{"id":12040,"date":"2020-11-04T18:20:24","date_gmt":"2020-11-04T10:20:24","guid":{"rendered":"http:\/\/yidianhulian.com\/?p=12040"},"modified":"2020-11-28T16:10:08","modified_gmt":"2020-11-28T08:10:08","slug":"%e5%85%a8%e6%96%b0%e5%ae%89%e8%a3%85lamp%e7%8e%af%e5%a2%83","status":"publish","type":"post","link":"https:\/\/yidianhulian.com\/?p=12040","title":{"rendered":"\u5168\u65b0\u5b89\u88c5LAMP\u73af\u5883"},"content":{"rendered":"\n<h1>\u5b89\u88c5apache<\/h1>\n\n\n\n<h2>1.\u4f7f\u7528yum\u5b89\u88c5apache:<\/h2>\n\n\n\n<p>yum install -y httpd<\/p>\n\n\n\n<h2>2.\u4e0b\u8f7d\u5b8c\u6210\u540e\u542f\u52a8\uff1a<\/h2>\n\n\n\n<p>systemctl start httpd.service<br>systemctl status httpd.service\uff08\u67e5\u770b\u8fd0\u884c\u72b6\u6001\uff09<\/p>\n\n\n\n<h2>3.\u8bbe\u7f6eapache\u5f00\u673a\u81ea\u542f\u52a8<\/h2>\n\n\n\n<p>systemclt enable httpd.service<\/p>\n\n\n\n<p>\u81f3\u6b64apache\u5b89\u88c5\u5b8c\u6bd5<\/p>\n\n\n\n<h1>\u5b89\u88c5mod_ssl<\/h1>\n\n\n\n<p>yum -y install mod_ssl<\/p>\n\n\n\n<h1>\u5b89\u88c5mariadb<\/h1>\n\n\n\n<h2>1.\u9996\u5148\u8bbe\u7f6e\u6570\u636e\u6e90<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">curl -sS https:\/\/downloads.mariadb.com\/MariaDB\/mariadb_repo_setup | sudo bash<\/pre>\n\n\n\n<h2>2.\u66f4\u65b0\u7f13\u5b58<\/h2>\n\n\n\n<p>yum clean all &nbsp;<br>yum makecache &nbsp;<br>yum repolist<\/p>\n\n\n\n<h2>3.\u663e\u793a\u53ef\u5b89\u88c5\u7684\u7248\u672c<\/h2>\n\n\n\n<p>#\u8fd9\u4e2a\u53ef\u4ee5\u770b\u7248\u672c\u53f7<br>yum search mariadb &#8211;showduplicates&nbsp;<br>\u6216<br>yum search mariadb<\/p>\n\n\n\n<h2>4.\u5b89\u88c5<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo yum install MariaDB-server galera-4 MariaDB-client MariaDB-shared MariaDB-backup MariaDB-common<\/pre>\n\n\n\n<h2>5.\u542f\u52a8\u670d\u52a1<\/h2>\n\n\n\n<p>systemctl enable mariadb &#8211;now<\/p>\n\n\n\n<p>6.\u914d\u7f6e\u6570\u636e\u5e93<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysql_secure_installation<\/pre>\n\n\n\n<p>\u9996\u5148\u662f\u8bbe\u7f6e\u5bc6\u7801\uff0c\u4f1a\u63d0\u793a\u5148\u8f93\u5165\u5bc6\u7801<\/p>\n\n\n\n<p>Enter current password for root (enter for none):&lt;\u2013\u521d\u6b21\u8fd0\u884c\u76f4\u63a5\u56de\u8f66<\/p>\n\n\n\n<p>\u8bbe\u7f6e\u5bc6\u7801<\/p>\n\n\n\n<p>Set root password? [Y\/n]&nbsp;&lt;\u2013 \u662f\u5426\u8bbe\u7f6eroot\u7528\u6237\u5bc6\u7801\uff0c\u8f93\u5165y\u5e76\u56de\u8f66\u6216\u76f4\u63a5\u56de\u8f66<br>New password:&nbsp;&lt;\u2013 \u8bbe\u7f6eroot\u7528\u6237\u7684\u5bc6\u7801<br>Re-enter new password:&nbsp;&lt;\u2013 \u518d\u8f93\u5165\u4e00\u6b21\u4f60\u8bbe\u7f6e\u7684\u5bc6\u7801<\/p>\n\n\n\n<p>\u5176\u4ed6\u914d\u7f6e<\/p>\n\n\n\n<p>Remove anonymous users? [Y\/n]&nbsp;&lt;\u2013 \u662f\u5426\u5220\u9664\u533f\u540d\u7528\u6237\uff0c\u56de\u8f66<\/p>\n\n\n\n<p>Disallow root login remotely? [Y\/n]&nbsp;&lt;\u2013\u662f\u5426\u7981\u6b62root\u8fdc\u7a0b\u767b\u5f55,\u56de\u8f66,<\/p>\n\n\n\n<p>Remove test database and access to it? [Y\/n]&nbsp;&lt;\u2013 \u662f\u5426\u5220\u9664test\u6570\u636e\u5e93\uff0c\u56de\u8f66<\/p>\n\n\n\n<p>Reload privilege tables