编译安装httpd 2.4 ---格式待整理

浏览数：33 / 时间：2015年06月09日

httpd 2.4 版本需要依赖于apr 1.4版本
httpd 依赖于 apr，apr-util
   其安装又先后顺序之分：
       1、apr
       2、apr-util
       3、httpd

[root@localhost httpd]# rpm -q httpd
httpd-2.2.15-39.el6.centos.x86_64
[root@localhost httpd]# service httpd stop
Stopping httpd:                                            [FAILED]
[root@localhost httpd]# chkconfig httpd off
[root@localhost httpd]# chkconfig --list httpd
httpd             0:off   1:off   2:off   3:off   4:off   5:off   6:off
[root@localhost httpd]#

首先安装开发环境：

   Development tools
   Server Platform Development

[root@1inux httpd]# yum -y groupinstall "Development tools" "Server Platform Development"

二、编译安装apr
[root@1inux httpd]# tar xf apr-1.5.0.tar.bz2
[root@1inux httpd]# ls
apr-1.5.0 apr-1.5.0.tar.bz2 apr-util-1.5.3.tar.bz2 httpd-2.4.10.tar.bz2
[root@1inux httpd]# cd apr-1.5.0
[root@localhost apr-1.5.0]# ./configure --prefix=/usr/local/apr       //安装在/usr/local/apr目录下
[root@localhost apr-1.5.0]# make && make install

三、编译安装apr-util

[root@localhost httpd]# tar -xf apr-util-1.5.3.tar.bz2
[root@localhost httpd]# cd apr-util-1.5.3

[root@localhost apr-util-1.5.3]# ./configure --help   //可以获取安装帮助
[root@localhost apr-util-1.5.3]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
                       //--prefix=/usr/local/apr-util   表示安装路径
                       //--with-apr       依赖于刚才安装的apr安装路径

[root@localhost apr-util-1.5.3]# make && make install

三、编译安装httpd

+++++++++++++++++++++++++++++++++++++++++++++++++++
注：编译安装Apache 默认使用的是daemon用户也可以在编译时指定，但前提需手工创建指定的用户

           # groupadd -r apache
           # useradd -r -g apache apahce
[root@localhost httpd]# grep "^apache\b" /etc/passwd
apache:x:48:48:Apache:/var/www:/sbin/nologin
[root@localhost httpd]# grep "^apache\b" /etc/gshadow
apache:!::
[root@localhost httpd]#

------------------

[root@localhost httpd]# tar -xf httpd-2.4.10.tar.bz2
[root@localhost httpd]# cd httpd-2.4.10
[root@localhost httpd-2.4.10]#

[root@localhost httpd-2.4.10]# less INSTALL    //获取安装帮助信息
[root@localhost httpd-2.4.10]# ./configure --help

--------------------------------------------
--enable-http   //启用对http协议的支持
--enable-ssl   //启用支持ssl
--enable-so   //支持模块装卸载

--enable-cache   //启用动态文件的缓存功能
--enable-cgi       //启动对cgi支持
--enable-rewrite   //支持url重写功能
--enable-proxy    //支持proxy
--enable-proxy-fcgi    //表示对fcgi做代理
--enable-proxy-http   //启用对http做代理
--with-apr=PATH   //指明apr路径
--with-apr-util=PATH   //指明apr-util路径

--enable-modules=MODULE-LIST
                          Space-separated list of modules to enable | "all" |
                          "most" | "few" | "none" | "reallyall"
       all:表示编译所有模块
       most:编译大多数模块
       few:编译最常用模块
       none：一个模块也不编译
       reallyall：接近所有
--enable-mpms-shared       //把支持mpm的做成共享模块
--with-mpm=MPM   //启用默认哪个MPM {event|worker|prefork|winnt} （winnt只能在Windows上用）
--enable-mods-shared=MODULE-LIST   //编译成共享模块
--enable-mods-static=MODULE-LIST   //编译成静态模块
--disable-authn-file   //禁用基于base的认证方式
--enable-authn-dbm    //启用基于dbm的认证
--enable-authn-anon   //启用匿名认证
--enable-authn-dbd    //基于dbd的认证

[root@localhost httpd-2.4.10]# ./configure --prefix=/usr/local/apache --sysconfdir=/etc/httpd24 --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util/ --enable-modules=most --enable-mpms-shared=all --with-mpm=prefork

__________________________
安装过程中报错需要安装下面两个程序
[root@localhost httpd-2.4.10]# yum install pcre-devel zlib-devel
_______________________________

