================================================================================================
Install  2 Packages

Total download size: 173 k
Installed size: 351 k
Is this ok [y/N]: y
Downloading Packages:
(1/2): sscg-2.3.3-6.el8.x86_64.rpm                                                  36 kB/s |  43 kB     00:01    
(2/2): mod_ssl-2.4.37-12.module_el8.0.0+185+5908b0db.x86_64.rpm                    105 kB/s | 130 kB     00:01    
-------------------------------------------------------------------------------------------------------------------
Total                                                                              139 kB/s | 173 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                           1/1 
  Installing       : sscg-2.3.3-6.el8.x86_64                                                                   1/2 
  Installing       : mod_ssl-1:2.4.37-12.module_el8.0.0+185+5908b0db.x86_64                                    2/2 
  Running scriptlet: mod_ssl-1:2.4.37-12.module_el8.0.0+185+5908b0db.x86_64                                    2/2 
  Verifying        : mod_ssl-1:2.4.37-12.module_el8.0.0+185+5908b0db.x86_64                                    1/2 
  Verifying        : sscg-2.3.3-6.el8.x86_64                                                                   2/2 

Installed:
  mod_ssl-1:2.4.37-12.module_el8.0.0+185+5908b0db.x86_64                  sscg-2.3.3-6.el8.x86_64                 

Complete!
[root@centos8 ~]#cd /etc/httpd/conf.d/
[root@centos8 conf.d]#ll
total 32
-rw-r--r-- 1 root root 2926 Oct  8 05:42 autoindex.conf
-rw-r--r-- 1 root root  400 Oct  8 05:44 README
-rw-r--r-- 1 root root 8720 Oct  8 05:40 ssl.conf
-rw-r--r-- 1 root root  621 Dec 13 10:26 test.conf
-rw-r--r-- 1 root root 1252 Oct  8 05:40 userdir.conf
-rw-r--r-- 1 root root  516 Oct  8 05:40 welcome.conf
[root@centos8 conf.d]#
[root@centos8 conf.d]#cd
[root@centos8 ~]#
[root@centos8 ~]#systemctl restart httpd
[root@centos8 ~]#
[root@centos8 ~]#ss -ntl          #查看端口https：443 是否开启
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:443                        0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*            
[root@centos8 ~]#curl -kv https://192.168.32.8
* Rebuilt URL to: https://192.168.32.8/
*   Trying 192.168.32.8...
* TCP_NODELAY set
* Connected to 192.168.32.8 (192.168.32.8) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:

......省略部分
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; O=Unspecified; CN=centos8; emailAddress=root@centos8
*  start date: Dec 13 02:54:19 2019 GMT
os8
*  SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET / HTTP/1.1
> Host: 192.168.32.8
> User-Agent: curl/7.61.1
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 200 OK
< Date: Fri, 13 Dec 2019 02:55:07 GMT
< Server: Apache/2.4.37 (centos) OpenSSL/1.1.1
< Last-Modified: Fri, 13 Dec 2019 01:26:34 GMT
< ETag: "27-5998bc0a040e5"
< Accept-Ranges: bytes
< Content-Length: 39
< Content-Type: text/html; charset=UTF-8
< 
This is a HTTPD(apache) test for kaivi
* Connection #0 to host 192.168.32.8 left intact
[root@centos8 ~]#

https 服务安装成功，可以使用浏览器验证一下 https://192.168.32.8
在这里插入图片描述
能够访问，但是没有权威的CA证书，所以会出现上述的情况

自己创建证书，配置 https 功能
下面我们在之前实验的基础上使用我们自己创建的 CA 文件
在centos8中/etc/pki/tls/certs/Makefile已经没有了，Makefile文件可以帮助我们直接生成自己创建的CA。所以这里我们从centos7：192.168.32.7中拷贝到centos8：192.168.32.8中.

