Apache - 技术栈

一.Apache安装

复制代码

[root@Apache ~]# dnf install httpd -y	
[root@Apache ~]# systemctl enable --now httpd

二.Apache服务基本信息

软件：httpd
端口：http 80 https 443
主配置文件： /etc/httpd/conf/httpd.conf
子配置文件： /etc/httpd/conf.d/
服务启动脚本： httpd.service
默认发布目录： /var/www/html
默认发布文件：index.html

三.Apache的基本配置

1.发布文件

默认发布文件的生成

bash 复制代码

[root@Apache ~]# echo 172.25.254.100 > /var/www/html/index.html	#写在默认发布目录和默认发布文件里
[root@Apache ~]# cat /var/www/html/index.html 
172.25.254.100

测试

bash 复制代码

[root@Apache ~]# curl 172.25.254.100	#访问
172.25.254.100

2.默认发布文件的修改

bash 复制代码

[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 
168 <IfModule dir_module>
169     DirectoryIndex wjh.html index.html	#必须要写在index.html前面，不然会先读取index.html
170 </IfModule>

[root@Apache ~]# echo wjh > /var/www/html/wjh.html

[root@Apache ~]# systemctl reload httpd		#重载apache

[root@Apache ~]# curl 172.25.254.100
wjh

[root@Apache ~]# rm -rf /var/www/html/wjh.html #把wjh.html删除，则又会读取index.html

[root@Apache ~]# curl 172.25.254.100
172.25.254.100

3.修改默认发布目录

bash 复制代码

#生成新的默认发布目录和默认发布文件
[root@Apache ~]# mkdir /var/web/html -p
[root@Apache ~]# echo "新的默认发布目录" > /var/web/html/index.html

[root@Apache ~]# vim /etc/httpd/conf/httpd.conf  #修改主配置文件
125 DocumentRoot "/var/web/html"	修改默认发布目录路径
129 #<Directory "/var/www">		#用#注释默认发布目录权限配置块
130 #    AllowOverride None
131     # Allow open access:
132 #    Require all granted
133 #</Directory>
134 
135 <Directory "/var/web">		#可以直接复制旧目录权限配置块，修改路径即可
136     AllowOverride None		#关闭伪静态权限等
137     # Allow open access:
138     Require all granted		#允许所有IP访问
139 </Directory>

[root@Apache ~]# systemctl restart httpd	#重启服务

#测试：
[root@Apache ~]# curl 172.25.254.100
新的默认发布目录

4.修改服务端口

bash 复制代码

[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 
 47 Listen 808	#修改监听端口

[root@Apache ~]# systemctl restart httpd	#重启服务
[root@Apache ~]# netstat -antlupe | grep httpd	#查看是否有对应监听端口
tcp6       0      0 :::808                  :::*                    LISTEN      0          62346      30090/httpd         

[root@Apache ~]# curl 172.25.254.100
curl: (7) Failed to connect to 172.25.254.100 port 80: 拒绝连接
[root@Apache ~]# curl 172.25.254.100:808
新的默认发布目录

5.目录的访问控制

基于IP的访问控制
在访问172.25.254.100/wjh只能让172.25.254.10主机访问其他人不能

bash 复制代码

[root@Apache ~]# mkdir /var/web/html/wjh	
[root@Apache ~]# echo wjh > /var/web/html/wjh/index.html

[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 
141 <Directory "/var/web/html/wjh">	
142     Order deny,allow	#先执行deny，在执行allow
143     Deny from All	#拒绝所有
144     Allow from 172.25.254.10	#允许172.25.254.10主机访问
145 </Directory>

[root@Apache ~]# systemctl restart httpd	#重启服务

[root@Apache ~]# curl 172.25.254.100:808	#访问主页面还是能访问到
新的默认发布目录
[root@Apache ~]# curl 172.25.254.100:808/wjh/	#访问wjh目录时则不能
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

[root@node1 ~]# curl 172.25.254.100:808/wjh/	#只有10主机能访问
wjh

基于用户认证的访问控制
当访问172.25.254.100/wang目录时需要通过用户认证否则拒绝访问

bash 复制代码

[root@Apache ~]# mkdir /var/web/html/wang	#创建目录
[root@Apache ~]# echo "需要用户认证才能进入" > /var/web/html/wang/index.html

[root@Apache ~]# htpasswd -cm /etc/httpd/.htpasswd wjh #创建用户认证文件
New password: 
Re-type new password: 
Adding password for user wjh
[root@Apache ~]# vim /etc/httpd/conf/httpd.conf 
<Directory "/var/web/html/wang">	
    AuthUserFile /etc/httpd/.htpasswd	#指定用户认证文件
    AuthName "Please input username and password"	#登录提示文本
    AuthType basic	#认证类型
    Require valid-user	#允许用户认证文件里所有用户
</Directory>