启动Apach

启动Apache之前还需要做两件工作
1、将其二进制文件添加至环境变量中

[root@localhost bin]# vim /etc/profile.d/httpd.sh

export PATH=/usr/local/apache/bin:$PATH

[root@localhost bin]# . /etc/profile.d/httpd.sh   //重读此配置文件
[root@localhost bin]# echo $PATH   //验证
/usr/local/apache/bin:/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin

[root@localhost bin]# hash -r   //清楚所有hash记录
[root@localhost bin]#

2、为头文件添加软连接
[root@localhost apache]# ln -sv /usr/local/apache/include/ /usr/include/httpd
`/usr/include/httpd‘ -> `/usr/local/apache/include/‘
[root@localhost apache]#
3、编辑man配置文件添加Apache man路径
[root@localhost apache]# vim /etc/man.config
添加如下内容：
MANPATH /usr/local/apache/MAN

================================================
OK 上述步骤完成后就可以启动Apache了

[root@localhost bin]# apachectl start
AH00558: httpd: Could not reliably determine the server‘s fully qualified domain name, using localhost.localdomain. Set the ‘ServerName‘ directive globally to suppress this message
[root@localhost bin]# ss -tnl
State       Recv-Q Send-Q                       Local Address:Port                         Peer Address:Port
LISTEN      0      128                                     :::52949                                  :::*
LISTEN      0      128                                     :::22                                     :::*
LISTEN      0      128                                      *:22                                      *:*
LISTEN      0      128                              127.0.0.1:631                                     *:*
LISTEN      0      128                                    ::1:631                                    :::*
LISTEN      0      100                                    ::1:25                                     :::*
LISTEN      0      100                              127.0.0.1:25                                      *:*
LISTEN      0      128                              127.0.0.1:6010                                    *:*
LISTEN      0      128                                    ::1:6010                                   :::*
LISTEN      0      128                              127.0.0.1:6011                                    *:*
LISTEN      0      128                                    ::1:6011                                   :::*
LISTEN      0      128                                      *:37772                                   *:*
LISTEN      0      128                                     :::111                                    :::*
LISTEN      0      128                                      *:111                                     *:*
LISTEN      0      128                                     :::80                                     :::*
[root@localhost bin]#

===================================================

[root@localhost ~]# cd /usr/local/apache/
[root@localhost apache]# ls -l
total 52
drwxr-xr-x 2 root root 4096 Mar 25 13:06 bin       //Apache 二进制文件
drwxr-xr-x 2 root root 4096 Mar 25 13:06 build   //保存安装编译时的选项
drwxr-xr-x 2 root root 4096 Mar 25 13:06 cgi-bin   //
drwxr-xr-x 3 root root 4096 Mar 25 13:06 error   //错误页面文件
drwxr-xr-x 2 root root 4096 Mar 25 12:31 htdocs   //Apache 站点目录，网页文件存放位置
drwxr-xr-x 3 root root 4096 Mar 25 13:06 icons   //Apache可能会用到的图标
drwxr-xr-x 2 root root 4096 Mar 25 13:06 include   // 头文件
drwxr-xr-x 2 root root 4096 Mar 25 13:17 logs       //日志文件
drwxr-xr-x 4 root root 4096 Mar 25 13:06 man       //帮助手册
drwxr-xr-x 14 root root 12288 Jul 16 2014 manual
drwxr-xr-x 2 root root 4096 Mar 25 13:06 modules   //编译安装的模块
[root@localhost apache]#

***************如何更改MPM*******************************************************************

[root@localhost modules]# httpd -M //查看到我们现在使用的是prefork

注意更配置文件之前应该先关闭Apache
[root@localhost httpd24]# apachectl stop
[root@localhost httpd24]# vim httpd.conf

更改配置文件 [root@localhost httpd24]# vim /etc/httpd24/httpd.conf

将LoadModule mpm_prefork_module modules/mod_mpm_prefork.so 更改为
LoadModule mpm_event_module modules/mod_mpm_event.so

[root@localhost httpd24]# apachectl start   //启动Apache
AH00558: httpd: Could not reliably determine the server‘s fully qualified domain name, using localhost.localdomain. Set the ‘ServerName‘ directive globally to suppress this message
[root@localhost httpd24]#

再次查看当前MPM
[root@localhost modules]# httpd -M
mpm_event_module (shared)

OK 已经完成
***********************************************************
************更改Apache 2.4 版本的Web目录*******************
***********************************************************
Apache 2.4 和2.2版本相比一大特性就是在 Main中如果不是定义允许的都将被拒绝

1、首先我们创建一个目录，作为更改后的网站目录使用
[root@localhost httpd24]# mkdir /data/web/htdocs -pv
mkdir: created directory `/data‘
mkdir: created directory `/data/web‘
mkdir: created directory `/data/web/htdocs‘
[root@localhost httpd24]#
创建默认文件
# vim /data/web/htdocs/index.html
<h1> I LOVE LINUX </h1>