[root@centos7 ~]#cd /etc/pki/tls/certs/
[root@centos7 certs]#ll
total 12
lrwxrwxrwx. 1 root root   49 Dec  5 21:43 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-
bundle.pem
lrwxrwxrwx. 1 root root   55 Dec  5 21:43 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-
bundle.trust.crt
-rwxr-xr-x. 1 root root  610 Oct 31  2018 make-dummy-cert
-rw-r--r--. 1 root root 2516 Oct 31  2018 Makefile              #自创建CA文件
-rwxr-xr-x. 1 root root  829 Oct 31  2018 renew-dummy-cert
[root@centos7 certs]#scp Makefile 192.168.32.8:/etc/pki/tls/certs/
The authenticity of host 192.168.32.8 (192.168.32.8)' can't be established.
ECDSA key fingerprint is SHA256:ofG5ch7HSw0hxj2Ef76oh4WuOnpubsABj0/YiNrGqYw.
ECDSA key fingerprint is MD5:cc:68:4d:5c:63:31:d1:62:2b:f9:d4:b5:fc:5e:1d:7c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.32.8' (ECDSA) to the list of known hosts.
root@192.168.32.8's password: 
Makefile                                                                         100% 2516     1.2MB/s   00:00

然后再centos8：192.168.32.8中创建CA

[root@centos8 ~]#cd /etc/pki/tls/certs/
[root@centos8 certs]#ll
total 4
lrwxrwxrwx. 1 root root   49 May 11  2019 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-
bundle.pem
lrwxrwxrwx. 1 root root   55 May 11  2019 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-
bundle.trust.crt
-rw-r--r--  1 root root 3737 Dec 13 11:32 localhost.crt  #之前安装mod_ssl模块重启时自己生产的证书文件
-rw-r--r--  1 root root 2516 Dec 13 11:30 Makefile

这里直接使用Makefile文件会要输入一个加密的口令，这里实验先把它取消：

[root@centos8 certs]#vim Makefile 

%.key:
        umask 77 ; \
     #  /usr/bin/openssl genrsa -aes128 $(KEYLEN) > $@  #把加密算法-aes128去掉即可
        /usr/bin/openssl genrsa  $(KEYLEN) > $@

创建CA

[root@centos8 certs]#make magedu.org.crt
umask 77 ; \
/usr/bin/openssl genrsa  2048 > magedu.org.key         #生产的Key
Generating RSA private key, 2048 bit long modulus (2 primes)
....+++++
..................+++++
e is 65537 (0x010001)
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key magedu.org.key -x509 -days 365 -out magedu.org.crt 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN                   #CN
State or Province Name (full name) []:beijing           #beijing
Locality Name (eg, city) [Default City]:beijing            #beijing
Organization Name (eg, company) [Default Company Ltd]:magedu      #组织名magedu
Organizational Unit Name (eg, section) []:M39           #部门名称  M39 班级名
Common Name (eg, your name or your server's hostname) []:likai.tech       #CA域名
Email Address []:
[root@centos8 certs]#ll
total 16
lrwxrwxrwx. 1 root root   49 May 11  2019 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-
bundle.pem
lrwxrwxrwx. 1 root root   55 May 11  2019 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-
bundle.trust.crt
-rw-------  1 root root 1334 Dec 13 11:33 magedu.org.crt         #生成的CA
-rw-------  1 root root 1679 Dec 13 11:33 magedu.org.key         #生成的KEY
-rw-r--r--  1 root root 2509 Dec 13 11:32 Makefile

查看自创建CA

[root@centos8 certs]#openssl x509 -in magedu.org.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:e1:f3:b4:97:69:8b:02:dd:9b:32:5d:4e:ea:ee:61:16:15:12:6f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, ST = beijing, L = beijing, O = magedu, OU = M39, CN = likai.tech
        Validity
            Not Before: Dec 13 03:33:52 2019 GMT
            Not After : Dec 12 03:33:52 2020 GMT
        Subject: C = CN, ST = beijing, L = beijing, O = magedu, OU = M39, CN = likai.tech
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
......部分省略
     25:ba:24:ce:84:91:e7:c0:bb:24:55:7f:2b:e1:67:84:e2:e2:
         1e:1a:f9:14:4f:35:d7:e8:f3:77:34:08:9e:94:a4:f5:2b:ee:
         cb:92:72:6e:6f:4d:93:a1:93:52:73:fa:1f:0e:bd:17:42:e6:
         81:da:5d:6c:80:a9:51:62:03:dc:7f:07:7e:9e:00:65:3e:b7:
         ab:4f:81:8d:79:aa:df:b3:38:05:17:e6:a6:7b:13:c3:fa:7b:
         6f:88:30:ea