[root@Apache ~]# systemctl restart httpd	#重启服务

#测试：
[root@Apache ~]# curl 172.25.254.100:808/wang/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

[root@Apache ~]# curl 172.25.254.100:808/wang/ -uwjh:123
需要用户认证才能进入

四.Apache服务器的虚拟主机

服务Ip是非常有限的资源，Apache默认只能发布一个站点，但是企业可能有多个站点要发布，那么就需要Apache的虚拟机技术。

1.建立各个站点的默认发布目录和默认发布文件

<www.fordwin.org> 访问默认

bbs.fordwin.org /var/web/virtual/fordwin.org/bbs

news.fordwin.org /var/web/virtual/fordwin.org/news

bash 复制代码

[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/bbs -p

[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/news -p

[root@Apache ~]# echo bbs.fordwin.org > /var/web/virtual/fordwin.org/bbs/index.html

[root@Apache ~]# echo news.fordwin.org > /var/web/virtual/fordwin.org/news/index.html

2.配置虚拟主机

bash 复制代码

[root@Apache ~]# vim /etc/httpd/conf.d/vhosts.conf
<VirtualHost _default_:808>
    DocumentRoot /var/web/html
    CustomLog /etc/httpd/logs/default.log combined
</VirtualHost>

<VirtualHost *:808>
    ServerName news.fordwin.org
    DocumentRoot /var/web/virtual/fordwin.org/news
    CustomLog /etc/httpd/logs/news.log combined
</VirtualHost>

<VirtualHost *:808>
    ServerName bbs.fordwin.org
    DocumentRoot /var/web/virtual/fordwin.org/bbs
    CustomLog /etc/httpd/logs/bbs.log combined
</VirtualHost>

3.测试：

bash 复制代码

[root@Apache ~]# curl news.fordwin.org:808
news.fordwin.org
[root@Apache ~]# curl bbs.fordwin.org:808
bbs.fordwin.org
[root@Apache ~]# curl www.fordwin.org:808
新的默认发布目录

五.Apache的https访问

1.生成证书

bash 复制代码

[root@Apache ~]# mkdir /etc/httpd/certs

[root@Apache ~]# openssl req -newkey rsa:2048 -nodes -sha256 -keyout /etc/httpd/certs/fordwin.org.key -x509 -days 365 -out /etc/httpd/certs/fordwin.org.crt
#填写信息
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:JiangSu  
Locality Name (eg, city) [Default City]:NanJing
Organization Name (eg, company) [Default Company Ltd]:fordwin
Organizational Unit Name (eg, section) []:webserver
Common Name (eg, your name or your server's hostname) []:www.fordwin.org   
Email Address []:fordwin@fordwin.org

[root@Apache ~]# ls /etc/httpd/certs/
fordwin.org.crt  fordwin.org.key

2.安装加密套件

bash 复制代码

[root@Apache ~]# dnf install mod_ssl -y

[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/login -p

[root@Apache ~]# echo login.fordwin.org > /var/web/virtual/fordwin.org/login/index.html

3.配置加密

bash 复制代码

[root@Apache ~]# mkdir /var/web/virtual/fordwin.org/login -p

[root@Apache ~]# echo login.fordwin.org > /var/web/virtual/fordwin.org/login/index.html

[root@Apache ~]# vim /etc/httpd/conf.d/vhosts.conf 
<VirtualHost *:808>
    ServerName login.fordwin.org	
    RewriteEngine On	#开启重写模块
    RewriteRule ^/(.*)$ https://login.fordwin.org/$1 [R=301] #永久301重定向到https
</VirtualHost>

<VirtualHost *:443>
    ServerName login.fordwin.org
    DocumentRoot /var/web/virtual/fordwin.org/login
    CustomLog /etc/httpd/logs/login.log combined
    SSLEngine on	#开启SSL/TLS 加密引擎
    SSLCertificateFile /etc/httpd/certs/fordwin.org.crt
    SSLCertificateKeyFile /etc/httpd/certs/fordwin.org.key
</VirtualHost>

[root@Apache ~]# systemctl restart httpd

[root@Apache ~]# vim /etc/hosts
172.25.254.100  Apache www.fordwin.org  news.fordwin.org bbs.fordwin.org login.fordwin.org

4.测试：

bash 复制代码

[root@Apache ~]# curl -kL login.fordwin.org:808
login.fordwin.org