首页 > 代码库 > 笔记十

笔记十

6.远程邮件发送权限

 useradd lzt

 passwd lzt

 cd /etc/postfix/

 vim /etc/postfix/access 修改内容为:

 在最后一行添加所要禁止的 ip REJECT

 如:172.25.254.8 REJECT 

 postmap access ##执行完此条命令会发现出现一个新的access.db文件

 postconf -d | grep client

 @@smtpd_client_restrictions =##此行为上条命令显示结果的倒数第二行,为所需

 postconf -e "smtpd_client_restrictions = check_client_access hash:/etc/postfix/access" ##此处hash后的文件不用加.db文件类型

 systemctl restart postfix.service 

 vim /etc/postfix/main.cf 可发现在文件末尾会添加:

 smtpd_client_restrictions = check_client_access hash:/etc/postfix/access


解除限制:

 vim /etc/postfix/access

 删除最后一行所要禁止的 ip REJECT

 postmap access

 systemctl restart postfix.service


实例:

[root@mailwestos ~]# useradd lzt

[root@mailwestos ~]# passwd lzt

Changing password for user lzt.

[root@mailwestos ~]# cd /etc/postfix/

[root@mailwestos postfix]# ls

access     generic     header_checks  master.cf  transport

canonical  generic.db  main.cf        relocated  virtual

[root@mailwestos postfix]# vim access 

在最后一行添加 172.25.254.8 REJECT

[root@mailwestos postfix]# postmap access 

[root@mailwestos postfix]# ls

access     canonical  generic.db     main.cf    relocated  virtual

access.db  generic    header_checks  master.cf  transport

[root@mailwestos postfix]# postconf -e | grep client

[root@mailwestos postfix]# postconf -d | grep client

broken_sasl_auth_clients = no

local_header_rewrite_clients = permit_inet_interfaces

smtpd_client_restrictions =##此行为下条命令所需要的

unknown_client_reject_code = 450

[root@mailwestos postfix]# postconf -e "smtpd_client_restrictions = check_client_access hash:/etc/postfix/access"

[root@mailwestos postfix]# systemctl restart postfix.service 


实例测试:

[kiosk@foundation7 Desktop]$ ssh root@172.25.254.8

root@172.25.254.8‘s password: 

Last login: Sat Dec  3 09:25:19 2016

[root@foundation8 ~]# telnet 172.25.254.207 25

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail from:lzt@westos.com

250 2.1.0 Ok

rcpt to:root@westos.com

554 5.7.1 <unknown[172.25.254.8]>: Client host rejected: Access denied

421 4.4.2 mailwestos.westos.com Error: timeout exceeded

Connection closed by foreign host.

[root@foundation8 ~]# logout

Connection to 172.25.254.8 closed.

[kiosk@foundation7 Desktop]$ telnet 172.25.254.207 25

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail lzt@westos.com

501 5.5.4 Syntax: MAIL FROM:<address>

mail from:lzt@westos.com

250 2.1.0 Ok

rcpt to:root@westos.com

250 2.1.5 Ok

data

354 End data with <CR><LF>.<CR><LF>

mm

bb

v.

.

250 2.0.0 Ok: queued as 3AB8E17E81D

quit

221 2.0.0 Bye

Connection closed by foreign host.


7.通过发件人地址进行限制

 cd /etc/postfix/

 vim sender ##此文件需要自己建立

修改内容为: user@域名 REJECT##表示禁止user发送邮件

如:

 lzt@westos.com REJECT##表示禁止用户lzt发送邮件

 postmap sender 

 postconf -d | grep sender

@@ smtpd_sender_restrictions =##此行为上条命令结果的倒数第五行,为所需

 postconf -e "smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender"

 systemctl restart postfix.service 


解除:

 vim sender

 删除上步所添加的内容 user@westos.com REJECT

 postmap sender 

 systemctl restart postfix.service


实例:

[root@mailwestos postfix]# vim sender

 修改内容为: lzt@westos.com REJECT

[root@mailwestos postfix]# postmap sender 

[root@mailwestos postfix]# ls

access     canonical  generic.db     main.cf    relocated  sender.db  virtual

access.db  generic    header_checks  master.cf  sender     transport

[root@mailwestos postfix]# postconf -d | grep sender


smtpd_reject_unlisted_sender = no

smtpd_sender_login_maps =

smtpd_sender_restrictions =##此行为所需

unverified_sender_defer_code = 450

unverified_sender_reject_code = 450


[root@mailwestos postfix]# postconf -e "smtpd_sender_restrictions ="

