说到Centos我们大家都知道，已经更新到了Centos7.1版本了，Centos7比之前的Centos6.x版本内容更新比较大，最显著的是命令有明显差异。当然除了OS升级以外，services也有变化的，比如防火墙，从iptables到firewalld的转变，对于Centos版本的不同功能不是今天介绍的主题，我们介绍的主要内容为Apache2.4下部署Domino服务的HTTP代理服务。之前我们使用的是Centos6.4下安装Apache2.2实现了Domino的HTTP代理服务，近期公司的部分服务要升级，所以将Centos6.4升级到了Centos7.0，然后将Apache2.2升级到了Apache2.4，升级的过程很简单，OS就不多说了，直接重装了，然后Apache的服务是我们安装最新的(yum install httpd)，然后将Apache2.2的httpd.conf直接拷贝覆盖到了Apache2.4下的httpd.conf文件，覆盖后，我们发现Httpd服务无法正常启动。提示缺少一些模块，在安装模块中发现，很多模块都找不到，经过查看官网介绍很多模块已更改名称了。所以在此放弃更改apache的相关模块设置后，继续查找Apache实现HTTP代理的文档介绍，很好的解决了Apache2.4最新版本对HTTP的代理服务，具体见下：
环境介绍：
Hostname: domino.abc.com
ip:192.168.6.102
roles:Domino9.0
Hostname: proxy.abc.com
ip:192.168.6.101
roles:Centos7+Apache2.4
我们首先是准备一台Domino9.0的server，然后配置好web服务，然后创建一个测试账户
创建web服务数据库
配置proxy代理服务
然后，修改服务器配置
然后创建web-sso配置
填写配置信息
创建Domino SSO key及保存退出
最后修改Domino的web配置信息，
修改后我们注册一个测试用户user01
配置完成后，建议给domion的http服务创建证书，我在工作台上右击---打开应程序
certsrv.nsf 数据库
打开后我们按照图示中的4个步骤进行证书申请（申请证书的步骤忽略，如果有什么不懂，请参考本地博客中的其他文章有详细介绍http://gaowenlong.blog.51cto.com/451336/1657408）
申请完证书后，我们需要修改服务器配置，指定证书的路径
指定路劲后，我们换需要配置WEB服务的ssl相关配置
然后我们测试使用ssl进行访问Domino服务的web服务
最后建议重启domino服务，为了能让配置即可生效
restart server
Domino环境准备好后，我们接下来就是准备代理服务器了，我们需要安装一台Centos7，根据架构进行命名服务
hostnamectl set-hostname proxy systemctl stop firewalld systemctl disable firewalld
关闭selinux vim /etc/selinx/config
注修改完selinxu及计算机名后我们需要重启系统才能生效
接下来就是安装apache2.4了。我们使用yum
install httpd默认就是apache2.4版本
安装完成后，可以通过rpm查看httpd的版本,我们查看到已安装的是httpd-2.4.6-31
rpm -qa | grep httpd
我们首先是备份httpd.conf的文件，因为我们需要修改httpd.conf的文件，所以建议操作前备份一下
cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf
启动httpd服务
systemctl start httpd
启动服务后，我们尝试访问页面
接下来我们就为apache申请证书，申请证书前，我们需要安装SSL模块
yum install mod_ssl
用私钥serverkey文件生成证书请求文件csr openssl req -new -key server.key -out server.csr server.csr 是证书请求文件
接下来我们需要使用server.csr文件进行CA的证书申请，再此我们使用windows的CA进行证书申请
接下来我们需要使用server.csr文件进行CA的证书申请，再此我们使用windows的CA进行证书申请
打开CA服务器
然后提交申请，下载证书
下载证书后，我们将证书文件暂时拷贝到/etc/pki/tls下
我们在cd /etc/httpd/conf目录下创建ssl文件夹
mkdir ssl
我们再次进入etc/pki/tls
cp certnew.cer server.key server.csr cert.pem /etc/httpd/conf/ssl/
证书文件及目录配置好后。我们需要修改httpd.conf的配置文件指定证书路径
ProxyRequests
off listen 443 https #NameVirtualHost *:443 <VirtualHost *:443> # Site info ServerName proxy.abc.com ServerAdmin [email protected] SSLEngine on SSLProxyEngine on SSLCertificateFile /etc/httpd/conf/ssl/webserver.pem SSLCertificateKeyFile /etc/httpd/conf/ssl/web.key SSLCACertificatePath /etc/httpd/conf/ssl SSLCACertificateFile /etc/httpd/conf/ssl/ca.pem </VirtualHost>
指定好后，我们重启httpd,提示错误
systemctl restart httpd
我们进入conf.d目录下
我们想到确实配置有问题，我们既然配置了ssl的目录，所以我们需要吧/etc/httpd/conf.d/ssl.conf删除
rm /etc/httpd/conf.d/ssl.conf
删除后。我们重启服务后再次访问
systemctl restart httpd
接下来我们通过https进行访问，访问成功
可以访问后，我们接下来需要将Apache代理HTTP的代码全部粘贴到httpd.conf中
以下内容为默认的httpd.conf文件中添加的所有文件内容
我们需要将以下内容添加到httpd.conf的最后
Redirect
/ https://proxy.abc.com
SSLSessionCache
"shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
ProxyRequests
off
listen
443 https
#NameVirtualHost
*:443
<VirtualHost
*:443>
# Site
info
ServerName
proxy.abc.com
ServerAdmin