now? [Y\/n]&nbsp;&lt;\u2013 \u662f\u5426\u91cd\u65b0\u52a0\u8f7d\u6743\u9650\u8868\uff0c\u56de\u8f66<\/p>\n\n\n\n<p>\u521d\u59cb\u5316MariaDB\u5b8c\u6210\uff0c\u63a5\u4e0b\u6765\u6d4b\u8bd5\u767b\u5f55<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysql -uroot -ppassword<\/pre>\n\n\n\n<p>\u8bbe\u7f6e\u6570\u636e\u5e93\u5141\u8bb8\u8fdc\u7a0b\u8fde\u63a5\uff1a<\/p>\n\n\n\n<p>mysql -uroot -p\uff08\u8fdb\u5165\u6570\u636e\u5e93\uff09<\/p>\n\n\n\n<p>\u67e5\u770bMySQL\u5e93\u4e2d\u7684user\u8868\uff08user\u8868\u4e2d\u5b58\u7740\u94fe\u63a5\u4fe1\u606f\uff09<\/p>\n\n\n\n<p>select host,user from user;<\/p>\n\n\n\n<p>\u4f7f\u7528\u66f4\u65b0\u8bed\u53e5\u662froot\u7528\u6237\u53ef\u4ee5\u5728\u4efb\u610fIP\u7684\u7535\u8111\u4e0a\u767b\u5f55<\/p>\n\n\n\n<p>update user set host=&#8217;%&#8217;,user=&#8217;root&#8217; limit 1;<\/p>\n\n\n\n<p>\u4f7f\u4fee\u6539\u751f\u6548<\/p>\n\n\n\n<p>flush privileges;<\/p>\n\n\n\n<p>\u9000\u51faMariadb\u540e\u5e76\u91cd\u542f mariadb\u670d\u52a1<\/p>\n\n\n\n<p>systemctl restart mariadb<\/p>\n\n\n\n<p>\u81f3\u6b64\uff0c\u6570\u636e\u5e93\u5b89\u88c5\u5b8c\u6bd5<\/p>\n\n\n\n<h1>\u5b89\u88c5php<\/h1>\n\n\n\n<h2>1.\u9996\u5148\u5b89\u88c5 EPEL \u6e90\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">yum install epel-release<\/pre>\n\n\n\n<h2>2.\u5b89\u88c5 REMI \u6e90\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">yum install http:\/\/rpms.remirepo.net\/enterprise\/remi-release-7.rpm<\/pre>\n\n\n\n<h2>3.\u5b89\u88c5 Yum \u6e90\u7ba1\u7406\u5de5\u5177\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">yum install yum-utils<\/pre>\n\n\n\n<h2>4.\u5b89\u88c5 PHP7.3\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">yum install -y php73-php-fpm php73-php-cli php73-php-bcmath php73-php-gd php73-php-json php73-php-mbstring php73-php-mcrypt php73-php-mysqlnd php73-php-opcache php73-php-pdo php73-php-pecl-crypto php73-php-pecl-mcrypt php73-php-pecl-geoip php73-php-recode php73-php-snmp php73-php-soap php73-php-xmll<\/pre>\n\n\n\n<h2>5.\u542f\u52a8php\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl enable php73-php-fpm\uff08\u5f00\u673a\u81ea\u542f\u52a8\uff09<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl start php73-php-fpm\uff08\u542f\u52a8\uff09<\/pre>\n\n\n\n<h1>\u914d\u7f6eapache\u865a\u62df\u673a<\/h1>\n\n\n\n<p>\u5728\/etc\/httpd\/conf.d\u6587\u4ef6\u5939\u65b0\u5efa\u4e00\u4e2aconf\u914d\u7f6e\u6587\u4ef6\uff0c\u518d\u628a\u4ee5\u4e0b\u5185\u5bb9\u62f7\u8d1d\u5230\u91cc\u9762<\/p>\n\n\n\n<p>\u4f8b\u5982\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img src=\"http:\/\/oa.yidianhulian.com\/download?key=2010225f9146ea41a43\" alt=\"\"\/><\/figure>\n\n\n\n<p>&nbsp;&nbsp;<br>&nbsp; &nbsp; DocumentRoot &#8220;\/var\/www\/html\/web\/app\/public_html&#8221;&nbsp; &nbsp;#\u9879\u76ee\u6839\u76ee\u5f55<br>&nbsp; &nbsp; ServerName lottery.yidianhulian.com&nbsp;&nbsp;#\u7ed1\u5b9a\u7684\u57df\u540d<br>&nbsp; &nbsp; &nbsp; &nbsp;<br>&nbsp; &nbsp; &nbsp; Options FollowSymLinks ExecCGI<br>&nbsp; &nbsp; &nbsp; AllowOverride All<br>&nbsp; &nbsp; &nbsp; Order allow,deny<br>&nbsp; &nbsp; &nbsp; Allow from