[root@mailwestos postfix]# postconf -e "smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender"

[root@mailwestos postfix]# systemctl restart postfix.service 


解除实例:

[root@mailwestos postfix]# vim sender

 删除上步所添加的内容 lzt@westos.com REJECT

[root@mailwestos postfix]# postmap sender 

[root@mailwestos postfix]# systemctl restart postfix.service


实例测试:

[kiosk@foundation7 Desktop]$ telnet 172.25.254.207 25

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail from:student@westos.com

250 2.1.0 Ok

rcpt to:root@westos.com

250 2.1.5 Ok

data

354 End data with <CR><LF>.<CR><LF>

vv

bb.

.

250 2.0.0 Ok: queued as 4588D17E81D

quit

221 2.0.0 Bye

Connection closed by foreign host.

[kiosk@foundation7 Desktop]$ telnet 172.25.254.207 25

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail from:lzt@westos.com

250 2.1.0 Ok

rcpt to:root@westos.com

554 5.7.1 <lzt@westos.com>: Sender address rejected: Access denied

421 4.4.2 mailwestos.westos.com Error: timeout exceeded

Connection closed by foreign host.


解除后的实例测试:

[kiosk@foundation7 Desktop]$ telnet 172.25.254.207 25  

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail from:lzt@westos.com

250 2.1.0 Ok

rcpt to:root@westos.com

250 2.1.5 Ok

data

354 End data with <CR><LF>.<CR><LF>

kk

nn

.

250 2.0.0 Ok: queued as 9448717E81D

quit

221 2.0.0 Bye

Connection closed by foreign host.


8.不能接收邮件

cd /etc/postfix/

vim recipient

 user@域名 REJECT##表示禁止user接收邮件

如:

 lzt@westos.com REJECT##表示禁止用户lzt接收邮件

 postmap recipient

 postconf -d | grep recipient

@@ smtpd_recipient_restrictions =##此行为所需行

 postconf -e "smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/recipient"

 systemctl restart postfix.service 


解除:

vim recipient

删除 user@域名 REJECT

postmap recipient

systemctl restart postfix.service


实例:

[root@mailwestos postfix]# vim /etc/postfix/recipient##此文件需要自己建立

 修改内容为: lzt@westos.com REJECT

[root@mailwestos postfix]# postmap /etc/postfix/recipient

[root@mailwestos postfix]# postconf -d | grep recipient

smtpd_recipient_restrictions =

[root@mailwestos postfix]# postconf -e "smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/recipient"

[root@mailwestos postfix]# systemctl restart postfix.service 


实例测试:

[kiosk@foundation7 Desktop]$ telnet 172.25.254.207 25

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘.

220 mailwestos.westos.com ESMTP Postfix

mail from:root@westos.com

250 2.1.0 Ok

rcpt to:lzt@westos.com

554 5.7.1 <lzt@westos.com>: Recipient address rejected: Access denied

421 4.4.2 mailwestos.westos.com Error: timeout exceeded

Connection closed by foreign host.


做完实验后删除 /etc/postfix/main.cf 文件中 679 行之后的内容


#########邮件的收发(与图形化界面)#########

server端(172.25.254.207):

yum install dovecot -y

cd /etc/dovecot/

vim dovecot.conf

 24 protocols = imap pop3 lmtp

 48 login_trusted_networks = 0.0.0.0/0

 49 disable_plaintext_auth = no

cd conf.d/

vim 10-mail.conf

mail_location = mbox:~/mail:INBOX=/var/mail/%u

systemctl start dovecot

>/var/log/maillog


测试(在真机上):

yum install mutt -y

mutt -f imap://lzt@172.25.254.207


在server端查看日志:

cat /var/log/maillog

若报错信息为无法找到文件:Error:chown(/home/lzt/mail/.imap)

su - lzt

cd mail/

ls -a

mkdir .imap (执行完后,在真机上再次执行 mutt -f imap://lzt@172.25.254.207,若还是被拒绝,执行如下:)

