CentOS 7配置+xcache, php module

CentOS7,apm+xcache,PHP module;

a) 一个虚拟主机提供@L_447_0@myAdmin，另一个虚拟主机提供wordpress；

b) 为@L_447_0@myAdmim提供https服务；

selinux处于关闭状态

httpd2.4

@H_10_16@mariadb5.5

PHP5.4

安装：PHP-MysqL @L_447_0@mariadb-server httpd

yum-yinstallPHP-MysqL@L_447_0@mariadb-serverhttpd@H_616_78@

@H_616_78@

配置安装PHP组件

yuminstallPHP-MysqLPHP-gdlibjpeg*PHP-ldapPHP-odbc@H_616_78@

安装https相关模块

@H_406_15@mod_ssl@H_616_78@

配置httpd虚拟主机

vim/etc/httpd/conf.d/FQDN.conf@H_616_78@@H_616_78@<VirtualHost*:80>@H_616_78@ServerNamewww.@L_447_0@myadmin.com@H_616_78@DocumentRoot/httpd/vhosts/@L_447_0@myadmin@H_616_78@<Directory"/httpd/vhosts/@L_447_0@myadmin">@H_616_78@Optionsnone@H_616_78@AllowOverrideNone@H_616_78@requireallgranted@H_616_78@</Directory>@H_616_78@ErrorLog/var/log/httpd/@L_447_0@myadmin/error.log@H_616_78@CustomLog/var/log/httpd/@L_447_0@myadmin/access.logcombined@H_616_78@</VirtualHost>@H_616_78@@H_616_78@<VirtualHost*:80>@H_616_78@ServerNamewww.wordpress.com@H_616_78@DocumentRoot/httpd/vhosts/wordpress@H_616_78@<Directory"/httpd/vhosts/wordpress">@H_616_78@Optionsnone@H_616_78@AllowOverrideNone@H_616_78@requireallgranted@H_616_78@</Directory>@H_616_78@ErrorLog/var/log/httpd/wordpress/error.log@H_616_78@CustomLog/var/log/httpd/wordpress/access.logcombined@H_616_78@</VirtualHost>@H_616_78@

创建日志文件夹

[root@localhost~]#mkdir/var/log/httpd/wordpress@H_616_78@[root@localhost~]#mkdir/var/log/httpd/@L_447_0@myadmin@H_616_78@

创建根文件夹

[root@localhost~]#mkdir-p/httpd/vhosts/wordpress@H_616_78@[root@localhost~]#mkdir-p/httpd/vhosts/@L_447_0@myAdmin@H_616_78@

检查httpd语法，启动服务，设置开机自动启动服务

[root@localhost~]#httpd-t@H_616_78@SyntaxOK@H_616_78@[root@localhost~]#systemctlstarthttpd@H_616_78@[root@localhost~]#systemctlenablehttpd@H_616_78@

启动mariadb，并设置为开启

[root@localhost~]#systemctlstartmariadb.service@H_616_78@[root@localhost~]#systemctlenablemariadb.service@H_616_78@

