- 实验需求:
1、CentOS 7, npm rpm包, php-fpm;
a) 一个虚拟主机提供wordpress,另一个虚拟主机提供phpmysamin;
b) 为phpMyAdmim提供https服务; - 实验环境:
Linux服务器操作系统版本:CentOS Linux release 7.2.1511 (Core) IP:172.16.252.113
WIN7系统客户机:IP:172.16.250.100 - 实验前提:
1)关闭防火墙和SELinux
~]# service iptables stop
~]# setenforce 0 - 实验过程:
一、安装amp环境
1.yum包安装nmp
# yum install nginx php-fpm php-mysql mariadb-server -y
1)检查是否成功安装包
# rpm -qa nginx php-fpm php-mysql mariadb-server
2)启动服务
# nginx
# systemctl start mariadb
3)查看服务是否正常启动
# ss -nlt
# ps aux | grep nginx
# ps aux | grep myslq
# ps aux | grep php-fpm
4)设置开机自动启动
# systemctl enable httpd
# systemctl enable mariadb
5)检查是否设置成开机自启动
# systemctl is-enabled httpd
# systemctl is-enabled mariadb
2. 配置虚拟主机
1)创建虚拟主机目录和配置文件/conf.d/vhosts.conf
# mkdir -pv /etc/nginx/conf.d/vhosts.conf
2)在nginx.conf中的http段添加如下内容
include conf.d/*.conf; //包含自定义虚拟主机路径
fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:1 keys_zone=fcgicache:10m max_size=1g;
//定义缓存路径,级别,缓存空间名称,磁盘缓存最大缓存数
3)创建缓存目录
# mkdir -pv /var/cache/nginx/fastcgi
4)配置虚拟主机/conf.d/vhosts.conf
server {
listen 80;
server_name www.yang.com;
gzip on;
gzip_disable chrome;
gzip_types text/plain text/css text/xml application/xml application/json application/x-javascript;
location / {
root /web/host1/wordpress;
index index.php index.html index.htm;
}
location ~ \.php$ {
root /web/host1/wordpress;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /web/host1/wordpress/$fastcgi_script_name;
fastcgi_cache fcgicache;
fastcgi_cache_key $request_uri;
fastcgi_cache_valid 200 10m;
fastcgi_cache_valid 301 302 2m;
fastcgi_cache_valid 404m;
include fastcgi.conf;
}
}
server {
listen 80;
server_name web.yang.com;
root /web/host2/phpmyadmin;
location / {
index index.php index.html index.html;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /web/host2/phpmyadmin/$fastcgi_script_name;
fastcgi_cache fcgicache;
fastcgi_cache_key $request_uri;
fastcgi_cache_valid 200 10m;
fastcgi_cache_valid 301 302 2m;
fastcgi_cache_valid 404 2m;
include fastcgi.conf;
}
}
server {
ssl on;
listen 443 ssl;
server_name web.yang.com;
root /web/host2/phpmyadmin;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
ssl_session_cache shared:SSL:5m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
index index.php index.html index.htm;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /web/host2/phpmyadmin/$fastcgi_script_name;
fastcgi_cache fcgicache;
fastcgi_cache_key $request_uri;
fastcgi_cache_valid 200 10m;
fastcgi_cache_valid 301 302 2m;
fastcgi_cache_valid 404 3m;
include fastcgi.conf;
}
}
二、部署wordpress环境:
1)创建站点目录
# mkdir /web/host1/ -pv
2)解压wordpress包
# unzip wordpress-4.3.1-zh_CN.zip
3)拷贝到站点目录www1中
# cp -R wordpress /web/host1/
4)修改网站属主和属组
# chown -R nginx.nginx /web/host1/wordpress
5)修改php-fpm.conf下的www.conf
user = nginx
group = nginx
6)登录数据库
# mysql -uroot -p
7)为bolg创建数据库名为:wordpress
MariaDB [(none)]> CREATE DATABASE wordpress;
8)查数据库是否创建成功
MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| wordpress |
+--------------------+
4 rows in set (0.00 sec)
9)授权用户
MariaDB [(none)]> GRANT ALL ON wordpress.* TO [email protected]‘localhost‘ IDENTIFIED BY ‘liyang‘;
Query OK, 0 rows affected (0.03 sec)
MariaDB [(none)]> GRANT ALL ON wordpress.* TO [email protected]‘172.16.%.%‘ IDENTIFIED BY ‘liyang‘;
Query OK, 0 rows affected (0.00 sec)
10)改名wordpress配置文件为wp-config.php
# cp wp-config-sample.php wp-config.php
11)修改wp-config.php文件连接数据库
# sed -n ‘22,38p‘ /web/host1/wordpress/wp-config.php
/** WordPress数据库的名称 */
define(‘DB_NAME‘, ‘wordpress‘);
/** MySQL数据库用户名 */
define(‘DB_USER‘, ‘liyang‘);
/** MySQL数据库密码 */
define(‘DB_PASSWORD‘, ‘liyang‘);
/** MySQL主机 */
define(‘DB_HOST‘, ‘localhost‘);
/** 创建数据表时默认的文字编码 */
define(‘DB_CHARSET‘, ‘utf8‘);
/** 数据库整理类型。如不确定请勿更改 */
define(‘DB_COLLATE‘, ‘‘);
三、测试
1)在服务器端添加域名解析
# echo "172.16.66.60 www.yang.com" >> /etc/hosts
2)在PC中的hosts文件中添加
172.16.66.60 www.yang.com
3)httpd-->php是否可以访问
# cat admin.php
<?php
phpinfo();
?>
4)httpd-->php--mariadb是否可以访问
5)在浏览器中,根据提示安装http://www.yang.com/index.php
6)查看数据库是否生成数据
~]# mysql -uliyang -p
