devbox
盐析白兔
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

RHCE---服务+ansible

作者：盐析白兔 | 2024-05-16 02:14:58

赞

踩

ens224 ethernet connecting (getting ip configuration) wired connection 2

一、命令提示符颜色

  1. 也可以写入配置文件/etc/profile
  2. [root@master ~]# vim .bashrc 
  3. 绿色：
  4. PS1='\[\033[01;32m\]\u@\H:\[\033[01;34m\]\w\$\[\033[00m\] '
  5. 粉红色：
  6. PS1='\[\e[1;35m\]\u@\h:\[\e[0m\]\[\e[1;33m\]\w\[\e[1;35m\]\[\e[0m\]\[\e[1;34m\]\$ \[\e[0m\]'
  7. [root@master ~]# source .bashrc

详解：

  1. [root@master ~]# echo $PS1
  2. [\u@\h \W]\$
  3. 那么里面的 [\u@\h \W]$分别代表什么呢？
  4. PS1(是数字1而不是字母l)，每个版本bash的PS1变量内的特殊符号可能有些小的差异，
  5. 你可以先man bash 一下。
  6.   下面是RedHat7环境下默认的特殊符号所代表的意义：
  7.   \d ：代表日期，格式为weekday month date，例如："Mon Aug 1"
  8.   \H ：完整的主机名称。例如：我的机器名称为：RedHat7.linux，则这个名称就是RedHat7.linux
  9.   \h ：仅取主机的第一个名字，如上例，则为RedHat7，而.linux则被省略
  10.   \t ：显示时间为24小时格式，如：HH：MM：SS
  11.   \T ：显示时间为12小时格式
  12.   \A ：显示时间为24小时格式：HH：MM
  13.   \u ：当前用户的账号名称
  14.   \v ：BASH的版本信息
  15.   \w ：完整的工作目录名称。家目录会以 ~代替
  16.   \W ：利用basename取得工作目录名称，所以只会列出最后一个目录
  17.   \# ：下达的第几个命令
  18.   \$ ：提示字符，如果是root时，提示符为：# ，普通用户则为：$
  19.   默认的PS1内容为： PS1='[\u@\h \W]\$ ' ，
  20.   所以默认的提示符就是： [root@linux ~]#
  21.  
  22. 当我们了解上述参数之后，在实际操作过程中，我们如果想显示主机全名以及完整的工作目录，我们就需要修改PS1的相应参数，并写入/etc/profile文件中 例如：修改前，我们默认的PS1对于主机名、目录都只是显示一部分，
  23. [root@RedHat7 ~]# hostname
  24. RedHat7.linux
  25. [root@RedHat7 ~]# 
  26. [root@RedHat7 ~]# cd /etc/sysconfig/network-scripts/
  27. [root@RedHat7 network-scripts]#
  28. 现在我们想让主机名和工作路径全部显示出来，根据上面参数，我们需要用到大写的H和小写的w，我们用echo命令将修改后的PS1追加到 /etc/profile文件中(不建议这样操作，最好还是vim 进到文件去编辑好些)，并更新该文件
  29. [root@RedHat7 ~]# echo "PS1='[\u@\H \w]\$' " >> /etc/profile
  30. [root@RedHat7 ~]# source /etc/profile
  31. 如果是在虚拟机里面或者是Xshell中，我们可能还要重启或断开连接再次连接才能看到结果。
  32. [root@RedHat7.linux ~]$ cd /etc/sysconfig/network-scripts/
  33. [root@RedHat7.linux /etc/sysconfig/network-scripts]$ 
  34. 此时，我们可以看到主机全名和工作路径的全部
  35.  
  36.  颜色值设置
  37.  PS1中设置字符颜色的格式为：\[\e[F;Bm\]，\[\e[0m\] 其中
  38.  “F“为字体颜色，编号为30-37，
  39.  “B”为背景颜色，编号为40-47。用 \[\e[0m\]结束颜色设置，颜色表如下：
  40.   F 　　 B
  41.   30 　　 40 　　 黑色
  42.   31 　　 41 　　 红色
  43.   32 　　 42 　　 绿色
  44.   33 　　 43 　　 黄色
  45.   34 　　 44 　　 蓝色
  46.   35 　　 45 　　 紫红色
  47.   36 　　 46 　　 青蓝色
  48.   37 　　 47 　　 白色
  49.   根据颜色表，套用入字符颜色设置格式中，就可以对linux终端命令行颜色进行个性化设置。
  50.   比如要设置命令行的格式为绿字黑底，显示当前用户的账号名称、
  51.   主机的第一个名字、完整的当前工作目录名称、24小时格式时间，就可以使用如下的命令：
  52.  
  53.   export PS1='\[\e[30;1m\][\u@\h \w]\$ \[\e[0m\]  -----黑色提示符
  54.   export PS1='\[\e[31;1m\][\u@\h \w]\$ \[\e[0m\]  -----红色提示符
  55.   export PS1='\[\e[32;1m\][\u@\h \w]\$ \[\e[0m\]  -----绿色提示符
  56.   export PS1='\[\e[33;1m\][\u@\h \w]\$ \[\e[0m\]  -----黄色提示符
  57.   export PS1='\[\e[34;1m\][\u@\h \w]\$ \[\e[0m\]  -----蓝色提示符(天蓝)
  58.   export PS1='\[\e[35;1m\][\u@\h \w]\$ \[\e[0m\]  -----粉色提示符
  59.   export PS1='\[\e[36;1m\][\u@\h \w]\$ \[\e[0m\]  -----蓝色提示符(海蓝)
  60.   export PS1='\[\e[37;1m\][\u@\h \w]\$ \[\e[0m\]  -----白色提示符

环境准备：

  1. 1.至少俩台linux主机，一台是控制节点，一台是受控节点
  2. 2.控制节点和受控节点都需要安装Python36
  3. 3.控制节点需要安装ansible
  4. 4.控制节点需要获得受控节点的普通用户或root用户的权限，控制节点需要ssh客户端，受控节点需要ssh服务端
  5. 5.控制节点和受控节点之间网络联通，配置静态ip

二、环境安装：

主机名IP地址角色
master172.25.250.132控制节点
node01172.25.250.128受控节点
node02172.25.250.129受控节点

1、替换yum源，方便安装软件：----阿里

  1. sed -e 's|^mirrorlist=|#mirrorlist=|g' \
  2.     -e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
  3.     -i.bak \
  4.     /etc/yum.repos.d/Rocky-*.repo
  5.  
  6. dnf makecache

2、安装常用工具：

yum install -y bash-completion tree lrzsz  vim  net-tools.x86_64  unzip   lsof  wget

3、修改主机名：

  1. master: hostnamectl set-hostname master
  2. node01:hostnamectl set-hostname node01
  3. node02:hostnamectl set-hostname node02

4、配置ip地址：

master:俩张网卡NAT和桥接模式

node01 node02：桥接模式

  1. master主机上的配置：
  2. 1.查看状态：
  3.  
  4. [root@master ~]# nmcli device
  5. DEVICE  TYPE      STATE                                  CONNECTION
  6. ens160  ethernet  connected                              ens160
  7. ens224  ethernet  connecting (getting IP configuration)  Wired connection 1
  8. lo      loopback  unmanaged                              --
  9. [root@master ~]# nmcli connection
  10. NAME                UUID                                  TYPE      DEVICE
  11. Wired connection 1  408f15fc-eaa9-3a51-ae18-d9673dcbabab  ethernet  ens224
  12. ens160              b4725590-2691-43b0-b2a8-7eae81ee470a  ethernet  ens160
  13.  
  14.  
  15. 2、添加ip，网关，dns，改为手动，开机自启
  16. [root@master ~]# cd /etc/sysconfig/network-scripts/
  17. [root@master network-scripts]# ll
  18. total 4
  19. -rw-r--r--. 1 root root 247 Dec 13 09:34 ifcfg-ens160
  20. [root@master network-scripts]# cat ifcfg-ens160
  21. TYPE=Ethernet
  22. PROXY_METHOD=none
  23. BROWSER_ONLY=no
  24. BOOTPROTO=dhcp
  25. DEFROUTE=yes
  26. IPV4_FAILURE_FATAL=no
  27. IPV6INIT=yes
  28. IPV6_AUTOCONF=yes
  29. IPV6_DEFROUTE=yes
  30. IPV6_FAILURE_FATAL=no
  31. NAME=ens160
  32. UUID=b4725590-2691-43b0-b2a8-7eae81ee470a
  33. DEVICE=ens160
  34. ONBOOT=yes ---改为yes
  35.  
  36. 3、修改master主机桥接网卡的ip地址：
  37. [root@master ~]# nmcli device
  38. DEVICE  TYPE      STATE                                  CONNECTION
  39. ens160  ethernet  connected                              ens160
  40. ens224  ethernet  connecting (getting IP configuration)  Wired connection 1
  41. lo      loopback  unmanaged       
  42. [root@master network-scripts]# nmcli device  connect ens224 ---自动创建connection，如果有俩个网段就可以实现
  43. 但是我在家在学校只有一个192.168.x.x的地址，包括后面俩台node也配不上
  44. [root@master network-scripts]# nmcli device connect ens224
  45. Error: Connection activation failed: (5) IP configuration could not be reserved (no available address, timeout, etc.).

5、网卡改为仅主机模式：

  1. 仅主机：172.25.250.x 255.255.255.0
  2.  
  3. master：192.168.11.154---NAT模式，都可以连接
  4.  
  5. master：172.25.250.132
  6. node01：172.25.250.128
  7. node02:172.25.250.129

6、配置hosts文件：

  1. 172.25.250.132 master
  2. 172.25.250.128 node01
  3. 172.25.250.129 node02

7、xshell配置会话：

  1. 172.25.250.132 master
  2. 172.25.250.128 node01
  3. 172.25.250.129 node02

8、时间同步：

  1. 这里我使用的是仅主机模式，所以受控节点的主机没有互联网，但是三台主机的时间一样的，我就不做配置
  2.  
  3. 1、安装时间同步软件包：
  4. [root@master ~]# yum install chrony
  5.  
  6. 2、修改配置文件：
  7. [root@master ~]# vim /etc/chrony.conf
  8. pool 2.rocky.pool.ntp.org iburst
  9. pool ntp1.aliyun.com iburst
  10. pool ntp2.aliyun.com iburst
  11.  
  12. 3、设置为开机自启：
  13. [root@master ~]# systemctl enable --now chronyd
  14.  
  15. 4、写计划任务同步：
  16.  
  17. [root@master ~]# vim /etc/crontab
  18. 0 10  * * * root  chronyc sources &>/dev/null

9、装Python36：

  1. 1、每台机器都装：接下来的操作都在master上
  2. yum install python36 -y
  3.  
  4. 2、不用root权限，权限太高了；在master主机上创建student 密码redhat；在node节点上用的redhat用户，密码redhat
  5. [root@node01 ~]# vim /etc/sudoers
  6. root    ALL=(ALL)       ALL
  7. redhat ALL=(ALL)       NOPASSWD: ALL
  8. 强制保存退出
  9. 如果用的visudo打开就不用，正常退出就行
  10.  
  11.  
  12. 3、测试：
  13. [root@master ~]# visudo
  14. [root@master ~]#
  15. [root@master ~]#
  16. [root@master ~]# su - student
  17. Last login: Tue Dec 13 12:17:40 CST 2022 on pts/0
  18. [student@master ~]$ sudo ls /root
  19. anaconda-ks.cfg

10、安装ansible：

  1. 1、阿里云下载扩展源：epel
  2. [student@master ~]$ sudo yum install -y https://mirrors.aliyun.com/epel/epel-release-latest-8.noarch.rpm
  3.  
  4. 也可以自己写源：
  5. [epel]
  6. name=epel
  7. baseurl=https://mirrors.aliyun.com/epel/8/Everything/x86_64/
  8. gpgcheck=0
  9.  
  10. 2、安装ansible：
  11. [student@master ~]$ yum install ansible -y
  12.  
  13. 3、查看ansible版本信息：
  14. [student@master ~]$ ansible --version
  15. ansible [core 2.13.3]
  16.   config file = /etc/ansible/ansible.cfg
  17.   configured module search path = ['/home/student/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  18.   ansible python module location = /usr/lib/python3.9/site-packages/ansible
  19.   ansible collection location = /home/student/.ansible/collections:/usr/share/ansible/collections
  20.   executable location = /usr/bin/ansible
  21.   python version = 3.9.13 (main, Nov 16 2022, 15:31:39) [GCC 8.5.0 20210514 (Red Hat 8.5.0-15)]
  22.   jinja version = 3.1.2
  23.   libyaml = True