查看日志:

cat /var/log/maillog 

若报错信息为无法找到文件:Error:chown(/home/lzt/mail/.imap/INBOX)

su - lzt

cd mail/.imap/

touch INBOX (执行完后,在真机上再次执行 mutt -f imap://lzt@172.25.254.207,此时应该可以看到用户 lzt 的邮件)


在desktop端(172.25.254.107):

cd /mnt/

yum install lftp -y

lftp 172.25.254.250

lftp 172.25.254.250:~>cd pub/docs/software/

lftp 172.25.254.250:/pub/docs/software> get thunderbird-31.4.0.tar.bz2

tar jxf thunderbird-31.4.0.tar.bz2

cd  thunderbird/

@@{

./thunderbird 

(执行完后会出现,环境不支持的信息,如:-bash:./thunderbird:/lib/ld-linux.so.2:bad ELF:NO such file)

执行:

yum whatprovides /lib/ld-linux.so.2 

执行完后,会出现支持环境的软件,如:

Loaded plugins: langpacks

glibc-2.17-55.el7.i686 : The GNU libc libraries

执行:

yum install glibc-2.17-55.el7.i686 -y

}@@

重复执行上述@@{}@@中的内容,知道下载好所有的环境支持

此时,再次执行 ./thunderbird 若还是出现报错

(若环境支持已经确定全部做完,极有可能是因为是使用 ssh 服务时没有加 -X 即,没有开启图形支持,退出后 logout ,重新连接 ssh root@172.25.254.107 -X,再次执行 ./thunderbird 会开启图形界面) 

进入 "雷鸟" 图形页面后:

您的大名:lzt##此处的名字为 server 端虚拟机里的用户,用的时server机里本地用户名称

电子邮件地址:lzt@westos.com

密码: 空 

点击"确定"

    服务器主机名称SSL认证

收件: IMAP  172.25.254.207143自动侦测

寄件: SMTP  172.25.254.20725自动侦测

使用者名称: 收件: lzt寄件:lzt

点击"重新测试"--> "完成"

此时图形化界面已配置好

(图形界面里不能加入 root 用户,一般 student 用户可不加入,因为系统对其有特殊设置)


#######postfix + mysql######


server端(172.25.254.207):

yum install mariadb-server -y

systemctl start mariadb

yum install httpd php php-mysql -y

cd /var/www/html/

yum install lftp

lftp 172.25.254.250

lftp 172.25.254.250:~>cd pub/docs/software/

lftp 172.25.254.250:/pub/docs/software> get phpMyAdmin-3.4.0-all-languages.tar.bz2

tar jxf phpMyAdmin-3.4.0-all-languages.tar.bz2

mv phpMyAdmin-3.4.0-all-languages/ myadmin

cd myadmin

cp config.sample.inc.php config.inc.php

vim config.inc.php

17 $cfg[‘blowfish_secret‘] = ‘westos‘; (此处‘‘号内可添加任意字符)

systemctl start httpd 

(若服务长时间起不来,编辑文件 /etc/hosts --> 172.25.254.207 mailwestos.westos.com, 然后重启服务: systemctl start httpd)

systemctl restart mariadb@@@一定要重启

mysql_secure_installation 

/usr/bin/mysql_secure_installation: line 379: find_mysql_client: command not found

Set root password? [Y/n] 

New password: ##输入密码

Re-enter new password: ##确认密码

Password updated successfully!

Reloading privilege tables..


 ... Success!


Remove anonymous users? [Y/n] ##回车

 ... Success!


Disallow root login remotely? [Y/n] ##回车

 ... Success!


Remove test database and access to it? [Y/n]  ##回车

 - Dropping test database...

 ... Success!

 - Removing privileges on test database...

 ... Success!


Reload privilege tables now? [Y/n]  ##回车

 ... Success!