把生成的CA移动到对应的配置文件中

[root@centos8 certs]#pwd
/etc/pki/tls/certs
[root@centos8 ~]#mkdir /etc/httpd/conf.d/ssl

[root@centos8 certs]#mv magedu.org.* /etc/httpd/conf.d/ssl

[root@centos8 certs]#ls /etc/httpd/conf.d/ssl/
magedu.org.crt  magedu.org.key

修改对应的CA的配置文件

[root@centos8 certs]#rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf
/etc/httpd/conf.modules.d/00-ssl.conf
/usr/lib/.build-id
/usr/lib/.build-id/70/221b67fd81b65321f5220d22dcb99c36d3841c
/usr/lib/systemd/system/httpd-init.service
/usr/lib/systemd/system/httpd.socket.d/10-listen443.conf
/usr/lib64/httpd/modules/mod_ssl.so
/usr/libexec/httpd-ssl-gencerts
/usr/libexec/httpd-ssl-pass-dialog
/usr/share/man/man8/httpd-init.service.8.gz
/var/cache/httpd/ssl

[root@centos8 certs]#cd
[root@centos8 ~]#vim /etc/httpd/conf.d/ssl.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/ssl.conf |grep -Ev "^#|^$"
Listen 443 https          #端口
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLCryptoDevice builtin
<VirtualHost _default_:443>      #自带虚拟主机
ErrorLog logs/ssl_error_log       #自带错误日志
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /etc/httpd/conf.d/ssl/magedu.org.crt      #默认CA为/etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/httpd/conf.d/ssl/magedu.org.key   #默认key为/etc/httpd/conf.d/ssl/magedu.org.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
[root@centos8 ~]#
[root@centos8 ~]#systemctl restart httpd
[root@centos8 ~]#ss -ntl        #查看端口443端口是否打开 打开说明https服务起来
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:443                        0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*    

[root@centos8 ~]#curl -k https://127.0.0.1
This is a HTTPD(apache) test for kaivi

[root@centos8 ~]#curl -kv https://127.0.0.1 443
* Rebuilt URL to: https://127.0.0.1/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=beijing; L=beijing; O=magedu; OU=M39; CN=likai.tech   #自签名相关信息
*  start date: Dec 13 03:33:52 2019 GMT
*  expire date: Dec 12 03:33:52 2020 GMT
*  issuer: C=CN; ST=beijing; L=beijing; O=magedu; OU=M39; CN=likai.tech    
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET / HTTP/1.1
> Host: 127.0.0.1
> User-Agent: curl/7.61.1
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 200 OK
< Date: Fri, 13 Dec 2019 04:21:40 GMT
< Server: Apache/2.4.37 (centos) OpenSSL/1.1.1
< Last-Modified: Wed, 11 Dec 2019 06:59:00 GMT
< ETag: "27-5996829d3b0b9"
< Accept-Ranges: bytes
< Content-Length: 39
< Content-Type: text/html; charset=UTF-8
< 
This is a HTTPD(apache) test for kaivi          #能够访问相关内容
* Connection #0 to host 127.0.0.1 left intact

