Fi Afun sori CentOS7

2021-01-10 CentOS7 Apache HTTPS Gzip

Official itọkasi

Oju opo wẹẹbu osise Iwe Akọsilẹ Ọja HTTPS Gzip

Ṣe fifi sori ẹrọ

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd

Ṣe atunṣe faili iṣeto

Lẹhin fifi sori ẹrọ ti pari, a nilo lati ṣe diẹ ninu awọn iyipada si faili iṣeto. Akoonu iyipada kan pato nigbagbogbo pẹlu: IP ti a dè ati ibudo, gbigbe fifun pọ gzip, nọmba awọn isopọ nigbakan, ati SSL. Jẹ ki a ṣalaye wọn lẹẹkọọkan ni isalẹ.

Ṣe atunṣe IP ati ibudo ti a dè

IP aiyipada ati ibudo ti Afun ti tẹtisi jẹ 0.0.0.0:80. Ti a ba nilo lati yipada IP abojuto ati ibudo, a le ṣe atunṣe taara. Ti a ba nilo lati di awọn ibudo pupọ pọ, a tun le ṣafikun wọn. Ninu apẹẹrẹ atẹle, a sopọ awọn ibudo 80 ati 443. Port 443 jẹ nọmba ibudo aiyipada fun HTTPS.

            Listen 80
Listen 443 https

Ṣii gbigbe gzip

Nitori iṣẹ Sipiyu ti kọnputa wa jẹ giga giga, nigbagbogbo igo kekere yoo han ninu bandiwidi nẹtiwọọki, nitorinaa a le yan lati tan-an gbigbe fifunpọ gzip. Awọn ipele funmorawon wa 9. A le yan ni ibamu si iṣẹ ti olupin wa ati rii ipele ti o dara julọ julọ. Ninu apẹẹrẹ ni isalẹ a ṣeto si ipele 1. Awọn iru faili fisinuirindigbindigbin ni: html, xml, php, css, js, a tun le ṣafikun awọn iru faili fisinuirindigbindigbin bi o ti nilo.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>

Ṣeto KeepAlive

Iṣẹ ti KeepAlive ni lati jẹ ki alabara ati olupin sopọ mọ fun akoko kan. Nigbati a ba ṣii oju-iwe wẹẹbu kan, igbagbogbo a nilo lati fifuye akoonu akọkọ, js, css, ati awọn aworan. Niwon igbati orisun kọọkan nilo lati bẹrẹ ibeere HTTP ọtọ, a jẹ ki KeepAlive dinku akoko ti o nilo fun ibeere kọọkan lati fi idi ọna asopọ TCP / IP kan mulẹ. Ṣugbọn KeepAlive tun ni awọn abawọn O yoo fa ki awọn orisun IO olupin naa wa ni idaduro, nitorinaa a nilo lati yan boya lati jẹki KeepAlive ni ibamu si ipo gangan. Ti o ba ti ṣiṣẹ KeepAlive, a tun nilo lati ṣeto asiko to tosi fun o lati yago fun olupin IO ti o wa fun igba pipẹ. Apẹẹrẹ atẹle ni ọpọlọpọ awọn eto akọkọ ti KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5

Tunto nọmba ti igbakanna

Iṣeto ni oye ti nọmba ti nigbakan le mu ilọsiwaju ti olupin pọsi pupọ. Nigbagbogbo Apache wa n ṣiṣẹ ni ipo mpm_prefork. A nilo lati tunto ni idi pupọ awọn ipilẹ bọtini. Ohun ti a nilo lati fiyesi si ni pe nọmba ti o pọ julọ ti awọn isopọ ko yẹ ki o kere ju, o kere ju yoo fa ki a kọ nọmba nla ti awọn ibeere olumulo nigbati kọsọpọ ba ga. Iye oye ti a ṣeto yẹ ki o tọka si Sipiyu olupin ati iranti. Niwọn igba ti awọn orisun naa ti to, o yẹ ki a ṣeto rẹ bi o ti ṣee ṣe, ṣugbọn ti a ba ṣeto rẹ ti o tobi ju, awọn orisun olupin yoo rẹ ati Apache yoo tun jamba.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>

Tunto SSL

Pupọ awọn oju opo wẹẹbu ni bayi ti muu SSL ṣiṣẹ lati ṣe atilẹyin HTTPS awọn isopọ to ni aabo. Anfani ti HTTPS ni pe akoonu lakoko gbigbe ti wa ni ti paroko, nitorinaa ko si ye lati ṣe aniyan nipa jijo alaye nitori kikọlu nipasẹ awọn miiran. Ṣaaju ki o to muu SSL ṣiṣẹ, a gbọdọ kọkọ beere fun ijẹrisi kan Lẹhin ti a ba gba iwe-ẹri naa, tọka si iṣeto ni atẹle lati pari awọn eto SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>