Centos 7.5 搭建mysql+nginx+php+redis+php+ssl+denyhosts
系統(tǒng)環(huán)境:CentOS Linux release 7.5.1804 (Core)
軟件版本:Mysql 5.7.24
Nginx 1.14.0
PHP7.1.23擴(kuò)展(redis,igbinary,inotify,swoole,fileinfo)
redis-5.0.0
SSL
denyhosts
一兔毒、安裝mysql 5.7.24
安裝YUM Repo,由于CentOS的yum源中沒有mysql闷叉,需要到mysql的官網(wǎng)下載yum repo配置文件:
yum install wgetvim unzip zipgcc-c++–y
wget https://dev.mysql.com/get/mysql57-community-release-el7-9.noarch.rpm
然后進(jìn)行repo的安裝:
rpm -ivh mysql57-community-release-el7-9.noarch.rpm
執(zhí)行完成后會在/etc/yum.repos.d/目錄下生成兩個repo文件mysql-community.repomysql-community-source.repo
[圖片上傳失敗...(image-f52fe9-1558444333806)]
開始安裝MySQL使用yum命令即可完成安裝
yum install mysql-server –y
啟動msyql:
systemctl start mysqld
獲取安裝時的臨時密碼:
grep 'temporary password' /var/log/mysqld.log
用查到的密碼登錄:
mysql -u root -p
登錄成功后修改密碼:
set global validate_password_policy=0;
set password=password("52Wangdun");
配置默認(rèn)編碼為utf8:
vim /etc/my.cnf#添加
[mysqld]
character_set_server=utf8
init_connect='SET NAMES utf8'
[圖片上傳失敗...(image-f5de3f-1558444333806)]
附常用命令:
mysql_secure_installation #設(shè)置安全選項(xiàng)
systemctl stop mysqld #關(guān)閉MySQL
systemctl restart mysqld #重啟MySQL
systemctl status mysqld#查看MySQL運(yùn)行狀態(tài)
systemctl enable mysqld#設(shè)置開機(jī)啟動
systemctl disable mysqld#關(guān)閉開機(jī)啟動
默認(rèn)配置文件路徑:
配置文件:/etc/my.cnf
日志文件:/var/log/mysqld.log
服務(wù)啟動腳本:/usr/lib/systemd/system/mysqld.service
socket文件:/var/run/mysqld/mysqld.pid
二猫态、安裝nginx 1.14.0
編譯安裝前所需要的準(zhǔn)備:安裝GCC編譯器 PCRE庫zlib庫OpenSSL庫
yum install -y gccpcrepcre-develzlibzlib-developensslopenssl-devel
下載安裝包
wget http://nginx.org/download/nginx-1.14.0.tar.gz
解壓安裝
tar -zxvf nginx-1.14.0.tar.gz
cd nginx-1.14.0/
./configure --prefix=/usr/local/nginx --pid-path=/run/nginx.pid --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --with-http_ssl_module --with-http_v2_module --with-http_stub_status_module --with-pcre
編譯安裝
make
make install
防火墻增加80端口
firewall-cmd --zone=public --add-port=80/tcp --permanent
防火墻配置生效
firewall-cmd--reload
訪問網(wǎng)頁
[圖片上傳失敗...(image-6f2922-1558444333806)]
設(shè)置ngnix開機(jī)自啟,即在rc.local增加啟動代碼就可以了
vim /etc/rc.local增加一行
/usr/local/nginx/sbin/nginx
[圖片上傳失敗...(image-345775-1558444333806)]
設(shè)置執(zhí)行權(quán)限:
chmod 755 /etc/rc.local
關(guān)閉SELINUX
vim /etc/selinux/config將SELINUX=enforcing改為SELINUX=disabled
[圖片上傳失敗...(image-883791-1558444333804)]
附(Nginx部分控制命令):默認(rèn)Nginx安裝在/usr/local/nginx/中该园,因此
/usr/local/nginx/sbin/nginx #默認(rèn)啟動start
/usr/local/nginx/sbin/nginx -t #測試配置信息
/usr/local/nginx/sbin/nginx -s stop #快速停止服務(wù)
/usr/local/nginx/sbin/nginx -s quit #正常停止服務(wù)
/usr/local/nginx/sbin/nginx -s reload #重啟