运行mariadb的安全配置

[root@localhostconf.d]#MysqL_secure_installation@H_616_78@/usr/bin/MysqL_secure_installation:line379:find_MysqL_client:commandnotfound@H_616_78@@H_616_78@NOTE:rUNNINGALLPARTSOFTHISSCRIPTISRECOMMENDEDFORALLMariaDB@H_616_78@SERVERSINPRODUCTIONUSE!PLEASEREADEACHSTEPCAREFULLY!@H_616_78@@H_616_78@InordertologintoMariaDBtosecureit,we'llneedthecurrent@H_616_78@passwordfortherootuser.Ifyou'vejusTinstalledMariaDB,and@H_616_78@youhaven'tsettherootpasswordyet,thepasswordwillbeblank,@H_616_78@soyoushouldjustpressenterhere.@H_616_78@@H_616_78@Entercurrentpasswordforroot(enterfornonE):（回车）@H_616_78@OK,successfullyusedpassword,movingon...@H_616_78@@H_616_78@SetTingtherootpasswordensuresthatnobodycanlogintotheMariaDB@H_616_78@rootuserwithouttheproperauthorisation.@H_616_78@@H_616_78@Setrootpassword?[Y/n]Y@H_616_78@Newpassword:@H_616_78@Re-enternewpassword:@H_616_78@passwordupdatedsuccessfully!@H_616_78@Reloadingprivilegetables..@H_616_78@...success!@H_616_78@@H_616_78@@H_616_78@Bydefault,aMariaDBinstallationhasananonymoususer,allowinganyone@H_616_78@tologintoMariaDBwithouthavingtohaveauseraccountcreatedfor@H_616_78@them.ThisisintendedonlyfortesTing,andtomaketheinstallation@H_616_78@goabitsmoother.Youshouldremovethembeforemovingintoa@H_616_78@productionenvironment.@H_616_78@@H_616_78@Removeanonymoususers?[Y/n]y@H_616_78@...success!@H_616_78@@H_616_78@Normally,rootshouldonlybeallowedtoconnectfrom'localhost'.This@H_616_78@ensuresthatsomeonecAnnotguessattherootpasswordfromthenetwork.@H_616_78@@H_616_78@Disallowrootloginremotely?[Y/n]y@H_616_78@...success!@H_616_78@@H_616_78@Bydefault,MariaDBcomeswithadatabasenamed'test'thatanyonecan@H_616_78@access.ThisisalsointendedonlyfortesTing,andshouldberemoved@H_616_78@beforemovingintoaproductionenvironment.@H_616_78@@H_616_78@Removetestdatabaseandaccesstoit?[Y/n]y@H_616_78@-Droppingtestdatabase...@H_616_78@...success!@H_616_78@-Removingprivilegesontestdatabase...@H_616_78@...success!@H_616_78@@H_616_78@Reloadingtheprivilegetableswillensurethatallchangesmadesofar@H_616_78@willtakeeffectimR_895_11845@ediately.@H_616_78@@H_616_78@ReloadprivilegetablesNow?[Y/n]y@H_616_78@...success!@H_616_78@@H_616_78@Cleaningup...@H_616_78@@H_616_78@Alldone!Ifyou'vecompletedalloftheabovesteps,yourMariaDB@H_616_78@installationshouldNowbesecure.@H_616_78@@H_616_78@ThanksforusingMariaDB!@H_616_78@

编辑mariadb的配置文件，在[MysqLd]中添加配置

[root@localhost~]#vim/etc/my.cnf@H_616_78@@H_616_78@innodb_file_per_table=ON@H_616_78@skip_name_resolve=ON@H_616_78@

进入mariadb数据库

[root@localhost~]#MysqL-uroot-p@H_616_78@Enterpassword:@H_616_78@WelcometotheMariaDBmonitor.Commandsendwith;or\g.@H_616_78@YourMariaDBconnectionidis10@H_616_78@Serverversion:5.5.47-MariaDBMariaDBServer@H_616_78@@H_616_78@Copyright(C)2000,2015,Oracle,MariaDBCorporationAbandothers.@H_616_78@@H_616_78@Type'Help;'or'\h'forHelp.Type'\c'toclearthecurrenTinputstatement.@H_616_78@@H_616_78@mariaDB[(nonE)]>@H_616_78@

创建wordpress用数据库

@H_406_15@mariaDB[(nonE)]>grantallonwpdb.*to'wpuser@192.168.%.%'identifiedby'password'@H_616_78@->;@H_616_78@QueryOK,0rowsaffected(0.00seC)@H_616_78@

更新权限后退出

@H_406_15@mariaDB[(nonE)]>flushprivileges@H_616_78@->;@H_616_78@QueryOK,0rowsaffected(0.00seC)@H_616_78@@H_616_78@mariaDB[(nonE)]>quit@H_616_78@Bye@H_616_78@

安装wordpress

[root@localhostwordpress]#yum-yinstallwordpress@H_616_78@

将配置文件移动至/httpd/vhost/wordpress文件夹下

[root@localhostwordpress]#mv/usr/share/wordpress/httpd/vhosts/wordpress/@H_616_78@

