概述：
承接上篇，本篇为介绍下利用rpm包，实现LAMP组合，其中httpd和php的结合方式为fastcgi，也就是php运行为独立的服务，监听的某个套接字上，接受请求，提供服务
包括LAMP安装过程（http、php-fpm、mysql-server、php-mysql）
https的实现
利用xcache提升php对动态内容的处理能力
环境
可以将httpd、php、mysql都装在一个主机上，也可以单独安装，本例中使用将三者分开,具体环境为：
准备安装httpd服务的系统为CentOS7系统，IP为10.1.32.72
准备安装php的系统为CentOS7系统，IP为10.1.32.73
准备安装mysql的系统为CentOS6系统，IP为10.1.32.68
第一部分 在10.1.32.72上安装httpd
1、安装httpd
2、对httpd进行简单配置，启动服务，看服务是否正常
第二部分 在10.1.32.73上安装php-fpm、php-mysql
php与httpd结合方式为fastcgi方式时，要安装的软件包不是php而是php-fpm
安装php连接mysql的php的扩展模块php-mysql
1、安装php-fpm、php-mysql
2、对php-fpm进行简单配置，让其能与前端httpd连接
3、确保httpd的proxy模块被装载，修改httpd的配置文件，让httpd接收到的php请求，都代理至php-fpm的主机上进行处理
本处，我们将原有的httpd原有的中心主机注销，利用新建虚拟主机来实现
4、在php-fpm服务器上，提供php测试页面，进行访问测试
因为前端httpd服务接收到用户对php页面的请求时，是直接将请求转交给php来处理，所以，php的页面资源应该存放在php自身的服务器上
测试访问
5、查看php-fpm的状态页面和ping测试页面
编译httpd的配置文件，让httpd将对php的status页面的请求和ping测试页面的请求都反代到php-fpm的服务器上
在php-fpm主机上编辑php-fpm的配置文件，启用php-fpm的status页面和ping页面，修改完配置文件，重启php-fpm服务
测试访问
第三部分 在10.1.32.68上安装mysql-server
1、安装mysql服务
2、配置mysql，启动服务，授权一个账号，供php连接使用
3、在php-fpm上提供页面，查看数据库连接是否正常
第四部分 https的实现
1、在任意一个服务上建立私有CA(本例在mysql所在的节点上构建私有CA)
##################生成私钥文件##################
[root@mysql ~]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...............+++
...........................+++
e is 65537 (0x10001)
[root@mysql ~]# ##################确保CA工作的目录存在certs、newcerts、crl##################
[root@mysql ~]# ls /etc/pki/CA/
certs crl newcerts private
[root@mysql ~]# ##################创建CA工作需要的证书序列号文件和证书数据库索引文件##################
[root@mysql ~]# touch /etc/pki/CA/{serial,index.txt}
[root@mysql ~]# ##################提供证书初始编号##################
[root@mysql ~]# echo 01 > /etc/pki/CA/serial
[root@mysql ~]# ##################生成CA自签证书##################
[root@mysql ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
----- ##################填入相关信息##################
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:nwccompany
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:ca.nwc.com
Email Address []:caadmin@nwc.com
[root@mysql ~]#
2、在httpd服务器上生成证书签署请求，发送给私有CA所在服务器
[root@httpd ~]# mkdir /etc/httpd/ssl ######生成证书相关文件存放目录####### [root@httpd ~]# ######生成私钥文件####### [root@httpd ~]# (umask 077;openssl genrsa -out /etc/httpd/ssl/httpd.key 1024) Generating RSA private key, 1024 bit long modulus ......................++++++ .............++++++ e is 65537 (0x10001) [root@httpd ~]# [root@httpd ~]# [root@httpd ~]# ######生成证书签署请求####### [root@httpd ~]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- ######填入相关信息，注意hostname要与用户访问时的域名一致####### Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BeiJing Locality Name (eg, city) [Default City]:BeiJing Organization Name (eg, company) [Default Company Ltd]:nwccompany Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:www.a.com Email Address []:wwwadmin@a.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@httpd ~]# ######拷贝证书签署请求到私有CA服务器####### [root@httpd ~]# scp /etc/httpd/ssl/httpd.csr 10.1.32.68:/tmp root@10.1.32.68's password: httpd.csr 100% 696 0.7KB/s 00:00 [root@httpd ~]#
3、在私有CA服务器上进行证书的签署，并将签署后的证书发送给httpd服务器
[root@mysql ~]# ls /tmp httpd.csr yum.log [root@mysql ~]# ####### 签署证书 ######## [root@mysql ~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jul 13 09:46:29 2016 GMT Not After : Jul 13 09:46:29 2017 GMT Subject: countryName = CN stateOrProvinceName = BeiJing organizationName = nwccompany organizationalUnitName = ops commonName = www.a.com emailAddress = wwwadmin@a.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 42:AF:40:00:F2:CD:2F:05:2E:91:C3:AB:66:DB:04:D4:8C:E2:90:A4 X509v3 Authority Key Identifier: keyid:55:E3:92:99:17:92:2B:53:19:AE:57:29:34:AA:D0:1E:C3:04:88:54 Certificate is to be certified until Jul 13 09:46:29 2017 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@mysql ~]# ####### 复制证书到httpd服务器 ######## [root@mysql ~]# scp /etc/pki/CA/certs/httpd.crt 10.1.32.72:/etc/httpd/ssl/ The authenticity of host '10.1.32.72 (10.1.32.72)' can't be established. RSA key fingerprint is 61:20:77:df:ac:5c:a5:5c:8d:05:54:dc:f0:77:bc:ba. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.1.32.72' (RSA) to the list of known hosts. root@10.1.32.72's password: httpd.crt 100% 3845 3.8KB/s 00:00 [root@mysql ~]# [root@mysql ~]#