访问网页
在这里插入图片描述
因为是自签名证书，所以网址不信任。但是搭建CA证书已经成功

实现多个虚拟主机站点，apache不能支持，nginx支持

URL重定向

URL重定向，即将httpd 请求的URL转发至另一个的URL
重定向指令

Redirect [status] URL-path URL

status状态：
permanent： 返回永久重定向状态码 301

temp：返回临时重定向状态码302. 此为默认值
范例：

Redirect temp / https://www.magedu.com/   # /  表示根

实验：
修改默认访问页面内容，这个是http不进行加密的时候访问

[root@centos8 ~]#echo "HTTP 这是一个不加密的网址" > /var/www/html/index.html

创建一个新的文件夹/data/html，用来放置加密之后的页面访问内容

[root@centos8 ~]#mkdir /data/html

[root@centos8 ~]#echo "HTTPS 这是一个加密的网址" > /data/html/index.html

[root@centos8 ~]#vim /etc/httpd/conf.d/ssl.conf  #修改加密网页访问的文件路径并且授权
#DocumentRoot "/var/www/html"   #默认路径，注释掉
DocumentRoot "/data/html"       #指定新的路径
<directory /data/html>          #对访问文件夹授权
require all granted
</directory>

#ServerName www.example.com:443

[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:443                        0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*            

[root@centos8 ~]#systemctl restart httpd

访问页面对比：
在这里插入图片描述
在这里插入图片描述
2个不同的站点。在实际中这个2个虚拟主机访问的网页应该相同，所以需要进行跳转
让一个URL地址跳转到另外一个URL地址

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf 

Redirect temp / https://192.168.32.8/    #跳转的地址 表示从 /（根） 跳转到https://192.168.32.8/

[root@centos8 ~]#systemctl restart httpd

在centos7：192.168.32.7中访问：

[root@centos7 ~]#curl -I -k https://192.168.32.8   #直接访问https
HTTP/1.1 302 Found
Date: Fri, 13 Dec 2019 05:41:48 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1
Location: https://192.168.32.8/
Content-Type: text/html; charset=iso-8859-1

[root@centos7 ~]#curl -I -k http://192.168.32.8   #跳转访问
HTTP/1.1 302 Found         #状态302，表示临时跳转  如果配置文件中为permanent 则这里为301
Date: Fri, 13 Dec 2019 05:39:22 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1
Location: https://192.168.32.8/         #跳转的地址
Content-Type: text/html; charset=iso-8859-1

[root@centos7 ~]#

如果再网页中访问，因为没有设置访问条件，所以导致会出现不断的跳转，会出现放过跳转次数过多的提示，要解决可以用下面的HSTS技术。

实现HSTS

HSTS:HTTP Strict Transport Security , 服务器端配置支持HSTS后，会在给浏览器返回的HTTP首部中携
带HSTS字段。浏览器获取到该信息后，会将所有HTTP访问请求在内部做307跳转到HTTPS。而无需任
何网络过程,实现更高的安全性
HSTS preload list: 是Chrome浏览器中的HSTS预载入列表，在该列表中的网站，使用Chrome浏览器访
问时，会自动转换成HTTPS。Firefox、Safari、Edge浏览器也会采用这个列表
范例：

vim /etc/httpd/conf/httpd.conf
Header always set Strict-Transport-Security "max-age=31536000"
#为了解决最前面跳转时候的风险，在浏览器中就实现自动跳转    后面时间单位为s  这里为一年
RewriteEngine on
RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=302]

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf

#Redirect temp / https://192.168.32.8/    #把之前的注释掉
Header always set Strict-Transport-Security "max-age=31536000"
RewriteEngine on
RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=302] #后向引用

[root@centos8 ~]#
[root@centos8 ~]#systemctl restart httpd
[root@centos8 ~]#

在centos7：192.168.32.7中访问：

[root@centos7 ~]#curl -I -k http://192.168.32.8
HTTP/1.1 302 Found
Date: Fri, 13 Dec 2019 05:52:34 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1
Location: https://192.168.32.8/
Content-Type: text/html; charset=iso-8859-1

[root@centos7 ~]#

网页中查看:
直接访问192.168.32.8被跳转到了https://192.168.32.8
在这里插入图片描述

正向代理和反向代理

在这里插入图片描述
启用反向代理

ProxyPass "/" "http://www.example.com/"
ProxyPassReverse "/" "http://www.example.com/"