[email protected]
SSLEngine
on
SSLProxyEngine
on
SSLCertificateFile
/etc/httpd/conf/ssl/webserver.pem
SSLCertificateKeyFile
/etc/httpd/conf/ssl/web.key
SSLCACertificatePath
/etc/httpd/conf/ssl
SSLCACertificateFile
/etc/httpd/conf/ssl/ca.pem
#
Rewrite engine on
RewriteEngine
On
RewriteOptions
Inherit
# Log
filenames
ErrorLog
/etc/httpd/logs/error-inotes-redirect
CustomLog
/etc/httpd/logs/access-inotes-redirect common
LogLevel
info
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Rule
0 : If Cookie is set and user logs out, remove the cookie
RewriteCond
%{HTTP_COOKIE} ^.*iNotesServer=.*
RewriteCond
%{QUERY_STRING} ^Logout
RewriteRule
^/.* - [CO=iNotesServer:domino:.abc.com:1]
# Rule
1 : Read domino server name from first access to the mail directory,
# save
it to the cookie and redirect to the mail server
RewriteCond
%{REQUEST_URI} ^/(.*)/mail
RewriteRule
/(.*)/mail/(.*) https://$1.abc.com/mail/$2[P,CO=iNotesServer:$1:.abc.com]
# Rule
2 : If cookie is set, use it to rewrite rules for iNotes generated URLs
# and
non mail DBs for the server definde in the cookie iNotesServer
RewriteCond
%{REQUEST_URI} ^/favicon.ico [OR]
RewriteCond
%{REQUEST_URI} ^/domjs [OR]
RewriteCond
%{REQUEST_URI} ^/domjava [OR]
RewriteCond
%{REQUEST_URI} ^/domcfg.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/iNotes [OR]
RewriteCond
%{REQUEST_URI} ^/icons [OR]
RewriteCond
%{REQUEST_URI} ^/iwaredir.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/names.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/mail [OR]
RewriteCond
%{REQUEST_URI} ^/archive [OR]
RewriteCond
%{REQUEST_URI} ^/download [OR]
RewriteCond
%{REQUEST_URI} ^/dwa(.*)
RewriteCond
%{HTTP_COOKIE} ^.*iNotesServer=([^;]+)
RewriteRule
/(.*) https://%1.abc.com/$1 [P,L]
# Rule
3 : if no cookie set -> on first
access on the iNotes iwaredir.nsf
RewriteCond
%{REQUEST_URI} ^/favicon.ico [OR]
RewriteCond
%{REQUEST_URI} ^/domcfg.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/iwaredir.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/names.nsf
RewriteRule
/(.*) https://domino.abc.com/$1 [P,L]
# Rule
4 : everything else should be redirected to the original link
RewriteCond
%{REQUEST_URI} ^/
RewriteRule
/ https://domino.abc.com/ [P]
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
ProxyPassReverse
/domino/mail/ https://domino.abc.com/mail/
ProxyPassReverse
/ https://domino.abc.com/
</VirtualHost>
添加以上代码后，我们需要在linux 中的hosts文件中添加domino的解析地址
添加完成后，我们就可以访问apache的代理服务器地址了，然后通过user01进行访问测试了
提示正在跳转中
跳转及登陆成功
整个httpd.conf配置文件内容
#
# This
is the main Apache HTTP server configuration file. It contains the
#
configuration directives that give the server its instructions.
# See
<URL:http://httpd.apache.org/docs/2.4/> for detailed information.
# In
particular, see
#
<URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
# for
a discussion of each configuration directive.
#
# Do
NOT simply read the instructions in here without understanding
# what
they do. They‘re here only as hints or
reminders. If you are unsure
#
consult the online docs. You have been warned.