11、配置免密登录：

  1. 1、在master主机上创建密钥对：
  2. [student@master ~]$ ssh-copy-id redhat@node02
  3. /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/student/.ssh/id_rsa.pub"
  4. The authenticity of host 'node02 (172.25.250.129)' can't be established.
  5. ECDSA key fingerprint is SHA256:723ytDI+oeyH5SeBHONt70U2NspX11SZ5lwzBASGLy4.
  6. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
  7. /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
  8. /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
  9. redhat@node02's password:输入密码
  10.  
  11. Number of key(s) added: 1
  12.  
  13. Now try logging into the machine, with:   "ssh 'redhat@node02'"
  14. and check to make sure that only the key(s) you wanted were added.
  15.  
  16. 2、测试：
  17. 在master连接node节点：
  18. [student@master ~]$ ssh redhat@node01
  19. Last login: Tue Dec 13 12:12:43 2022
  20. [redhat@node01 ~]$

12、环境搭好了，做好快照

所有的密码都是redhat

三、简单操作：

ansible清单和配置文件

1、定义清单文件：

  1. 1、创建一个文件夹存放：：
  2. [student@master ~]$ mkdir ansibleTest
  3. [student@master ~]$ cd ansibleTest/
  4. [student@master ansibleTest]$
  5.  
  6. 2、编写文件，注意优先级
  7. [student@master ~]$ sudo vim /etc/ansible/hosts
  8. 这是在默认配置文件中的主机清单文件：
  9. [student@master ~]$ tail -2 /etc/ansible/hosts
  10. node01
  11. node02
  12.  
  13. 这是在自定义的主机清单文件，-i指定清单文件文件名：
  14. [student@master ansibleTest]$ ansible all --list-hosts -i ./inventory
  15.   hosts (3):
  16.     node01
  17.     node02
  18.     master
  19. 这是查看主机组里面的主机文件：
  20. [student@master ansibleTest]$ ansible webserver --list-hosts -i ./inventory
  21.   hosts (2):
  22.     node01
  23.     node02

2、执行清单文件：

  1. [student@master ~]$ ansible all --list-hosts
  2.   hosts (2):
  3.     node01
  4.     node02

3、修改配置文件

  1. 1、自定义ansible.cfg，这几条信息都需要写
  2. [student@master ansibleTest]$ cat ./ansible.cfg
  3. [defaults]
  4. inventory= ./inventory
  5. remote_user = redhat
  6. ask_pass = false
  7. [privilege_escalation]
  8. become = True
  9. become_method = sudo
  10. become_user = root
  11. become_ask_pass = False

4、简单测试：

  1. 1.masterping不通。因为没有免密做student免密登录redhat：
  2. [student@master ansibleTest]$ ansible all -m ping
  3. The authenticity of host 'master (172.25.250.132)' can't be established.
  4. ECDSA key fingerprint is SHA256:NeqtJaCF7cvzBynyHDzGp4j1w6qIRrF2du45YRldvB8.
  5. Are you sure you want to continue connecting (yes/no/[fingerprint])? node01 | SUCCESS => {
  6.     "ansible_facts": {
  7.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  8.     },
  9.     "changed": false,
  10.     "ping": "pong"
  11. }
  12. node02 | SUCCESS => {
  13.     "ansible_facts": {
  14.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  15.     },
  16.     "changed": false,
  17.     "ping": "pong"
  18. }
  19. 这里master上面的redhat需要密码，但是在清单文件中是ask_pass = false，所以ping不通master
  20. root    ALL=(ALL)       ALL
  21. student ALL=(ALL) NOPASSWD: ALL
  22. redhat ALL=(ALL) NOPASSWD:ALL
  23. 添加redhat进去
  26. 2、把公钥私钥用student用户传给redhat
  27. [student@master ansibleTest]$ ssh-copy-id redhat@master
  28. 测试：
  29. [student@master ansibleTest]$ ansible all -m ping
  30. node02 | SUCCESS => {
  31.     "ansible_facts": {
  32.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  33.     },
  34.     "changed": false,
  35.     "ping": "pong"
  36. }
  37. node01 | SUCCESS => {
  38.     "ansible_facts": {
  39.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  40.     },
  41.     "changed": false,
  42.     "ping": "pong"
  43. }
  44. master | SUCCESS => {
  45.     "ansible_facts": {
  46.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  47.     },
  48.     "changed": false,
  49.     "ping": "pong"
  50. }
  51. 学会看日志

5、几个清单文件的优先级：

[student@master ansibleTest]$ ll /etc/ansible/ansible.cfg  ~/ansible.cfg   ./ansible.cfg

运行临时命令

1、创建文件：

  1. 1、file模块：
  2. [student@master ansibleTest]$ ansible-doc -l ---查看所有模块
  3. [student@master ansibleTest]$ ansible-doc file ---查看file模块的用法
  4. [student@master ansibleTest]$ ansible all -m ping -v ---ping模块
  5. Using /home/student/ansibleTest/ansible.cfg as config file  ---使用的配制文件
  6. node01 | SUCCESS => {
  7.     "ansible_facts": {
  8.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  9.     },
  10.     "changed": false,
  11.     "ping": "pong"
  12. }
  13. node02 | SUCCESS => {
  14.     "ansible_facts": {
  15.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  16.     },
  17.     "changed": false,
  18.     "ping": "pong"
  19. }
  20. master | SUCCESS => {
  21.     "ansible_facts": {
  22.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  23.     },
  24.     "changed": false,
  25.     "ping": "pong"
  26. }

作业：

  1. 使用yum和service模块安装和启动httpd服务，但是我node没有网，所以下载不了
  2. [student@master ansibleTest]$ ansible all -m yum -a 'name=httpd state=present'
  3. [student@master ansibleTest]$ ansible all -m service -a 'name=httpd state=started'
  4.  
  5. 这里我把受控节点也添加了俩张网卡，一个仅主机一个NAT
  6. [student@master ansibleTest]$ ansible all -m yum -a 'name=httpd state=present'
  7. node01 | SUCCESS => {
  8.     "ansible_facts": {
  9.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  10.     },
  11.     "changed": false,
  12.     "msg": "Nothing to do",
  13.     "rc": 0,
  14.     "results": []
  15. }
  16. node02 | SUCCESS => {
  17.     "ansible_facts": {
  18.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  19.     },
  20.     "changed": false,
  21.     "msg": "Nothing to do",
  22.     "rc": 0,
  23.     "results": []
  24. }
  25. master | SUCCESS => {
  26.     "ansible_facts": {
  27.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  28.     },
  29.     "changed": false,
  30.     "msg": "Nothing to do",
  31.     "rc": 0,
  32.     "results": []
  33. }
  34.  
  35. 测试：
  36. [student@master ansibleTest]$ ansible all -m shell -a 'systemctl is-active httpd'
  37. node02 | CHANGED | rc=0 >>
  38. active
  39. node01 | CHANGED | rc=0 >>
  40. active
  41. master | CHANGED | rc=0 >>
  42. active

playbook

1、编写一个确保chrond服务开机自启：

  1. 1、安装chrony服务：---注意服务名称呀！！！！
  2. [student@master ansibleTest]$  ansible all -m yum -a 'name=chrony state=present'
  3. node01 | SUCCESS => {
  4.     "ansible_facts": {
  5.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  6.     },
  7.     "changed": false,
  8.     "msg": "Nothing to do",
  9.     "rc": 0,
  10.     "results": []
  11. }
  12. master | SUCCESS => {
  13.     "ansible_facts": {
  14.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  15.     },
  16.     "changed": false,
  17.     "msg": "Nothing to do",
  18.     "rc": 0,
  19.     "results": []
  20. }
  21. node02 | CHANGED => {
  22.     "ansible_facts": {
  23.         "discovered_interpreter_python": "/usr/libexec/platform-python"
  24.     },
  25.     "changed": true,
  26.     "msg": "",
  27.     "rc": 0,
  28.     "results": [
  29.         "Installed: timedatex-0.5-3.el8.x86_64",
  30.         "Installed: chrony-4.2-1.el8.rocky.1.0.x86_64"
  31.     ]
  32. }
  33.  
  34.  
  35. 2、编写playbook：
  36.  
  37. ---
  38. - name: enable chronyd
  39.   hosts: all
  40.   tasks:
  41.     - name: enable chrony service
  42.       service:
  43.         name: chronyd
  44.         enabled: yes
  45.  
  46. 3、运行playbook：
  47. [student@master ansibleTest]$ ansible-playbook chrony_service.yaml
  48.  
  49. PLAY [enable chronyd] ************************************************************************************************************************
  50.  
  51. TASK [Gathering Facts] ***********************************************************************************************************************
  52. ok: [node01]
  53. ok: [node02]
  54. ok: [master]
  55.  
  56. TASK [enable chrony service] *****************************************************************************************************************
  57. ok: [node01]
  58. ok: [node02]
  59. ok: [master]
  60.  
  61. PLAY RECAP ***********************************************************************************************************************************
  62. master                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  63. node01                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  64. node02                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  65. 执行成功结果！！！

2、语法检测：

  1. [student@master ansibleTest]$ ansible-playbook  --syntax-check chrony_service.yaml
  2. playbook: chrony_service.yaml

实验：

案例一：安装http 启动防火墙，写入测试页index.html

  1. 1、编写playbook：
  2.  
  3. ---
  4. - name: configer web server
  5.   hosts: webs
  6.   tasks:
  7.     - name: install httpd
  8.       yum:
  9.         name: httpd
  10.         state: present
  11.     - name: start firwalld
  12.       service:
  13.         name: firewalld
  14.         state: started
  15.  
  16.     - name: firewalld allow httpd
  17.       firewalld:
  18.         service: http
  19.         state: enabled
  20.     - name: copy index.html
  21.       copy:
  22.         content: "this is web test"
  23.         dest: /var/www/html/idnex.html
  24.     - name: test web page
  25.       uri:
  26.         url: http://localhost
  27.         return_content: yes
  28.         status_code: 200
  29.  
  30. 2、语法检测：
  31. [student@master ansibleTest]$ ansible-playbook --syntax-check configer_server.yaml
  32. playbook: configer_server.yaml
  33.  
  34. 3、运行playbook：
  35.  
  36. [student@master ansibleTest]$ ansible-playbook configer_server.yaml
  37.  
  38. PLAY [configer web server] *******************************************************************************************************************
  39.  
  40. TASK [Gathering Facts] ***********************************************************************************************************************
  41. ok: [node02]
  42. ok: [node01]
  43.  
  44. TASK [install httpd] *************************************************************************************************************************
  45. ok: [node01]
  46. ok: [node02]
  47.  
  48. TASK [start firwalld] ************************************************************************************************************************
  49. ok: [node02]
  50. ok: [node01]
  51.  
  52. TASK [firewalld allow httpd] *****************************************************************************************************************
  53. ok: [node02]
  54. ok: [node01]
  55.  
  56. TASK [copy index.html] ***********************************************************************************************************************
  57. changed: [node01]
  58. changed: [node02]
  59.  
  60. TASK [test web page] *************************************************************************************************************************
  61. ok: [node02]
  62. ok: [node01]
  63.  
  64. PLAY RECAP ***********************************************************************************************************************************
  65. node01                     : ok=6    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  66. node02                     : ok=6    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