此时在desktop或者真机浏览器里输入: 172.25.254.207/myadmin 然后选择中文模式

新建数据库: email

在 email 库里新建数据表,名为:muser 字段数:4

字段类型长度/值默认

usernameVARCHAR50

passwordVARCHAR50

domainVARCHAR50

maildirVARCHAR100

给数据表里添加信息

usernameVARCHAR(50)admin@westos.org

passwordVARCHAR(50)123

domainVARCHAR(50)westos.org

maildirVARCHAR(100)westos.org/admin/(注意:此处的admin一定要写为目录: admin/)


切换回server端:

mysql -uroot -predhat

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 2

MariaDB [(none)]> CREATE USER postfix@localhost identified by ‘postfix‘;

Query OK, 0 rows affected (0.00 sec)


MariaDB [(none)]> GRANT INSERT,UPDATE,SELECT on email.* to postfix@localhost;

Query OK, 0 rows affected (0.00 sec)


MariaDB [(none)]> quit



cd /etc/postfix

vim mysql-users.cf 内容为:

hosts = localhost

user = postfix

password = postfix

dbname = email

table = muser

select_field = username

where_field = username   


postmap -q "admin@westos.org" mysql:/etc/postfix/mysql-users.cf

cp -p mysql-users.cf mysql-domain.cf

vim mysql-domain.cf 修改最后两行内容为:

select_field = domain

where_field = domain


postmap -q "westos.org" mysql:/etc/postfix/mysql-domain.cf

cp -p mysql-users.cf mysql-domain.cf

vim mysql-domain.cf 修改最后两行内容为:

select_field = maildir

where_field = username


postmap -q "admin@westos.org" mysql:/etc/postfix/mysql-maildir.cf


groupadd vmail -g 666

useradd -u 666 -g 666 vmail -s /sbin/nologin

postconf -d | grep virtual

postconf -e "virtual_gid_maps = static:666"

postconf -e "virtual_uid_maps = static:666"

postconf -e "virtual_mailbox_base = /home/vmail"

postconf -e "virtual_alias_mps = mysql:/etc/postfix/mysql-users.cf"

postconf -e "virtual_mailbox_domains = mysql:/etc/postfix/mysql-domain.cf"

postconf -e "virtual_mailbox_maps = mysql:/etc/postfix/mysql-maildir.cf"


mail admin@westos.org

cd /home/vmail/westos.org/admin

ls 结果为: cur new tmp

cat new/(tab补齐)##进行查看邮件


cd /etc/dovecot/

vim dovecot.conf

 24 protocols = imap pop3 lmtp

 48 login_trusted_networks = 0.0.0.0/0

 49 disable_plaintext_auth = no

cd /etc/dovecot

cd conf.d/

vim 10-auth.conf 修改内容为:

第 123 行  !include auth-sql.conf.ext


cd /usr/share/doc/dovecot-2.2.10/example-config/

cp dovecot-sql.conf.ext /etc/dovecot/

cd /etc/dovecot/


vim dovecot-sql.conf.ext 修改内容为:

 32 driver = mysql

 71 connect = host=localhost dbname=email user=postfix password=postfix

 78 default_pass_scheme = PLAIN

107 password_query = \

108   SELECT username, domain, password \

109   FROM muser WHERE username = ‘%u‘ AND domain = ‘%d‘

125 user_query = SELECT maildir, 666 AS uid, 666 AS gid FROM muser WHERE username =     ‘%u‘


cd conf.d/

vim 10-mail.conf 修改内容为:

 30 mail_location = maildir:/home/vmail/%d/%n

168 first_valid_uid = 666

175 first_valid_gid = 666

systemctl restart dovecot.service


telnet 172.25.254.207 110  

如果报错信息为:

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘

-ERR Disconnected:Auth process broken


那么执行:

yum search dovecot

yum install dovecot-mysql.x86_64 -y


然后再执行:

telnet 172.25.254.207 110  

会出现下列信息:

Trying 172.25.254.207...

Connected to 172.25.254.207.

Escape character is ‘^]‘

+OK [XCLIENT] Dovecot ready.##表示 110 端口正常

user admin@westos.org

+OK 

pass 123

+OK Logged in.

quit

+OK Logged out.##表示 mysql 连接正常


在dsktop端(172.25.254.107):(连接时使用 ssh root@172.25.254.107 -X)

cd /mnt/thunderbird/

执行:

./thunderbird 

进入 "雷鸟" 图形页面

进入"设定"-->添加新的电子邮件账户

您的大名: admin@westos.org##此处的名字为 mysql 里的用户,用的时 数据库email库中muser表中的用户名称

电子邮件地址:admin@westos.com

密码: 空 

点击"确定"

    服务器主机名称SSL认证

收件: IMAP  172.25.254.207143自动侦测

寄件: SMTP  172.25.254.20725自动侦测

使用者名称: 收件: admin@westos.org寄件:admin@westos.org

点击"重新测试"--> "完成"