特定URL反向代理

ProxyPass "/images" "http://www.example.com/"
ProxyPassReverse "/images" http://www.example.com/

apache即使有反向代理功能，基本也没有人用，但是有这个功能。调度到另外一台服务器。

Sendfile机制

不用 sendfile 的传统网络传输过程： read(file, tmp_buf, len) write(socket, tmp_buf, len) 硬盘 >>
kernel buffer >> user buffer >> kernel socket buffer >> 协议栈
在这里插入图片描述
一般网络应用通过读硬盘数据，写数据到 socket 来完成网络传输,底层执行过程：
1 系统调用 read() 产生一个上下文切换：从 user mode 切换到 kernel mode，然后 DMA 执行拷贝，把文件数据从硬盘读到一个 kernel buffer 里。
2 数据从 kernel buffer 拷贝到 user buffer，然后系统调用 read() 返回，这时又产生一个上下文切换：从kernel mode 切换到 user mode
3 系统调用 write() 产生一个上下文切换：从 user mode 切换到 kernel mode，然后把步骤2读到 user buffer 的数据拷贝到 kernelbuffer（数据第2次拷贝到 kernel buffer），不过这次是个不同的 kernel buffer，这个 buffer和socket 相关联。
4 系统调用 write() 返回，产生一个上下文切换：从 kernel mode 切换到 usermode(第4次切换),然后DMA从 kernel buffer 拷贝数据到协议栈（第4次拷贝）
上面4个步骤有4次上下文切换，有4次拷贝，如果能减少切换次数和拷贝次数将会有效提升性能

Sendfile机制
在这里插入图片描述
在kernel 2.0+ 版本中，系统调用 sendfile() 就是用来简化上面步骤提升性能的。sendfile() 不但能减少切换次数而且还能减少拷贝次数用 sendfile() 来进行网络传输的过程： sendfile(socket, file, len); 硬盘>> kernel buffer (快速拷贝到kernel socket buffer) >> 协议栈
1 系统调用 sendfile() 通过 DMA 把硬盘数据拷贝到 kernel buffer，然后数据被 kernel 直接拷贝到另外一个与 socket 相关的 kernel buffer。这里没有 user mode 和 kernel mode 之间的切换，在 kernel 中直接完成了从一个 buffer 到另一个buffer 的拷贝
2 DMA 把数据从 kernel buffer 直接拷贝给协议栈，没有切换，也不需要数据从 usermode 拷贝到 kernel mode，因为数据就在 kernel 里

查看centos8中的sendfile模块

[root@centos8 ~]#cat /etc/httpd/conf/httpd.conf |grep "EnableSendfile"
# EnableMMAP and EnableSendfile: On systems that support it, 
# Defaults if commented: EnableMMAP On, EnableSendfile Off
EnableSendfile on           #默认开启

httpd 配置 basic 验证

方法一：

[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
<directory /var/www/html/admin/>
 	authtype basic
	AuthName "admin test for kaivi"
	AuthUserFile "/etc/httpd/conf.d/.httpuser"    #验证的特定账户文件
	Require user kaivi duanxin                    #特定账户
</directory>

[root@centos8 ~]#mkdir -pv /var/www/html/admin      #新建一个文件目录
mkdir: created directory '/var/www/html/admin'
[root@centos8 ~]#
[root@centos8 ~]#echo '<h1> admin tset for kaivi !</h1>' > /var/www/html/admin/index.html
[root@centos8 ~]#
[root@centos8 ~]#htpasswd -c /etc/httpd/conf.d/.httpuser kaivi     #创建第一个指定用户  -c
New password: 
Re-type new password: 
Adding password for user kaivi

[root@centos8 ~]#htpasswd  /etc/httpd/conf.d/.httpuser duanxin     #创建新增一个指定用户 取消-c
New password: 
Re-type new password: 
Adding password for user duanxin