案列二：在上一实验基础上写多个play

  1. 1、编写playbook：
  2. [student@master ansibleTest]$ cat configer_server.yaml
  3. ---
  4. - name: configer web server
  5.   hosts: webs
  6.   tasks:
  7.     - name: install httpd
  8.       yum:
  9.         name: httpd
  10.         state: present
  11.     - name: start firwalld
  12.       service:
  13.         name: firewalld
  14.         state: started
  15.  
  16.     - name: firewalld allow httpd
  17.       firewalld:
  18.         service: http
  19.         state: enabled
  20.     - name: copy index.html
  21.       copy:
  22.         content: "this is web test"
  23.         dest: /var/www/html/index.html
  24.     - name: test web page
  25.       uri:
  26.         url: http://localhost
  27.         return_content: yes
  28.         status_code: 200
  29.  
  30.  
  31. - name: test web pages
  32.   hosts: master
  33.   tasks:
  34.     - name: test node01 web
  35.       uri:
  36.         url: http://node01
  37.         status_code: 200
  38.     - name: test node02 web
  39.       uri:
  40.         url: http://node02
  41.         status_code: 200
  42.  
  43. 2、测试：
  44.  
  45. [student@master ansibleTest]$ ansible-playbook configer_server.yaml
  46.  
  47. PLAY [configer web server] *******************************************************************************************************************
  48.  
  49. TASK [Gathering Facts] ***********************************************************************************************************************
  50. ok: [node02]
  51. ok: [node01]
  52.  
  53. TASK [install httpd] *************************************************************************************************************************
  54. ok: [node01]
  55. ok: [node02]
  56.  
  57. TASK [start firwalld] ************************************************************************************************************************
  58. ok: [node02]
  59. ok: [node01]
  60.  
  61. TASK [firewalld allow httpd] *****************************************************************************************************************
  62. ok: [node02]
  63. ok: [node01]
  64.  
  65. TASK [copy index.html] ***********************************************************************************************************************
  66. changed: [node01]
  67. changed: [node02]
  68.  
  69. TASK [test web page] *************************************************************************************************************************
  70. ok: [node02]
  71. ok: [node01]
  72.  
  73. PLAY RECAP ***********************************************************************************************************************************
  74. node01                     : ok=6    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  75. node02                     : ok=6    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

案例三：webserver

  1. 1、编写playbook：
  2. ---
  3. - name: first play
  4.   hosts: webs
  5.   tasks:
  6.     - name: install packages
  7.       yum:
  8.         name:
  9.           - httpd
  10.           - php
  11.           - firewalld
  12.           - mariadb-server
  13.           - php-mysqlnd
  14.         state: latest
  15.  
  16.  
  17.     - name: start firewalld
  18.       service:
  19.         name: firewalld
  20.         state: started
  21.         enabled: yes
  22.  
  23.     - name: configer firewalld allow http
  24.       firewalld:
  25.         service: http
  26.         permanent: yes
  27.         state: enabled
  28.         immediate: yes
  29.  
  30.     - name: copy index.php
  31.       copy:
  32.         src: index.php
  33.         dest: /var/www/html/index.php
  34.  
  35.  
  36.     - name: start httpd
  37.       service:
  38.         name: httpd
  39.         state: restarted
  40.         enabled: yes
  41.  
  42. - name: second play
  43.   hosts: master
  44.   become: no
  45.   tasks:
  46.     - name: test web1 page
  47.       uri:
  48.         url: http://node01
  49.         return_content: yes
  50.         status_code: 200
  51.  
  52.     - name: test web2 page
  53.       uri:
  54.         url: http://node02
  55.         return_content: yes
  56.         status_code: 200
  57.  
  58. 2、编写php文件：
  59. [student@master ansibleTest]$ cat index.php
  60. <?php
  61. phpinfo();
  62.  
  63.         
  64. 3、测试：
  65. [student@master ansibleTest]$ ansible-playbook plays.yaml
  66.  
  67. PLAY [first play] ****************************************************************************************************************************
  68.  
  69. TASK [Gathering Facts] ***********************************************************************************************************************
  70. ok: [node02]
  71. ok: [node01]
  72.  
  73. TASK [install packages] **********************************************************************************************************************
  74. ok: [node01]
  75. ok: [node02]
  76.  
  77. TASK [start firewalld] ***********************************************************************************************************************
  78. ok: [node02]
  79. ok: [node01]
  80.  
  81. TASK [configer firewalld allow http] *********************************************************************************************************
  82. ok: [node01]
  83. ok: [node02]
  84.  
  85. TASK [copy index.php] ************************************************************************************************************************
  86. ok: [node01]
  87. ok: [node02]
  88.  
  89. TASK [start httpd] ***************************************************************************************************************************
  90. ok: [node01]
  91. ok: [node02]
  92.  
  93. PLAY [second play] ***************************************************************************************************************************
  94.  
  95. TASK [Gathering Facts] ***********************************************************************************************************************
  96. ok: [master]
  97.  
  98. TASK [test web1 page] ************************************************************************************************************************
  99. ok: [master]
  100.  
  101. TASK [test web2 page] ************************************************************************************************************************
  102. ok: [master]
  103.  
  104. PLAY RECAP ***********************************************************************************************************************************
  105. master                     : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  106. node01                     : ok=6    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  107. node02                     : ok=6    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

作业：在受控节点上添加一个普通用户xiaohong，配置控制节点的student可以免密登录xiaohong用户，并且xiaohong可以sudo。

  1. 1、编写yaml：
  2. [student@master ansibleTest]$ cat user.yaml
  3. ---
  4. - name: generate public/private key pair
  5.   hosts: master
  6.   become: no
  7.   remote_user: student
  8.   tasks:
  9.     - openssh_keypair:
  10.         path: /home/student/.ssh/id_rsa
  11.  
  12. - name: create user
  13.   hosts: node01
  14.   tasks:
  15.     - name: create user xiaohong
  16.       user:
  17.         name: xiaohong
  18.         state: present
  19.  
  20.     - name: setting passwd
  21.       shell: echo redhat | passwd --stdin xiaohong
  22.  
  23.     - name: setting sudoers
  24.       lineinfile:
  25.         line: "xiaohong ALL=(ALL) NOPASSWD: ALL"
  26.         path: /etc/sudoers
  27.  
  28. - name: set authorized key
  29.   hosts: node01
  30.   remote_user: xiaohong
  31.   become: no
  32.   tasks:
  33.     - name: set authorized key
  34.       authorized_key:
  35.         state: present
  36.         user: xiaohong
  37.         key: "{{ lookup( 'file', '/home/student/.ssh/id_rsa.pub' ) }}"
  38.  
  39. 2、修改ansible.cfg文件
  40. [student@master ansibleTest]$ cat ansible.cfg
  41. [defaults]
  42. inventory= ./inventory
  43. remote_user = redhat
  44. ask_pass = yes
  45. [privilege_escalation]
  46. become = True
  47. become_method = sudo
  48. become_user = root
  49. become_ask_pass = False
  50.  
  51. 3、语法检测：
  52. [student@master ansibleTest]$ ansible-playbook user.yaml
  53.  
  54. 4、执行：需要输入密码！！！
  55.  
  56. [student@master ansibleTest]$ ansible-playbook user.yaml
  57. SSH password:
  58.  
  59. PLAY [generate public/private key pair] ******************************************************************************************************
  60.  
  61. TASK [Gathering Facts] ***********************************************************************************************************************
  62. ok: [master]
  63.  
  64. TASK [openssh_keypair] ***********************************************************************************************************************
  65. changed: [master]
  66.  
  67. PLAY [create user] ***************************************************************************************************************************
  68.  
  69. TASK [Gathering Facts] ***********************************************************************************************************************
  70. ok: [node01]
  71.  
  72. TASK [create user xiaohong] ******************************************************************************************************************
  73. changed: [node01]
  74.  
  75. TASK [setting passwd] ************************************************************************************************************************
  76. changed: [node01]
  77.  
  78. TASK [setting sudoers] ***********************************************************************************************************************
  79. changed: [node01]
  80.  
  81. PLAY [set authorized key] ********************************************************************************************************************
  82.  
  83. TASK [Gathering Facts] ***********************************************************************************************************************
  84. ok: [node01]
  85.  
  86. TASK [set authorized key] ********************************************************************************************************************
  87. changed: [node01]
  88.  
  89. PLAY RECAP ***********************************************************************************************************************************
  90. master                     : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  91. node01                     : ok=6    changed=4    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

作业二：给受控主机部署yum仓库

仓库1：

name：base

description：baseos

base url：http://mirrors.163.com/centos-vault/8.5.2111/BaseOS/x86_64/os/

需要验证软件包gpg签名

gpgcheck在/etc/pki/rpm-gpg/rpm-gpg-key-*

启用此软件仓库

仓库2：

name：app

description：APPstream

base url：http://mirrors.163.com/centos-vault/8.5.2111/AppStream/x86_64/os/

需要验证软件包gpg签名

gpgcheck在/etc/pki/rpm-gpg/rpm-gpg-key-*

注意：检查自己的linux版本，选择对应版本的仓库

部署成功后在受控节点上安装vsftpd软件包

  1. 环境前准备：
  2. 查看配置文件：
  3. [student@master ansibleTest]$ cat ansible.cfg
  4. [defaults]
  5. inventory= ./inventory
  6. remote_user = redhat
  7. ask_pass = false
  8. [privilege_escalation]
  9. become = True
  10. become_method = sudo
  11. become_user = root
  12. become_ask_pass = False
  13. [student@master ansibleTest]$ ansible --version
  14. ansible [core 2.13.3]
  15.   config file = /home/student/ansibleTest/ansible.cfg
  16.   configured module search path = ['/home/student/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  17.   ansible python module location = /usr/lib/python3.9/site-packages/ansible
  18.   ansible collection location = /home/student/.ansible/collections:/usr/share/ansible/collections
  19.   executable location = /usr/bin/ansible
  20.   python version = 3.9.13 (main, Nov 16 2022, 15:31:39) [GCC 8.5.0 20210514 (Red Hat 8.5.0-15)]
  21.   jinja version = 3.1.2
  22.   libyaml = True
  23.  
  24. 查看inventory：
  25. [student@master ansibleTest]$ cat inventory
  26. [webs]
  27. node01
  28. node02
  29.  
  30. [web1]
  31. node01
  32.  
  33. [web2]
  34. node02
  35.  
  36. [all]
  37. node01
  38. node02
  39. master
  40.  
  41. 做好免密登录，重传
  42. [student@master ansibleTest]$ ssh-copy-id redhat@node01
  43. [student@master ansibleTest]$ ssh-copy-id redhat@node02
  44.  
  45.  
  46. 1、编写playbook：
  47. [student@master ansibleTest]$ cat yum.yaml
  48. ---
  49. - name: create repository
  50.   hosts: webs
  51.   tasks:
  52.     - name: add repository baseos
  53.       yum_repository:
  54.         name: base
  55.         description: baseos
  56.         baseurl: http://mirrors.163.com/rocky/8.6/BaseOS/x86_64/os/
  57.         gpgcheck: yes
  58.         gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG_KEY-rockyofficial
  59.         enabled: yes
  60.     - name: add repository app
  61.       yum_repository:
  62.         name: app
  63.         description: appstream
  64.         baseurl: http://mirrors.163.com/rocky/8.6/AppStream/x86_64/os/
  65.         gpgcheck: yes
  66.         gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG_KEY-rockyofficial
  67.         enabled: yes
  68.  
  69. 2、语法检测：
  70. [student@master ansibleTest]$ ansible-playbook yum.yaml
  71.  
  72. 3、测试：
  73. [student@master ansibleTest]$ ansible-playbook yum.yaml
  74.  
  75. PLAY [create repository] *********************************************************************************************************************
  76.  
  77. TASK [Gathering Facts] ***********************************************************************************************************************
  78. ok: [node02]
  79. ok: [node01]
  80.  
  81. TASK [add repository baseos] *****************************************************************************************************************
  82. changed: [node02]
  83. changed: [node01]
  84.  
  85. TASK [add repository app] ********************************************************************************************************************
  86. changed: [node01]
  87. changed: [node02]
  88.  
  89. PLAY RECAP ***********************************************************************************************************************************
  90. node01                     : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  91. node02                     : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

作业三：给web主机组写一个playbook，该playbook有俩个play，第一个play可以保证在web主机组上安装httpd和php，确保web主机组的/var/www/html/目录下有一个index.php，内容如下：

  1. <?php
  2. phpinfo();