配置相应wordpress配置文件

[root@localhostwordpress]#vimwp-config.php@H_616_78@//**MysqLsetTings-Youcangetthisinfofromyourwebhost**//@H_616_78@/**Thenameofthedatabaseforwordpress*/@H_616_78@define('db_name','wpdb');@H_616_78@@H_616_78@/**MysqLdatabaseusername*/@H_616_78@define('DB_USER','wpuser');@H_616_78@@H_616_78@/**MysqLdatabasepassword*/@H_616_78@define('DB_password','password');@H_616_78@@H_616_78@/**MysqLhostname*/@H_616_78@define('DB_HOST','192.168.1.10');@H_616_78@

输入www.wordpress.com后进入主页

安装@L_447_0@myAdmin

[root@www@L_447_0@myAdmin]#yum-yinstall@L_447_0@myAdmin@H_616_78@

将安装文件复制至相应目录下

cp-r.//httpd/vhosts/@L_447_0@myadmin/@H_616_78@

用浏览器打开

为@L_447_0@myAdmin配置https使用192.186.1.7为192.168.1.10颁发CA证书为192.168.1.7创建私有CA；切换至/etc/pki/CA/目录

[root@bogon~]#cd/etc/pki/CA/@H_616_78@[root@bogonCA]#(umask077;opensslgenrsa-outprivate/cakey.pem1024)@H_616_78@GeneratingRSAprivatekey,1024bitlongmodulus@H_616_78@.................++++++@H_616_78@......................................++++++@H_616_78@eis65537(0x10001@H_616_78@

创建自签证书

[root@bogonCA]#opensslreq-new-x509-keyprivate/cakey.pem-outcacert.pem@H_616_78@Youareabouttobeaskedtoenterinformationthatwillbeincorporated@H_616_78@intoyourcertificaterequest.@H_616_78@whatyouareabouttoenteriswhatiscalledaDisTinguishedNameoraDN.@H_616_78@Therearequiteafewfieldsbutyoucanleavesomeblank@H_616_78@ForsomefieldstherewillbeaDefaultValue,@H_616_78@Ifyouenter'.',thefieldwillbeleftblank.@H_616_78@-----@H_616_78@CountryName(2lettercodE)[XX]:CN@H_616_78@StateorprovinceName(fullName)[]:beijing@H_616_78@LocalityName(eg,city)[DefaultCity]:beijing@H_616_78@OrganizationName(eg,company)[DefaultCompanyLtd]:@L_447_0@myadmin@H_616_78@OrganizationalUnitName(eg,section)[]:@L_447_0@myadmin@H_616_78@CommonName(eg,yournameoryourserver'shostName)[]:ca.admin.com@H_616_78@EmailAddress[]:caadmin@@L_447_0@myadmin.com@H_616_78@

创建结构文件

[root@bogonCA]#touchindex.txt@H_616_78@[root@bogonCA]#echo01>serial@H_616_78@

为服务端配置证书

[root@wwwssl]#opensslreq-new-keyhttpd.key-outhttpd.csr@H_616_78@Youareabouttobeaskedtoenterinformationthatwillbeincorporated@H_616_78@intoyourcertificaterequest.@H_616_78@whatyouareabouttoenteriswhatiscalledaDisTinguishedNameoraDN.@H_616_78@Therearequiteafewfieldsbutyoucanleavesomeblank@H_616_78@ForsomefieldstherewillbeaDefaultValue,yournameoryourserver'shostName)[]:www.@L_447_0@myadmin.com@H_616_78@EmailAddress[]:caadmin@@L_447_0@myadmin.com@H_616_78@@H_616_78@Pleaseenterthefollowing'extra'attributes@H_616_78@tobesentwithyourcertificaterequest@H_616_78@AchALLENgepassword[]:@H_616_78@Anoptionalcompanyname[]:@H_616_78@