三伐弹、安裝PHP7.1.23
編譯安裝前所需要的準(zhǔn)備
yum -y install libxml2 libxml2-devel opensslopenssl-devel curl-devellibjpeg-devellibpng-develfreetype-devellibmcrypt-devellibxsltlibxslt-devel
安裝過程中發(fā)現(xiàn)無法安裝libmcrypt擴(kuò)展需要安裝第三方y(tǒng)um源
wget http://www.atomicorp.com/installers/atomic
sh ./atomic(默認(rèn)回車就行)
安裝所依賴的包
yum install php-mcrypt -y
yum install libmcrypt -y
yum install libmcrypt-devel -y
yum install bzip2-devel -y
yum install gmp-devel -y
yum install readline-devel –y
yum install psmisc –y
下載安裝包
wget -O php-7.1.23.tar.gz http://am1.php.net/get/php-7.1.23.tar.gz/from/this/mirror
解壓
tarzxvf php-7.1.23.tar.gz
進(jìn)入目錄
cd php-7.1.23
開始配置
./configure \
--prefix=/usr/local/php \
--with-config-file-path=/etc \
--enable-fpm \
--with-fpm-user=www-data \
--with-fpm-group=www-data \
--enable-inline-optimization \
--disable-debug \
--disable-rpath \
--enable-shared \
--enable-soap \
--with-libxml-dir \
--with-xmlrpc \
--with-openssl \
--with-mcrypt \
--with-mhash \
--with-pcre-regex \
--with-sqlite3 \
--with-zlib \
--enable-bcmath \
--with-iconv \
--with-bz2 \
--enable-calendar \
--with-curl \
--with-cdb \
--enable-dom \
--enable-exif \
--enable-fileinfo \
--enable-filter \
--with-pcre-dir \
--enable-ftp \
--with-gd \
--with-openssl-dir \
--with-jpeg-dir \
--with-png-dir \
--with-zlib-dir \
--with-freetype-dir \
--enable-gd-native-ttf \
--enable-gd-jis-conv \
--with-gettext \
--with-gmp \
--with-mhash \
--enable-json \
--enable-mbstring \
--enable-mbregex \
--enable-mbregex-backtrack \
--with-libmbfl \
--with-onig \
--enable-pdo \
--with-mysqli=mysqlnd \
--with-pdo-mysql=mysqlnd \
--with-zlib-dir \
--with-pdo-sqlite \
--with-readline \
--enable-session \
--enable-shmop \
--enable-simplexml \
--enable-sockets \
--enable-sysvmsg \
--enable-sysvsem \
--enable-sysvshm \
--enable-wddx \
--with-libxml-dir \
--with-xsl \
--enable-zip \
--enable-mysqlnd-compression-support \
--with-pear \
--enable-opcache
開始編譯安裝
make
make install
配置php環(huán)境變量, vim /etc/profile 在末尾加上
PATH=$PATH:/usr/local/php/bin
export PATH
[圖片上傳失敗...(image-352c51-1558444333806)]
保存后使立即生效
source /etc/profile
查看PHP版本php -v
[圖片上傳失敗...(image-d7d514-1558444333806)]
設(shè)置php開機(jī)自啟,即在rc.local增加啟動代碼就可以了
vim /etc/rc.local增加一行
/usr/local/php/sbin/php-fpm[圖片上傳失敗...(image-e1fc5a-1558444333804)]
設(shè)置執(zhí)行權(quán)限:
chmod 755 /etc/rc.local
附(PHP部分控制命令)
/usr/local/php/sbin/php-fpm #啟動PHP
killallphp-fpm #關(guān)閉PHP
四拉馋、配置nginx支持php-fpm
創(chuàng)建web用戶,組都設(shè)置為www-data
groupadd www-data
useradd -g www-data www-data
復(fù)制一份php-fpm配置文件
cd /usr/local/php/etc