该playbook里面的第二个play用于测试该web主机组的web服务能否被成功访问index.php内容

管理事实

案例一：向受管主机的/home/file文件里面写入内容如下：

  1. hostname=当前主机的名字
  2. memory=当前主机的内存大小
  3. BIOS version = 当前主机的bios的版本
  4. distribution = 当前linux主机的发行版本信息
  5. size of disk device is 当前主机的磁盘大小
  1. [student@master ansibleTest]$ cat sys.yaml
  2. ---
  3. - name: first play
  4.   hosts: master
  5.   tasks:
  6.     - name: print msg
  7.       debug:
  8.         msg: |
  9.                 hostname: {{ ansible_facts.hostname }},
  10.                 memory: {{ ansible_facts.memory_mb.real.total }}
  11.                 bios version: {{ ansible_facts.bios_version }}
  12.                 distribution: {{ansible_facts.distribution }}
  13.                 device size: {{ ansible_facts.device.sda.size}}
  14.  
  15.     - name: copy file
  16.       copy:
  17.         content: |
  18.                 hostname: {{ ansible_facts.hostname }},
  19.                 memory: {{ ansible_facts.memory_mb.real.total }}
  20.                 bios version: {{ ansible_facts.bios_version }}
  21.                 distribution: {{ansible_facts.distribution }}
  22.                 device size: {{ ansible_facts.device.sda.size}}
  23.  
  24.         dest: /home/file

案例二：将createuser.fact文件传输到受管主机工作为自定义事实

案例三：使用debug模块，显示当前受控主机的dns服务器的ip地址

  1. [student@master ansibleTest]$ ansible-playbook dns.yaml
  2.  
  3. PLAY [firt play] *****************************************************************************************************************************
  4.  
  5. TASK [Gathering Facts] ***********************************************************************************************************************
  6. ok: [node01]
  7.  
  8. TASK [debug] *********************************************************************************************************************************
  9. ok: [node01] => {
  10.     "ansible_facts.dns.nameservers": [
  11.         "192.168.11.2",
  12.         "172.25.250.1"
  13.     ]
  14. }
  15.  
  16. PLAY RECAP ***********************************************************************************************************************************
  17. node01                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  18.  
  19. [student@master ansibleTest]$ cat dns.yaml
  20. ---
  21. - name: firt play
  22.   hosts: node01
  23.   tasks:
  24.     - debug:
  25.         var: ansible_facts.dns.nameservers

实施任务控制

案列一：重启服务

  1. 1、编写playbook：
  2. [student@master ansibleTest]$ cat restart_service.yaml
  3. ---
  4. - name: restart service
  5.   hosts: all
  6.   tasks:
  7.     - name: install httpd mariadb-server
  8.       yum:
  9.         name:
  10.           - httpd
  11.           - mariadb-server
  12.  
  13.         state: present
  14.       register: result
  15.  
  16.     - debug:
  17.         var: result
  18.  
  19.     - name: start service
  20.       service:
  21.         name: "{{ item }}"
  22.         state: restarted
  23.       loop:
  24.         - httpd
  25.         - mariadb
  26.       when: result.rc == 0
  27. 2、执行：俩次执行不一样，因为幂等性
  28. [student@master ansibleTest]$ ansible-playbook restart_service.yaml
  29.  
  30. PLAY [restart service] ***********************************************************************************************************************
  31.  
  32. TASK [Gathering Facts] ***********************************************************************************************************************
  33. ok: [node02]
  34. ok: [node01]
  35. ok: [master]
  36.  
  37. TASK [install httpd mariadb-server] **********************************************************************************************************
  38. ok: [node01]
  39. ok: [master]
  40. ok: [node02]
  41.  
  42. TASK [debug] *********************************************************************************************************************************
  43. ok: [node01] => {
  44.     "result": {
  45.         "changed": false,
  46.         "failed": false,
  47.         "msg": "Nothing to do",
  48.         "rc": 0,
  49.         "results": []
  50.     }
  51. }
  52. ok: [node02] => {
  53.     "result": {
  54.         "changed": false,
  55.         "failed": false,
  56.         "msg": "Nothing to do",
  57.         "rc": 0,
  58.         "results": []
  59.     }
  60. }
  61. ok: [master] => {
  62.     "result": {
  63.         "changed": false,
  64.         "failed": false,
  65.         "msg": "Nothing to do",
  66.         "rc": 0,
  67.         "results": []
  68.     }
  69. }
  70.  
  71. TASK [start service] *************************************************************************************************************************
  72. changed: [node01] => (item=httpd)
  73. changed: [node02] => (item=httpd)
  74. changed: [master] => (item=httpd)
  75. changed: [node01] => (item=mariadb)
  76. changed: [node02] => (item=mariadb)
  77. changed: [master] => (item=mariadb)
  78.  
  79. PLAY RECAP ***********************************************************************************************************************************
  80. master                     : ok=4    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  81. node01                     : ok=4    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  82. node02                     : ok=4    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

四、个人博客搭建

一、主要内容

wordpress依赖于PHP和MySQL，所以在搭建wordpress前需要先把PHP和MySQL的环境搭建好,本文中使用的web服务为apache。

1、安装LAMP服务器系统(Linux、Apache、MySQL、PHP )

2、安装WordPress

二、具体步骤

安装apache

使用yum安装apache

root@rocky:~# yum install httpd -y

启动apache

  1. root@rocky:~# systemctl is-active httpd
  2. active
  3. root@rocky:~# systemctl start httpd

设置开机自启动

  1. systemctl enable httpd
  2.  
  3. 或者：重启加开机自启动
  4. root@rocky:~# systemctl enable --now httpd

安装PHP

root@rocky:~# yum install php php-devel -y

接下来是一些拓展

yum install php-gd php-ldap php-odbc php-pear php-xml php-xmlrpc -y

还有一个不能通过上述方式直接安装的php-mysql

  1. root@rocky:~# yum search php-mysql
  2. Last metadata expiration check: 0:16:40 ago on Sat 17 Dec 2022 07:54:40 PM CST.
  3. ===================================================================== Name Matched: php-mysql ======================================================================
  4. php-mysqlnd.x86_64 : A module for PHP applications that use MySQL databases
  5. root@rocky:~# yum install php-mysqlnd.x86_64
  6. Last metadata expiration check: 0:16:55 ago on Sat 17 Dec 2022 07:54:40 PM CST.
  7. Package php-mysqlnd-7.2.24-1.module+el8.4.0+413+c9202dda.x86_64 is already installed.
  8. Dependencies resolved.
  9. Nothing to do.
  10. Complete!

PHP,启动！

root@rocky:~# systemctl start php-fpm

开机启动

root@rocky:~# systemctl enable php-fpm

安装MySQL

很多教程选择安装mysql的客户端来进行以下操作，官网也是这么玩的，但是我懒，就选择了直接摁命令行

root@rocky:~# yum install mysql mysql-server

启动MySQL

root@rocky:~# systemctl start mysqld.service

修改新建好的账户密码

root@rocky:~# mysqladmin -u root password 123456

登入你的MySQL

root@rocky:~# mysql -u root -p123456

输入你刚刚修改的密码，然后新建一个库

  1. mysql> create database wordpress ;
  2. Query OK, 1 row affected (0.00 sec)

新建一个用户(MySQL8.0需要先创建用户，如果不是8.0+可以跳过这步)，如果报错把"IDENTIFIED BY '这里是你的密码'"这块去掉

  1. mysql> CREATE USER 'root'@'%' IDENTIFIED BY '123456';
  2. Query OK, 0 rows affected (0.00 sec)
  3.  
  4. mysql> CREATE USER 'wordpress'@'%' IDENTIFIED BY '123456';
  5. Query OK, 0 rows affected (0.01 sec)

授予访问权限，刷新

  1. mysql> grant all privileges on wordpress .* to 'root'@'%';
  2. Query OK, 0 rows affected (0.00 sec)
  3.  
  4. mysql> grant all privileges on wordpress to 'wordpress'@'%';
  5. Query OK, 0 rows affected (0.00 sec)
  6.  
  7.  
  8. mysql> flush privileges;
  9. Query OK, 0 rows affected (0.00 sec)

准备工作完成开始安装wordpress

安装wordpress

下载wordpress的包，并解压。如果你愿意冒着一点打不开的风险重新安装的话可以试试下面的最新版，毕竟在装了两次最新版都死亡白屏但是换成了旧版本之前，我也是个一定要装最新版的强迫症

  1. root@rocky:~#  wget http://wordpress.org/latest.tar.gz
  2.  
  3.  tar -xzf latest.tar.gz

附上我用起来没毛病的包

  1. root@rocky:~# wget https://cn.wordpress.org/wordpress-5.0.3-zh_CN.zip
  2. root@rocky:~#unzip wordpress-5.0.3-zh_CN.zip

将wordpress文件夹拷贝至apache服务器根文件目录下(正常情况下为：/var/www/html )

root@rocky:~#cp -r wordpress /var/www/html/

跳转然后创建并修改wordpress的配置文件

  1. root@rocky:~# cd /var/www/html/wordpress/
  2. root@rocky:/var/www/html/wordpress# cp wp-config-sample.php wp-config.php
  3. root@rocky:/var/www/html/wordpress# vim wp-config.php

修改数据库名字，用户名，密码

测试：

关闭防火墙selinux

  1. root@rocky:/var/www/html/wordpress# systemctl is-active firewalld.service
  2. active
  3. root@rocky:/var/www/html/wordpress# systemctl stop firewalld.service
  4. root@rocky:/var/www/html/wordpress# setenforce 0
  5. root@rocky:/var/www/html/wordpress# getenforce
  6. Permissive

访问

http://192.168.11.142/wordpress/wp-admin/install.php

进行wordpress初始化,一顿操作猛如虎，但是结果进不了数据库

简化步骤直接操作：

  1. 1、安装httpd：
  2. [root@rocky ~]#yum update
  3. [root@rocky ~]# yum install httpd -y
  4.  
  5. 2、启动服务;
  6. [root@rocky ~]# systemctl start httpd
  7.  
  8. 3、关闭防火墙，selinux
  9. [root@rocky ~]# systemctl stop firewalld.service
  10. [root@rocky ~]# setenforce 0
  11.  
  12. 4、安装PHP：
  13. [root@rocky ~]# yum install php -y
  14.  
  15. 5、安装组件：
  16. [root@rocky ~]#yum install php-* -y
  17.  
  18. 6、写phpinfo
  19. [root@rocky html]# cat info.php
  20. <?php
  21. phpinfo();
  22. ?>
  23.  
  24. 7、重启服务：
  25. [root@rocky html]# systemctl restart httpd.service
  26. [root@rocky html]# systemctl restart php-fpm.service
  27.  
  28. 8、安装mysql：
  29. [root@rocky html]# yum install mysql-server -y
  30.  
  31. 9、重启并设置为开机自启动：
  32. [root@rocky html]# systemctl enable --now mysqld
  33.  
  34. 10、设置数据库密码：
  35. mysqladmin -uroot -p123456
  36.  
  37. 11、创建数据库：
  38. mysql> create database wordpress;
  39. Query OK, 1 row affected (0.00 sec)
  40.  
  41. 12、下载WordPress：
  42. root@rocky:~# wget https://cn.wordpress.org/wordpress-5.0.3-zh_CN.zip
  43. root@rocky:~#unzip wordpress-5.0.3-zh_CN.zip
  44.  
  45. 13、拷贝一份并命名为 wp-config.php
  46. [root@rocky wordpress]# cp wp-config-sample.php wp-config.php
  47.  
  48. 14、修改三个地方：
  49. 第一个是数据库名称，安装mysql时最后面创建的数据库，这里是wordpress
  50. 第二个是数据库的名称，这里没创建用户，用默认的root即可
  51. 第三个是数据库的密码，即安装第3步数据库时修改的密码，没修改的话默认填写’’,空着，不要删除两个单引号，(实际上我没试过没密码的，习惯性给数据库都添加了密码，这里你可以试试看没密码的，如果不行就按照安装数据库部分第三步修改一下密码，然后设置进来就行)
  52. 修改完成后按esc，然后输入：wq退出保存文件即可
  53.  
  54. 15、测试：http://192.168.11.142/wordpress/wp-admin/install.php
  55. 数据库密码为空

蒸汽小火车：

下载链接：http://rpmfind.net/linux/rpm2html/search.php?query=sl&submit=Search+...&system=&arch=+x86_64