all<br>&nbsp; &nbsp; &nbsp; Require all granted<br>&nbsp; &nbsp; DirectoryIndex index.php index.html error\/index.html<br>&nbsp;<br>&nbsp; ErrorDocument 400 \/error\/400.html<br>&nbsp; ErrorDocument 403 \/error\/403.html<br>&nbsp; ErrorDocument 404 \/error\/404.html<br>&nbsp; ErrorDocument 500 \/error\/500.html<br>&nbsp; ErrorDocument 501 \/error\/501.html<br>&nbsp; ErrorDocument 502 \/error\/502.html<br>&nbsp; ErrorDocument 503 \/error\/503.html<br>&nbsp; ErrorDocument 504 \/error\/504.html<br>&nbsp; ErrorDocument 505 \/error\/505.html<br>&nbsp; ErrorDocument 506 \/error\/506.html<br>&nbsp; ErrorDocument 507 \/error\/507.html<br>&nbsp; ErrorDocument 510 \/error\/510.html<\/p>\n\n\n\n<h1>\u914d\u7f6ehttps<\/h1>\n\n\n\n<p>1.\u4f7f\u7528\u57df\u540d\u53ef\u4ee5\u7533\u8bf7\u514d\u8d39\u7684ssl\u8bc1\u4e66\uff0c\u9009\u62e9apache\u7248\u672c\uff0c\u8bc1\u4e66\u4e00\u5171\u6709\u4e09\u4e2a\u6587\u4ef6\uff0c\u4f8b\u5982:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img src=\"http:\/\/oa.yidianhulian.com\/download?key=2010225f914d3419b74\" alt=\"\"\/><\/figure>\n\n\n\n<p>2.\u5728\u670d\u52a1\u5668\u4e2d\u65b0\u5efa\u4e00\u4e2a\u6587\u4ef6\u5939\uff0c\u628a\u8fd9\u4e09\u4e2a\u6587\u4ef6\u62f7\u8d1d\u5230\u91cc\u9762<\/p>\n\n\n\n<p>3.\u914d\u7f6ehttps\u5176\u5b9e\u5c31\u662f\u914d\u7f6e<strong>\/etc\/httpd\/conf.d\/ssl.conf\u6587\u4ef6\uff0c<\/strong>\u4f7f\u7528yum\u4e0b\u8f7dmod_ssl\u540e\u4f1a\u81ea\u52a8\u751f\u6210\u8fd9\u4e2a\u6587\u4ef6\u3002\u5bf9\u6587\u4ef6\u8fdb\u884c\u914d\u7f6e\uff0c\u4f8b\u5982\uff1a<\/p>\n\n\n\n<p>#<br># When we also provide SSL we have to listen to the&nbsp;<br># the HTTPS port in addition.<br>#<br>Listen 443 https<\/p>\n\n\n\n<p>##<br>## &nbsp;SSL Global Context<br>##<br>## &nbsp;All SSL configuration in this context applies both to<br>## &nbsp;the main server and all SSL-enabled virtual hosts.<br>##<\/p>\n\n\n\n<p># &nbsp; Pass Phrase Dialog:<br># &nbsp; Configure the pass phrase gathering process.<br># &nbsp; The filtering dialog program (`builtin&#8217; is a internal<br># &nbsp; terminal dialog) has to provide the pass phrase on stdout.<br>SSLPassPhraseDialog exec:\/usr\/libexec\/httpd-ssl-pass-dialog<\/p>\n\n\n\n<p># &nbsp; Inter-Process Session Cache:<br># &nbsp; Configure the SSL Session Cache: First the mechanism&nbsp;<br># &nbsp; to use and second the expiring timeout (in seconds).<br>SSLSessionCache &nbsp; &nbsp; &nbsp; &nbsp; shmcb:\/run\/httpd\/sslcache(512000)<br>SSLSessionCacheTimeout &nbsp;300<\/p>\n\n\n\n<p># &nbsp; Pseudo Random Number Generator (PRNG):<br># &nbsp; Configure one or more sources to seed the PRNG of the&nbsp;<br># &nbsp; SSL library. The seed data should be of good random quality.<br># &nbsp; WARNING! On some platforms \/dev\/random blocks if not enough entropy<br># &nbsp; is available. This means you then cannot use the \/dev\/random device<br># &nbsp; because it would lead to very long connection times (as long as<br># &nbsp; it requires to make more entropy available). But usually those<br># &nbsp; platforms additionally provide a \/dev\/urandom device which doesn&#8217;t<br># &nbsp; block. So, if available, use this one instead. Read the mod_ssl User<br># &nbsp; Manual for more details.