[root@centos8 ~]#cat /etc/httpd/conf.d/.httpuser   #查看指定访问用户文件
kaivi:$apr1$FS/FeT6f$6q46m2TLyCOl8k0Um0J12/
duanxin:$apr1$56bpeN9g$5H22EP5sbnj1CcHcZ4MeT1
[root@centos8 ~]#
[root@centos8 ~]#chmod 600 /etc/httpd/conf.d/.httpuser     #授权
[root@centos8 ~]#
[root@centos8 ~]#setfacl -m u:apache:r /etc/httpd/conf.d/.httpuser    #授权
[root@centos8 ~]#
[root@centos8 ~]#systemctl restart httpd

[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*            

[root@centos8 ~]#curl  192.168.32.8/admin/index.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn t understand how to supply
the credentials required.</p>
</body></html>

[root@centos8 ~]#curl -u kaivi 192.168.32.8/admin/index.html
Enter host password for user 'kaivi':               #输入对应的口令
<h1> admin tset for kaivi !</h1>

在这里插入图片描述
在这里插入图片描述

方法二

上面实验中我们配置实现了 basic 验证， 下面我们在之前的基础上使用另外一种配置方式，实现相同的功能

[root@centos8 ~]#systemctl stop httpd

[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*            
[root@centos8 ~]#vim /etc/httpd/conf.d/test.conf

[root@centos8 ~]#cat /etc/httpd/conf.d/test.conf
<directory /var/www/html/admin/>
#	authtype basic
#	AuthName "admin test for kaivi"
#	AuthUserFile "/etc/httpd/conf.d/.httpuser"
#	Require user kaivi duanxin
	allowoverride authconfig              #允许.htaccess文件覆盖授权
</directory>
[root@centos8 ~]#vim /var/www/html/admin/.htaccess

[root@centos8 ~]#cat /var/www/html/admin/.htaccess
authtype basic
AuthName "admin test for kaivi"
AuthUserFile "/etc/httpd/conf.d/.httpuser"
Require user kaivi duanxin              #指定访问用户

[root@centos8 ~]#systemctl start httpd

[root@centos8 ~]#ss -ntl
State         Recv-Q         Send-Q                  Local Address:Port                  Peer Address:Port         
LISTEN        0              128                           0.0.0.0:22                         0.0.0.0:*            
LISTEN        0              128                           0.0.0.0:80                         0.0.0.0:*            
LISTEN        0              128                              [::]:22                            [::]:*    
        
[root@centos8 ~]#curl  192.168.32.8/admin/index.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn t understand how to supply
the credentials required.</p>
</body></html>

[root@centos8 ~]#curl -u duanxin 192.168.32.8/admin/index.html
Enter host password for user 'duanxin':        #输入账号口令
<h1> admin tset for kaivi !</h1>
[root@centos8 ~]#

组用户访问设置

上一个实验中的用户身份验证方式是基于单个用户的， 现在我们在之前的演示基础上继续进行配，使用 用户组 basic 验证

[root@centos8 ~]#vim /etc/httpd/conf.d/.httpgroup
[root@centos8 ~]#cat /etc/httpd/conf.d/.httpgroup
group1: kaivi           #分配在组1中
group2: duanxin

[root@centos8 ~]#chown apache. /etc/httpd/conf.d/.httpgroup
[root@centos8 ~]#
[root@centos8 ~]#ll /etc/httpd/conf.d/
total 20
-rw-r--r-- 1 root root 2926 Oct  8 05:42 autoindex.conf
-rw-r--r-- 1 root root  400 Oct  8 05:44 README
-rw-r--r-- 1 root root  197 Dec 13 14:38 test.conf
-rw-r--r-- 1 root root 1252 Oct  8 05:40 userdir.conf
-rw-r--r-- 1 root root  516 Oct  8 05:40 welcome.conf
[root@centos8 ~]#ls -al /etc/httpd/conf.d/
total 28
drwxr-xr-x  2 root   root    134 Dec 13 14:45 .
drwxr-xr-x  5 root   root    105 Dec 11 14:55 ..
-rw-r--r--  1 root   root   2926 Oct  8 05:42 autoindex.conf
-rw-r--r--  1 apache apache   30 Dec 13 14:45 .httpgroup
-rw-r-----+ 1 root   root     90 Dec 13 14:26 .httpuser
-rw-r--r--  1 root   root    400 Oct  8 05:44 README
-rw-r--r--  1 root   root    197 Dec 13 14:38 test.conf
-rw-r--r--  1 root   root   1252 Oct  8 05:40 userdir.conf
-rw-r--r--  1 root   root    516 Oct  8 05:40 welcome.conf
[root@centos8 ~]#
[root@centos8 ~]#vim /var/www/html/admin/.htaccess 