MariaDB [(none)]> show databases;
MariaDB [(none)]> use wordpress;
MariaDB [wordpress]> show tables;
+-----------------------+
| Tables_in_wordpress |
+-----------------------+
| wp_commentmeta |
| wp_comments |
| wp_links |
| wp_options |
| wp_postmeta |
| wp_posts |
| wp_term_relationships |
| wp_term_taxonomy |
| wp_terms |
| wp_usermeta |
| wp_users |
+-----------------------+
11 rows in set (0.00 sec)
四、部署phpMyAdmin环境:
1)创建站点目录
# mkdir /web/host2
2)解压phpMyAdmin包
# unzip phpMyAdmin-4.4.14.1-all-languages.zip
3)拷贝到站点目录www2中
# cp -r phpMyAdmin-4.4.14.1-all-languages /web/host2/
4)创建软连接phpMyAdmin
# ln -sv phpMyAdmin-4.4.14.1-all-languages/ phpmyadmin
5)修改网站属主和属组
# chown -R nginx.nginx /web/host2/phpmyadmin
6)修改配置文件
# cp config.sample.inc.php config.inc.php
7)生成随机数
~]# openssl rand -hex 8
640b56f72820ace8
8)修改配置文件config.inc.php
# vim config.inc.php
$cfg[‘blowfish_secret‘] = ‘640b56f72820ace8‘
7)在浏览器中测试,根据提示输入数据库名和密码(主机账号和密码是授权wordpress中用户)
在PC机浏览器中测试:http://web.yang.com/index.php 通过80端口访问
8)phpmyadmin错误:The mbstring extension is missing. Please check your PHP configuration.
解决方法:
# yum install php-mbstring -y
9)phpmyadmin错误:Error during session start; please check your PHP and/or webserver log file and configure your PHP i
解决方法:
# mkdir -pv /var/lib/php/session
# chown -R nginx.nginx /var/lib/php/session/
3.为phpMyAdmim提供https服务
工作目录:/etc/pki/CA/
一、建立私有CA
1)生成私钥
[[email protected] CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
..............................................................................+++
............+++
e is 65537 (0x10001)
2)生成自签证书
[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:liyang
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server‘s hostname) []:web.yang.com
Email Address []:[email protected]
3)提供辅助文件
[[email protected] CA]# touch index.txt
[[email protected] CA]# echo 01 > serial
[[email protected] CA]# tree
.
├── cacert.pem
├── certs
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
├── private
│ └── cakey.pem
├── serial
└── serial.old
二、节点申请证书
1)生成私钥
# mkdir -pv /etc/httpd/ssl
ssl]# (umask 077; openssl genrsa -out nginx.key 1024)
2)生成证书签署请求:
[[email protected] ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:liyang
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server‘s hostname) []:web.yang.com
Email Address []:[email protected]
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
ssl]# cp nginx.csr /tmp/
三、CA签发证书
1)签署证书
[[email protected] ~]# openssl ca -in /tmp/nginx.csr -out /etc/pki/CA/certs/nginx.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 29 11:11:37 2016 GMT
Not After : Jul 29 11:11:37 2017 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = liyang
organizationalUnitName = Ops
commonName = web.yang.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
F5:73:F0:F1:7F:B6:B6:5D:41:F1:ED:7A:69:FE:6F:8E:A6:59:41:42
X509v3 Authority Key Identifier:
keyid:91:41:DA:D3:44:05:36:98:14:A7:81:D6:64:AC:D5:8E:EB:6E:D3:97
Certificate is to be certified until Jul 29 11:11:37 2017 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
2)把签署好的证书发还给请求者。
# cp /etc/pki/CA/certs/nginx.crt /etc/nginx/ssl/
注意:本次私建CA和节点申请证书在同一台机器完成。
四、测试结果:
1)在PC机浏览器中测试:https://web.yang.com/index.php 通过443端口访问
4.压力测试:
一、正常测试
1)测试wordpress并发
# # ab -c 100 -n 200 http://www.yang.com/index.php
Requests per second: 389.38 [#/sec] (mean)
Requests per second: 6949.27 [#/sec] (mean)
2)测试phpmyadmin http 并发
# ab -c 100 -n 200 http://web.yang.com/index.php
Requests per second: 5641.91 [#/sec] (mean)
Requests per second: 54.74 [#/sec] (mean)
3)测试phpmyadmin https 并发
# ab -c 100 -n 100 https://web.yang.com/index.php
Requests per second: 44.32 [#/sec] (mean)
Requests per second: 45.28 [#/sec] (mean)
二、为php安装xcache加速器测试数据:
1)yum 安装php-xcache
~]# yum install php-xcache
2)测试并发
# ab -c 100 -n 200 http://web.yang.com/index.php
Requests per second: 44.77 [#/sec] (mean)
# ab -c 100 -n 200 https://web.yang.com/index.php
Requests per second: 44.12 [#/sec] (mean)
# ab -c 100 -n 200 http://www.yang.com/index.php
Requests per second: 109.11 [#/sec] (mean)