<br>SSLRandomSeed startup file:\/dev\/urandom &nbsp;256<br>SSLRandomSeed connect builtin<br>#SSLRandomSeed startup file:\/dev\/random &nbsp;512<br>#SSLRandomSeed connect file:\/dev\/random &nbsp;512<br>#SSLRandomSeed connect file:\/dev\/urandom 512<\/p>\n\n\n\n<p>#<br># Use &#8220;SSLCryptoDevice&#8221; to enable any supported hardware<br># accelerators. Use &#8220;openssl engine -v&#8221; to list supported<br># engine names. &nbsp;NOTE: If you enable an accelerator and the<br># server does not start, consult the error logs and ensure<br># your accelerator is functioning properly.&nbsp;<br>#<br>SSLCryptoDevice builtin<br>#SSLCryptoDevice ubsec<\/p>\n\n\n\n<p>##<br>## SSL Virtual Host Context<br>##<\/p>\n\n\n\n<p>&nbsp; &nbsp; &nbsp; #\u627e\u5230\u8fd9\u4e2a\u6807\u7b7e<\/p>\n\n\n\n<p># General setup for the virtual host, inherited from global configuration<br>ServerName lottery.yidianhulian.com &nbsp; #\u914d\u7f6e\u57df\u540d<br>DocumentRoot \/var\/www\/html\/web\/app\/public_html &nbsp;#\u914d\u7f6e\u9879\u76ee\u6839\u76ee\u5f55<\/p>\n\n\n\n<p>&nbsp; #\u6dfb\u52a0\u8fd9\u4e2a\u6807\u7b7e\u5141\u8bb8\u8bbf\u95ee\u8be5\u9879\u76ee<br>&nbsp;<br>&nbsp; &nbsp; &nbsp; Options FollowSymLinks ExecCGI<br>&nbsp; &nbsp; &nbsp; AllowOverride All<br>&nbsp; &nbsp; &nbsp; Order allow,deny<br>&nbsp; &nbsp; &nbsp; Allow from all<br>&nbsp; &nbsp; &nbsp; Require all granted<br>&nbsp; &nbsp; DirectoryIndex index.php index.html error\/index.html<br>&nbsp;<\/p>\n\n\n\n<p># Use separate log files for the SSL virtual host; note that LogLevel<br># is not inherited from httpd.conf.<br>ErrorLog logs\/ssl_error_log<br>TransferLog logs\/ssl_access_log<br>LogLevel warn<\/p>\n\n\n\n<p># &nbsp; SSL Engine Switch:<br># &nbsp; Enable\/Disable SSL for this virtual host.<br>SSLEngine on<\/p>\n\n\n\n<p># &nbsp; SSL Protocol support:<br># List the enable protocol levels with which clients will be able to<br># connect. &nbsp;Disable SSLv2 access by default:<br>SSLProtocol all -SSLv2 -SSLv3 &nbsp;# \u6dfb\u52a0SSL\u534f\u8bae\u652f\u6301\u534f\u8bae\uff0c\u53bb\u6389\u4e0d\u5b89\u5168\u7684\u534f\u8bae\u3002<\/p>\n\n\n\n<p># &nbsp; SSL Cipher Suite:<br># &nbsp; List the ciphers that the client is permitted to negotiate.<br># &nbsp; See the mod_ssl documentation for a complete list.<br>SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM &nbsp; # \u4fee\u6539\u52a0\u5bc6\u5957\u4ef6\u3002<\/p>\n\n\n\n<p># &nbsp; Speed-optimized SSL Cipher configuration:<br># &nbsp; If speed is your main concern (on busy HTTPS servers e.g.),<br># &nbsp; you might want to force clients to specific, performance<br># &nbsp; optimized ciphers. In this case, prepend those ciphers<br># &nbsp; to the SSLCipherSuite list, and enable SSLHonorCipherOrder.<br># &nbsp; Caveat: by giving precedence to RC4-SHA and AES128-SHA<br># &nbsp; (as in the example below), most connections will no longer<br># &nbsp; have perfect forward secrecy &#8211; if the server&#8217;s key is<br># &nbsp; compromised, captures of past or future traffic must be<br># &nbsp; considered compromised, too.