Faka i-Apache kwi-CentOS7

2021-01-10 CentOS7 Apache HTTPS Gzip

Isalathiso esisemthethweni

Iwebhusayithi esemthethweni Amaxwebhu eMveliso HTTPS Gzip

Yenza ufakelo

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd

Guqula ifayile yoqwalaselo

Emva kokuba ufakelo lugqityiwe, kufuneka senze uhlengahlengiso kwifayile yoqwalaselo. Umxholo othile wokulungiswa uhlala ubandakanya: ukubopha i-IP kunye nezibuko, ukuhanjiswa koxinzelelo lwe-gzip, inani lonxibelelwano olufanayo, kunye ne-SSL. Masicacise nganye nganye ngezantsi.

Guqula i-IP ebotshiweyo kunye nezibuko

I-IP emiselweyo kunye nezibuko i-Apache emameleyo yi-0.0.0.0:80. Ukuba sifuna ukuguqula i-IP ebekwe esweni kunye nezibuko, sinokuyiguqula ngokuthe ngqo. Ukuba sifuna ukubopha amazibuko amaninzi, sinokongeza kubo. Kumzekelo olandelayo, sibopha izibuko 80 no 443. Izibuko 443 linombolo yezibuko emiselweyo ye-HTTPS.

            Listen 80
Listen 443 https

Vula ukuhanjiswa kwe-gzip

Kuba ukusebenza kwecompyuter yethu ye-CPU kuphezulu kakhulu, ihlala i-bottleneck iya kubonakala kwi-bandwidth yenethiwekhi, ngenxa yoko sinokukhetha ukuvula ukuhanjiswa koxinzelelo lwe-gzip. Kukho amanqanaba angama-9 okucinezelwa Sinokukhetha ngokokusebenza kweseva yethu kwaye sifumane elona nqanaba lifanelekileyo. Kumzekelo ongezantsi, sayibeka kwinqanaba 1. Iindidi zeefayile ezixineneyo zezi: html, xml, php, css, js, sinokongeza iintlobo zeefayile ezixineneyo njengoko kufuneka.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>

Cwangcisa i-KeepAlive

Umsebenzi we-KeepAlive kukugcina umxhasi kunye nomncedisi exhunyiwe ixesha elithile. Xa sivula iphepha lewebhu, sihlala sidinga ukulayisha owona mxholo uphambili, js, css, kunye nemifanekiso. Kodwa i-KeepAlive ikwanazo neengxaki, izakubangela ukuba izibonelelo zeseva ze-IO zixakeke, kungoko kufuneka sikhethe ukuba i-KeepAlive iyayenza na imeko leyo. Ukuba i-KeepAlive yenziwe, kufuneka kwakhona ukuba siyisete ixesha lokuphumla ukuze kuthintelwe ukuba i-IO iseva ixesha elide. Lo mzekelo ulandelayo uqulethe izicwangciso eziphambili ze-KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5

Qwalasela inani elifanayo

Uqwalaselo olufanelekileyo lwenani ngaxeshanye linokuphucula kakhulu ukuphuma kweserver. Ngokwesiqhelo iApache yethu isebenza kwimowudi mpm_prefork. Kufuneka simisele ngokufanelekileyo iiparameter eziphambili. Into ekufuneka siyithathele ingqalelo kukuba elona nani liphezulu lonxibelelwano akufuneki libe lincinci kakhulu, lincinci kakhulu liya kubangela inani elikhulu lezicelo zomsebenzisi ukuba zaliwe xa ikhonkrithi iphezulu. Ixabiso elifanelekileyo esilisetayo kufuneka libhekise kwi-CPU yomncedisi kunye nememori.Ukuba nje izixhobo zanele, kufuneka sizibeke zinkulu ngangokunokwenzeka, kodwa ukuba sibeka kakhulu, izixhobo zeseva ziya kudinwa kwaye i-Apache nayo iya kuphazamiseka.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>

Qwalasela i-SSL

Uninzi lwewebhu ngoku zinikwe i-SSL ukuxhasa uqhagamshelo olukhuselekileyo lwe-HTTPS. Uncedo lwe-HTTPS kukuba umxholo ngexesha lokuhambisa u-encrypted, ke akukho sidingo sokukhathazeka malunga nokuvuza kolwazi ngenxa yokuqhawulwa ngabanye. Ngaphambi kokwenza i-SSL isebenze, kufuneka kuqala sifake isicelo sesatifikethi, emva kokuba sifumene isatifikethi, jonga kolu luhlu lulandelayo ukuze sigqibe useto lwe-SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>