[root@centos8 ~]#cat /var/www/html/admin/.htaccess 
authtype basic
AuthName "admin test for kaivi"
AuthUserFile "/etc/httpd/conf.d/.httpuser"       #指定的用户文件
#Require user kaivi duanxin
AuthGroupFile "/etc/httpd/conf.d/.httpgroup"     #指定组里面的特定用户  2个要求都要满足
Require group group1      #组1中的用户能够访问  kaivi

[root@centos8 ~]#systemctl restart httpd

[root@centos8 ~]#curl -u kaivi 192.168.32.8/admin/index.html     #访问成功
Enter host password for user 'kaivi':
<h1> admin tset for kaivi !</h1>
[root@centos8 ~]#curl -u duanxin 192.168.32.8/admin/index.html    #访问失败
Enter host password for user 'duanxin':
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>
KAIVI-Blog
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
09 最新站点登录入口
数字
10-21 1643
中文站点登录网址大全Google站点登录——http://www.google.com/intl/zh-CN/add_url.htmlGoogle网页目录——http://directory.google.com/Top/World/Chinese_Simplified/百度站点登录——http://www.baidu.com/search/url_submit.html百度网址站——http:/...
web服务器中默认首页和默认网站的配置(以apache服务器为例)
morgan363的专栏
09-21 3406
默认首页的配置：      第一种：直接修改apache服务器的配置文件./conf/httpd.conf中的DirectoryIndex，如：（项目web以index.php为首页）                                                                             DirectoryIndex index.html
JavaScript 获得 汉字 的 完整 拼音
小董同学
09-22 1654
var Pinyin={} Pinyin._pinyin={"a":"\u554a\u963f\u9515","ai":"\u57c3\u6328\u54ce\u5509\u54c0\u7691\u764c\u853c\u77ee\u827e\u788d\u7231\u9698\u8bf6\u6371\u55f3\u55cc\u5ad2\u7477\u66a7\u7839\u953f\u9...
利用apache实现URL地址隐藏跳转（301跳转）
weixin_34388207的博客
11-23 1666
问题2：实现www.aaa.com跳转到www.bbb.com要求地址栏为www.aaa.com不变（该跳转为内部跳转，需使用apache的proxy代理功能） 描述：在实现了URL地址的301跳转后（参见http://oldboy.blog.51cto.com/2561410/620701）， 现在要求输入www.aaa.com出来的内容是www.bbb...
httpd配置完还是默认的网页
m0_65725268的博客
01-02 1039
httpd配置完，没有出现自己输入的字，而是出现默认的网页。 解决办法： (1)在localhost上创建一个目录为/home/www,并在/home/www下，创建index.html。[root@localhost~]#mkdir /home/www [root@localhost~]#echo "The web's test">/home/www/index.html (2)打开httpd的配置文件，第119行找到DocumentRoot，修改为/home/html，同时，修改...
三大WEB服务器配置文档
08-13
本文将详细介绍三种常见的Web服务器——APACHE、LIGHTTPD和NGINX的安装配置过程及其特点。 首先，我们来看看**APACHE服务器**。APACHE是全球最广泛使用的开源Web服务器，以其稳定性和灵活性著称。在LAMP（Linux、...
PHP 服务器配置(使用Apache及IIS两种方法)
10-29
对于使用IIS作为Web服务器的情况，配置过程有所不同： 1. **安装IIS**：在Windows Server操作系统中安装IIS服务。 2. **安装PHP**：按照上述步骤安装PHP。 3. **安装FastCGI**：下载并安装FastCGI for IIS组件。...
中间件——WEB服务器软件.docx
06-25