<br>#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5<br>SSLHonorCipherOrder on&nbsp;<\/p>\n\n\n\n<p># &nbsp; Server Certificate:<br># Point SSLCertificateFile at a PEM encoded certificate. &nbsp;If<br># the certificate is encrypted, then you will be prompted for a<br># pass phrase. &nbsp;Note that a kill -HUP will prompt again. &nbsp;A new<br># certificate can be generated using the genkey(1) command.<br>#SSLCertificateFile \/etc\/pki\/tls\/certs\/localhost.crt<br>SSLCertificateFile \/etc\/httpd\/cert\/4520877_lottery.yidianhulian.com_public.crt &nbsp;#\u8bc1\u4e66\u6240\u5728\u76ee\u5f55\u3002\u8981\u4e00\u4e00\u5bf9\u5e94\uff0c\u6ce8\u610f\u770b\u6587\u4ef6\u540d<\/p>\n\n\n\n<p># &nbsp; Server Private Key:<br># &nbsp; If the key is not combined with the certificate, use this<br># &nbsp; directive to point at the key file. &nbsp;Keep in mind that if<br># &nbsp; you&#8217;ve both a RSA and a DSA private key you can configure<br># &nbsp; both in parallel (to also allow the use of DSA ciphers, etc.)<br>SSLCertificateKeyFile \/etc\/httpd\/cert\/4520877_lottery.yidianhulian.com.key &nbsp;#\u8bc1\u4e66\u6240\u5728\u76ee\u5f55\u3002\u8981\u4e00\u4e00\u5bf9\u5e94\uff0c\u6ce8\u610f\u770b\u6587\u4ef6\u540d<\/p>\n\n\n\n<p># &nbsp; Server Certificate Chain:<br># &nbsp; Point SSLCertificateChainFile at a file containing the<br># &nbsp; concatenation of PEM encoded CA certificates which form the<br># &nbsp; certificate chain for the server certificate. Alternatively<br># &nbsp; the referenced file can be the same as SSLCertificateFile<br># &nbsp; when the CA certificates are directly appended to the server<br># &nbsp; certificate for convinience.<br>SSLCertificateChainFile \/etc\/httpd\/cert\/4520877_lottery.yidianhulian.com_chain.crt &nbsp;#\u8bc1\u4e66\u6240\u5728\u76ee\u5f55\u3002\u8981\u4e00\u4e00\u5bf9\u5e94\uff0c\u6ce8\u610f\u770b\u6587\u4ef6\u540d<\/p>\n\n\n\n<p># &nbsp; Certificate Authority (CA):<br># &nbsp; Set the CA certificate verification path where to find CA<br># &nbsp; certificates for client authentication or alternatively one<br># &nbsp; huge file containing all of them (file must be PEM encoded)<br>#SSLCACertificateFile \/etc\/pki\/tls\/certs\/ca-bundle.crt<\/p>\n\n\n\n<p># &nbsp; Client Authentication (Type):<br># &nbsp; Client certificate verification type and depth. &nbsp;Types are<br># &nbsp; none, optional, require and optional_no_ca. &nbsp;Depth is a<br># &nbsp; number which specifies how deeply to verify the certificate<br># &nbsp; issuer chain before deciding the certificate is not valid.<br>#SSLVerifyClient require<br>#SSLVerifyDepth &nbsp;10<\/p>\n\n\n\n<p># &nbsp; Access Control:<br># &nbsp; With SSLRequire you can do per-directory access control based<br># &nbsp; on arbitrary complex boolean expressions containing server<br># &nbsp; variable checks and other lookup directives. &nbsp;The syntax is a<br># &nbsp; mixture between C and Perl. &nbsp;See the mod_ssl documentation<br># &nbsp; for more details. &nbsp;<br>#<br>#SSLRequire ( &nbsp; &nbsp;%{SSL_CIPHER} !