Ku rakib Apache CentOS7

Tixraac rasmi ah

Samee rakibo

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd
        

Wax ka beddel feylka qaabeynta

Ka dib marka rakibidu dhammaato, waxaan u baahannahay inaan waxoogaa ka beddelo feylka qaabeynta. Waxyaabaha wax ka beddelka gaarka ah badanaa waxaa ka mid ah: ku xiran IP iyo dekedda, gudbinta gzip compression, tirada isku xirnaanta isku midka ah, iyo SSL. Aynu mid mid ugu sharaxno hoos.

Wax ka beddel IP-ga ku xidhan iyo dekedda

IP-ga caadiga ah iyo dekedda uu Apache dhagaysto waa 0.0.0.0:80. Haddii aan u baahanahay inaan wax ka beddelno kormeerka IP-ga iyo dekedda, si toos ah ayaan wax uga beddeli karnaa. Haddii aan u baahanahay inaan xirno dekedo badan, sidoo kale waan ku dari karnaa. Tusaalaha soo socda, waxaan ku xirnaa dekadaha 80 iyo 443. Port 443 waa lambarka dekedda ee HTTPS.

            Listen 80
Listen 443 https
        

Fur gudbinta gzip

Sababtoo ah waxqabadka kumbuyuutarka ee kumbuyuutarradeedu aad buu u sarreeyaa, badiyaa cidhiidhiga ayaa ka soo muuqan doona shabakadda ballaadhinta, markaa waxaan dooran karnaa inaan shidno gudbinta gzip compression. Waxaa jira 9 heer oo isku-riixid ah.Waxaan dooran karnaa iyadoo loo eegayo waxqabadka adeegeena oo aan helno heerka ugu habboon. Tusaalaha hoose, waxaan u dejinnay heerka 1. Noocyada faylka ee la isku adkeeyay ayaa kala ah: html, xml, php, css, js, waxaan sidoo kale ku dari karnaa noocyada feylasha ee la cadaadiyey markii loo baahdo.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>
        

Samee KeepAlive

Shaqada shirkadda 'KeepAlive' waa inay macmiilka iyo adeegeedu ku xirnaadaan muddo. Markii aan furano degel, waxaan badanaa ubaahan nahay inaan sooxirno waxyaabaha ugu muhiimsan, js, css, iyo sawirada.Maadaama kheyraad kastaa ubaahan yahay inuu bilaabo codsi HTTP gooni ah, waxaan awood u siineynaa KeepAlive inay yareyso waqtiga loo baahan yahay codsi kasta si loo dhiso xiriiriyaha TCP / IP. Laakiin KeepAlive sidoo kale waxay leedahay cillado.Waxay sababi doontaa in kheyraadka IO ee server-ka la mashquuliyo, marka waxaan u baahanahay inaan kala dooranno inaan u oggolaanno KeepAlive hadba xaaladda dhabta ah. Haddii KeepAlive la shaqeysiiyo, waxaan sidoo kale u baahanahay inaan u dhigno waqti macquul ah si aan uga fogaanno in server IO lagu mashquuliyo muddo dheer. Tusaalaha soo socdaa wuxuu kakoobanyahay dhowr goobood oo muhiim ah oo ah KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5
        

Isku habee tirada isku mar

Isku dheelitir macquul ah ee tirada isla mar ahaantaana waxay si weyn u wanaajin kartaa soo gudbinta serverka. Badanaa Apache-keena wuxuu ku shaqeeyaa qaabka mpm_prefork. Waxaan u baahannahay inaan si macquul ah u qaabeyno dhowr xuddun oo muhiim ah. Waxa aan u baahannahay inaan fiiro gaar ah u yeelanno ayaa ah in tirada ugu badan ee iskuxirayaashu aysan noqon mid aad u yar, oo aad u yar ayaa sababi doonta in tiro badan oo ka mid ah codsiyada isticmaalaha la diido marka isku xirnaanta ay sarreyso. Qiimaha macquulka ah ee aan dejineyno waa inuu tixraacaa processor-ka iyo xasuusta serverka Ilaa iyo inta kheyraadku nagu filan yahay, waa inaan u dhignaa sida ugu macquulsan, laakiin hadii aan si aad u weyn u dhigno, kaydka adeegaha wuu daalayaa Apache sidoo kale wuu burburayaa.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>
        

Deji SSL

Bogagga intarnetka badankood hadda waxay leeyihiin awood SSL si ay u taageeraan HTTPS isku xirnaanta sugan. Faa'iidada HTTPS ayaa ah in waxyaabaha ku jira inta lagu jiro gudbinta ay yihiin kuwo sir ah, sidaa darteed looma baahna in laga walwalo baxsiga macluumaadka sababo la xiriira dhexgalka dadka kale. Kahor inta aanad awood siinin SSL, waa inaan marka hore codsano shahaado.Marka aan helno shahaadada, tixraac qaabeynta soo socota si aad u buuxiso goobaha SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>