Httpd

secoug · 发表于 2019-10-20 09:25:34

本帖最后由 secoug 于 2019-10-20 11:35 编辑

在instructor名字服务器上，再加一个别名：
/var/named/chroot/var/named/example.com.zone

复制代码

把/usr/share/doc/httpd-2.4.6/httpd-vhosts.conf拷到/etc/httpd/conf.d/，名字叫做vhosts.conf

复制代码

[root@server3 ~]# semanage port -l | grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 82, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
[root@server3 ~]# semanage port -l -C
SELinux Port Type Proto Port Number
http_port_t tcp 82
[root@server3 ~]# systemctl restart httpd
Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
[root@server3 ~]# semanage port -a -t http_port_t -p tcp 8909
[root@server3 ~]# semanage port -l -C
SELinux Port Type Proto Port Number
http_port_t tcp 82, 8909

复制代码

复制代码

如果要区分日志：

复制代码

如果所有的虚拟主机都一样要求对某一个地址或者某一个网段不能访问：

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.0.42/32 service name='http' reject'

复制代码

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.0.42/32 port port=8909 protocol=tcp reject'

复制代码

复制代码

如果只要某个虚拟主机不能访问：

复制代码

上面的Require not host 这一定要写主机名：

复制代码

把/etc/httpd/conf.d/welcome.conf改个名字：

或者写成网段：

复制代码

对服务器本机能够访问，而对外其他主机都不能访问的写法：

复制代码

------
没有CA，自签证书，但是不是用现成的那一对（SomeOrganization），而是自己生成新的自签证书：

复制代码

在instructor的/root/bin/gls-setup-gen-sslcerts
:

#
# certs archived in /etc/pki/tls/certs/serverX.crt
# certs published at /var/ftp/pub/materials/tls/certs/serverX.crt
#
# keys archive in /etc/pki/tls/private/serverX.key
# keys published at /var/ftp/pub/materials/tls/private/serverX.key
#
#######################################################################
SUBJ_PREFIX="/C=US/ST=North Carolina/L=Raleigh/O=Example, Inc."
DOMAIN="example.com"
PUBTLS=/var/ftp/pub/materials/tls
if [ -d $PUBTLS ]; then
echo WARNING: the directory $PUBTLS already exists, which is
echo probably not a good thing. To completely regenerate
echo student certs and keys, first remove the directory
echo $PUBTLS, then run this script.
echo
echo Bravely venturing on...
fi
mkdir -p $PUBTLS/{certs,private}
umask 077
<div>pushd /etc/pki/tls/certs</div><div>
</div><div>for i in $(seq 20); do</div><div> SERVER=server$i
SUBJECT="$SUBJ_PREFIX/CN=$SERVER.$DOMAIN"
KEY=../private/$SERVER.key</div><div> if [ -e $KEY ]; then
echo "key for $SERVER already exists. skipping."
continue
fi</div><div> openssl req -new -nodes -out $SERVER.csr -keyout $KEY -subj "$SUBJECT"</div><div> openssl ca -batch -in $SERVER.csr -out $SERVER.crt</div><div> ( cat $KEY; echo; cat $SERVER.crt ) > $SERVER.pem</div><div> install -m 644 $SERVER.crt $SERVER.pem $PUBTLS/certs
install -m 644 $KEY $PUBTLS/private</div><div> rm -f $SERVER.csr</div><div>done</div><div>popd
</div><div>
</div>

复制代码