~ m\/^(EXP|NULL)\/ \\<br># &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and %{SSL_CLIENT_S_DN_O} eq &#8220;Snake Oil, Ltd.&#8221; \\<br># &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and %{SSL_CLIENT_S_DN_OU} in {&#8220;Staff&#8221;, &#8220;CA&#8221;, &#8220;Dev&#8221;} \\<br># &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and %{TIME_WDAY} &gt;= 1 and %{TIME_WDAY} &lt;= 5 \\<br># &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and %{TIME_HOUR} &gt;= 8 and %{TIME_HOUR} &lt;= 20 &nbsp; &nbsp; &nbsp; ) \\<br># &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or %{REMOTE_ADDR} =~ m\/^192\\.76\\.162\\.[0-9]+$\/<br>#<\/p>\n\n\n\n<p># &nbsp; SSL Engine Options:<br># &nbsp; Set various options for the SSL engine.<br># &nbsp; o FakeBasicAuth:<br># &nbsp; &nbsp; Translate the client X.509 into a Basic Authorisation. &nbsp;This means that<br># &nbsp; &nbsp; the standard Auth\/DBMAuth methods can be used for access control. &nbsp;The<br># &nbsp; &nbsp; user name is the `one line&#8217; version of the client&#8217;s X.509 certificate.<br># &nbsp; &nbsp; Note that no password is obtained from the user. Every entry in the user<br># &nbsp; &nbsp; file needs this password: `xxj31ZMTZzkVA&#8217;.<br># &nbsp; o ExportCertData:<br># &nbsp; &nbsp; This exports two additional environment variables: SSL_CLIENT_CERT and<br># &nbsp; &nbsp; SSL_SERVER_CERT. These contain the PEM-encoded certificates of the<br># &nbsp; &nbsp; server (always existing) and the client (only existing when client<br># &nbsp; &nbsp; authentication is used). This can be used to import the certificates<br># &nbsp; &nbsp; into CGI scripts.<br># &nbsp; o StdEnvVars:<br># &nbsp; &nbsp; This exports the standard SSL\/TLS related `SSL_*&#8217; environment variables.<br># &nbsp; &nbsp; Per default this exportation is switched off for performance reasons,<br># &nbsp; &nbsp; because the extraction step is an expensive operation and is usually<br># &nbsp; &nbsp; useless for serving static content. So one usually enables the<br># &nbsp; &nbsp; exportation for CGI and SSI requests only.<br># &nbsp; o StrictRequire:<br># &nbsp; &nbsp; This denies access when &#8220;SSLRequireSSL&#8221; or &#8220;SSLRequire&#8221; applied even<br># &nbsp; &nbsp; under a &#8220;Satisfy any&#8221; situation, i.e. when it applies access is denied<br># &nbsp; &nbsp; and no other module can change it.<br># &nbsp; o OptRenegotiate:<br># &nbsp; &nbsp; This enables optimized SSL connection renegotiation handling when SSL<br># &nbsp; &nbsp; directives are used in per-directory context.&nbsp;<br>#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire<br><br>&nbsp; &nbsp; SSLOptions +StdEnvVars<br><br><br>&nbsp; &nbsp; SSLOptions +StdEnvVars<\/p>\n\n\n\n<p># &nbsp; SSL Protocol Adjustments:<br># &nbsp; The safe and default but still SSL\/TLS standard compliant shutdown<br># &nbsp; approach is that mod_ssl sends the close notify alert but doesn&#8217;t wait for<br># &nbsp; the close notify alert from client. When you need a different shutdown<br># &nbsp; approach you can use one of the following variables:<br># &nbsp; o ssl-unclean-shutdown:<br># &nbsp; &nbsp; This forces an unclean shutdown when the connection is closed, i.e. no<br># &nbsp; &nbsp; SSL close notify alert is send or allowed to received. &nbsp;This violates<br># &nbsp; &nbsp; the SSL\/TLS standard but is needed for some brain-dead browsers. Use<br># &nbsp; &nbsp; this when you receive I\/O errors because of the standard approach where<br># &nbsp; &nbsp; mod_ssl sends the close notify alert.