cpphp-fpm.conf.defaultphp-fpm.conf
打開配置文件
vimphp-fpm.conf
發(fā)現(xiàn)最后一行引入php-fpm.d目錄下所有 .conf類型的配置文件
[圖片上傳失敗...(image-25a677-1558444333806)]
打開php-fpm.d目錄,復(fù)制默認(rèn)配置文件并打開修改
cdphp-fpm.d
vim www.conf修改用戶和用戶組為www-data用戶
[圖片上傳失敗...(image-f87314-1558444333806)]
保存退出惨好,啟動php-fpm服務(wù)
/usr/local/php/sbin/php-fpm
php-fpm默認(rèn)使用9000端口椅邓,使用如下命令查看啟動狀態(tài)
netstat -lnt | grep 9000
[圖片上傳失敗...(image-1cdddd-1558444333806)]
nginx相關(guān)配置打開nginx配置文件
vim /usr/local/nginx/conf/nginx.conf
修改用戶組第一行注釋去掉 nobody改為www-data
[圖片上傳失敗...(image-a1b910-1558444333806)]
添加index.php,使nginx默認(rèn)使用index.php為入口頁
[圖片上傳失敗...(image-cedff7-1558444333806)]
配置php-fpm模塊昧狮,去掉注釋并修改第69行的/scripts 為 $document_root
[圖片上傳失敗...(image-57d07b-1558444333806)]
以上都修改后保存退出,先檢測相關(guān)配置是否正確
/usr/local/nginx/sbin/nginx–t
[圖片上傳失敗...(image-111c3-1558444333806)]
顯示正確板壮,重啟nginx
/usr/local/nginx/sbin/nginx -s reload
切到nginx下的html目錄(默認(rèn)代碼目錄)新建index.php
[圖片上傳失敗...(image-c58d99-1558444333806)]
<?php
phpinfo();
?>
測試訪問對應(yīng)地址是否可以運(yùn)行
http://58.53.128.101/index.php
[圖片上傳失敗...(image-348dfd-1558444333806)]
看到這界面說明php成功運(yùn)行逗鸣。
五、安裝redis-5.0.0
下載redis-5.0.0安裝包
wget http://download.redis.io/releases/redis-5.0.0.tar.gz
解壓
tar -zxvf redis-5.0.0.tar.gz
cd redis-5.0.0
編譯安裝
yum install gcc
make MALLOC=libc
切換至redis的src目錄,將目錄下的文件復(fù)制到/usr/local/redis/bin/目錄
mkdir -p /usr/local/redis/bin/
cd src
cp redis-sentinel redis-server redis-benchmark redis-check-aof redis-check-rdb redis-cli /usr/local/redis/bin/
make install
創(chuàng)建配置目錄
mkdir -p /usr/local/redis/etc/
cp /root/redis-5.0.0/redis.conf /usr/local/redis/etc/redis.conf
修改配置文件vim /usr/local/redis/etc/redis.conf
daemonize yes
pidfile /var/run/redis_6379.pid
port 6379
loglevel notice
dir/usr/local/redis/
將redis的啟動腳本復(fù)制一份放到/etc/init.d目錄下
cp /root/redis-5.0.0/utils/redis_init_script /etc/init.d/redisd
修改啟動腳本
vim /etc/init.d/redisd
[圖片上傳失敗...(image-35ddf6-1558444333805)]
CONF="/usr/local/redis/etc/redis.conf"
設(shè)置開機(jī)啟動
chkconfig redisd on
啟動redisd
service redisd start
[圖片上傳失敗...(image-8519b3-1558444333805)]
關(guān)閉redisd
[圖片上傳失敗...(image-debd0a-1558444333805)]
查看redis目錄結(jié)構(gòu)
[圖片上傳失敗...(image-2c8875-1558444333805)]
六、php7安裝redis擴(kuò)展
配置phpize
wget http://ftp.gnu.org/gnu/m4/m4-1.4.9.tar.gz
tar -zvxf m4-1.4.9.tar.gz
cd m4-1.4.9/
編譯安裝
./configure && make && make install
配置autoconf
wget http://ftp.gnu.org/gnu/autoconf/autoconf-2.62.tar.gz
tar -zvxf autoconf-2.62.tar.gz
cd autoconf-2.62/
編譯安裝
./configure && make && make install
yum install m4 –y
yum install autoconf –y
下載包
wget https://codeload.github.com/phpredis/phpredis/zip/develop