在mysql的图形化界面往email库的muser表里添加:

usernameVARCHAR(50)lp@westos.org

passwordVARCHAR(50)123

domainVARCHAR(50)westos.org

maildirVARCHAR(100)westos.org/lp/(注意:此处的admin一定要写为目录: lp/)

切换回server端:

mail lp@westos.org##相当于激活lp用户


再次在dsktop端(172.25.254.107):(连接时使用 ssh root@172.25.254.107 -X)

cd /mnt/thunderbird/

执行:

./thunderbird 

进入 "雷鸟" 图形页面

进入"设定"-->添加新的电子邮件账户

您的大名: lp@westos.org##此处的名字为 mysql 里的用户,用的时 数据库email库中muser表中的用户名称

电子邮件地址:lp@westos.com

密码: 空 

点击"确定"

    服务器主机名称SSL认证

收件: IMAP  172.25.254.207143自动侦测

寄件: SMTP  172.25.254.20725自动侦测

使用者名称: 收件: lp@westos.org寄件:lp@westos.org

点击"重新测试"--> "完成"

!!!@@@在此页面可以互发邮件进行验证



##########空壳邮件#######

空壳:由于 mta(电子邮件服务器)不能裸露在网络中,因此,给其寻找一个代理(替身--172.25.254.107)。其职责为:只负责接收邮件,将接收的邮件转发给真正的 mta (172.25.254.207)

在desktop端(172.25.254.107 maillinux.linux.com):

vim /etc/named.rfc1912.zones  添加内容:

 37 zone "westos.org" IN {

 38         type master;

 39         file "westos.org.zone";

 40         allow-update { none; };

 41 };


cd /var/named/

cp -p westos.com.zone westos.org.zone

vim westos.org.zone  修改内容为:

  1 $TTL 1D

  2 @       IN SOA  dns.westos.org. root.westos.org. (

  3                                         0       ; serial

  4                                         1D      ; refresh

  5                                         1H      ; retry

  6                                         1W      ; expire

  7                                         3H )    ; minimum

  8                 NS      dns.westos.org.

  9 dns             A       172.25.254.107

 10 westos.org.     MX 1    172.25.254.107.

                                      

systemctl restart named

mv /etc/postfix /mnt/

yum reinstall postfix.x86_64 -y

vim /etc/postfix/main.cf  修改内容为:

75 myhostname = maillinux.linux.com##自身的名字

83 mydomain = linux.com##自身的域名

98 myorigin = westos.org##邮件的来源

113 inet_interfaces = all##打开所有接口

116 #inet_interfaces = localhost

140 local_transport = error:local delivery disable##空壳报错

164 mydestination =##不处理任何文件

313 relayhost = 172.25.254.207##转发邮件的目的地址


systemctl restart postfix.service 

systemctl status postfix.service


在server端(172.25.254.207 mailwestos.westos.com):

systemctl stop firewalld

setenforce 0

systemctl start mariadb

systemctl start dovecot

vim /etc/postfix/main.cf 修改内容为:

264 mynetworks = 172.25.254.0/24 或者 此处 ip 也可为 172.25.254.107 ##接收空壳发送的邮件


systemctl restart postfix.service

cd /home/vmail/

rm -fr westos.org


测试-在desktop端(172.25.254.107):

[root@maillinux named]# mail admin@westos.org

mail admin@westos.org

Subject: oooo

cccc

.

EOT


验证-在server端(172.25.254.207):

[root@mailwestos ~]# cd /home/vmail

[root@mailwestos vmail]# ls

westos.org

[root@mailwestos vmail]# cd westos.org/

[root@mailwestos westos.org]# cd admin/

[root@mailwestos admin]# cd new/

[root@mailwestos new]# ls

1480776239.Vfd01I26fe28M583680.mailwestos.westos.com##表示成功接收从空壳转发的邮件,即,从 空壳 (172.25.254.107)转发的邮件发送成功


@@@@查询extmail


######################apache#################################

lamp = linux + apache + mysql + php

lnmp = linux + nginx + mysql + php

nginx 提供共享服务


curl -I 域名##查看域名使用服务的信息

如: curl -I www.baidu.com

    curl -I baidu.com


nmap ## 全称(Network Mapper),Linux下的网络扫描和嗅探工具包。

nmap的下载: yum install nmap -y

nmap示例: nmap -A www.xupt.edu.cn


jsp## Java Server Pages -- java服务器页面

asp## Active Server Pages -- MicroSOFT公司开发的服务器端脚本环境

cgi## Common Gateway Interface -- 公共网关接口(有不同含义)