2、更改配置文件：/etc/apache24/httpd.conf

注：更改配置文件之前一定要先备份配置文件，以防止造成无法挽回的损失

   2.1、将DocumentRoot "/usr/local/apache/htdocs" 更改为如下：
DocumentRoot "/data/web/htdocs"

然后保存重启Apache服务，访问站点，发现是Forbidden 没有权限访问

   2.2、所以在2.4版本中只更改DocumentRoot还不行
还需要更改<Directory>标签将<Directory "/usr/local/apache/htdocs">更改为<Directory "/data/web/htdocs">

然后保存配置文件，重启Apache
这样就可以看到我们刚才定义的主页文件了

3、在2.4版本中基于IP的访问控制法则不在使用Allow、Deny等而更改为如下：
   允许所有主机访问：Require all granted
   拒绝所有主机访问：Require all deny

   控制特定IP访问：
       Require ip IPADDR：授权指定来源地址的主机访问
       Require not ip IPADDR：拒绝指定来源地址的主机访问

       其中IPADDR格式如下：
           IPADDR：
               IP: 172.16.100.2
               Network/mask: 172.16.0.0/255.255.0.0
               Network/Length: 172.16.0.0/16
               Net: 172.16

   控制特定主机（HOSTNAME）访问
       Require host HOSTNAME
       Require not host HOSTNAME

       HOSTNAME:
       FQDN: 特定主机
       DOMAIN：指定域内的所有主机

4、虚拟主机的实现
   基于IP、Port和FQDN都支持；
   基于FQDN的不再需要NameVirtualHost指令
   4.1、注释掉配置文件中的DocumentRoot
   4.2、在配置文件中找到如下，并启用之
   Include /etc/httpd24/extra/httpd-vhosts.conf
   4.3、然后编辑httpd-vhosts.conf
__________________
[root@localhost modules]# mkdir -pv /data/{a.com,b.com}/htdocs //创建目录
mkdir: created directory `/data/a.com‘
mkdir: created directory `/data/a.com/htdocs‘
mkdir: created directory `/data/b.com‘
mkdir: created directory `/data/b.com/htdocs‘
[root@localhost modules]# echo "<h1>www.a.com</h1>" >> /data/a.com/htdocs/index.html   //创建主页
[root@localhost modules]# echo "<h1>www.b.com</h1>" >> /data/b.com/htdocs/index.html
[root@localhost modules]#
___________________

<VirtualHost *:80>
    ServerAdmin www.a.com
    DocumentRoot "/data/a.com/htdocs"
    ServerName www.a.com
    ServerAlias a.com
    ErrorLog "logs/a.com-error_log"
    CustomLog "logs/a.com-access_log" combined
        <Directory "/data/a.com/htdocs">
         AllowOverride None
        Options None
        Require all granted
        </Directory>
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin www.b.com
    DocumentRoot "/data/b.com/htdocs"
    ServerName b.com
    ErrorLog "logs/b.com-error_log"
    CustomLog "logs/b.com-access_log" common
        <Directory "/data/b.com/htdocs">
         AllowOverride None
        Options None
        Require all granted
        </Directory>
</VirtualHost>

注：为了使日志更加详细，也可以将common更改为combined

4.4、修改完成后，重读配置文件
[root@localhost httpd24]# killall -SIGHUP httpd   //重读配置文件

[root@localhost httpd24]# httpd -S   //查看虚拟主机信息
AH00558: httpd: Could not reliably determine the server‘s fully qualified domain name, using localhost.localdomain. Set the ‘ServerName‘ directive globally to suppress this message
VirtualHost configuration:
*:80                   is a NameVirtualHost
         default server www.a.com (/etc/httpd24/extra/httpd-vhosts.conf:23)
         port 80 namevhost www.a.com (/etc/httpd24/extra/httpd-vhosts.conf:23)
                 alias a.com
         port 80 namevhost b.com (/etc/httpd24/extra/httpd-vhosts.conf:32)
ServerRoot: "/usr/local/apache"
Main DocumentRoot: "/usr/local/apache/htdocs"
Main ErrorLog: "/usr/local/apache/logs/error_log"
Mutex default: dir="/usr/local/apache/logs/" mechanism=default
PidFile: "/usr/local/apache/logs/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="daemon" id=2
Group: name="daemon" id=2
[root@localhost httpd24]#

5、ssl的配置
   启用模块：
      LoadModule ssl_module modules/mod_ssl.so
      Include /etc/httpd24/extra/httpd-ssl.conf
   LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

