![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
|
Fedora13 apache |
$ sudo /sbin/chkconfig --list | grep http httpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off $ sudo /sbin/chkconfig --level 35 httpd on $ sudo /sbin/chkconfig --list | grep httpd httpd 0:off 1:off 2:off 3:on 4:off 5:on 6:off
$ sudo /etc/init.d/httpd start httpd を起動中: [ OK ]
$ sudo vi /var/www/html/index.html <html> <head><title>HELLO APCHE WORLD</title></head> <body> HELLO APACHE WORLD </body> </head>
$ sudo /usr/bin/system-config-firewall
$ sudo yum -y install phpで、php 5.3 と php-cli と php-common がインストールされる。
$ sudo yum -y install php-mbstring
$ ls /etc/httpd/conf.d/ README mod_dnssd.conf php.conf proxy_ajp.conf welcome.conf既に、php.conf が作られていて、libphp5.so が読み込まれるようになっています。(mod_php は、php5 で廃止され、代わりに php5_module (libphp5.so) を使うようになった)
$ sudo /etc/init.d/httpd restart httpd を停止中: [ OK ] httpd を起動中: [ OK ]
$ sudo vi /var/www/html/phpinfo.php <?php phpinfo(); ?>
# cd /etc/httpd/conf.d/ # ls | sort 10_welcome.conf 50_mod_dnssd.conf 50_php5_module.conf 50_proxy_ajp.conf 90_mod_deflate.conf README
<Location /> # Insert filter SetOutputFilter DEFLATE # Netscape 4.x has some problems... BrowserMatch ^Mozilla/4 gzip-only-text/html # Netscape 4.06-4.08 have some more problems BrowserMatch ^Mozilla/4\.0[678] no-gzip # MSIE masquerades as Netscape, but it is fine # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48 # the above regex won't work. You can use the following # workaround to get the desired effect: BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html # Don't compress images SetEnvIfNoCase Request_URI \ \.(?:gif|jpe?g|png)$ no-gzip dont-vary # Make sure proxies don't deliver the wrong content Header append Vary User-Agent env=!dont-vary </Location> DeflateBufferSize 8096 DeflateCompressionLevel 9 DeflateMemLevel 9 DeflateWindowSize 15
$ sudo /etc/init.d/httpd restart httpd を停止中: [ OK ] httpd を起動中: [ OK ]
$ sudo yum -y install mod_ssl $ cd /etc/http/conf.d/ $ sudo mv ssl.conf 50_ssl.conf $ sudo /etc/init.d/httpd restart httpd を停止中: [ OK ] httpd を起動中: [ OK ]
以上
LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>$ su # vi /etc/pki/tls/openssl.conf ... 72 73 # default_days = 365 74 default_days = 3650 ...
# cd /etc/pki/tls/misc/
# ./CA -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 2048 bit RSA private key
...+++
............+++
writing new private key to '/etc/pki/CA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Bunkyo
Organization Name (eg, company) [Default Company Ltd]:Personal CA
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:kagyuu
Email Address []:kagyuu@hondou.homedns.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem: ※最初に打ち込んだ pass phrase を入力※
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
f3:84:6d:a2:a3:b5:cd:8d
Validity
Not Before: Jun 30 16:14:03 2010 GMT
Not After : Jun 29 16:14:03 2013 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
organizationName = Personal CA
commonName = kagyuu
emailAddress = kagyuu@hondou.homedns.org
X509v3 extensions:
X509v3 Subject Key Identifier:
4A:DB:4D:62:2D:4D:F2:58:B7:EB:02:41:C5:E6:B2:97:6D:8D:32:95
X509v3 Authority Key Identifier:
keyid:4A:DB:4D:62:2D:4D:F2:58:B7:EB:02:41:C5:E6:B2:97:6D:8D:32:95
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Jun 29 16:14:03 2013 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
# ./CA -newreq-nodes Generating a 2048 bit RSA private key .......................................+++ ..................+++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:JP State or Province Name (full name) []:Tokyo Locality Name (eg, city) [Default City]:Bunkyo Organization Name (eg, company) [Default Company Ltd]:AHO Organizational Unit Name (eg, section) []:Web Admin Common Name (eg, your name or your server's hostname) []:hondou.homedns.org Email Address []:kagyuu@hondou.homedns.org Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Request (and private key) is in newreq.pem
# ./CA -sign
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
f3:84:6d:a2:a3:b5:cd:8e
Validity
Not Before: Jun 30 16:33:34 2010 GMT
Not After : Jun 27 16:33:34 2020 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
localityName = Bunkyo
organizationName = AHO
organizationalUnitName = Web Admin
commonName = hondou.homedns.org
emailAddress = kagyuu@hondou.homedns.org
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
93:7C:01:CD:79:F5:0F:25:91:67:CC:6A:85:A4:35:E3:E5:D5:4C:29
X509v3 Authority Key Identifier:
keyid:4A:DB:4D:62:2D:4D:F2:58:B7:EB:02:41:C5:E6:B2:97:6D:8D:32:95
Certificate is to be certified until Jun 27 16:33:34 2020 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
$ cd /etc/pki/tls/misc/ $ sudo openssl rsa -in newreq.pem -out server.key writing RSA key $ sudo openssl x509 -in newcert.pem -out server.crt
$ sudo vi /etc/httpd/conf.d/50_ssl.conf 100 101 # Server Certificate: 102 # Point SSLCertificateFile at a PEM encoded certificate. If 103 # the certificate is encrypted, then you will be prompted for a 104 # pass phrase. Note that a kill -HUP will prompt again. A new 105 # certificate can be generated using the genkey(1) command. 106 SSLCertificateFile /etc/pki/tls/misc/server.crt 107 #SSLCertificateFile /etc/pki/tls/certs/localhost.crt 108 109 # Server Private Key: 110 # If the key is not combined with the certificate, use this 111 # directive to point at the key file. Keep in mind that if 112 # you've both a RSA and a DSA private key you can configure 113 # both in parallel (to also allow the use of DSA ciphers, etc.) 114 SSLCertificateKeyFile /etc/pki/tls/misc/server.key 115 #SSLCertificateKeyFile /etc/pki/tls/private/localhost.key 116
$ sudo /etc/init.d/httpd restart httpd を停止中: [ OK ] httpd を起動中: [ OK ]
# MaxClients: maximum number of server processes allowed to start # MaxRequestsPerChild: maximum number of requests a server process serves <IfModule prefork.c> StartServers 8 MinSpareServers 5 MaxSpareServers 20 # ServerLimit 256 # MaxClients 256 ServerLimit 25 MaxClients 25 MaxRequestsPerChild 4000 </IfModule>
average.png 2908件
[詳細]
cert.png 3011件
[詳細]
iptables.png 3111件
[詳細]
cert2.png 3111件
[詳細]
mod_deflate.png 3042件
[詳細]
hello.png 2974件
[詳細]
phpinfo.png 2954件
[詳細]
