Faʻapipiʻi Apache ile CentOS7

2021-01-10 CentOS7 Apache HTTPS Gzip

Faʻamatalaga aloaʻia

'Upega tafaʻilagi aloaʻia Pepa faʻamaumauga HTTPS Gzip

Faatino faapipiiina

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd

Fesuiaʻi le faila faʻatulagaina

A maeʻa le faʻapipiʻiina, e manaʻomia ona tatou faia ni suiga i le faila faʻatulagaina. O le faʻapitoa faʻapitoa suiga mataupu masani lava ona aofia ai: fusifusia IP ma taulaga, gzip faʻamamaina faʻasalalauina, numera o tutusa fesoʻotaʻiga, ma SSL. Seʻi tatou faʻamatalaina taʻitasi i lalo.

Faʻaleleia le IP fusifusia ma le taulaga

O le IP faaletonu ma le uafu e faʻalogo iai Apache o le 0.0.0.0:80. Afai tatou te manaʻomia le toe faʻaleleia o le IP mataituina ma le uafu, e mafai ona tatou toe faʻalelei saʻo. Afai matou te manaʻomia le fusifusia o le tele o taulaga, e mafai foi ona tatou faʻaopopoina. I le faʻataʻitaʻiga lenei, matou te fusifusia taulaga 80 ma 443. Ole Port 443 ole numera uafu le aoga mo HTTPS.

            Listen 80
Listen 443 https

Tatala gzip auina atu

Talu ai o le tatou komepiuta CPU gaioiga e maualuga tele, e masani lava o le fagu o le a aliali mai i le upega tafaʻilagi bandwidth, ina ia mafai ai ona tatou filifili e ki i luga o gzip faʻamomosi transmisi. E i ai vaega e 9. O le faʻatonutonuina .. E mafai ona tatou filifili e tusa ma le faʻatinoga a le matou server ma saili le tulaga sili ona talafeagai. I le faʻataʻitaʻiga i lalo, matou setiina i le tulaga 1. O ituaiga faila faila o: html, xml, php, css, js, e mafai foi ona tatou faʻaopopoina faʻasolosolo faila faila pe a manaʻomia.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>

Faʻatulaga KeepAlive

O le gaioiga a KeepAlive o le taofia o le tagata maʻi ma le 'auʻauna tuʻufaʻatasia mo se vaitaimi o taimi. A matou tatalaina se 'upega tafaʻilagi, e masani ona manaʻomia le utaina o mea autu, js, css, ma ata, talu ai e manaʻomia e punaoa taʻitasi se isi talosaga HTTP, matou te faʻaavanoaina le KeepAlive e faʻaititia le taimi manaʻomia mo talosaga taʻitasi e faʻatu ai se TCP / IP fesoʻotaʻiga. Ae e iai foi drawbacks a KeepAlive, o le a mafua ai ona nofoia 'auʻaunaga a le' auʻaunaga IO, o lea e tatau ai ona tatou filifili pe faʻatagaina KeepAlive e tusa ai ma le tulaga moni. Afai e mafai le KeepAlive, e tatau foi ona tatou seti se taimi talafeagai mo ia e aloese ai mai le tautua IO mo se taimi umi. O le faʻataʻitaʻiga lea e aofia ai le tele o tulaga taua o KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5

Faʻatulaga le numera tutusa

O se fetuutuunaʻi faʻatulagaina o le numera o le tuʻufaʻatasia mafai ona sili atu le faʻaleleia o le throughput o le 'auʻaunaga. E masani lava o la matou Apache e galue i le mpm_prefork mode. Matou te manaʻomia le fetuʻunaʻi lelei faʻatulagaina autu. O le mea e tatau ona tatou mataala i ai o le aofaʻi maualuga o fesoʻotaʻiga e le tatau ona laʻititi, laʻititi e mafua ai le tele o numera o tagata faʻaoga e teena pe a maualuga le maliega. O le tau talafeagai na matou setiina e tatau ona faʻasino i le 'auʻauna CPU ma le manatuaina. Afai lava e lava le alagaʻoa, e tatau ona tatou setiina i le tele e mafai ai, ae afai tatou te setiina tele tele, o le sapalai punaoa o le a lelava ma Apache o le a faʻapea foi ona paʻu.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>

Faʻalelei le SSL

Tele o 'upega tafaʻilagi ua iai SSL faʻatagaina e lagolago HTTPS saogalemu faʻafesoʻotaʻiga. O le lelei o le HTTPS o le mea i le taimi o le faʻasalalauina ua faʻailogaina, o lea e leai se mea e popole ai e uiga i leakage faʻamatalaga ona o le faʻalavelaveina e isi. Ae e leʻi faʻatagaina le SSL, e tatau ona muamua talosaga mo se tusi pasi, pe a maeʻa ona maua le tusi pasi, tagaʻi i le faʻatonuga lenei e faʻamaeʻa ai tulaga SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>