Faka i-Apache ku-CentOS7

2021-01-10 CentOS7 Apache HTTPS Gzip

Isethenjwa esisemthethweni

Iwebhusayithi esemthethweni Imibhalo Yomkhiqizo HTTPS Gzip

Yenza ukufakwa

            yum -y install libmcrypt libmcrypt-devel mcrypt mhash
yum -y install httpd

Shintsha ifayela lokumisa

Ngemuva kokuthi ukufakwa kuqediwe, sidinga ukwenza okuthile kufayela lokumisa. Okuqukethwe kokuguqulwa okuthile kuvame ukufaka: i-IP eboshiwe nembobo, ukudluliswa kokucindezelwa kwe-gzip, inombolo yokuxhuma okufanayo, ne-SSL. Ake sizichaze ngamunye ngamunye ngezansi.

Shintsha i-IP eboshiwe nembobo

I-IP ezenzakalelayo nechweba i-Apache elilalelayo lingu-0.0.0.0:80. Uma sidinga ukuguqula i-IP kanye ne-port egadiwe, singakuguqula ngqo. Uma sidinga ukubopha amachweba amaningi, singakwazi futhi ukuwafaka. Esibonelweni esilandelayo, sibopha amachweba 80 no-443. IPort 443 yinombolo ethekwini ezenzakalelayo ye-HTTPS.

            Listen 80
Listen 443 https

Vula ukudluliswa kwe-gzip

Ngoba ukusebenza kwe-CPU yekhompyutha yethu kuphezulu kakhulu, imvamisa ibhodlela lizovela kumkhawulokudonsa wenethiwekhi, ngakho-ke singakhetha ukuvula ukudluliswa kokucindezelwa kwe-gzip. Kunamazinga we-9 wokucindezelwa.Singakhetha ngokuya ngokusebenza kweseva yethu bese sithola ileveli efaneleke kakhulu. Esibonelweni esingezansi, sisibeka ezingeni 1. Izinhlobo zamafayela ezicindezelwe yilezi: html, xml, php, css, js, futhi singangeza nezinhlobo zamafayela acindezelwe njengoba kudingeka.

            <IfModule mod_deflate.c>
    DeflateCompressionLevel 1
    AddOutputFilterByType DEFLATE text/html text/plain text/xml application/x-javascript application/x-httpd-php
    AddOutputFilter DEFLATE js css
</IfModule>

Setha i-KeepAlive

Umsebenzi we-KeepAlive ukugcina iklayenti neseva ixhunywe isikhathi esithile. Lapho sivula ikhasi lewebhu, imvamisa sidinga ukulayisha okuqukethwe okuyinhloko, i-js, i-css, nezithombe. Kepha i-KeepAlive ibuye ibe nezingqinamba .. Izodala ukuthi izinsiza zeseva ze-IO zihlale, ngakho-ke kudingeka sikhethe ukuthi sizonika i-KeepAlive amandla ngokwesimo sangempela. Uma i-KeepAlive inikwe amandla, kudingeka futhi ukuthi siyisethele isikhathi esikahle ukuze ivikele iseva IO ukuhlala isikhathi eside. Isibonelo esilandelayo siqukethe izilungiselelo eziningana eziyinhloko ze-KeepAlive.

            KeepAlive On
MaxKeepAliveRequests 400
KeepAliveTimeout 5

Lungiselela inombolo yesikhathi esifanayo

Ukucushwa okunengqondo kwenombolo yesikhathi esifanayo kungathuthukisa kakhulu ukuphuma kweseva. Imvamisa i-Apache yethu isebenza ngemodi mpm_prefork. Sidinga ukumisa ngokufanelekile imingcele ethile ebalulekile. Esikudinga ukunaka ukuthi inani eliphakeme lokuxhuma akumele libe lincane kakhulu, kuncane kakhulu kuzodala ukuthi inani elikhulu lezicelo zomsebenzisi linqatshwe lapho imali yemali iphezulu. Inani elifanele esizibekele lona kufanele libhekise ku-CPU yeseva nememori. Uma nje izinsizakusebenza zanele, kufanele siyisethe ibe nkulu ngangokunokwenzeka, kepha uma siyibeka ibe nkulu kakhulu, izinsizakusebenza zeseva zizophela futhi i-Apache nayo izoshayeka.

            <IfModule mpm_prefork_module>
    StartServers         10
    MinSpareServers      25
    MaxSpareServers      50
    ServerLimit          1500
    MaxClients           1000
    MaxRequestsPerChild  3000
</IfModule>

Lungiselela i-SSL

Iningi lamawebhusayithi manje selinikwe amandla i-SSL ukuxhasa ukuxhumana okuphephile kwe-HTTPS. Inzuzo ye-HTTPS ukuthi okuqukethwe ngesikhathi sokudlulisa kubhalwe ngemfihlo, ngakho-ke asikho isidingo sokukhathazeka ngokuvuza kolwazi ngenxa yokuvinjelwa abanye. Ngaphambi kokunika amandla i-SSL, kufanele siqale sifake isicelo sesitifiketi. Ngemuva kokuthola isitifiketi, bhekisa ekucushweni okulandelayo ukuqedela izilungiselelo ze-SSL.

            <VirtualHost *:443>
    ServerAdmin www.test.com
    ServerName www.testl.com
    DocumentRoot  /var/www/test
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLHonorCipherOrder on
    SSLCertificateFile /etc/httpd/conf/cert/public.crt
    SSLCertificateKeyFile /etc/httpd/conf/cert/1533528967430.key
    SSLCertificateChainFile /etc/httpd/conf/cert/chain.crt
    AllowEncodedSlashes on
    <Directory "/var/www/test.com">
         Options FollowSymLinks
         AllowOverride All
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>