总之，Apache HTTP Server和Tomcat是Web服务器领域中的两个关键组件，它们共同构成了许多网站和技术基础设施的基础。Apache的强大和灵活性，加上Tomcat对Java应用的良好支持，使得这两个工具在开发和运行Web应用程序...
Linux课件——WWW服务器的配置
06-22
【Linux课件——WWW服务器的配置】 ...Apache服务器是这个领域中的...理解这些基本操作对于管理和维护一个高效的Web服务器至关重要，尤其在Linux环境中，Apache提供了强大而灵活的解决方案，能满足各种Web服务需求。
Apache,wsgi,django 程序部署配置方法详解
09-19
WSGI（Web Server Gateway Interface）是Python Web应用的标准接口，它定义了Web服务器如何与Python应用程序通信。Django则是一个高级的Python Web框架，用于快速开发安全和可维护的网站。 首先，我们需要确保系统...
Unity3d 动态读取外部文件
㊰ ❀ ☀ ☁ ☂ ☃
07-28 1466
分两种情况： 1，加载封装好的内部文件。 var aaa : Material;//空材质   var bbb : GameObject;//要绑定材质的模型   function Start()   {   aaa.mainTexture = Resources.Load("你的资源名，例如“pic1”不需要文件扩展名");   bbb.renderer.materi
HTTP服务器
weixin_52555458的博客
07-28 826
Linux服务器搭建
4 368.72 php,fsogga368368.72bbb.com
weixin_39992462的博客
03-24 356
Domain Name:72BBB.COMRegistry Domain ID:2272996645_DOMAIN_COM-VRSNRegistrar WHOIS Server:whois.web.comRegistrar URL:http://www.networksolutions.comUpdated Date:2020-07-13T09:28:08ZCreation Date:2018-0...
Linux Web发布 限制用户、客户端与基于IP、端口、域名访问
XinCenWeiSei的博客
04-24 3122
httpd服务的访问控制 发布web，dns正向解析（参考Linux web发布一） 1、客户端地址限制 vim /usr/local/httpd/conf/httpd.conf 用 / 命令查找 htdocs （以下为编辑内容） <RequireAll> （开始） Require all granted （允许所有自带，删除重新添加） Require not ip 192.168.1.250 192.168.2.0/24 (限制1.2
20130828可注册域名列表
热门推荐
落寞红尘
08-28 35万+
aabkx.com aapun.com abmrw.com abnks.com acphq.com acsgq.com actcL.com aderz.com adjni.com adojj.com adyjy.com afabd.com afcfx.com afrhi.com afubd.com ahscp.com aihtt.com aimfp.com ai
配置Apache服务器的默认首页
总有一天，你的日积月累，会成为别人的望尘莫及
06-08 2393
1、修改Apache服务器的默认首页： 访问Apache服务器时，默认是直接访问htdocs目录下的index.html，这是在conf/httpd.conf中配置的。 查到conf/httpd.conf中的&lt;IfModule dir_module&gt;，其默认内容如下： &lt;IfModule dir_module&gt;    DirectoryIndex index.php...
http服务配置详解
最新发布
m0_46543351的博客
10-02 2526
今天配置了http，踩了点坑，前来分享，报错如下：client denied by server configuration
Computer Science Conference Rankings
weixin_34232363的博客
05-26 449
AREA: Databases Rank 1:        SIGMOD: ACM SIGMOD Conf on Management of Data       PODS: ACM SIGMOD Conf on Principles of DB Systems       VLDB: Very Large Data Bases       ICDE: Intl Conf on Data E...
apache服务器显示index,在APACHE服务器上的访问方式上去除index.php
weixin_31727937的博客
08-06 735
下面我说下apache下，如何去掉URL里面的index.php例如:你原来的路径是：localhost/index.php/index改变后的路径是:localhost/index1.httpd.conf配置文件中加载了mod_rewrite.so模块//在APACHE里面去配置#LoadModulerewrite_modulemodules/mod_rewrite.so...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值