#
#
Configuration and logfile names: If the filenames you specify for many
# of
the server‘s control files begin with "/" (or "drive:/" for
Win32), the
#
server will use that explicit path. If
the filenames do *not* begin
# with
"/", the value of ServerRoot is prepended -- so ‘log/access_log‘
# with
ServerRoot set to ‘/www‘ will be interpreted by the
#
server as ‘/www/log/access_log‘, where as ‘/log/access_log‘ will be
#
interpreted as ‘/log/access_log‘.
#
#
ServerRoot: The top of the directory tree under which the server‘s
#
configuration, error, and log files are kept.
#
# Do
not add a slash at the end of the directory path. If you point
#
ServerRoot at a non-local disk, be sure to specify a local disk on the
#
Mutex directive, if file-based mutexes are used. If you wish to share the
# same
ServerRoot for multiple httpd daemons, you will need to change at
#
least PidFile.
#
ServerRoot
"/etc/httpd"
#
#
Listen: Allows you to bind Apache to specific IP addresses and/or
#
ports, instead of the default. See also the <VirtualHost>
#
directive.
#
#
Change this to Listen on specific IP addresses as shown below to
#
prevent Apache from glomming onto all bound IP addresses.
#
#Listen
12.34.56.78:80
Listen
80
#
#
Dynamic Shared Object (DSO) Support
#
# To
be able to use the functionality of a module which was built as a DSO you
# have
to place corresponding `LoadModule‘ lines at this location so the
#
directives contained in it are actually available _before_ they are used.
#
Statically compiled modules (those listed by `httpd -l‘) do not need
# to
be loaded here.
#
#
Example:
#
LoadModule foo_module modules/mod_foo.so
#
Include
conf.modules.d/*.conf
#
# If
you wish httpd to run as a different user or group, you must run
#
httpd as root initially and it will switch.
#
#
User/Group: The name (or #number) of the user/group to run httpd as.
# It
is usually good practice to create a dedicated user and group for
#
running httpd, as with most system services.
#
User
apache
Group
apache
#
‘Main‘ server configuration
#
# The
directives in this section set up the values used by the ‘main‘
#
server, which responds to any requests that aren‘t handled by a
#
<VirtualHost> definition. These
values also provide defaults for
# any
<VirtualHost> containers you may define later in the file.
#
# All
of these directives may appear inside <VirtualHost> containers,
# in
which case these default settings will be overridden for the
#
virtual host being defined.
#
#
#
ServerAdmin: Your address, where problems with the server should be
#
e-mailed. This address appears on some
server-generated pages, such
# as
error documents. e.g.
[email protected]
#
ServerAdmin
[email protected]
#
#
ServerName gives the name and port that the server uses to identify itself.
# This
can often be determined automatically, but we recommend you specify
# it
explicitly to prevent problems during startup.
#
# If
your host doesn‘t have a registered DNS name, enter its IP address here.
#
#ServerNamewww.example.com:80
#
# Deny
access to the entirety of your server‘s filesystem. You must
#
explicitly permit access to web content directories in other
#
<Directory> blocks below.
#
<Directory
/>
AllowOverride none
Require all denied
</Directory>
#
# Note
that from this point forward you must specifically allow
#
particular features to be enabled - so if something‘s not working as
# you
might expect, make sure that you have specifically enabled it
#
below.
#
#
#
DocumentRoot: The directory out of which you will serve your
#
documents. By default, all requests are taken from this directory, but
#
symbolic links and aliases may be used to point to other locations.
#
DocumentRoot
"/var/www/html"
#
#
Relax access to content within /var/www.
#
<Directory
"/var/www">
AllowOverride None
# Allow open access:
Require all granted
</Directory>
#
Further relax access to the default document root:
<Directory
"/var/www/html">
#
# Possible values for the Options directive
are "None", "All",
# or any combination of:
#
Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be
named *explicitly* --- "Options All"
# doesn‘t give it to you.
#
# The Options directive is both complicated
and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives
may be placed in .htaccess files.
# It can be "All",
"None", or any combination of the keywords:
#
Options FileInfo AuthConfig Limit
#
AllowOverride None
#
# Controls who can get stuff from this
server.
#
Require all granted
</Directory>
#
#
DirectoryIndex: sets the file that Apache will serve if a directory
# is
requested.
#
<IfModule
dir_module>
DirectoryIndex index.html
</IfModule>
#
# The
following lines prevent .htaccess and .htpasswd files from being
#
viewed by Web clients.