  1. 1、下载：
  2. [root@rocky ~]# wget http://rpmfind.net/linux/epel/8/Everything/x86_64/Packages/s/sl-5.02-1.el8.x86_64.r   pm
  3. 2、安装：
  4. [root@rocky ~]# rpm -i sl-5.02-1.el8.x86_64.rpm
  5. warning: sl-5.02-1.el8.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 2f86d6a1: NOKEY
  6. 3、运行：
  7. [root@rocky ~]# sl

五、RHCE---服务篇

环境准备

1、将网卡设置为开机自启动：

  1. [root@master ~]# nmcli connection modify ens160 connection.autoconnect yes
  2. [root@master ~]# nmcli connection up ens160
  3. Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

2、学习环境：8.x

  1. [root@master ~]# cat /etc/os-release
  2. NAME="Rocky Linux"
  3. VERSION="8.6 (Green Obsidian)"
  4. ID="rocky"
  5. ID_LIKE="rhel centos fedora"
  6. VERSION_ID="8.6"
  7. PLATFORM_ID="platform:el8"
  8. PRETTY_NAME="Rocky Linux 8.6 (Green Obsidian)"
  9. ANSI_COLOR="0;32"
  10. CPE_NAME="cpe:/o:rocky:rocky:8:GA"
  11. HOME_URL="https://rockylinux.org/"
  12. BUG_REPORT_URL="https://bugs.rockylinux.org/"
  13. ROCKY_SUPPORT_PRODUCT="Rocky Linux"
  14. ROCKY_SUPPORT_PRODUCT_VERSION="8"
  15. REDHAT_SUPPORT_PRODUCT="Rocky Linux"
  16. REDHAT_SUPPORT_PRODUCT_VERSION="8"

3、系统时间--方便后期查看日志文件更新时间：

[root@master ~]# timedatectl set-timezone   Asia/Shanghai

4、配置好yum/dnf源 rpm

curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo

5、安装常用的软件包：

yum install -y bash-completion tree lrzsz  vim  net-tools.x86_64  unzip net-tools  lsof  wget

6、rpm包软件管理：

  1. rpm包进行管理
  2. rpm   -ivh 安装软件
  3.       -evh 卸载软件
  4.        -qa     rpm -qa | grep httpd 查看信息
  5.        -ql      
  6.        -qf

7、yum/dnf 7的版本用yum更多，在8版本之后用的dnf之多，可以在后期自己尝试用dnf

  1. #vim   /etc/fstab
  2. /dev/sr0   /mnt  iso9660    defaults     0 0 
  3. #mount -a 查看挂载
  4. #vim /etc/yum.repos.d/base.repo 
  5. [BaseOS]
  6. name=RHEL8.5-BaseOS
  7. baseurl=file:///mnt/BaseOS
  8. gpgcheck=0
  9. [AppStream]
  10. name=RHEL8.5-AppStream
  11. baseurl=file:///mnt/AppStream
  12. gpgcheck=0

案例

案例一： 搭建web服务器，提供redhat测试界面

linux主机作为服务器

1、部署web服务程序 apache http server(httpd)

  1. [root@localhost ~]# rpm -qa | grep httpd
  2. httpd-filesystem-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch
  3. httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64
  4. httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64
  5. redhat-logos-httpd-84.5-1.el8.noarch
  6. [root@localhost ~]# yum install httpd -y

2、当前主机启动该服务程序

  1. #systemctl    start|stop|restart|status|load|reload|enable|disable|is-active|is-enabled   httpd
  2. [root@localhost ~]# systemctl start httpd
  3. [root@localhost ~]# systemctl is-active httpd

3、提供客户端主机可以访问的资源文件

默认的资源文件

问什么默认访问的是欢迎界面：通过主配置/var/www/html加载网站资源文件(index.html),当文件不存在，匹配子配置文件/etc/httpd/conf.d/welcome.conf

Alias /.noindex.html /usr/share/httpd/noindex/index.html

4、关闭防火墙，selinux

  1. [root@localhost ~]# systemctl stop firewalld      ---建议临时关闭
  2.  [root@localhost ~]# systemctl disable firewalld

关闭selinux:

  1. 临时生效
  2. [root@localhost ~]# setenforce 0      ---主机运行状态下临时关闭
  3. [root@localhost ~]# getenforce            --查看selinux状态
  4. Permissive 
  5. 永久修改linux状态
  6. [root@localhost ~]# vim /etc/selinux/config 
  7. # This file controls the state of SELinux on the system.
  8. # SELINUX= can take one of these three values:
  9. #     enforcing - SELinux security policy is enforced.     强制状态(开启)
  10. #     permissive - SELinux prints warnings instead of enforcing.   警告(关闭)
  11. #     disabled - No SELinux policy is loaded.                    禁用(不加载selinux)
  12. SELINUX=permissive

5、rpm -ql httpd | more

/etc/httpd/conf 主配置目录(默认提供的参数信息)

/etc/httpd/conf/httpd.conf

/etc/httpd/conf.d 子配置目录(辅助)(自定义的配置文件)

/etc/httpd/conf.d/*.conf

一个完整配置文件先加载主配置文件，在加载子配置文件

/etc/httpd/conf.modules.d 模块配置文件的路径

  1. 全局生效
  2. ServerRoot   /etc/httpd      配置文件中加载文件的主路径
  3. Listen  80                   服务程序默认监听端口
  4. User apache                  服务程序运行后的所属用户和所属组
  5. Group apache
  6. Serveradmin  root@localhost
  7. #ServerName  www.example.com:80   定义服务主机访问名称
  8. ServerName 0.0.0.0:80
  9. DocumentRoot "/var/www/html"   定义网站默认的主路径
  10. IncludeOptional conf.d/*.conf   开始加载所有子配置文件
  11.  
  12. 局部生效
  13. <Directory />            目录起始标签  /
  14.     AllowOverride none
  15.     Require all denied         请求所有拒绝
  16. </Directory>
  17. <Directory "/var/www">     目录起始标签  /var/www  
  18.     AllowOverride None
  19.     # Allow open access:
  20.     Require all granted     请求所有允许  
  21. </Directory>
  22. <IfModule dir_module>      模块标记  对目录模块定义
  23.     DirectoryIndex index.html     网站主目录索引文件文件名为index.html
  24. </IfModule>

案例二：搭建网站创建自定义网页文件

linux主机作为服务器

1、部署web服务程序 apache http server(httpd)

2、当前主机启动该服务程序

3、提供客户端主机可以访问的资源文件

  1. #cd /var/www/html
  2.   #echo helloworld > index.html
  3.   通过主配置/var/www/html加载网站资源文件(index.html)当文件存在，直接加载该文件内容进行相应。

4、关闭防火墙，selinux

window/linux 客户端主机

浏览器：url 网址 http://ip/1/index.html /var/www/html/1/index.html

权限控制

web服务程序资源文件的权限控制可以在配置文件和文件层级。

  1. <Directory "/www">     目录起始标签  /www  
  2.     AllowOverride None
  3.     #Allow open access:
  4.     Require all granted     请求所有允许  
  5. </Directory>
  6. [root@localhost ~]# chmod o-r /www/index.html
  7. [root@localhost ~]# ll /www/index.html
  8. -rw-r-----. 1 root root 13 Mar 20 09:58 /www/index.html
  9. [root@localhost ~]# chmod o+r /www/index.html
  10.  
  11. https://httpd.apache.org/docs/2.4/howto/auth.html
  12. require user tom
  13. Require ip address
  14. Require not  ip address
  15. Require host domain_name
  16. <Directory /openlab>
  17.         AllowOverride none
  18.         <RequireAll>
  19.                 Require all granted
  20.                 Require not  ip 192.168.153.128
  21.         </RequireAll>
  22. </Directory>
  23.  
  24. 多网站访问
  25. http://ip|域名|:80
  26. https://

案例三：多ip匹配多网站

1、当前主机配置多个ip

  1. [root@localhost ~]# nmcli connection modify ens160 ipv4.method manual ipv4.addresses  192.168.153.128/24 ipv4.gateway 192.168.153.2 ipv4.dns 114.114.114.114 +ipv4.a
  2. ddresses 192.168.153.129 +ipv4.addresses  192.168.153.130
  3. [root@localhost ~]# nmcli connection up ens160 
  4. Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
  5. [root@localhost ~]# ip a

2、通过配置基于多个虚拟主机标签配置多个网站站点

  1. 虚拟主机示例文件
  2. # rpm -ql httpd | grep vhosts.conf
  3. #  vim /usr/share/doc/httpd/httpd-vhosts.conf
  4. 1.自定义子配置文件，配置多主机网站信息
  5. vim /etc/httpd/conf.d/vhosts.conf 
  6. <VirtualHost 192.168.153.128:80>
  7.     DocumentRoot "/openlab/128"
  8.     ServerName 192.168.153.128
  9.     ErrorLog "/var/log/httpd/dummy-128.example.com-error_log"
  10.     CustomLog "/var/log/httpd/dummy-128.example.com-access_log" common
  11. </VirtualHost>
  12.  
  13. <VirtualHost 192.168.153.129:80>
  14.     DocumentRoot "/openlab/129"
  15.     ServerName 192.168.153.129
  16. </VirtualHost>
  17.  
  18. <VirtualHost 192.168.153.130:80>
  19.     DocumentRoot "/openlab/130"
  20.     ServerName 192.168.153.130
  21. </VirtualHost>
  22. #资源路径的访问权限
  23. <Directory /openlab>
  24.         AllowOverride none
  25.         Require all granted
  26. </Directory>
  27. 2.根据配置创建对应资源文件
  28. #mkdir /openlab/{128,129,130} -pv
  29. #echo this is 128 > /openlab/128/index.html
  30. #echo this is 129 > /openlab/129/index.html
  31. #echo this is 130 > /openlab/130/index.html
  32. #systemctl restart httpd

案例四： 基于多端口访问多网站

  1. ##130-80
  2. <VirtualHost 192.168.153.130:80>
  3.     DocumentRoot "/openlab/130"
  4.     ServerName 192.168.153.130
  5. </VirtualHost>
  6. ##130--10000    
  7. Listen 10000   #监听自定义端口
  8. <VirtualHost 192.168.153.130:10000>
  9.     DocumentRoot "/openlab/10000"
  10.     ServerName 192.168.153.130
  11. </VirtualHost>
  12. <Directory /openlab>
  13.         AllowOverride none
  14.         Require all granted
  15. </Directory> 
  16.  
  17. [root@localhost ~]# mkdir /openlab/10000
  18. [root@localhost ~]# echo this is 10000 > /openlab/10000/index.html
  19. [root@localhost ~]# systemctl restart httpd     
  20.  
  21. 测试：

案例五：基于域名访问多网站

  1. <VirtualHost 192.168.153.128:80>
  2.     DocumentRoot "/openlab/haha"
  3.     ServerName www.haha.com
  4.     ErrorLog "/var/log/httpd/dummy-128.example.com-error_log"
  5.     CustomLog "/var/log/httpd/dummy-128.example.com-access_log" common
  6. </VirtualHost>
  7. <VirtualHost 192.168.153.128:80>
  8.     DocumentRoot "/openlab/xixi"
  9.     ServerName www.xixi.com
  10.     ErrorLog "/var/log/httpd/dummy-128.example.com-error_log"
  11.     CustomLog "/var/log/httpd/dummy-128.example.com-access_log" common
  12. </VirtualHost>
  13. <Directory /openlab>
  14.         AllowOverride none
  15.         Require all granted
  16. </Directory> 
  17. [root@localhost ~]# mkdir /openlab/{haha,xixi}
  18. [root@localhost ~]# echo this is xixi > /openlab/xixi/index.html
  19. [root@localhost ~]# echo this is haha > /openlab/haha/index.html
  20. [root@localhost ~]# systemctl restart httpd

客户端测试

  1. 1.通过域名访问需要将域名解析为ip
  2. 	通过浏览器缓存匹配
  3. 	客户端主机的hosts文件匹配  
  4.   		window：C:\Windows\System32\drivers\etc
  5. 							192.168.153.128         www.haha.com
  6. 							192.168.153.128         www.xixi.com                         
  7.          linux :  /etc/hosts
  8. 	路由缓存记录匹配
  9. 	本地dns服务