mv develop phpredis-develop.zip
unzip phpredis-develop.zip
cd phpredis-develop
生成configure配置文件:
/usr/local/php/bin/phpize
編譯安裝:
./configure --with-php-config=/usr/local/php/bin/php-config
make&& make install
配置/usr/local/php/etc/php.ini 添加
extension=redis.so
重啟php
Killall php-fpm
/usr/local/php/sbin/php-fpm
訪問http://58.53.128.101/index.php撒璧,查找Redis
[圖片上傳失敗...(image-f1c4bc-1558444333805)]
七透葛、php7安裝inotify擴(kuò)展
pecl install inotify
配置/etc/php.ini 添加
extension=inotify.so
重啟php
Killall php-fpm
/usr/local/php/sbin/php-fpm
訪問http://58.53.128.101/index.php,查找inotify
[圖片上傳失敗...(image-e24eed-1558444333805)]
八卿樱、php7安裝igbinary擴(kuò)展
pecl install igbinary
配置/etc/php.ini 添加
extension=igbinary.so
重啟php
killallphp-fpm
/usr/local/php/sbin/php-fpm
訪問http://58.53.128.101/index.php僚害,查找igbinary
[圖片上傳失敗...(image-dff7a1-1558444333805)]
九、php7安裝swoole擴(kuò)展
下載安裝包
wget https://codeload.github.com/swoole/swoole-src/tar.gz/v4.0.2
tar -zxvf v4.0.2
cd swoole-src-4.0.2/
生成configure配置文件:
/usr/local/php/bin/phpize
編譯安裝
./configure --with-php-config=/usr/local/php/bin/php-config
make clean && make &&make install
配置/usr/local/php/etc/php.ini添加
extension= swoole.so
重啟php
killallphp-fpm
/usr/local/php/sbin/php-fpm
訪問http://58.53.128.101/index.php繁调,查找swoole.so
[圖片上傳失敗...(image-bd69f7-1558444333805)]
php7安裝fileinfo擴(kuò)展
cd /root/lnmp1.5/src/
tar -xjvf php-7.1.18.tar.bz2
cd php-7.1.18/ext/fileinfo/
/usr/local/php/bin/phpize
./configure -with-php-config=/usr/local/php/bin/php-config
make&& make install
vi /usr/local/php/etc/php.ini添加
extension= fileinfo.so
重啟php
killallphp-fpm
/usr/local/php/sbin/php-fpm
訪問http://58.53.128.101/index.php萨蚕,查找fileinfo.so
[圖片上傳失敗...(image-cafca8-1558444333805)]
十粹胯、在Nginx上配置多個站點(diǎn)
在Nginx配置目錄下筝蚕,創(chuàng)建一個”vhost”目錄
mkdir /usr/local/nginx/conf/vhost
創(chuàng)建site b的配置文件
vim /usr/local/nginx/conf/vhost/rk.cakai.cn.conf
server {
listen 80;
server_name gm.cakai.cn;
root /app/gm.cakai.cn/;
index index.html index.htm index.php;
location / {
if (!-e $request_filename) {
rewrite (.*) /index.php;
}
}
location ~ .php$ {
root /app/gm.cakai.cn;
fastcgi_pass 127.0.0.1:9000;
fastcgi_indexindex.php;
fastcgi_param SCRIPT_FILENAME fastcgi_script_name;
includefastcgi_params;
}
}
創(chuàng)建site b的配置文件
vim /usr/local/nginx/conf/vhost/b.conf
server {
listen 80;
server_name gm.cakai.cn;
root /app/gm.cakai.cn/;
index index.html index.htm index.php;
location / {
if (!-e $request_filename) {
rewrite (.*) /index.php;
}
}
location ~ .php$ {
root /app/gm.cakai.cn;
fastcgi_pass 127.0.0.1:9000;
fastcgi_indexindex.php;
fastcgi_param SCRIPT_FILENAME fastcgi_script_name;
