本文详细介绍了Apache源码在Linux环境下的编译安装步骤，包括环境准备、httpd配置、虚拟主机配置、访问控制及https服务配置。在虚拟主机配置中，分别讲解了相同IP不同端口、不同IP相同端口以及相同IP相同端口不同域名的配置方法。在https服务配置中，提到了证书的生成与配置，并指出生产环境中通常购买证书。
文章目录
apache源码安装与配置
1.apache源码编译安装
1.1 环境准备
- 网卡配置 vim wget 以及依赖包openssl-devel pcre-devel expat-devel libtool gcc
[root@rookie ~]# yum -y install wget vim
[root@rookie ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
[root@rookie ~]# wget https://downloads.apache.org/apr/apr-1.7.0.tar.gz
[root@rookie ~]# wget https://downloads.apache.org/apr/apr-util-1.6.1.tar.gz
[root@rookie ~]# wget https://downloads.apache.org/httpd/httpd-2.4.54.tar.gz
[root@rookie ~]# yum -y install openssl-devel pcre-devel expat-devel libtool gcc make --allowerasing
[root@rookie ~]# useradd -r -M -s /sbin/nologin apache
[root@rookie ~]# id apache
[root@rookie ~]# grep apache /etc/group
1.2 编译安装apache 顺序为apr—>arp-util----->httpd
//全部解压缩
[root@rookie ~]# ls
anaconda-ks.cfg apr-1.7.0.tar.gz apr-util-1.6.1.tar.gz httpd-2.4.53.tar.gz
[root@rookie ~]# tar -xf apr-1.7.0.tar.gz
[root@rookie ~]# tar -xf apr-util-1.6.1.tar.gz
[root@rookie ~]# tar -xf httpd-2.4.54.tar.gz
[root@rookie ~]# ls
anaconda-ks.cfg apr-1.7.0.tar.gz apr-util-1.6.1.tar.gz httpd-2.4.53.tar.gz
apr-1.7.0 apr-util-1.6.1 httpd-2.4.54
//apr配置文件更改和编译
[root@rookie ~]# cd apr-1.7.0
[root@rookie apr-1.7.0]# vim configure
# $RM "$cfgfile" //将此行加上注释，或者删除此行
[root@rookie apr-1.7.0]# ./configure --prefix=/usr/local/apr
[root@rookie apr-1.7.0]# make && make install
//编译安装apr-util
[root@rookie ~]# cd apr-util-1.6.1
[root@rookie apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr/
[root@rookie apr-util-1.6.1]# make && make install
//编译安装httpd
[root@rookie apr-util-1.6.1]# cd ../httpd-2.4.54
[root@rookie httpd-2.4.54]# ./configure --prefix=/usr/local/apache --enable-so --enable-ssl --enable-cgi --enable--rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util --enable-modules=most --enable-mpms-shared=all --with-mpm=prefork
....
Server Version: 2.4.54
Install prefix: /usr/local/apache
C compiler: gcc
CFLAGS: -g -O2 -pthread
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE
LDFLAGS:
LIBS:
C preprocessor: gcc -E
[root@rookie httpd-2.4.54]# make && make install
2. httpd配置
2.1 设置环境变量 头文件 man文档
//环境变量设置
[root@rookie ~]# echo 'export PATH=/usr/local/apache/bin:$PATH' > /etc/profile.d/apache.sh
[root@rookie ~]# source /etc/profile.d/apache.sh
[root@rookie ~]# which httpd
/usr/local/apache/bin/httpd
[root@rookie ~]# which apachectl
/usr/local/apache/bin/apachectl
//头文件设置
[root@rookie ~]# ln -s /usr/local/apache/include/ /usr/include/apache
[root@rookie ~]# ll /usr/include/|grep apache
lrwxrwxrwx. 1 root root 26 4月 16 00:10 apache -> /usr/local/apache/include/
//man文档
[root@rookie ~]# vim /etc/man_db.conf
MANDATORY_MANPATH /usr/local/apache/man //需要添加的一行
2.2 服务启动与开机自启
//关防火墙
[root@rookie ~]# systemctl disable --now firewalld
[root@rookie ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; >
Active: inactive (dead)
//立即生效
[root@rookie ~]# setenforce 0
[root@rookie ~]# getenforce
Permissive
//设置永久生效
[root@rookie ~]# vim /etc/selinux/config
SELINUX=disabled //将enforcing 修改为 disabled
//启动服务
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
[root@rookie ~]# apachectl start
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:80 *:*
//修改配置文件
[root@rookie ~]# cd /usr/local/apache/conf
[root@rookie conf]# vim httpd.conf
#ServerName www.example.com:80 // 此行取消注释
//设置开机自启 写一个server文件 可以直接复制其他的文件更改
[root@rookie conf]# cd /usr/lib/systemd/system
[root@rookie system]# ls sshd.service
sshd.service
[root@rookie system]# cp sshd.service httpd.service