# vim /etc/httpd24/extra/httpd-ssl.conf
DocumentRoot "/data/web/htdocs"
ServerName www.a.com:443
ServerAdmin [email protected]
ErrorLog "/usr/local/apache/logs/a.com.443error_log"
TransferLog "/usr/local/apache/logs/a.com.443access_log"
        <Directory "/data/web/htdocs">
         AllowOverride None
        Options None
        Require all granted
        </Directory>

==========================================
CA 创建

[root@1inux CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
........................................................................................+++
.......................+++
e is 65537 (0x10001)

[root@1inux CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 10000
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HN
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:FREELOVE
Organizational Unit Name (eg, section) []:OPS
Common Name (eg, your name or your server‘s hostname) []:www.freelove.com
Email Address []:[email protected]

2、生成自签证书

[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 1024)
Generating RSA private key, 1024 bit long modulus
............................................++++++
....++++++
e is 65537 (0x10001)
[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HN
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:FREELOVE
Organizational Unit Name (eg, section) []:OPS
Common Name (eg, your name or your server‘s hostname) []:www.a.com
Email Address []:[email protected]

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost ssl]# ls
httpd.csr httpd.key
[root@localhost ssl]# scp httpd.csr [email protected]:/tmp
The authenticity of host ‘172.16.66.81 (172.16.66.81)‘ can‘t be established.
RSA key fingerprint is d6:3b:33:71:32:69:7a:dd:47:c2:49:03:ec:03:a1:5e.
Are you sure you want to continue connecting (yes/no)? y
Please type ‘yes‘ or ‘no‘: yes
Warning: Permanently added ‘172.16.66.81‘ (RSA) to the list of known hosts.
[email protected]‘s password:
httpd.csr                                                                    100% 672     0.7KB/s   00:00
[root@localhost ssl]#
--------------------------
3、签发：
--------------------------------
[root@1inux tmp]# openssl ca -in httpd.csr -out httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
/etc/pki/CA/index.txt: No such file or directory
unable to open ‘/etc/pki/CA/index.txt‘
140020295247688:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen(‘/etc/pki/CA/index.txt‘,‘r‘)
140020295247688:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
[root@1inux tmp]# touch /etc/pki/CA/index.txt
[root@1inux tmp]# openssl ca -in httpd.csr -out httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
/etc/pki/CA/serial: No such file or directory
error while loading serial number
140189682972488:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen(‘/etc/pki/CA/serial‘,‘r‘)
140189682972488:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
[root@1inux tmp]# echo 01 >> /etc/pki/CA/serial
[root@1inux tmp]# openssl ca -in httpd.csr -out httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Apr 9 00:28:31 2015 GMT
            Not After : Apr 6 00:28:31 2025 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HN
            organizationName          = FREELOVE
            organizationalUnitName    = OPS
            commonName                = www.a.com
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                F5:2E:C1:AE:18:63:58:F9:85:17:7B:29:F2:C4:F2:3C:69:41:C4:21
            X509v3 Authority Key Identifier:
                keyid:FA:D9:62:94:D7:AF:C9:D9:02:B5:47:29:22:6A:07:B2:F7:29:E3:57

Certificate is to be certified until Apr 6 00:28:31 2025 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@1inux tmp]#

[root@1inux tmp]# scp httpd.crt [email protected]:/etc/httpd24/ssl
[email protected]‘s password:
httpd.crt                                                                                                                   100% 3810     3.7KB/s   00:00
[root@1inux tmp]#

========
SSLCertificateKeyFile "/etc/httpd24/ssl/httpd.key"
SSLCertificateFile "/etc/httpd24/ssl/httpd.crt"

# killall -SIGHUP httpd   //重新加载httpd配置文件

>> 6、服务脚本

apachectl=/usr/local/apache/bin/apachectl
httpd=${HTTPD-/usr/local/apache/bin/httpd}
pidfile=${PIDFILE-/usr/local/apache/logs/httpd.pid}

[root@localhost init.d]# chkconfig --add httpd24
[root@localhost init.d]# chkconfig --list | grep httpd24
httpd24           0:off   1:off   2:off   3:off   4:off   5:off   6:off

[root@localhost init.d]# chkconfig httpd24 on
[root@localhost init.d]# chkconfig --list | grep httpd24
httpd24           0:off   1:off   2:on   3:on   4:on   5:on   6:off
[root@localhost init.d]#

重启：
[root@localhost init.d]# service httpd24 restart
Stopping httpd:                                            [ OK ]
Starting httpd: AH00558: httpd: Could not reliably determine the server‘s fully qualified domain name, using localhost.localdomain. Set the ‘ServerName‘ directive globally to suppress this message
                                                           [ OK ]
[root@localhost init.d]#