includefastcgi_params;
}
}打開nginx.conf文件
vim /usr/local/nginx/conf/nginx.conf
將虛擬目錄的配置文件加入到”http {}”部分的末尾 ,注釋server {}****內(nèi)容
include /usr/local/nginx/conf/vhost/*.conf;
[圖片上傳失敗...(image-e931e-1558444333804)]
重啟Nginx服務(wù)
/usr/local/nginx/sbin/nginx -s reload
十币励、在Nginx配置SSL 證書使用https訪問
防火墻增加443端口
firewall-cmd --zone=public --add-port=443/tcp --permanent
防火墻配置生效
firewall-cmd --reload
上傳證書文件并修改站點(diǎn)配置文件
vim /usr/local/nginx/conf/vhost/gm.cakai.cn.conf
server {
listen 443;
server_name gm.cakai.cn;
root /app/gm.cakai.cn/;
index index.html index.htm index.php;
ssl on;
ssl_certificate /usr/local/nginx/conf/ssl/gm.cakai.cn.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/gm.cakai.cn.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
location / {
if (!-e $request_filename) {
rewrite (.*) /index.php;
}
}
location ~ .php$ {
root /app/gm.cakai.cn/;
fastcgi_pass 127.0.0.1:9000;
fastcgi_indexindex.php;
fastcgi_param SCRIPT_FILENAME fastcgi_script_name;
includefastcgi_params;
}
}
[圖片上傳失敗...(image-4c195f-1558444333804)]
重啟ngnix就可以通過游覽器使用https訪問了
/usr/local/nginx/sbin/nginx -s reload
十一拇舀、 部署denyhosts防止ssh暴力破解
DenyHosts是Python語言寫的一個程序懂酱,它會分析sshd的日志文件(/var/log/secure)念赶,當(dāng)發(fā)現(xiàn)重復(fù)的攻擊時就會記錄IP到/etc/hosts.deny文件恢暖,從而達(dá)到自動屏IP的功能蒸走。
下載安裝包
wgethttp://"downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz"
tar -xzf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
開始安裝
python setup.py install
DenyHosts默認(rèn)安裝到/usr/share/denyhosts目錄
配置
cd /usr/share/denyhosts/
cpdenyhosts.cfg-distdenyhosts.cfg
vimdenyhosts.cfg
PURGE_DENY = 1h #過多久后清除已阻止IP
HOSTS_DENY = /etc/hosts.deny #將阻止IP寫入到hosts.deny
BLOCK_SERVICE = sshd #阻止服務(wù)名
DENY_THRESHOLD_INVALID = 1 #允許無效用戶登錄失敗的次數(shù)
DENY_THRESHOLD_VALID = 10 #允許普通用戶登錄失敗的次數(shù)
DENY_THRESHOLD_ROOT = 5 #允許root登錄失敗的次數(shù)
WORK_DIR = /usr/share/denyhosts/data #將deny的host或ip紀(jì)錄到Work_dir中
DENY_THRESHOLD_RESTRICTED = 1 #設(shè)定 deny host 寫入到該資料夾
LOCK_FILE = /var/lock/subsys/denyhosts #將DenyHOts啟動的pid紀(jì)錄到LOCK_FILE中宾袜,已確保服務(wù)正確啟動捻艳,防止同時啟動多個服務(wù)。
HOSTNAME_LOOKUP=NO #是否做域名反解
ADMIN_EMAIL = #設(shè)置管理員郵件地址
DAEMON_LOG = /var/log/denyhosts #自己的日志文件
DAEMON_PURGE = 1h #該項(xiàng)與PURGE_DENY 設(shè)置成一樣庆猫,也是清除hosts.deniedssh用戶的時間
設(shè)置啟動腳本使DenyHosts每次系統(tǒng)重起后自動啟動:
cp daemon-control-dist daemon-control
ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts
添加服務(wù)并設(shè)置開機(jī)啟動
chkconfig --add denyhosts
chkconfigdenyhosts on
啟動denyhosts服務(wù)并查看狀態(tài)
servicedenyhosts start
servicedenyhosts status
查看屏蔽IP
cat /etc/hosts.deny
[圖片上傳失敗...(image-a328c6-1558444333804)]
??u?[??????