[root@rookie system]# vim httpd.service
[Unit]
Description=httpd server daemon
After=network.target sshd-keygen.target
[Service]
Type=forking
ExecStart=/usr/lcoal/apache/bin/apachectl start
ExecStop=/usr/lcoal/apache/bin/apachectl stop
ExecReload=/bin/kill -HUP $MAINPID
[Install]
WantedBy=multi-user.target
- 最后删除行 修改参数后的文件如图
[root@rookie ~]# systemctl daemon-reload
[root@rookie ~]# systemctl status httpd
httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disa>
Active: inactive (dead)
root@rookie ~]# systemctl start httpd
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:80 *:*
[root@rookie ~]# systemctl status httpd
httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disa>
Active: active (running) since Sat 2022-04-16 10:55:45 CST
[root@rookie ~]# systemctl enable httpd
[root@rookie ~]# systemctl status httpd
httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor pre>
Active: active (running) since Sat 2022-04-16 10:55:45 CST; 1min 35s ago
3. 虚拟主机配置
3.1 配置相同ip 不同端口号的虚拟主机
//进入并修改虚拟主机文件
[root@rookie ~]# cd /usr/local/apache/conf/extra
[root@rookie extra]# ls
[root@rookie extra]# vim httpd-vhosts.conf
- 配置文件修改后如图
//放网站的目录也要建好
[root@rookie ~]# cd /usr/local/apache/htdocs/
[root@rookie htdocs]# ls
index.html
[root@rookie htdocs]# mkdir test.example.com
[root@rookie htdocs]# ls
index.html test.example.com
//取消注释/usr/local/apache/conf/httpd.confz中 关于配置文件的# Virtual hosts行 使得上面修改的文件能包含进来 ，让配置文件生效
[root@rookie htdocs]# vim /usr/local/apache/conf/httpd.conf
//重启访问 此时网页为空
[root@rookie htdocs]# systemctl restart httpd
[root@rookie htdocs]# systemctl status httpd
httpd.service - httpd server daemon
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2022-04-16 12:31:51 CST; 4s ago
- 进入网站 没有命令首页文件（index.html）添加内容时，效果如下图
[root@rookie apache]# cd /usr/local/apache/htdocs/test.example.com/
[root@rookie test.example.com]# ls
[root@rookie test.example.com]# echo "wow wow wow" > xyx.html
[root@rookie test.example.com]# ls
xyx.html
![![在这里插入图片描述]](/https://i-blog.csdnimg.cn/blog_migrate/184530147ed2a26e3e9a9a784b1b7f5e.png)
- 更名后首页效果图
[root@rookie test.example.com]# mv xyx.html index.html
[root@rookie test.example.com]# ls
index.html
![]
)](/https://i-blog.csdnimg.cn/blog_migrate/3a824e38a2e7b48bb77d09a5b377c53e.png)
- 建一个新网站 但因为此时只配置了一个虚拟主机，两个网站访问都是同一个页面
[root@rookie htdocs]# ls
index.html test.example.com
[root@rookie htdocs]# mkdir blog.example.com
[root@rookie htdocs]# cd blog.example.com
[root@rookie blog.example.com]# ls
[root@rookie blog.example.com]# echo "good day to you" > index.html
[root@rookie blog.example.com]# ls
index.html
- 改配置文件/usr/local/apache/conf/extra/httpd-vhosts.conf 设置两个网站并设置监听
[root@rookie ~]# vim /usr/local/apache/conf/extra/httpd-vhosts.conf
[root@rookie ~]# systemctl restart httpd
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 *:81 *:*
3.2 配置不同ip 相同端口号的虚拟主机
- 先加ip 让网卡至少有两个ip
[root@rookie ~]# ip a
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:84:66:3b brd ff:ff:ff:ff:ff:ff
inet 192.168.177.128/24 brd 192.168.177.255 scope global dynamic noprefixroute ens33
valid_lft 995sec preferred_lft 995sec
[root@rookie ~]# ip addr add 192.168.177.129/24 dev ens33
[root@rookie ~]# ip a s ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:84:66:3b brd ff:ff:ff:ff:ff:ff
inet 192.168.177.128/24 brd 192.168.177.255 scope global dynamic noprefixroute ens33
valid_lft 928sec preferred_lft 928sec
inet 192.168.177.129/24 scope global secondary ens33
valid_lft forever preferred_lft forever
- 改配置文件/usr/local/apache/conf/extra/httpd-vhosts.conf
- 重启后验证
