12 、实现一个 web 服务器
在server0上配置一个站点http://server0.example.com，然后执行以下步骤：
从http://classroom.example.com/materials/station.html下载文件，并且
将文件重命名为index.html,绝对不能修改此文件的内容。
将index.html拷贝到你的web服务器的DocumentRoot目录下。
来自example.com域的客户端可以访问此web站点。
来自my133t.org域的客户端拒绝访问此web站点。
备注： 网站的DocumentRoot如果题目没有指定，那么随意。
[root@server0 ~]# yum install httpd -y
[root@server0 ~]# rpm -ql httpd
/etc/httpd/conf/httpd.conf 主配置文件
/usr/share/doc/httpd-2.4.6/httpd-vhosts.conf 子配置文件
/usr/share/doc/httpd-2.4.6/httpd-manual.conf[root@server0 ~]# cp /usr/share/doc/httpd-2.4.6/httpd-vhosts.conf /etc/httpd/conf.d/ 重命名下
[root@server0 ~]# cp /usr/share/doc/httpd-2.4.6/httpd-manual.conf /etc/httpd/conf.d/[root@server0 conf.d]# vim vhost.conf
<Directory "/var/www/html">
<RequireAll>
Require all granted
Require not host .my133t.com
</RequireAll>
</Directory><VirtualHost 172.25.0.11:80> #直接写ip：port
DocumentRoot "/var/www/html"
ServerName server0.example.com
</VirtualHost>[root@server0 ~]# cd /var/www/html/
[root@server0 html]# wget http://classroom.example.com/materials/station.html
[root@server0 html]# mv station.html index.html #只能cat 该文件， 检测:md5值匹配[root@server0 conf.d]# firewall-cmd --permanent --add-service=http
[root@server0 conf.d]# firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=172.25.0.0/24 service name=http accept'
[root@server0 conf.d]# firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=172.17.10.0/24 service name=http reject'
[root@server0 conf.d]# firewall-cmd --reload [root@server0 ~]# systemctl enable httpd
[root@server0 ~]# systemctl restart httpd[root@server0 ~]# firefox server0.example.com
13 、配置安全 web 服务
站点http://server0.example.com配置TLS加密。
一个已经签名证书从http://classroom.example.com/pub/tls/certs/server0.crt获取
此证书的密钥从http://classroom.example.com/pub/tls/private/server0.key获取
此证书的授权信息从http://classroom.example.com/pub/example-ca.crt获取
[root@server0 ~]# yum install mod_ssl -y
[root@server0 ~]# rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf[root@server0 ~]# cat /etc/httpd/conf.d/ssl.conf 参考
100 SSLCertificateFile /etc/pki/tls/certs/localhost.crt
107 SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
122 #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt[root@server0 ~]# vim /etc/httpd/conf.d/vhost.conf
<Directory "/var/www/html">
<RequireAll>
Require all granted
Require not host .my133t.com
</RequireAll>
</Directory><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/html"
ServerName server0.example.com
SSLCertificateFile /etc/pki/tls/certs/server0.crt 3行直接添加到
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCACertificateFile /etc/pki/tls/certs/example-ca.crt
</VirtualHost>[root@server0 ~]# wget -O /etc/pki/tls/certs/server0.crt http://classroom.example.com/pub/tls/certs/server0.crt
[root@server0 ~]# wget -O /etc/pki/tls/private/server0.key http://classroom.example.com/pub/tls/private/server0.key
[root@server0 ~]# wget -O /etc/pki/tls/certs/example-ca.crt http://classroom.example.com/pub/example-ca.crt[root@server0 ~]# firewall-cmd --permanent --add-service=https 加密服务https
[root@server0 ~]# firewall-cmd --reload [root@server0 ~]# systemctl restart httpd.service
[root@server0 ~]# systemctl enable httpd.service[root@server0 ~]# firefox https://server0.example.com
14 、配置虚拟主机
在server0上扩展你的web服务器，为站点http://www0.example.com创建一个虚拟主机，然后执行以下步骤：
设置DocumentRoot为/var/www/virtual
从http://classroom.example.com/materials/www.html下载文件并重命名为index.html，
不要对文件index.html内容做任何修改。
将index.htm文件放到虚拟主机的DocumentRoot目录下
确保floyd用户能够在/var/www/virtual目录下创建文件
注意：原始站点http://server0.example.com必须仍然能够访问。
站点的所用的域名网络中已有DNS服务器解析。
[root@server0 ~]# mkdir -pv /var/www/virtual[root@server0 ~]# cd /var/www/virtual
[root@server0 virtual]# wget http://classroom.example.com/materials/www.html
[root@server0 virtual]# mv www.html index.html[root@server0 ~]# id floyd
[root@server0 ~]# useradd floyd
[root@server0 ~]# setfacl -m u:floyd:rwx /var/www/virtual/
[root@server0 ~]# getfacl /var/www/virtual/[root@server0 ~]# vim /etc/httpd/conf.d/vhost.conf <Directory "/var/www/html">
<RequireAll>
Require all granted
Require not host .my133t.com
</RequireAll>