排错方式

  1. (1) 启动不成功(配置文件写的有问题)systemctl restart httpd  
  2. [root@localhost ~]#systemctl status httpd
  3. [root@localhost ~]# journalctl -xe
  4. [root@localhost ~]# httpd -t
  5.  
  6. (2)访问的内容不是我们定义的内容
  7. 逻辑问题：分析主机配置标签是否能匹配或是否冲突
  8. 		资源文件是否创建
  9.         匹配对应文件是否有权限
  10. 		防火墙，selinux

案例六：虚拟目录

alias 虚拟目录名称 真实目录路径

​ 为了便于对网站资源进行灵活管理，还可以把这些文件存放在本地计算机的其它文件夹中或者其它计算机的共享文件夹中，然后再把这个文件夹映射到网站主目录中的一个目录上，这个文件夹被称为“虚拟目录”。

每个虚拟目录都有一个别名，这样用户就可以通过这个虚拟目录的别名来访问与之对应的真实文件夹中的资源了。虚拟目录的好处是在不需要改变别名的情况下，可以随时改变其对应的文件夹。

  1. <VirtualHost 192.168.153.128:80>
  2.     DocumentRoot "/openlab/128"
  3.     #  /网站根目录=/openlab/128
  4.     Alias /file   /openlab/128/1/f/file/newfile/
  5.     ServerName 192.168.153.128
  6.         #  /openlab/128/3w
  7.     Alias /3w     /www
  8. </VirtualHost>
  9. <Directory /openlab>
  10.         AllowOverride none
  11.         Require all granted
  12. </Directory>
  13. <Directory "/www">
  14.     AllowOverride None
  15.     # Allow open access:
  16.     Require all granted
  17. </Directory>
  18.  
  19.  
  20. [root@localhost ~]# mkdir -pv  /openlab/128/1/f/file/newfile/
  21. mkdir: created directory '/openlab/128/1'
  22. mkdir: created directory '/openlab/128/1/f'
  23. mkdir: created directory '/openlab/128/1/f/file'
  24. mkdir: created directory '/openlab/128/1/f/file/newfile/'
  25. [root@localhost ~]# echo this is zijiemian > /openlab/128/1/f/file/newfile/index.html
  26.  
  27. [root@localhost ~]# mkdir /www
  28. mkdir: cannot create directory ‘/www’: File exists
  29. [root@localhost ~]# cd /www
  30. [root@localhost www]# ll
  31. total 4
  32. -rw-r--r--. 1 root root 13 Mar 20 09:58 index.html
  33. [root@localhost www]# echo this is 128 test page > index.html

案例七：用户访问控制+虚拟目录

  1. <VirtualHost 192.168.153.128:80>
  2.     DocumentRoot "/openlab/128"
  3.        # /网站根目录=/openlab/128
  4.     Alias /file   /openlab/128/1/f/file/newfile/
  5.     ServerName 192.168.153.128
  6.     Alias /3w     /www
  7. </VirtualHost>
  8. <Directory /openlab>
  9.         AllowOverride none
  10.         Require all granted
  11. </Directory>
  12. <Directory /www>
  13.         AuthType Basic
  14.         AuthName "Please login:"
  15.         AuthuserFile /etc/httpd/userfile
  16.         Require user tom zhangsan
  17. </Directory>
  18.  
  19. [root@localhost www]# htpasswd -c /etc/httpd/userfile tom    
  20. New password: 
  21. Re-type new password: 
  22. Adding password for user tom
  23. [root@localhost www]# htpasswd /etc/httpd/userfile zhangsan
  24. New password: 
  25. Re-type new password: 
  26. Adding password for user zhangsan
  27.  
  28. curl  http://192.168.153.128/3w/   -u tom

案例八：搭建加密网站

1.加载mod_ssl认证模块

[root@localhost www]# yum install mod_ssl -y

2.生成自签名证书

  1. (第二种) [root@localhost ~]#cd /etc/pki/tls/certs
  2. [root@localhost certs]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ../private/openlab.key  -x509 -days 365 -out openlab.crt
  3.  
  4. ----------------------------------------------x509 key csr crt---------------------------
  5. [root@www certs]# openssl genrsa -aes128 2048 > openlab.key
  6.  (第三种) #openssl req -utf8 -new -key openlab.key -x509 -days 365 -out openlab.crt 
  7. -------------------------------------------------------------------------------------

3.虚拟主机标签中添加加密验证信息

  1. <VirtualHost 192.168.153.128:443>
  2.     DocumentRoot "/ssl"
  3.     ServerName 192.168.153.128
  4.     SSLEngine on
  5. 	SSLCertificateFile /etc/pki/tls/certs/openlab.crt
  6. 	SSLCertificateKeyFile /etc/pki/tls/private/openlab.key
  7. </VirtualHost>
  8. <Directory /ssl>
  9. ​        AllowOverride none
  10. ​        Require all granted
  11. </Directory>

4.重启服务测试

**案例九：扩展配置 **

1.通过http/https 实现文件共享
目录标签中 options +indexes
indexes 默认加载directoryindex 目录标签后，当目录directoryindex找不到对应网页文件(删除主路径下的index.html，以及欢迎界面)会加载mod_autoindex 会将网站主路径下的文件格式为目录列表提供客户端主机访问。

2.配置用户主界面---静态

  1. 1.更改用户主界面配置
  2. vim /etc/httpd/conf.d/userdir.conf
  3. <IfModule mod_userdir.c>
  4. UserDir public_html
  5. <Directory "/home/tom/public_html">
  6. AuthType Basic
  7. AuthName "please login"
  8. AuthuserFile /etc/httpd/userfile
  9. Require user tom
  10. 注意： 访问用户主界面通过什么协议访问
  11. 指定网站访问方式(ip)通过哪种协议可以匹配
  12. 2.创建资源信息
  13. #useradd tom
  14. #mkdir /home/tom/public_html
  15. #echo this is tom > /home/tom/public_html/index.html
  16. #chmod o+rx /home/tom
  17. #htpasswd -c /etc/httpd/userfile tom
  18. 3.重启
  19. 4.firewalld setenfore

搭建动态网站
LAMP
1.linux平台部署web服务
2.配置web服务
(1).安装web服务
(2).根据配置定义加载网页资源文件的路径

  1. [root@localhost uc_server]# cat /etc/httpd/conf.d/vhosts.conf
  2. <Directory /www>
  3. AllowOverride none
  4. Require all granted
  5. <Virtualhost 192.168.153.128:80>
  6. DocumentRoot /www
  7. ServerName 192.168.153.128

(3).根据配置创建资源文件

  1. #mkdir /www
  2. #cd /www  
  3. #unzip Discuz_X3.4_SC_UTF8_20191201.zip

(4).重启服务

3.部署mariadb

  1. [root@localhost install]# yum install mairadb-server -y
  2. [root@localhost www]# systemctl start mariadb
  3. [root@localhost www]# mysql_secure_installation 初始化数据库
  4. enter
  5. y
  6. redhat
  7. redhat
  8. 一直y
  9. [root@localhost www]# mysql -uroot -predhat // -u用户名 -p密码
  10. MariaDB [(none)]> create database luntan;
  11. MariaDB [(none)]>quit
  12. [root@localhost www]# systemctl restart mariadb

4.安装PHP应用程序

  1. yum install php* -y
  2. [root@localhost upload]# pwd
  3. /www/upload
  4. [root@localhost upload]# chmod o+w data config uc_* -R

NFS

1.NFS 网络文件系统(文件共享协议)
通过nfs服务器可以共享文件，客户端主机通过挂载方式访问共享文件。
2.挂载的特点：(文件访问)
通过客户端主机挂载点目录连接服务端共享的nfs文件系统，类似与所有文件都在本地，但实际上所有文
件都在服务端主机中，通过服务端主机可以控制客户某些主机可以访问该文件。
3.挂载方式：
1)临时挂载
2)开机自动挂载
3)自动挂载
一个挂载点可以同时连接多个文件系统(不推荐)注意：RHEL7.X 多个nfs文件系统不支持同时挂载到
一个挂载点目录，但RHEL8.x 多个nfs文件系统不支持同时挂载到一个挂载点目录，但通过挂载点访问的是最后一次连接的文件系统。
同一个文件系统可以挂载到多个挂载点目录。
4.nfs 文件共享的原理

5.nfs服务搭建
服务端
1)安装软件包rpcbind nfs-server
2)自定设置，编辑配置文件

vim /etc/exports
共享目录 允许访问的主机(参数，...)

  1. ro rw
  2. root_squash
  3. no_root_squash
  4. all_squash
  5. anonuid=
  6. anongid=
  7. no_all_squash
  8. sync
  9. async
  10. atime
  11. noatime
  1. 创建资源文件
    创建共享主目录，以及主目录对于用户访问权限设置
    4)systemctl start nfs-server
    exportfs -ra
    5)防火墙 ，selinux
    客户端：linux
    1).showmount -e 服务端ip 查询服务主机共享文件系统
    2).挂载文件系统
    6.服务是否启动
    systemctl is-active httpd
  1. systemctl status httpd
  2. ps -aux | grep httpd
  3. ss -tunlp | grep 2048
  4. netstat -tunlp | grep httpd
  5. lsof -i:80
  6. rpcinfo -p

7.nfs优缺点

**案例：架设一台NFS服务器，并按照以下要求配置 **

1、开放/nfs/shared目录，供所有用户查询资料
2、开放/nfs/upload目录，为192.168.100.0/24网段主机可以上传目录，
并将所有用户及所属的组映射为nfs-upload,其UID和GID均为210

3、将/home/tom目录仅共享给192.168.100.136这台主机，并只有用户tom可以完全访问该目录
autofs
能够动态管理文件系统，在系统需要该文件系统资源时，将文件系统动态挂载可以动态取消挂载。

  1. 1.安装自动挂载服务程序
  2. yum install autofs -y
  3. 2.自定义触发条件，满足该条件后，将文件系统自动挂载
  4. vim /etc/auto.master 主参数文件中定义挂载条件
  5. #挂载点主目录 子参数文件(连接autofs文件系统)
  6. /nfs /etc/auto.nfs
  7. vim /etc/auto.nfs
  8. #触发条件(挂载点目录) 文件系统名称
  9. test 192.168.153.128:/test
  10. 3.加载参数
  11. systemctl restart autofs
  12. 查看挂载点主目录是否自动创建
  13. 手动： cd /nfs cd test
  14. 自动触发：
  15. mount /dev/sr0 /pub/sr0

