CentOS 7系统之 lamp ( module )详解

    安装要求：CentOS 7系统之 lamp ( module )

             (1) 三者分离于两台主机；

            (2) 一个虚拟主机用于提供PHPMyAdmin；另一个虚拟主机用于提供Wordpress；

           (3) xcache

           (4) 为phpMyAdmin提供https虚拟主机；

    安装环境：

开始前下载阿里云的base源到本地。

 1、 192.168.1.104主机配置(数据库的创建 ，授权等)

    [root@localhost yum.repos.d]# yum install mariadb mariadb-server -y

    [root@localhost yum.repos.d]# systemctl start mariadb.service

    [root@localhost ~]# Mysql_secure_installation  //设置安全向导，root密码改为mageedu

    /usr/bin/mysql_secure_installation: line 379: find_mysql_client: command not found

    NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB

          SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

    In order to log into MariaDB to secure it, we'll need the current

    password for the root user.  If you've just installed MariaDB, and

    you haven't set the root password yet, the password will be blank,

    so you should just press enter here.

    Enter current password for root (enter for none): 

    OK, successfully used password, moving on...

    Setting the root password ensures that nobody can log into the MariaDB

    root user without the proper authorisation.

    Set root password? [Y/n] y

    New password: 

    Re-enter new password: 

    Password updated successfully!

    Reloading privilege tables..

     ... Success!

    By default, a MariaDB installation has an anonymous user, allowing anyone

    to log into MariaDB without having to have a user account created for

    them.  This is intended only for testing, and to make the installation

    Go a bit smoother.  You should remove them before moving into a

    production environment.

    Remove anonymous users? [Y/n] y

     ... Success!

    NORMally, root should only be allowed to connect from 'localhost'.  This

    ensures that someone cannot guess at the root password from the network.

    Disallow root login remotely? [Y/n] n

     ... skipping.

    By default, MariaDB comes with a database named 'test' that anyone can

    access.  This is also intended only for testing, and should be removed

    before moving into a production environment.

    Remove test database and access to it? [Y/n] n

     ... skipping.

    Reloading the privilege tables will ensure that all changes made so far

    will take effect immediately.

    Reload privilege tables now? [Y/n] y

     ... Success!

    Cleaning up...

    All done!  If you've completed all of the above steps, your MariaDB

    installation should now be secure.

    Thanks for using MariaDB!

    [root@localhost ~]# mysql -uroot -pmageedu   //验证用户登陆

    MariaDB [(none)]> CREATE DATABASE wpdb; //创建wordpress数据库

     MariaDB [(none)]> GRANT ALL ON wpdb.* TO wpuser@'192.168.%.%' IDENTIFIED BY 'wppass';         //授权wordpress用户

    MariaDB [(none)]> FLUSH PRIVILEGES;

    MariaDB [(none)]> SHOW DATABASES;

    +--------------------+

    | Database           |

    +--------------------+

    | information_schema |

    | mysql              |

    | performance_schema |

    | test               |

    | wpdb               |

    +--------------------+

    5 rows in set (0.00 sec)

    MariaDB [(none)]> CREATE DATABASE pma;  //创建phpMyAdmin数据库

    Query OK, 1 row affected (0.00 sec)

    MariaDB [(none)]> GRANT ALL ON pma.* TO pma@'192.168.%.%' IDENTIFIED BY     'pmapass';   

    Query OK, 0 rows affected (0.00 sec)

    MariaDB [(none)]> FLUSH PRIVILEGES;   

    Query OK, 0 rows affected (0.00 sec)

    MariaDB [(none)]> GRANT ALL ON *.* TO testuser@'192.168.%.%' IDENTIFIED BY           'testpass';

    Query OK, 0 rows affected (0.00 sec)  //授权一个测试用户

    MariaDB [(none)]> FLUSH PRIVILEGES;

    Query OK, 0 rows affected (0.00 sec)

2、 192.168.1.103主机配置 （httpd,php）

    [root@localhost ~]# yum install httpd php php-mysql php-mbstring -y    

    [root@localhost ~]# systemctl start httpd.service

    编写测试代码，验证php是否可以连接数据库

    [root@localhost ~]# cd /var/www/html

    [root@localhost html]# vim index.php

    [root@localhost html]# systemctl reload httpd.service

3、xcache的编译安装

  xcache可以选择编译安装，但epel源中也有提供,这里用编译安装的方式。

    [root@localhost ~]# yum groupinstall "Development Tools" "Server Platform Development" -y  //安装开发包组

    [root@localhost ~]# yum install php-devel -y //安装xcache依赖php的包

  下载xcache压缩包

    [root@localhost ~]# ls

    anaconda-ks.cfg  xcache-3.2.0.tar.bz2

    [root@localhost ~]# tar xf xcache-3.2.0.tar.bz2 

    [root@localhost ~]# ls

    anaconda-ks.cfg  xcache-3.2.0  xcache-3.2.0.tar.bz2

    [root@localhost ~]# cd xcache-3.2.0/

    [root@localhost xcache-3.2.0]# phpize

    [root@localhost xcache-3.2.0]# ./configure --enable-xcache --with-php-config=/usr/bin/php-config

    [root@localhost xcache-3.2.0]# make && make install

    [root@localhost xcache-3.2.0]# cp xcache.ini /etc/php.d/ 

    [root@localhost xcache-3.2.0]# systemctl restart httpd.service

  浏览器访问，发现xcache已经安装完，对应版本为3.2.0

4、安装配置wordpress,配置虚拟主机

 配置虚拟主机  

    [root@localhost ~]# vim /etc/httpd/conf/httpd.conf  //注释掉httpd默认访问路径

    #DocumentRoot "/var/www/html"