</Directory><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/html"
ServerName server0.example.com
SSLCertificateFile /etc/pki/tls/certs/server0.crt
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCACertificateFile /etc/pki/tls/certs/example-ca.crt
</VirtualHost><VirtualHost 172.25.0.11:80> 添加虚拟主机www0
DocumentRoot "/var/www/virtual"
ServerName www0.example.com
</VirtualHost>[root@server0 ~]# systemctl restart httpd.service
[root@server0 ~]# systemctl enable httpd.service
[root@server0 ~]# firefox http://www0.example.com
15 、配置 web 内容的访问
在你的server0上的web服务器的DocumentRoot目录下创建一个名为private的目录，要求如下：
从http://classroom.example.com/materials/private.html下载一个文件副本到这个目录，并且重命名为index.html。
不要对这个文件的内容作任何修改。
从system1上，任何人都可以浏览private的内容，但是从其他系统就不能访问这个目录的内容。
（注意题目要求谁可以访问，灵活变化）
备注：此题目是接着上一题，所以这里的DocumentRoot指的就是上面的/var/www/virtual/。
[root@server0 ~]# mkdir -pv /var/www/virtual/private
[root@server0 ~]# cd /var/www/virtual/private[root@server0 private]# wget http://classroom.example.com/materials/private.html
[root@server0 private]# mv private.html index.html[root@server0 private]# vim /etc/httpd/conf/httpd.conf 主配置参考文件[root@server0 private]# vim /etc/httpd/conf.d/vhost.conf
<Directory "/var/www/html">
<RequireAll>
Require all granted
Require not host .my133t.com
</RequireAll>
</Directory><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/html"
ServerName server0.example.com
SSLCertificateFile /etc/pki/tls/certs/server0.crt
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCACertificateFile /etc/pki/tls/certs/example-ca.crt
</VirtualHost><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/virtual"
ServerName www0.example.com
</VirtualHost><Directory "/var/www/virtual/private"> #### 添加
Require all denied 全部拒绝
Require local 本地访问
</Directory>[root@server0 private]# systemctl restart httpd
[root@server0 private]# systemctl enable httpd
[root@server0 private]#
[root@server0 private]# firefox http://www0.example.com/private/index.html
16 、实现动态 Web容 内容 [ [ 新版题库已经没有这题] ]
在server0上配置提供动态web内容，要求如下：
动态内容由名为webapp0.example.com的虚拟主机提供虚拟主机监听在端口8908
从http://classroom.example.com/materials/webinfo.wsgi下载一个脚本，然后放在适当的位置，
无论如何不要修改此文件的内容。客户端访问http://webapp0.example.com:8908/时应该接收到动态生成的web页面。
此站点http://webapp0.example.com:8908/。必须能够被example.com域内的所有系统访问。
[root@server0 ~]# mkdir -pv /var/www/webapp
[root@server0 ~]# cd /var/www/webapp
[root@server0 webapp]# wget http://classroom.example.com/materials/webinfo.wsgi[root@server0 ~]# semanage port -l |grep http
[root@server0 ~]# semanage port -a -t http_port_t -p tcp 8908 注册selinux端口 （可以图形界面policycoreutils-gui包，命令：system-config-selinx）
Full path required for exclude: net:[4026532647].
Full path required for exclude: net:[4026532647].
[root@server0 ~]# semanage port -l |grep http[root@server0 ~]# firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=172.25.0.0/24 port port=8908 protocol=tcp accept' #防火墙
success
[root@server0 ~]# firewall-cmd --reload [root@server0 ~]# yum install mod_wsgi.x86_64 -y
[root@server0 ~]# rpm -ql mod_wsgi
/usr/share/doc/mod_wsgi-3.4/README[root@server0 ~]# vim /usr/share/doc/mod_wsgi-3.4/README
WSGIScriptAlias /wsgi/ /usr/local/wsgi/scripts/[root@server0 ~]# vim /etc/httpd/conf.d/vhost.conf
<Directory "/var/www/html">
<RequireAll>
Require all granted
Require not host .my133t.com
</RequireAll>
</Directory><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/html"
ServerName server0.example.com
SSLCertificateFile /etc/pki/tls/certs/server0.crt
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCACertificateFile /etc/pki/tls/certs/example-ca.crt
</VirtualHost><VirtualHost 172.25.0.11:80>
DocumentRoot "/var/www/virtual"
ServerName www0.example.com
</VirtualHost><Directory "/var/www/virtual/private">
Require all denied
Require local
</Directory>Listen 8908 #添加 监听8908端口
<VirtualHost 172.25.0.11:8908>
DocumentRoot "/var/www/webapp"
ServerName webapp0.example.com
WSGIScriptAlias / /var/www/webapp/webinfo.wsgi
</VirtualHost>[root@server0 ~]# systemctl restart httpd
[root@server0 ~]# systemctl enable httpd
[root@server0 ~]# firefox http://webapp0.example.com:8908/
