Apache
一.Apache安装
[root@Apache ~]# dnf install httpd -y [root@Apache ~]# systemctl enable --now httpd二.Apache服务基本信息
软件：httpd
端口：http 80 https 443
主配置文件： /etc/httpd/conf/httpd.conf
子配置文件： /etc/httpd/conf.d/
服务启动脚本： httpd.service
默认发布目录： /var/www/html
默认发布文件：index.html
三.Apache的基本配置
1.发布文件
- 默认发布文件的生成
[root@Apache ~]# echo 172.25.254.100 > /var/www/html/index.html #写在默认发布目录和默认发布文件里 [root@Apache ~]# cat /var/www/html/index.html 172.25.254.100- 测试
[root@Apache ~]# curl 172.25.254.100 #访问 172.25.254.1002.默认发布文件的修改
[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 168 <IfModule dir_module> 169 DirectoryIndex wjh.html index.html #必须要写在index.html前面，不然会先读取index.html 170 </IfModule> [root@Apache ~]# echo wjh > /var/www/html/wjh.html [root@Apache ~]# systemctl reload httpd #重载apache [root@Apache ~]# curl 172.25.254.100 wjh [root@Apache ~]# rm -rf /var/www/html/wjh.html #把wjh.html删除，则又会读取index.html [root@Apache ~]# curl 172.25.254.100 172.25.254.1003.修改默认发布目录
#生成新的默认发布目录和默认发布文件 [root@Apache ~]# mkdir /var/web/html -p [root@Apache ~]# echo "新的默认发布目录" > /var/web/html/index.html [root@Apache ~]# vim /etc/httpd/conf/httpd.conf #修改主配置文件 125 DocumentRoot "/var/web/html" 修改默认发布目录路径 129 #<Directory "/var/www"> #用#注释默认发布目录权限配置块 130 # AllowOverride None 131 # Allow open access: 132 # Require all granted 133 #</Directory> 134 135 <Directory "/var/web"> #可以直接复制旧目录权限配置块，修改路径即可 136 AllowOverride None #关闭伪静态权限等 137 # Allow open access: 138 Require all granted #允许所有IP访问 139 </Directory> [root@Apache ~]# systemctl restart httpd #重启服务 #测试： [root@Apache ~]# curl 172.25.254.100 新的默认发布目录4.修改服务端口
[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 47 Listen 808 #修改监听端口 [root@Apache ~]# systemctl restart httpd #重启服务 [root@Apache ~]# netstat -antlupe | grep httpd #查看是否有对应监听端口 tcp6 0 0 :::808 :::* LISTEN 0 62346 30090/httpd [root@Apache ~]# curl 172.25.254.100 curl: (7) Failed to connect to 172.25.254.100 port 80: 拒绝连接 [root@Apache ~]# curl 172.25.254.100:808 新的默认发布目录5.目录的访问控制
- 基于IP的访问控制
- 在访问172.25.254.100/wjh只能让172.25.254.10主机访问其他人不能
[root@Apache ~]# mkdir /var/web/html/wjh [root@Apache ~]# echo wjh > /var/web/html/wjh/index.html [root@Apache ~]# vim /etc/httpd/conf/httpd.conf 141 <Directory "/var/web/html/wjh"> 142 Order deny,allow #先执行deny，在执行allow 143 Deny from All #拒绝所有 144 Allow from 172.25.254.10 #允许172.25.254.10主机访问 145 </Directory> [root@Apache ~]# systemctl restart httpd #重启服务 [root@Apache ~]# curl 172.25.254.100:808 #访问主页面还是能访问到 新的默认发布目录 [root@Apache ~]# curl 172.25.254.100:808/wjh/ #访问wjh目录时则不能 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> </body></html> [root@node1 ~]# curl 172.25.254.100:808/wjh/ #只有10主机能访问 wjh- 基于用户认证的访问控制
- 当访问172.25.254.100/wang目录时需要通过用户认证否则拒绝访问
[root@Apache ~]# mkdir /var/web/html/wang #创建目录 [root@Apache ~]# echo "需要用户认证才能进入" > /var/web/html/wang/index.html [root@Apache ~]# htpasswd -cm /etc/httpd/.htpasswd wjh #创建用户认证文件 New password: Re-type new password: Adding password for user wjh [root@Apache ~]# vim /etc/httpd/conf/httpd.conf <Directory "/var/web/html/wang"> AuthUserFile /etc/httpd/.htpasswd #指定用户认证文件 AuthName "Please input username and password" #登录提示文本 AuthType basic #认证类型 Require valid-user #允许用户认证文件里所有用户 </Directory> [root@Apache ~]# systemctl restart httpd #重启服务 #测试： [root@Apache ~]# curl 172.25.254.100:808/wang/ <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>401 Unauthorized</title> </head><body> <h1>Unauthorized</h1> <p>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.</p> </body></html> [root@Apache ~]# curl 172.25.254.100:808/wang/ -uwjh:123 需要用户认证才能进入四.Apache服务器的虚拟主机