讲所需签名证书复制至CA服务器

[root@wwwssl]#scphttpd.csr192.168.1.7:/tmp@H_616_78@Theauthenticityofhost'192.168.1.7(192.168.1.7)'can'tbeestablished.@H_616_78@ECDSAkeyfingerprintis4b:8b:6d:c8:53:c4:7e:ff:dd:26:a2:b9:67:1d:ab:cd.@H_616_78@AreyousureyouwanttoconTinueconnecTing(yes/no)?yes@H_616_78@Warning:PeRMANentlyadded'192.168.1.7'(ECDSA)totHelistofkNownhosts.@H_616_78@

给服务器签发证书

[root@bogonCA]#opensslca-in/tmp/httpd.csr-out/tmp/httpd.crt@H_616_78@Usingconfigurationfrom/etc/pki/tls/openssl.cnf@H_616_78@checkthattherequestmatchesthesignature@H_616_78@Signatureok@H_616_78@CertificateDetails:@H_616_78@serialnumber:1(0x1)@H_616_78@Validity@H_616_78@NotBefore:Jul1702:49:362016GMT@H_616_78@NotAfter:Jul1702:49:362017GMT@H_616_78@Subject:@H_616_78@countryName=CN@H_616_78@stateOrprovinceName=beijing@H_616_78@organizationName=@L_447_0@myadmin@H_616_78@organizationalUnitName=@L_447_0@myadmin@H_616_78@commonName=www.@L_447_0@myadmin.com@H_616_78@emailAddress=caadmin@@L_447_0@myadmin.com@H_616_78@X509v3extensions:@H_616_78@X509v3BasicConsTraints:@H_616_78@CA:falSE@H_616_78@@R_403_1253@Comment:@H_616_78@OpenSSLGeneratedCertificate@H_616_78@X509v3SubjectKeyIdentifier:@H_616_78@97:05:5A:39:41:43:C0:61:6E:E1:23:18:98:78:02:0D:21:F3:2B:EE@H_616_78@X509v3AuthorityKeyIdentifier:@H_616_78@keyid:0F:9B:41:AB:0F:47:89:C2:28:98:0F:59:61:BE:D3:4E:04:C9:51:81@H_616_78@@H_616_78@CertificateistobecertifieduntilJul1702:49:362017GMT(365days)@H_616_78@Signthecertificate?[y/n]:y@H_616_78@@H_616_78@@H_616_78@1outof1certificaterequestscertified,commit?[y/n]y@H_616_78@Writeoutdatabasewith1newentries@H_616_78@DataBaseupdated@H_616_78@

将签发好的证书复制至@L_447_0@myAdmin服务器

[root@bogonCA]#scp/tmp/httpd.crt192.168.1.10:/etc/httpd/ssl@H_616_78@Theauthenticityofhost'192.168.1.10(192.168.1.10)'can'tbeestablished.@H_616_78@ECDSAkeyfingerprintisd3:71:51:da:74:25:b2:af:b6:d2:d4:98:9a:cd:f4:ee.@H_616_78@AreyousureyouwanttoconTinueconnecTing(yes/no)?yes@H_616_78@Warning:PeRMANentlyadded'192.168.1.10'(ECDSA)totHelistofkNownhosts.@H_616_78@root@192.168.1.10'spassword:@H_616_78@httpd.crt100%33173.2KB/s00:00@H_616_78@

编辑ssl.conf文件，@H_616_78@

[root@www ssl]# cd ../conf.d@H_616_78@[root@www conf.d]# vim ssl.conf

将页面文件路径修改至@L_447_0@myAdmin页面路径

#General setup for the virtual host,inherited from global configuration@H_616_78@#DocumentRoot"/var/www/html"@H_616_78@#ServerNamewww.example.com:443@H_616_78@DocumentRoot"/httpd/vhosts/@L_447_0@myadmin"@H_616_78@ServerNamewww.@L_447_0@myadmin.com:443# Server Certificate:@H_616_78@#Point SSLCertificateFile at a PEM encoded certificate. If@H_616_78@# thecertificate is encrypted,then you will be prompted for a@H_616_78@#pass phrase. Note that a kill -HUP willprompt again. A new@H_616_78@#certificate can be generated using the genkey(1) command.@H_616_78@SSLCertificateFile/etc/httpd/ssl/httpd.crt