中间键(翻译),由于apache和nginx不能识别 jsp 和 asp:

tomcat## Apache 开发的免费开放源代码的Web应用服务器 

jboss## 基于J2EE的开放源代码的应用服务器


squid##缓冲 Internet 数据的软件

正向代理:客户知道向谁去索取,分为:1.传统代理  2.透明代理(较常使用)

反向代理:客户需求什么,服务软件去拿什么



!!!@@@在desktop端(172.25.254.107):

hostnamectl set-hostname web1.westos.com

yum install httpd -y

cd /var/www/html/

systemctl start httpd

vim /etc/httpd/conf/httpd.conf 修改内容为:

166 <IfModule dir_module>

167     DirectoryIndex file index.html ##此处在默认发布目录/var/www/html下 file,index.html两个文件,哪个在前,哪个优先看,如果两个文件都没有,则在浏览器显示的界面为apache的测试页面

168 </IfModule>


yum install httpd-manual.noarch -y##manual为httpd服务的使用手册

将默认发布目录(/var/www/html/)改变为 /www/westos/ :

cd /var/www/html

ls -Zd .

显示结果: drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 .

mkdir /www/westos/ -p 

semanage fcontext -a -t httpd_sys_content_t ‘/www/westos(/.*)?‘

restorecon -RvvF /www/

显示结果:

restorecon reset /www context unconfined_u:object_r:default_t:s0->system_u:object_r:default_t:s0

restorecon reset /www/westos context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0


vim /etc/httpd/conf/httpd.conf 修改内容为:

119 #DocumentRoot "/var/www/html"

120 DocumentRoot "/www/westos"

121 <Directory "/www/westos">

122     Require all granted

123 </Directory>


cd /www/westos/

vim index.html 编辑内容为: /www/westos/

systemctl restart httpd


查看端口:

查看监听端口:

ss -antlp |grep httpd

LISTEN0128:::80:::*

vim /etc/httpd/conf/httpd.conf 查看内容为:

41 #Listen 12.34.56.78:80

42 Listen 80##apache默认端口为 80 端口


如若改变文件/etc/httpd/conf/httpd.conf中的第 42 行为:

42 Listen 8080##在浏览器测试时需要输入 ip:8080 ,例如:172.25.254.107:8080


##访问权限(黑白名单):

vim /etc/httpd/conf/httpd.conf 修改内容为:

121 <Directory "/www/westos">

122     Require all granted

123     Order Deny,Allow##Deny,Allow 谁在前,先读谁(一般默认Allow在前)

124     Allow from 172.25.254.0/24##表示允许 172.25.254.x 网段的所有人访问

125     Deny from ALL ##表示拒绝所有人访问

126 </Directory>


正常设置为:

vim /etc/httpd/conf/httpd.conf 修改内容为:

121 <Directory "/www/westos">

122     Require all granted

123     Order Allow,Deny##Deny,Allow 谁在前,先读谁(一般默认Allow在前)

124     Allow from ALL##表示允许所有人访问

125     Deny from 172.25.254.1##表示拒绝 172.25.254.1 访问

126 </Directory>


如果设置如下:  结果为 --> 谁都访问不了 @@因为后读 Deny,从而禁止了所有人

122     Require all granted

123     Order Allow,Deny##Deny,Allow 谁在前,先读谁(一般默认Allow在前)

124     Allow from 172.25.254.0/24##表示允许 172.25.254.x 网段的所有人访问

125     Deny from ALL ##表示拒绝所有人访问

126 </Directory>


设置用户访问权限:

 cd /etc/httpd/

 htpasswd -cm htpasswdfile admin## -c 表示 create--建立

 htpasswd -m htpasswdfile lee##第二次执行不用加 -c ,若加了 -c 会覆盖第一次建立的用户信息

 vim /etc/httpd/conf/httpd.conf 修改内容为:

121 <Directory "/www/westos">

122 #    Require all granted

123         AllowOverride All##

124         Authuserfile /etc/httpd/htpasswdfile##用户信息所在的文件

125         Authname "Please input username & password"##提示信息

126         Authtype basic##基本认证类型

127         Require user admin##此处表示只允许使用用户 admin 在浏览器中访问

128 #    Order Deny,Allow

129 #   Allow from 172.25.254.0/24

130 #  Deny from ALL 

131 </Directory>

systemctl restart httpd.service 


若要允许 /etc/httpd/htpasswdfile文件中的全部用户,vim /etc/httpd/conf/httpd.conf 修改内容为:

127         Require valid-user##允许 /etc/httpd/htpasswdfile 文件中的全部用户

systemctl restart httpd.service 


## apache的虚拟主机

vim vim /etc/httpd/conf/httpd.conf 修改内容为:

119 DocumentRoot "/var/www/html"

120 #DocumentRoot "/www/westos"

121 <Directory "/www/westos">


mkdir /var/www/virtual/news.westos.com/html -p

mkdir /var/www/virtual/music.westos.com/html -p

cd /var/www/virtual/music.westos.com/html/

vim index.html 编辑添加内容为: 这里是music


cd /var/www/virtual/news.westos.com/html/

vim index.html 编辑添加内容为: 这里是news


vim vim /etc/httpd/conf/httpd.conf 进行查看文件该编辑的地方(364 行)与应该注意的地方(269 行):

269     Require all granted

364 IncludeOptional conf.d/*.conf


cd /etc/httpd/conf.d/

vim default.conf 修改内容为:

  1 <Virtualhost _default_:80>

  2         Documentroot /var/www/html

  3         Customlog "logs/default.log" combined##此处的

  4 </Virtualhost>

  5 <Directory "/var/www/html">

  6         Require all granted##此处 all 一定要为小写,否则重启httpd服务会报错

  7 </Directory>


vim music.conf 修改内容为:

  1 <Virtualhost *:80>

  2         Servername music.westos.com

  3         Documentroot /var/www/virtual/music.westos.com/html

  4         Customlog "logs/music.log" combined

  5 </Virtualhost>

  6 <Directory "/var/www/virtual/music.westos.com/html">

  7         Require all granted##此处 all 一定要为小写,否则重启httpd服务会报错

  8 </Directory>


vim news.conf 修改内容为:

  1 <Virtualhost *:80>

  2         Servername news.westos.com

  3         Documentroot /var/www/virtual/news.westos.com/html

  4         Customlog "logs/news.log" combined

  5 </Virtualhost>

  6 <Directory "/var/www/virtual/news.westos.com/html">

  7         Require all granted##此处 all 一定要为小写,否则重启httpd服务会报错

  8 </Directory>

systemctl restart httpd

重启服务成功后


虚拟主机的测试(在 server 端 172.25.254.207): ssh root@172.25.254.207 -X

vim /etc/hosts 在末尾行添加内容为:

172.25.254.107 www.westos.com westos.com music.westos.com news.westos.com

firefox --> 在浏览器中输入不同的域名 如:www.westos.com 或 westos.com 或 music.westos.com 或 news.westos.com --> 会出来不同的界面


浏览器清空缓存:

ctrl + shift + delete


##### https ####

cd /etc/httpd/conf.d/

yum install mod_ssl -y

systemctl restart httpd

netstat -antlpe | grep 443  结果如下:

tcp6       0      0 :::443                  :::*                    LISTEN      0          200312     14305/httpd         

yum install crypto-utils.x86_64 -y

进入图形界面后 --> NEXT --> 1024 --> NEXT --> 正在生成(此时需要敲键盘,动鼠标)--> NO --> NEXT --> 填写信息 --> NEXT(执行完后会为退出图形界面) ##执行完后,会生成 /etc/pki/tls/certs/www.westos.com.crt 和 /etc/pki/tls/private/www.westos.com.key 两个文件

cd /etc/httpd/conf.d/

vim  ssl.conf 修改内容为:

100 SSLCertificateFile /etc/pki/tls/certs/www.westos.com.crt##此处为上述生成的文件

107 SSLCertificateKeyFile /etc/pki/tls/private/www.westos.com.key##此处为上述生成的文件

systemctl restart httpd


测试(server 端 172.25.254.207):

打开浏览器 --> https://172.25.254.107 查看证书


本文出自 “12097560” 博客,请务必保留此出处http://12107560.blog.51cto.com/12097560/1880485

笔记十