<br># &nbsp; o ssl-accurate-shutdown:<br># &nbsp; &nbsp; This forces an accurate shutdown when the connection is closed, i.e. a<br># &nbsp; &nbsp; SSL close notify alert is send and mod_ssl waits for the close notify<br># &nbsp; &nbsp; alert of the client. This is 100% SSL\/TLS standard compliant, but in<br># &nbsp; &nbsp; practice often causes hanging connections with brain-dead browsers. Use<br># &nbsp; &nbsp; this only for browsers where you know that their SSL implementation<br># &nbsp; &nbsp; works correctly.&nbsp;<br># &nbsp; Notice: Most problems of broken clients are also related to the HTTP<br># &nbsp; keep-alive facility, so you usually additionally want to disable<br># &nbsp; keep-alive for those clients, too. Use variable &#8220;nokeepalive&#8221; for this.<br># &nbsp; Similarly, one has to force some clients to use HTTP\/1.0 to workaround<br># &nbsp; their broken HTTP\/1.1 implementation. Use variables &#8220;downgrade-1.0&#8221; and<br># &nbsp; &#8220;force-response-1.0&#8221; for this.<br>BrowserMatch &#8220;MSIE [2-5]&#8221; \\<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nokeepalive ssl-unclean-shutdown \\<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;downgrade-1.0 force-response-1.0<\/p>\n\n\n\n<p># &nbsp; Per-Server Logging:<br># &nbsp; The home of a custom SSL log file. Use this when you want a<br># &nbsp; compact non-error SSL logfile on a virtual host basis.<br>CustomLog logs\/ssl_request_log \\<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &#8220;%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \\&#8221;%r\\&#8221; %b&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5b89\u88c5apache 1.\u4f7f\u7528yum\u5b89\u88c5apache: yum install -y httpd 2.\u4e0b\u8f7d\u5b8c\u6210\u540e\u542f &hellip; <a href=\"https:\/\/yidianhulian.com\/?p=12040\" class=\"more-link\">\u7ee7\u7eed\u9605\u8bfb<span class=\"screen-reader-text\">\u5168\u65b0\u5b89\u88c5LAMP\u73af\u5883<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_links_to":"","_links_to_target":""},"categories":[148],"tags":[151,96],"_links":{"self":[{"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/posts\/12040"}],"collection":[{"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12040"}],"version-history":[{"count":3,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/posts\/12040\/revisions"}],"predecessor-version":[{"id":12058,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=\/wp\/v2\/posts\/12040\/revisions\/12058"}],"wp:attachment":[{"href":"https:\/\/yidianhulian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yidianhulian.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}