#
<Files
".ht*">
Require all denied
</Files>
#
#
ErrorLog: The location of the error log file.
# If
you do not specify an ErrorLog directive within a <VirtualHost>
#
container, error messages relating to that virtual host will be
#
logged here. If you *do* define an error
logfile for a <VirtualHost>
#
container, that host‘s errors will be logged there and not here.
#
ErrorLog
"logs/error_log"
#
#
LogLevel: Control the number of messages logged to the error_log.
#
Possible values include: debug, info, notice, warn, error, crit,
#
alert, emerg.
#
LogLevel
info
<IfModule
log_config_module>
#
# The following directives define some
format nicknames for use with
# a CustomLog directive (see below).
#
LogFormat "%h %l %u %t
\"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t
\"%r\" %>s %b" common
<IfModule logio_module>
# You need to enable mod_logio.c to use
%I and %O
LogFormat "%h %l %u %t
\"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\" %I %O" combinedio
</IfModule>
#
# The location and format of the access
logfile (Common Logfile Format).
# If you do not define any access logfiles
within a <VirtualHost>
# container, they will be logged here. Contrariwise, if you *do*
# define per-<VirtualHost> access
logfiles, transactions will be
# logged therein and *not* in this file.
#
#CustomLog "logs/access_log"
common
#
# If you prefer a logfile with access,
agent, and referer information
# (Combined Logfile Format) you can use the
following directive.
#
CustomLog "logs/access_log"
combined
</IfModule>
<IfModule
alias_module>
#
# Redirect: Allows you to tell clients
about documents that used to
# exist in your server‘s namespace, but do
not anymore. The client
# will make a new request for the document
at its new location.
# Example:
# Redirect permanent /foo http://www.example.com/bar
#
# Alias: Maps web paths into filesystem
paths and is used to
# access content that does not live under
the DocumentRoot.
# Example:
# Alias /webpath /full/filesystem/path
#
# If you include a trailing / on /webpath
then the server will
# require it to be present in the URL. You will also likely
# need to provide a <Directory>
section to allow access to
# the filesystem path.
#
# ScriptAlias: This controls which
directories contain server scripts.
# ScriptAliases are essentially the same as
Aliases, except that
# documents in the target directory are
treated as applications and
# run by the server when requested rather
than as documents sent to the
# client.
The same rules about trailing "/" apply to ScriptAlias
# directives as to Alias.
#
ScriptAlias /cgi-bin/
"/var/www/cgi-bin/"
</IfModule>
#
#
"/var/www/cgi-bin" should be changed to whatever your ScriptAliased
# CGI
directory exists, if you have that configured.
#
<Directory
"/var/www/cgi-bin">
AllowOverride None
Options None
Require all granted
</Directory>
<IfModule
mime_module>
#
# TypesConfig points to the file containing
the list of mappings from
# filename extension to MIME-type.
#
TypesConfig /etc/mime.types
#
# AddType allows you to add to or override
the MIME configuration
# file specified in TypesConfig for
specific file types.
#
#AddType application/x-gzip .tgz
#
# AddEncoding allows you to have certain
browsers uncompress
# information on the fly. Note: Not all
browsers support this.
#
#AddEncoding x-compress .Z
#AddEncoding x-gzip .gz .tgz
#
# If the AddEncoding directives above are
commented-out, then you
# probably should define those extensions
to indicate media types:
#
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
#
# AddHandler allows you to map certain file
extensions to "handlers":
# actions unrelated to filetype. These can
be either built into the server
# or added with the Action directive (see
below)
#
# To use CGI scripts outside of
ScriptAliased directories:
# (You will also need to add
"ExecCGI" to the "Options" directive.)
#
#AddHandler cgi-script .cgi
# For type maps (negotiated resources):
#AddHandler type-map var
#
# Filters allow you to process content
before it is sent to the client.
#
# To parse .shtml files for server-side
includes (SSI):
# (You will also need to add
"Includes" to the "Options" directive.)
#
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
</IfModule>
#
#
Specify a default charset for all content served; this enables
#
interpretation of all content as UTF-8 by default. To use the
#
default browser choice (ISO-8859-1), or to allow the META tags
# in
HTML content to override this choice, comment out this
#
directive:
#
AddDefaultCharset
UTF-8
<IfModule
mime_magic_module>
#
# The mod_mime_magic module allows the
server to use various hints from the
# contents of the file itself to determine
its type. The MIMEMagicFile
# directive tells the module where the hint
definitions are located.