[root@rookie ~]# systemctl restart httpd
3.3 配置相同ip 相同端口号 不同域名的虚拟主机 (生产中常用)
-
改配置文件/usr/local/apache/conf/extra/httpd-vhosts.conf
-
真机上C:\windows\system32\drivers\etc\hosts 加域名映射关系
请添加图片描述
4. 访问控制配置
- 访问控制法则：
| 法则 | 功能 |
|---|---|
| Require all granted | 允许所有主机访问 |
| Require all deny | 拒绝所有主机访问 |
| Require ip IPADDR | 只有此ip可访问 |
| Require not ip IPADDR | 只有此ip不可访问 |
| Require host HOSTNAME | 只有此主机名可访问 |
| Require not host HOSTNAME | 只有此主机名不可访问 |
| IPADDR的类型 | HOSTNAME的类型 |
|---|---|
| IP：192.168.1.1 | FQDN：完全限定域名 |
| Network/mask：192.168.1.0/255.255.255.0 | DOMAIN：指定域内的所有主机 |
| Network/Length：192.168.1.0/24 | |
| Net：192.168 |
- 注意：httpd-2.4版本默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问
- 限制此ip访问test.example.com
//修改配置文件
[root@rookie ~]# vim /usr/local/apache/conf/extra/httpd-vhosts.conf
[root@rookie ~]# systemctl restart httpd
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
- 意味着其他ip可以访问test和blog两个网站 192.168.177.1网段只可以访问blog
- 虚拟机可以访问
[root@rookie ~]# vim /etc/host
host.conf hostname hosts
[root@rookie ~]# vim /etc/hosts
192.168.177.128 test.example.com blog.example.com
[root@rookie ~]# curl test.example.com
wow wow wow
[root@rookie ~]# curl blog.example.com
good day to you
5. https服务配置
- 前置准备：更改主配置文件，启用ssl模块
[root@rookie ~]# cd /usr/local/apache/conf/
[root@rookie conf]# vim httpd.conf
LoadModule ssl_module modules/mod_ssl.so //取消注释这一行
5.1 生成证书（生产中一般是购买证书）
- CA生成一对密钥
[root@rookie conf]# cd /etc/pki/
[root@rookie pki]# mkdir CA
[root@rookie pki]# cd CA
[root@rookie CA]# mkdir private
[root@rookie CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@rookie CA]# ls private/
cakey.pem
- CA生成自签署证书
[root@rookie CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
[root@rookie CA]# ls
cacert.pem private
[root@rookie CA]# mkdir certs newcerts crl
[root@rookie CA]# touch index.txt && echo 01 > serial
- 客户端（例如httpd服务器）生成密钥
[root@rookie apache]# cd /usr/local/apache/conf
[root@rookie conf]# mkdir ssl
[root@rookie conf]# cd ssl
[root@rookie ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:runtime
Common Name (eg, your name or your server's hostname) []:test.example.com
Email Address []:1@2.com
[root@rookie ssl]# ls
httpd.key
- 客户端生成证书签署请求
[root@rookie ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:runtime
Common Name (eg, your name or your server's hostname) []:test.example.com
Email Address []:1@2.com
[root@rookie ssl]# ls
httpd.csr httpd.key
- CA签署客户端提交上来的证书
[root@rookie ssl]# openssl ca -in httpd.csr -out httpd.crt -days 365
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
[root@rookie ssl]# rm -f httpd.csr
[root@rookie ssl]# ls
httpd.crt httpd.key
5.2 配置https
- 改配置文件 打开ssl模块
[root@rookie ~]# vim /usr/local/apache/conf/httpd.conf
Include conf/extra/httpd-ssl.conf //查找ssl.conf 取消此行注释
[root@rookie ~]# cd /usr/local/apache/conf
[root@rookie conf]# ls extra/
[root@rookie conf]# vim extra/httpd-ssl.conf
- 这个配置文件有两处需要更改 如下图
- 检查语法是否有问题
[root@rookie extra]# httpd -t
AH00526: Syntax error on line 92 of /usr/local/apache/conf/extra/httpd-ssl.conf:
//再次修改
[root@rookie extra]# vim /usr/local/apache/conf/httpd.conf
- 找到此行 取消注释
[root@rookie extra]# httpd -t
Syntax OK
5.3 重启服务 设置hosts以便域名访问（生产无需此步）
[root@rookie ~]# systemctl restart httpd
[root@rookie ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
//删除之前设置的访问限制
[root@rookie ~]# vim /usr/local/apache/conf/extra/httpd-vhosts.conf
Require not ip 192.168.177.1 //此行删除
[root@rookie ~]# systemctl restart httpd
[root@rookie ~]# ss -antl
- 可以看到 自己配置的证书 只有QQ浏览器可以认证 其他浏览器不通过
扫一扫
1111
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