修改证书文件路径

# Server Certificate:@H_616_78@#Point SSLCertificateFile at a PEM encoded certificate. If@H_616_78@# thecertificate is encrypted,then you will be prompted for a@H_616_78@#pass phrase. Note that a kill -HUP willprompt again. A new@H_616_78@#certificate can be generated using the genkey(1) command.@H_616_78@SSLCertificateFile/etc/httpd/ssl/httpd.crt@H_616_78@@H_616_78@# Server Private Key:@H_616_78@# If the key is not combined with thecertificate,use this@H_616_78@# directive to point at the key file. Keep in mind that if@H_616_78@# you've both a RSA and a DSA private key youcan configure@H_616_78@# both in parallel (to also allow the use ofDSA ciphers,etc.)@H_616_78@SSLCertificateKeyFile/etc/httpd/ssl/httpd.key

重启httpd服务

[root@wwwconf.d]#systemctlrestarthttpd

访问https://www.phpmuadmin.com

@H_616_78@

安装xcache后重启httpd服务

[root@bogonconf.d]#yum-yinstallPHP-xcache
[root@bogonvhosts]#systemctlrestarthttpd

@H_616_78@

使用ab命令进行压力测试（进行10次）

[root@bogonvhosts]#ab-c100-n1000http://www.xcache.com/index.PHP
Timeperrequest:132.352[ms](mean)
Timeperrequest:1.324[ms](mean,acrossallconcurrentrequests)
Transferrate:34763.10[Kbytes/sec]received
[root@bogonvhosts]#ab-c200-n2000http://www.xcache.com/index.PHP
Timeperrequest:334.702[ms](mean)
Timeperrequest:1.674[ms](mean,acrossallconcurrentrequests)
Transferrate:27492.89[Kbytes/sec]received

[root@bogonvhosts]#ab-c300-n3000http://www.xcache.com/index.PHP
Timeperrequest:1513.902[ms](mean)
Timeperrequest:5.046[ms](mean,acrossallconcurrentrequests)
Transferrate:9117.43[Kbytes/sec]received

[root@bogonvhosts]#ab-c400-n4000http://www.xcache.com/index.PHP
Timeperrequest:5866.443[ms](mean)
Timeperrequest:14.666[ms](mean,acrossallconcurrentrequests)
Transferrate:3039.11[Kbytes/sec]received

[root@bogonvhosts]#ab-c500-n5000http://www.xcache.com/index.PHP
Timeperrequest:5984.272[ms](mean)
Timeperrequest:11.969[ms](mean,acrossallconcurrentrequests)
Transferrate:3681.99[Kbytes/sec]received

[root@bogonvhosts]#ab-c600-n6000http://www.xcache.com/index.PHP
Timeperrequest:6207.417[ms](mean)
Timeperrequest:10.346[ms](mean,acrossallconcurrentrequests)
Transferrate:4296.02[Kbytes/sec]received

[root@bogonvhosts]#ab-c700-n7000http://www.xcache.com/index.PHP
Timeperrequest:1901.629[ms](mean)
Timeperrequest:2.717[ms](mean,acrossallconcurrentrequests)
Transferrate:16936.40[Kbytes/sec]received、

[root@bogonvhosts]#ab-c800-n8000http://www.xcache.com/index.PHP
Timeperrequest:3199.896[ms](mean)
Timeperrequest:4.000[ms](mean,acrossallconcurrentrequests)
Transferrate:11224.73[Kbytes/sec]received

[root@bogonvhosts]#ab-c900-n9000http://www.xcache.com/index.PHP
Timeperrequest:3335.247[ms](mean)
Timeperrequest:3.706[ms](mean,acrossallconcurrentrequests)
Transferrate:12321.67[Kbytes/sec]received

[root@bogonvhosts]#ab-c1000-n10000http://www.xcache.com/index.PHP
Timeperrequest:4754.311[ms](mean)
Timeperrequest:4.754[ms](mean,acrossallconcurrentrequests)
Transferrate:9507.14[Kbytes/sec]received