**搭建web服务通过域名访问网站资源文件，网站资源文件通过nfs服务器共享个web服务端主机，提供用
户解析和查询 **

  1. 1.web服务器
  2. yum install httpd
  3. [root@localhost ~]# cat /etc/httpd/conf.d/vhosts.conf
  4. <Directory /www/129>
  5. AllowOverride none
  6. Require all granted
  7. <Virtualhost *:80>
  8. DocumentRoot /www/129
  9. ServerName 192.168.153.129
  10.  
  11. 2、安装自动挂载服务程序
  12. yum install autofs -y
  13. vim /etc/auto.master
  14. /www /etc/auto.web
  15. vim /etc/auto.web
  16. 129 192.168.153.128:/test
  17. systemctl restart autofs
  18. yum install php*
  19. yum install mariadb-server -y
  20. systemctl restart mariadb
  21. mysql_secure_installation
  22. mysql -uroot -predhat
  23. create database wordpress;
  24. exit
  25. systemctl start mairadb
  26. systemctl restart httpd
  27.  
  28. 3.nfs服务器 wordpress
  29. #rpm -qa | grep nfs
  30. #rpm -qa | grep rpcbind
  31. #vim /etc/exports
  32. #mkdir /test
  33. #cd /test
  34. 通过xftp将wordpress包传到共享主目录/test#unzip wordpress-5.9.2.zip
  35. #unzip wordpress-5.9.2.zip
  36. [root@localhost test]# ll
  37. total 19800
  38. drwxr-xr-x. 5 root root 4096 Mar 10 19:39 wordpress
  39. -rw-r--r--. 1 root root 20270503 Mar 27 04:30 wordpress-5.9.2.zip
  40. [root@localhost test]# systemctl restart nfs-server
  41. [root@localhost test]# systemctl stop firewalld
  42. [root@localhost test]# setenforce 0
  43. [root@localhost wordpress]# cp wp-config-sample.php wp-config.php

linux邮件客户端的配置

  1. 第三方邮件客户端程序验证能够通过linux主机将信件发送到外网邮件服务器。
  2.  
  3. yum install mailx -y
  4.  
  5. vim  /etc/mail.rc
  6.  
  7. set from=lxx1065372838@163.com      # 邮箱账号
  8. set smtp=smtp.163.com                         #邮件服务器的主机名
  9. set smtp-auth-user=lxx1065372838@163.com    # 邮箱账号
  10. set smtp-auth-password=QUREDFYKLNBRAIAA   #授权码
  11. set smtp-auth=login             
  12.  
  13. (1)#echo "邮件内容" | mail -s '邮件主题'     收件用户的邮箱账号
  14.  
  15. (2)#echo  邮件内容 > /a.txt
  16.  
  17. mail -s  '主题'  -a  /a.txt  收件用户的邮箱账号   <  /a.txt

nmcli

  1. ### 配置网卡冗余(主备)
  2.  
  3. #nmcli connection add type team ifname team0 con-name team0 config '{"runner":       {"name": "activebackup"}}
  4.  
  5. #nmcli connection add type  team-slave ifname ens224 con-name team0-port1 master team0
  6.  
  7. #nmcli connection add type team-slave  ifname ens256 con-name team0-port2 master team0
  8.  
  9. #nmcli connection show 
  10.  
  11. #nmcli con   up team0-port1
  12.  
  13. #nmcli con   up team0-port2
  14.  
  15. #teadctl team0   stat
  16.  
  17. #nmcli connection modify team0 ipv4.addresses 192.168.153.111/24   +ipv4.addresses 192.168.153.111/24ipv4.gateway 192.168.153.2  ipv4.dns 114.114.114.114 ipv4.method  manual  connection.autoconnect yes
  18.  
  19. ## 桥接网卡
  20.  
  21. #nmcli connection add type bridge-slave   ifname ens160 con-name br1-port1 master br1
  22.  #nmcli connection show 
  23.  #nmcli connection up br1-port1

环境准备：

1、下载环境：

2、解压：100G左右

3、打开：

  • 方法一：双击RH294.vmx
  • 方法二：vmware打开RH294.vmx

4、远程连接：

  • 给win的虚拟网卡：VMware Network Adapter VMnet1增加一个ip：
    • ip：172.25.254.1/255.255.255.0,不需要网关
  • 远程连接：
    • IP：172.25.254.250 kiosk/redhat
    • root用户远程登录密码：Asimov
    • student：student

5、设置课程：考试和工作都不用

  1. [kiosk@foundation0 ~]$ rht-setcourse rh294
  2. /content/rhel8.0/x86_64/vms /home/kiosk
  3. /home/kiosk
  4. Course set to rh294

6、启动课程环境：

  1. [kiosk@foundation0 ~]$ rht-vmctl status all
  2. bastion DEFINED
  3. workstation DEFINED
  4. servera DEFINED
  5. serverb DEFINED
  6. serverc DEFINED
  7. serverd DEFINED
  8.  
  9. [kiosk@foundation0 ~]$ rht-vmctl start classroom 
  10. [kiosk@foundation0 ~]$ rht-vmctl start all 
  11. Starting bastion.
  12. Starting workstation.
  13. Starting servera.
  14. Starting serverb.
  15. Starting serverc.
  16. Starting serverd.
  17.  
  18. 重置虚拟机：
  19. [kiosk@foundation0 ~]$ rht-vmctl reset  all 
  20. Are you sure you want to reset bastion workstation servera serverb serverc serverd? (y/n) y
  21.  
  22. 查看状态：
  23. [kiosk@foundation0 ~]$ rht-vmctl status all
  24. bastion RUNNING
  25. workstation RUNNING
  26. servera RUNNING
  27. serverb RUNNING
  28. serverc RUNNING
  29. serverd RUNNING
  30. [kiosk@foundation0 ~]$ rht-vmctl status classroom 
  31. classroom RUNNING
  32.  
  33. 学会查看帮助：
  34. [kiosk@foundation0 ~]$ rht-vmctl --help
  35.  
  36. This utility manages the Red Hat Training supplied VMs on the local
  37. hypervisor.
  38.  
  39. Usage: rht-vmctl [-y|--yes] VMCMD VMNAME [DATETIME]
  40.        rht-vmctl [-i|--inquire] VMCMD VMNAME [DATETIME]
  41.        rht-vmctl -h|--help
  42.  
  43.   where VMCMD is one of:
  44.     view       - launches console viewer of VMNAME
  45.     start      - obtain and start up VMNAME
  46.     stop       - stop a running VMNAME
  47.     restart    - if running, stop then start VMNAME
  48.     poweroff   - if running, force stop VMNAME
  49.     reset      - poweroff, return to saved or original state, start VMNAME
  50.     save       - stop, save image, start VMNAME (to DATETIME)
  51.     restore    - poweroff, restore to save (to DATETIME), start VMNAME
  52.     listsaves  - list the saves of VMNAME
  53.     status     - display libvirt status of VMNAME
  54.     get        - if not here, obtain VMNAME from server
  55.     remove     - remove VMNAME from system
  56.     fullreset  - poweroff, reobtain from server, start VMNAME (bad save/image)
  57.  
  58.   -i|--inquire - confirm each VMNAME first
  59.   -y|--yes     - confirm nothing, just do it
  60.  
  61.   VMNAME of "all" processes all VMs available in the course

注意：重新开机之后，只需要执行rht-vmctl start all

  1. 练习环境：
  2. [kiosk@foundation0 ~]$ ssh student@workstation
  3. Warning: Permanently added 'workstation,172.25.250.9' (ECDSA) to the list of known hosts.
  4. Activate the web console with: systemctl enable --now cockpit.socket
  5.  
  6. [student@workstation ~]$

ansible后面的命令：自己去了解一下

  1. student@master:~$ ansible-
  2. ansible-community   ansible-connection  ansible-doc         ansible-inventory   ansible-pull        
  3. ansible-config      ansible-console     ansible-galaxy      ansible-playbook    ansible-vault  
  4.  
  5. student@master:~/ansibleDemo$ ansible-inventory --list
  6. {
  7.     "_meta": {
  8.         "hostvars": {}
  9.     },
  10.     "all": {
  11.         "children": [
  12.             "ungrouped"
  13.         ]
  14.     }
  15. }

双网卡绑定team

堡垒机或跳板机

双网卡绑定：

  • 轮询：轮流响应用户请求。缺点：如果某一块网卡出现故障，可能会导致访问异常。
  • 主备：正常情况下，只有一个网卡工作。缺点：浪费了一块网卡资源。优点：高可用。
  • 负载均衡：流量分担。

扩展内容：

双网卡绑定：team

前提：需要俩块相同的类型的网卡

查看：

  1. [root@master ~]# nmcli connection show
  2. NAME   UUID                                  TYPE      DEVICE
  3. ens33  4f0220d5-7ac9-456a-ba4a-852f14911ac7  ethernet  ens33

修改连接名：

[root@master ~]# nmcli connection modify ens33 con-name ens33

查看team配置：

[root@master yum.repos.d]# cd /usr/share/doc/teamd-1.29/example_configs/

配置：

1、创建team0设备和team0会话

[root@master example_configs]# nmcli connection add type team con-name team0 ifname team0 config '{"runner":{"name":"activebackup"}}'

2、配置team0地址信息

[root@master example_configs]# nmcli connection modify team0 ipv4.method manual ipv4.addresses 192.168.11.100/24 ipv4.gatwag 192.168.11.2 ipv4.dns 114.114.114.114 autoconnect yes

3、添加设备到team0

  1. [root@master example_configs]# nmcli connection add type team-slave con-name team0-1 ifname ens33 master team0
  2. [root@master example_configs]# nmcli connection add type team-slave con-name team0-2 ifname ens34 master team0

4、激活设备

  1. 在虚拟机中去做，xshell会中断
  2.  
  3. [root@master example_configs]# nmcli connection up team0-1
  4. [root@master example_configs]# nmcli connection up team0-2
  5. [root@master example_configs]# nmcli connection up team0

5、查看

[root@master example_configs]# teamdctl team0 state

NFS服务器

案例一：共享/data目录给192.168.11.0/24整个网段可读可写

1、安装软件

[root@master ~]# yum install nfs-utils.x86_64  rpcbind.x86_64  -y

2、编写配置文件

  1. [root@master ~]# cat /etc/exports
  2. /data 192.168.11.0/24(rw,sync,no_root_squash)

3、创建目录

[root@master ~]# mkdir /data

4、测试

  1. [root@master ~]# showmount -e
  2. Export list for master.itcast.com:
  3. /data 192.168.11.0/24

挂载：

  • 手动挂载：mount
  • 开机自动挂载：/etc/fstab
  • 按需挂载：autofs，使用时挂载，灵活

案例：配置autofs挂载光盘到/mnt/dvd

1、安装软件

[root@master ~]# yum install autofs.x86_64 -y

2、写配置文件

  1. [root@master ~]# vim /etc/auto.master
  2. 上层目录 配置文件
  3. /mnt /etc/auto.cdrom
  4.  
  5. [root@master ~]# cat /etc/auto.cdrom
  6.  
  7. dvd     -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom

3、重启服务

[root@master ~]# systemctl enable --now autofs.service

4、测试

  1. [root@master ~]# ls /mnt/
  2.  
  3. [root@master ~]# ll /mnt/dvd
  4. total 1670
  5. -rw-rw-r--. 1 root root      14 Jul 26  2022 CentOS_BuildTag
  6. drwxr-xr-x. 3 root root    2048 Jul 26  2022 EFI
  7. -rw-rw-r--. 1 root root     227 Aug 30  2017 EULA
  8. -rw-rw-r--. 1 root root   18009 Dec 10  2015 GPL
  9. drwxr-xr-x. 3 root root    2048 Jul 26  2022 images
  10. drwxr-xr-x. 2 root root    2048 Jul 26  2022 isolinux
  11. drwxr-xr-x. 2 root root    2048 Jul 26  2022 LiveOS
  12. drwxr-xr-x. 2 root root 1671168 Jul 26  2022 Packages
  13. drwxr-xr-x. 2 root root    4096 Jul 26  2022 repodata
  14. -rw-rw-r--. 1 root root    1690 Dec 10  2015 RPM-GPG-KEY-CentOS-7
  15. -rw-rw-r--. 1 root root    1690 Dec 10  2015 RPM-GPG-KEY-CentOS-Testing-7
  16. -r--r--r--. 1 root root    2883 Jul 27  2022 TRANS.TBL
  17. [root@master ~]# df -h
  18. Filesystem               Size  Used Avail Use% Mounted on
  19. devtmpfs                 475M     0  475M   0% /dev
  20. tmpfs                    487M     0  487M   0% /dev/shm
  21. tmpfs                    487M  7.8M  479M   2% /run
  22. tmpfs                    487M     0  487M   0% /sys/fs/cgroup
  23. /dev/mapper/centos-root   17G  1.9G   16G  11% /
  24. /dev/sda1               1014M  139M  876M  14% /boot
  25. tmpfs                     98M     0   98M   0% /run/user/0
  26. /dev/sr0                 9.6G  9.6G     0 100% /mnt/dvd

DNS服务器

unbound

1、安装unbound

[root@master ~]# yum install unbound -y

2、编辑配置文件，对全局参数进行配置

  1. [root@master ~]# vim /etc/unbound/unbound.conf
  2.         access-control: 192.168.11.0/24 allow
  3.         username: ""
  4.         domain-insecure: "openlab.edu"
  5.  		include: /etc/unbound/local.d/*.conf