服务Ip是非常有限的资源，Apache默认只能发布一个站点，但是企业可能有多个站点要发布，那么就需要Apache的虚拟机技术。
1.建立各个站点的默认发布目录和默认发布文件
www.fordwin.org 访问默认
bbs.fordwin.org /var/web/virtual/fordwin.org/bbs
news.fordwin.org /var/web/virtual/fordwin.org/news
[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/bbs -p [root@Apache ~]# mkdir /var/web/virtual/fordwin.org/news -p [root@Apache ~]# echo bbs.fordwin.org > /var/web/virtual/fordwin.org/bbs/index.html [root@Apache ~]# echo news.fordwin.org > /var/web/virtual/fordwin.org/news/index.html2.配置虚拟主机
[root@Apache ~]# vim /etc/httpd/conf.d/vhosts.conf <VirtualHost _default_:808> DocumentRoot /var/web/html CustomLog /etc/httpd/logs/default.log combined </VirtualHost> <VirtualHost *:808> ServerName news.fordwin.org DocumentRoot /var/web/virtual/fordwin.org/news CustomLog /etc/httpd/logs/news.log combined </VirtualHost> <VirtualHost *:808> ServerName bbs.fordwin.org DocumentRoot /var/web/virtual/fordwin.org/bbs CustomLog /etc/httpd/logs/bbs.log combined </VirtualHost>3.测试：
[root@Apache ~]# curl news.fordwin.org:808 news.fordwin.org [root@Apache ~]# curl bbs.fordwin.org:808 bbs.fordwin.org [root@Apache ~]# curl www.fordwin.org:808 新的默认发布目录五.Apache的https访问
1.生成证书
[root@Apache ~]# mkdir /etc/httpd/certs [root@Apache ~]# openssl req -newkey rsa:2048 -nodes -sha256 -keyout /etc/httpd/certs/fordwin.org.key -x509 -days 365 -out /etc/httpd/certs/fordwin.org.crt #填写信息 Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:JiangSu Locality Name (eg, city) [Default City]:NanJing Organization Name (eg, company) [Default Company Ltd]:fordwin Organizational Unit Name (eg, section) []:webserver Common Name (eg, your name or your server's hostname) []:www.fordwin.org Email Address []:fordwin@fordwin.org [root@Apache ~]# ls /etc/httpd/certs/ fordwin.org.crt fordwin.org.key2.安装加密套件
[root@Apache ~]# dnf install mod_ssl -y [root@Apache ~]# mkdir /var/web/virtual/fordwin.org/login -p [root@Apache ~]# echo login.fordwin.org > /var/web/virtual/fordwin.org/login/index.html3.配置加密
[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/login -p [root@Apache ~]# echo login.fordwin.org > /var/web/virtual/fordwin.org/login/index.html [root@Apache ~]# vim /etc/httpd/conf.d/vhosts.conf <VirtualHost *:808> ServerName login.fordwin.org RewriteEngine On #开启重写模块 RewriteRule ^/(.*)$ https://login.fordwin.org/$1 [R=301] #永久301重定向到https </VirtualHost> <VirtualHost *:443> ServerName login.fordwin.org DocumentRoot /var/web/virtual/fordwin.org/login CustomLog /etc/httpd/logs/login.log combined SSLEngine on #开启SSL/TLS 加密引擎 SSLCertificateFile /etc/httpd/certs/fordwin.org.crt SSLCertificateKeyFile /etc/httpd/certs/fordwin.org.key </VirtualHost> [root@Apache ~]# systemctl restart httpd [root@Apache ~]# vim /etc/hosts 172.25.254.100 Apache www.fordwin.org news.fordwin.org bbs.fordwin.org login.fordwin.org4.测试：
[root@Apache ~]# curl -kL login.fordwin.org:808 login.fordwin.org