4、在httpd服务器上安装https所需的httpd的模块mod_ssl,修改httpd关于ssl的配置文件，让其符合当前工作环境
修改配置文件
由于同一个IP只支持定义一个https，故本例中将之前定义的哪个虚拟主机定义为https的页面
将准备定义为https的虚拟主机的定义注释掉
在ssl的虚拟主机中定义：
5、测试https访问
注意，因为是私有CA颁发的证书因此要将私有CA的自签证书导入浏览器的可信任的根CA颁发机构后，然后进行测试访问
第五部分 利用xcache提升php对动态内容的处理能力
加速的原理是：php在处理动态请求时，是将代码加载进来，然后进行编译成自检码(opcode)，执行后返回结果
利用php加速工具后，可以将之前已经编译过的自检码缓存下来实现重复利用，而不用每次请求都重新编译，以此来提升响应速度
本实验结果中，xcache安装后，php的处理能力略有提升，但是提升效果并不太明显，
但是在生产环境中实验的数据表明，xcache对php处理性能的提升大概3倍左右
1、测试在尚未安装xcache时，php的处理能力
[root@mysql ~]# ab -c 200 -n 2000 http://10.1.32.72/test.php This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking 10.1.32.72 (be patient) Completed 200 requests Completed 400 requests Completed 600 requests Completed 800 requests Completed 1000 requests Completed 1200 requests Completed 1400 requests Completed 1600 requests Completed 1800 requests Completed 2000 requests Finished 2000 requests Server Software: Apache/2.4.6 Server Hostname: 10.1.32.72 Server Port: 80 Document Path: /test.php Document Length: 46074 bytes Concurrency Level: 200 Time taken for tests: 3.725 seconds Complete requests: 2000 Failed requests: 219 (Connect: 0, Receive: 0, Length: 219, Exceptions: 0) Write errors: 0 Total transferred: 92937540 bytes HTML transferred: 92551812 bytes Requests per second: 536.89 [#/sec] (mean) Time per request: 372.515 [ms] (mean) Time per request: 1.863 [ms] (mean, across all concurrent requests) Transfer rate: 24363.92 [Kbytes/sec] received Connection Times (ms) min mean[+/-sd] median max Connect: 0 23 134.8 2 1016 Processing: 3 248 404.2 193 3662 Waiting: 2 244 404.0 188 3651 Total: 28 271 425.9 196 3701 Percentage of the requests served within a certain time (ms) 50% 196 66% 201 75% 205 80% 208 90% 221 95% 416 98% 1205 99% 3682 100% 3701 (longest request)
2、在php-fpm主机上安装php-xcache
因为xcache本身是作为php的模块运行，故要与php安装在一起
3、重启php-fpm服务，查看phpinfo页面是否有xcache的相关信息，并重新测试php的处理能力
[root@mysql ~]# ab -c 200 -n 2000 http://10.1.32.72/test.php This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking 10.1.32.72 (be patient) Completed 200 requests Completed 400 requests Completed 600 requests Completed 800 requests Completed 1000 requests Completed 1200 requests Completed 1400 requests Completed 1600 requests Completed 1800 requests Completed 2000 requests Finished 2000 requests Server Software: Apache/2.4.6 Server Hostname: 10.1.32.72 Server Port: 80 Document Path: /test.php Document Length: 46074 bytes Concurrency Level: 200 Time taken for tests: 3.091 seconds Complete requests: 2000 Failed requests: 245 (Connect: 0, Receive: 0, Length: 245, Exceptions: 0) Write errors: 0 Total transferred: 92531728 bytes HTML transferred: 92147728 bytes Requests per second: 747.01 [#/sec] (mean) Time per request: 309.112 [ms] (mean) Time per request: 1.546 [ms] (mean, across all concurrent requests) Transfer rate: 29233.07 [Kbytes/sec] received Connection Times (ms) min mean[+/-sd] median max Connect: 0 24 137.0 4 1043 Processing: 5 260 206.2 206 1808 Waiting: 4 249 206.1 196 1801 Total: 35 284 248.6 211 1914 Percentage of the requests served within a certain time (ms) 50% 211 66% 226 75% 246 80% 337 90% 426 95% 724 98% 1230 99% 1817 100% 1914 (longest request)
第六部分 利用LAMP组合，实现部署phpMyAdmin
1、下载phpMyAdmin到php-fpm所在的主机，解压到php页面所在的文件目录
2、测试访问
有可能会报缺少php组件的问题，进行安装php-mbstring组件，安装完后，记得重启php-fpm服务
测试访问
本测试环境中，为了解决上述问题，在httpd服务器上将所有资源的请求都交给php-fpm进行处理
原创文章，作者：M20-1倪文超，如若转载，请注明出处：http://www.178linux.com/51685