     [root@localhost ~]# mkdir /WEB/vhost/test1 -pv //创建虚拟主机的访问路径

    [root@localhost ~]# vim /etc/httpd/conf.d/vhost.conf  //创建虚拟主机的配置文件

    <VirtualHost 192.168.1.103:80>

        DocumentRoot "/web/vhost/test1"

        <Directory "/web/vhost/test1">

                Options None

                AllowOverride None

                Require all granted

        </Directory>

    </VirtualHost>

 下载wordpress（下载地址：https://wordpress.org/download/ ）

    [root@localhost ~]# cd /web/vhost/test1

              [root@localhost test1]# unzip wordpress-4.3.1-zh_CN.zip

    [root@localhost test1]# cd wordpress/           

    [root@localhost wordpress]# cp wp-config-sample.php wp-config.php  //复制示例的访问配置php文件，修改即可。      

    [root@localhost wordpress]# vim wp-config.php

    [root@localhost ~]# systemctl restart httpd.service

浏览器访问测试

5、安装phpMyAdmin

 配置虚拟主机  

    [root@localhost vhost]# vim /etc/httpd/conf/httpd.conf

       //添加8080端口

    [root@localhost ~]# mkdir /web/vhost/test2 -pv //创建虚拟主机的访问路径

    [root@localhost ~]# vim /etc/httpd/conf.d/vhost.conf  //编辑wordpress虚拟主机的配置文件即可

    <VirtualHost 192.168.1.103:80>

            DocumentRoot "/web/vhost/test1"

            <Directory "/web/vhost/test1">

                    Options None

                    AllowOverride None

                    Require all granted

            </Directory>

    </VirtualHost>

    <VirtualHost 192.168.1.103:8080>

            DocumentRoot "/web/vhost/test2"

            <Directory "/web/vhost/test2">

                Options FollowSymlinks 

                    AllowOverride None

                    Require all granted

            </Directory>

    </VirtualHost>

 下载方式：https://www.phpmyadmin.net/downloads/

     [root@localhost ~]# cd /web/vhost/test2

    [root@localhost test2]# unzip phpMyAdmin-4.4.14.1-all-languages.zip

    [root@localhost test2]# ln -sv phpMyAdmin-4.4.14.1-all-languages pma

    ‘pma’ -> ‘phpMyAdmin-4.4.14.1-all-languages’

    [root@localhost test2]# cd pma

    [root@localhost pma]# cp config.sample.inc.php config.inc.php

    [root@localhost pma]# openssl rand -base64 15  //生成15个随机数

    fgqvst4l0yODkOhq4FXC

    [root@localhost pma]# vim config.inc.php  //把随机数添加到访问配置文件中

用浏览器访问测试 192.168.1.103：8080/pma

    用户为 :  pma

    密码为 :  pmapass

6、为phpMyAdmin提供https虚拟主机

   把192.168.1.104做CA主机，192.168.1.103服务器进行测试

  1）

   a) 192.168.1.104主机上，创建私有CA

    [root@localhost ~]# cd /etc/pki/CA

    [root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)   //生成一个私钥

    Generating RSA private key, 2048 bit long modulus

    .....................+++

    .............+++

    e is 65537 (0x10001)

    [root@localhost CA]#  ll private/

    total 4

    -rw------- 1 root root 1679 May 27 07:09 cakey.pem

    [root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem  //生成自己的自签证书

    [root@localhost CA]# ll

    total 4

    -rw-r--r--  1 root root 1391 May 27 07:12 cacert.pem

    drwxr-xr-x. 2 root root    6 Jun 29  2015 certs

    drwxr-xr-x. 2 root root    6 Jun 29  2015 crl

    drwxr-xr-x. 2 root root    6 Jun 29  2015 newcerts

    drwx------. 2 root root   22 May 27 07:09 private

    [root@localhost CA]# touch serial index.txt

    [root@localhost CA]# echo 01 >serial

   b）192.168.1.103主机，创建证书签署请求

    [root@localhost ~]# cd /etc/httpd

    [root@localhost httpd]# mkdir ssl

    [root@localhost httpd]# cd ssl

    [root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 1024)

    Generating RSA private key, 1024 bit long modulus

    ..........++++++

    ..................++++++

    e is 65537 (0x10001)

    [root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr

    [root@localhost ssl]# ls

    httpd.csr  httpd.key

    [root@localhost ssl]# scp httpd.csr root@192.168.1.104:/tmp

   c) 192.168.1.104  签署证书

    [root@localhost CA]# openssl ca -in /tmp/httpd.csr -out certs/httpd.crt

    [root@localhost CA]# scp certs/httpd.crt root@192.168.1.103:/etc/httpd/ssl/

  2）、 192.168.1.103主机，配置httpd支持使用ssl,及使用的证书

    [root@localhost ssl]# ls

    httpd.crt  httpd.csr  httpd.key

    [root@localhost ssl]# yum install mod_ssl -y

    [root@localhost ssl]# cd /etc/httpd/conf.d

    [root@localhost conf.d]# ls

    autoindex.conf  php.conf  README  ssl.conf  userdir.conf  vhost.conf     welcome.conf

    [root@localhost conf.d]# mv ssl.conf ssl.conf.backup

    [root@localhost ~]# vim /etc/httpd/conf.d/vhost.conf

    [root@localhost conf.d]# httpd -t    

    Syntax OK

    [root@localhost conf.d]# systemctl restart httpd.service

    此时因为浏览器没有导入CA证书，所以基于https的访问将无法进行，需要浏览器中导入CA证书文件（把虚拟主机中/etc/pki/CA/cacert.pem文件复制到物理主机上进行导入）