#
MIMEMagicFile conf/magic
</IfModule>
#
#
Customizable error responses come in three flavors:
# 1)
plain text 2) local redirects 3) external redirects
#
# Some
examples:
#ErrorDocument
500 "The server made a boo boo."
#ErrorDocument
404 /missing.html
#ErrorDocument
404 "/cgi-bin/missing_handler.pl"
#ErrorDocument
402 http://www.example.com/subscription_info.html
#
#
#
EnableMMAP and EnableSendfile: On systems that support it,
#
memory-mapping or the sendfile syscall may be used to deliver
#
files. This usually improves server
performance, but must
# be
turned off when serving from networked-mounted
#
filesystems or if support for these functions is otherwise
#
broken on your system.
#
Defaults if commented: EnableMMAP On, EnableSendfile Off
#
#EnableMMAP
off
EnableSendfile
on
#
Supplemental configuration
#
# Load
config files in the "/etc/httpd/conf.d" directory, if any.
IncludeOptional
conf.d/*.conf
Redirect
/ https://proxy.abc.com
SSLSessionCache
"shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
ProxyRequests
off
listen
443 https
#NameVirtualHost
*:443
<VirtualHost
*:443>
# Site
info
ServerName
proxy.abc.com
ServerAdmin
[email protected]
SSLEngine
on
SSLProxyEngine
on
SSLCertificateFile
/etc/httpd/conf/ssl/webserver.pem
SSLCertificateKeyFile
/etc/httpd/conf/ssl/web.key
SSLCACertificatePath
/etc/httpd/conf/ssl
SSLCACertificateFile
/etc/httpd/conf/ssl/ca.pem
#
Rewrite engine on
RewriteEngine
On
RewriteOptions
Inherit
# Log
filenames
ErrorLog
/etc/httpd/logs/error-inotes-redirect
CustomLog
/etc/httpd/logs/access-inotes-redirect common
LogLevel
info
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Rule
0 : If Cookie is set and user logs out, remove the cookie
RewriteCond
%{HTTP_COOKIE} ^.*iNotesServer=.*
RewriteCond
%{QUERY_STRING} ^Logout
RewriteRule
^/.* - [CO=iNotesServer:domino:.abc.com:1]
# Rule
1 : Read domino server name from first access to the mail directory,
# save
it to the cookie and redirect to the mail server
RewriteCond
%{REQUEST_URI} ^/(.*)/mail
RewriteRule
/(.*)/mail/(.*) https://$1.abc.com/mail/$2[P,CO=iNotesServer:$1:.abc.com]
# Rule
2 : If cookie is set, use it to rewrite rules for iNotes generated URLs
# and
non mail DBs for the server definde in the cookie iNotesServer
RewriteCond
%{REQUEST_URI} ^/favicon.ico [OR]
RewriteCond
%{REQUEST_URI} ^/domjs [OR]
RewriteCond
%{REQUEST_URI} ^/domjava [OR]
RewriteCond
%{REQUEST_URI} ^/domcfg.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/iNotes [OR]
RewriteCond
%{REQUEST_URI} ^/icons [OR]
RewriteCond
%{REQUEST_URI} ^/iwaredir.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/names.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/mail [OR]
RewriteCond
%{REQUEST_URI} ^/archive [OR]
RewriteCond
%{REQUEST_URI} ^/download [OR]
RewriteCond
%{REQUEST_URI} ^/dwa(.*)
RewriteCond
%{HTTP_COOKIE} ^.*iNotesServer=([^;]+)
RewriteRule
/(.*) https://%1.abc.com/$1 [P,L]
# Rule
3 : if no cookie set -> on first
access on the iNotes iwaredir.nsf
RewriteCond
%{REQUEST_URI} ^/favicon.ico [OR]
RewriteCond
%{REQUEST_URI} ^/domcfg.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/iwaredir.nsf [OR]
RewriteCond
%{REQUEST_URI} ^/names.nsf
RewriteRule
/(.*) https://domino.abc.com/$1 [P,L]
# Rule
4 : everything else should be redirected to the original link
RewriteCond
%{REQUEST_URI} ^/
RewriteRule
/ https://domino.abc.com/ [P]
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
ProxyPassReverse
/domino/mail/ https://domino.abc.com/mail/
ProxyPassReverse
/ https://domino.abc.com/
</VirtualHost>
整个部署过程介绍完成
注：附件中是httpd.conf的配置文件，如果在apache2.4下的话， 直接将附件中下载覆盖即可。
附件的格式为httpd.7z,请下载后将扩展名从txt修改为.7z解压即可。
时间： 2024-10-29 10:46:23