3、进入配置解析域

  1. [root@master ~]# cd /etc/unbound/local.d/
  2. [root@master local.d]# ls
  3. block-example.com.conf
  4. [root@master local.d]# more  block-example.com.conf
  5. # entries in this file override toe global DNS
  6. #
  7. # Example blocking email going out to example.com
  8. #
  9. #       local-data: "example.com. 3600 IN MX 5 127.0.0.1"
  10. #       local-data: "example.com. 3600 IN A 127.0.0.1"
  11.  
  12. # This can also be done dynamically using: unbound-control local-data [...]
  13.  
  14. # For more complicated redirection, use conf.d/ with stub-add: or forward-add:

4、配置正向解析记录和反向解析目录

  1. [root@master local.d]# cat domain.conf
  2. local-zone:"openlab.edu." static
  3. local-data:"openlab.edu. 86400 IN SOA dns1.openlab.edu. root.openlab.edu 2023031501 1D 1H 1W 1H"
  4. local-data:"dns1.openlab.edu. IN  A 192.168.11.121"
  5. local-data:"www.openlab.edu. IN A  192.168.11.111"
  6. local-data:"web.openlab.edu.IN CNAME www.openlab.edu."
  7. local-data:"mail.openlab.edu. IN A 192.168.11.222"
  8. local-data:"openlab.edu. IN MX 5 mail.openlab.edu."
  9.  
  10. # 反向解析
  11. local-data-ptr:"192.168.11.121 dns1.openlab.edu"
  12. local-data-ptr:"192.168.11.111 www.openlab.edu"
  13. local-data-ptr:"192.168.11.111 web.openlab.edu"
  14. local-data-ptr:"192.168.11.222 mail.openlab.edu"

5、配置转发

  1. [root@master local.d]# vim /etc/unbound/unbound.conf
  2. forward-zone:
  3.         name: "."
  4.         forward-addr:223.5.5.5

6、语法检测

[root@master local.d]# unbound-checkconf

7、重启服务

[root@master ~]# systemctl restart unbound

8、测试

  1. 客户端：
  2. [root@master local.d]# yum install bind-utils.x86_64 -y
  3.  
  4. [root@master ~]# cat /etc/resolv.conf
  5. # Generated by NetworkManager
  6. search localdomain itcast.com
  7. nameserver 192.168.11.121
  8.  
  9. [root@master ~]#nslookup
  10. > 192.168.11.121

bind---常用

1、安装软件

[root@master ~]# yum install bind -y

2、关闭防火墙或者放行DNS服务

  1. [root@master ~]# firewall-cmd --permanent --add-service=dns
  2. success
  3. [root@master ~]# firewall-cmd --reload
  4. success

3、修改配置文件

  1. [root@master ~]# vim /etc/named.conf
  2. options {
  3.         listen-on port 53 { 192.168.11.148; }; #修改这一行IP，注意分号
  4.         //listen-on-v6 port 53 { ::1; }; # IPV6的，可以注释掉
  5.         directory       "/var/named";
  6.         dump-file       "/var/named/data/cache_dump.db";
  7.         statistics-file "/var/named/data/named_stats.txt";
  8.         memstatistics-file "/var/named/data/named_mem_stats.txt";
  9.         recursing-file  "/var/named/data/named.recursing";
  10.         secroots-file   "/var/named/data/named.secroots";
  11.         allow-query     { 192.168.11.0/24; }; # 修改为本网段，或者用any

4、区域文件

  1. [root@master ~]# vim /etc/named.rfc1912.zones # 路径在配置文件中有
  2. 正向解析：
  3. zone "openlab.edu" IN {
  4.         type master;
  5.         file "openlab.edu.zone";
  6. };
  7.  
  8. [root@master ~]# cd /var/named/
  9. [root@master named]# ll
  10. total 16
  11. drwxrwx---. 2 named named    6 Jan 26 00:48 data
  12. drwxrwx---. 2 named named    6 Jan 26 00:48 dynamic
  13. -rw-r-----. 1 root  named 2253 Apr  5  2018 named.ca
  14. -rw-r-----. 1 root  named  152 Dec 15  2009 named.empty
  15. -rw-r-----. 1 root  named  152 Jun 21  2007 named.localhost
  16. -rw-r-----. 1 root  named  168 Dec 15  2009 named.loopback
  17. drwxrwx---. 2 named named    6 Jan 26 00:48 slaves
  18. [root@master named]# cp -a named.localhost  openlab.edu.zone #注意带权限修改
  19. [root@master named]# vim openlab.edu.zone
  20. [root@master named]# cat openlab.edu.zone
  21. $TTL 1D
  22. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  23.                                         2023031601      ; serial
  24.                                         1D      ; refresh
  25.                                         1H      ; retry
  26.                                         1W      ; expire
  27.                                         3H )    ; minimum
  28.         NS      dns1.openlab.edu.
  29.         MX 5    mail.openlab.edu.
  30. dns1    A       192.168.11.148
  31. mail    A       192.168.11.222
  32. www     A       192.168.11.111
  33. web     CNAME   www

5、语法检测

  1. # 7版本的语法：
  2. [root@master named]# named-checkzone "openlab.edu" /var/named/openlab.edu.zone
  3. zone openlab.edu/IN: loaded serial 2023031601
  4. OK

6、重启服务

  1. [root@master named]# systemctl enable --now named.service
  2. Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.

7、客户端测试

  1. 安装bind-utils
  2. [root@node01 ~]# yum install bind-utils.x86_64  -y
  3. [root@node01 ~]# more /etc/resolv.conf
  4. # Generated by NetworkManager
  5. search localdomain itcast.com
  6. nameserver 192.168.11.148
  7.  
  8. [root@node01 ~]# nslookup
  9. > dns1.openlab.edu
  10. Server:         192.168.11.148
  11. Address:        192.168.11.148#53
  12.  
  13. Name:   dns1.openlab.edu
  14. Address: 192.168.11.148
  15. > www.openlab.edu
  16. Server:         192.168.11.148
  17. Address:        192.168.11.148#53
  18.  
  19. Name:   www.openlab.edu
  20. Address: 192.168.11.111
  21. > set type=cname
  22. > web.openlab.edu
  23. Server:         192.168.11.148
  24. Address:        192.168.11.148#53
  25.  
  26. web.openlab.edu canonical name = www.openlab.edu.

正向解析成功，接下来配置反向解析

1、修改主配置文件

  1. [root@master ~]# vim /etc/named.rfc1912.zones # 路径在配置文件中有
  2. zone "11.168.192.in-addr.arpa" IN {
  3.         type master;
  4.         file "192.168.11.zone";
  5. };

2、修改模板文件

  1. [root@master named]# vim /etc/named.rfc1912.zones
  2. [root@master named]# cp -a named.loopback 192.168.11.zone
  3. [root@master named]# vim 192.168.11.zone
  4. [root@master named]# cat 192.168.11.zone
  5. $TTL 1D
  6. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  7.                                         2023031601      ; serial
  8.                                         1D      ; refresh
  9.                                         1H      ; retry
  10.                                         1W      ; expire
  11.                                         3H )    ; minimum
  12.         NS      dns1.openlab.edu.
  13. dns1.openlab.edu.       A       192.168.11.148
  14. 148     PTR     dns1.openlab.edu.
  15. 111     PTR     www.openlab.edu.
  16. 111     PTR     web.openlab.edu.
  17. 222     PTR     mail.openlab.edu.

3、语法检测+重启服务

  1. [root@master named]# named-checkzone "openlab.edu" 192.168.11.zone
  2. zone openlab.edu/IN: loaded serial 2023031601
  3. OK
  4. [root@master named]# systemctl restart named

4、测试

  1. [root@node01 ~]# host -t PTR 192.168.11.148
  2. 148.11.168.192.in-addr.arpa domain name pointer dns1.openlab.edu.
  3. [root@node01 ~]# nslookup
  4. > 192.168.11.111
  5. 111.11.168.192.in-addr.arpa     name = www.openlab.edu.
  6. 111.11.168.192.in-addr.arpa     name = web.openlab.edu.

主从DNS服务器

区域完全传送(主从DNS)

需要俩台DNS服务器：master slave

M：192.168.11.148

S：192.168.11.138

主服务器配置

1、主配置文件

添加允许传送的从服务器，allow-transfer { address_match_elment;...};

  1. [root@master named]# vim /etc/named.conf
  2. options {
  3.         listen-on port 53 { 192.168.11.148; };
  4.         //listen-on-v6 port 53 { ::1; };
  5.         directory       "/var/named";
  6.         dump-file       "/var/named/data/cache_dump.db";
  7.         statistics-file "/var/named/data/named_stats.txt";
  8.         memstatistics-file "/var/named/data/named_mem_stats.txt";
  9.         recursing-file  "/var/named/data/named.recursing";
  10.         secroots-file   "/var/named/data/named.secroots";
  11.         allow-query     { 192.168.11.0/24; };
  12.         allow-transfer { 192.168.11.138;}; # 添加从服务器地址

2、数据文件

  1. [root@master named]# cat openlab.edu.zone
  2. $TTL 1D
  3. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  4.                                         2023031602      ; serial
  5.                                         1D      ; refresh
  6.                                         1H      ; retry
  7.                                         1W      ; expire
  8.                                         3H )    ; minimum
  9.         NS      dns1.openlab.edu.
  10.         NS      dns2.openlab.edu.
  11.         MX 5    mail.openlab.edu.
  12. dns1    A       192.168.11.148
  13. dns2    A       192.168.11.138
  14. mail    A       192.168.11.222
  15. www     A       192.168.11.111
  16. web     CNAME   www
  17.  
  18.  
  19. [root@master named]# cat 192.168.11.zone
  20. $TTL 1D
  21. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  22.                                         2023031602      ; serial
  23.                                         1D      ; refresh
  24.                                         1H      ; retry
  25.                                         1W      ; expire
  26.                                         3H )    ; minimum
  27.         NS      dns1.openlab.edu.
  28.         NS      dns2.oppenlab.edu.
  29. dns1.openlab.edu.       A       192.168.11.148
  30. dns2.openlab.edu.       A       192.168.11.138
  31. 148     PTR     dns1.openlab.edu.
  32. 138     PTR     dns2.openlab.edu.
  33. 111     PTR     www.openlab.edu.
  34. 111     PTR     web.openlab.edu.
  35. 222     PTR     mail.openlab.edu.

3、语法检测

  1. [root@master named]# named-checkzone "openlab.edu" 192.168.11.zone
  2. zone openlab.edu/IN: loaded serial 2023031602
  3. OK
  4.  
  5. [root@master named]# named-checkzone "openlab.edu" openlab.edu.zone
  6. zone openlab.edu/IN: loaded serial 2023031602
  7. OK

4、重启服务

[root@master named]# systemctl restart named

从服务器配置

1、安装软件

[root@node02 ~]# yum install bind -y

2、主配置文件

  1. [root@node02 ~]# vim /etc/named.conf
  2. options {
  3.         listen-on port 53 { 192.168.11.138; }; # 指向自己的IP
  4.         //listen-on-v6 port 53 { ::1; };
  5.         directory       "/var/named";
  6.         dump-file       "/var/named/data/cache_dump.db";
  7.         statistics-file "/var/named/data/named_stats.txt";
  8.         memstatistics-file "/var/named/data/named_mem_stats.txt";
  9.         secroots-file   "/var/named/data/named.secroots";
  10.         recursing-file  "/var/named/data/named.recursing";
  11.         allow-query     {192.168.11.0/24; }; # 指向网段即可

3、数据文件

  1. [root@node02 ~]# vim /etc/named.rfc1912.zones
  2. zone "openlab.edu" IN {
  3.         type slave;
  4.         file "slaves/opnlab.edu.zone";
  5.         masters {192.168.11.148;};
  6. }; 
  7. zone "11.168.192.in-addr.arpa" IN {
  8.         type slave;
  9.         file "slaves/192.168.11.zone";
  10.         masters {192.168.11.148;};
  11. };

4、语法检测

[root@node02 ~]# named-checkconf

5、测试

  1. [root@node02 ~]# firewall-cmd --permanent --add-service=dns
  2. success
  3. [root@node02 ~]# firewall-cmd --reload
  4. success
  5. [root@node02 ~]# systemctl enable --now named.service
  6. Created symlink /etc/systemd/system/multi-user.target.wants/named.service → /usr/lib/systemd/system/named.service.
  7.  
  8. [root@node02 ~]# ll /var/named/slaves/
  9. total 8
  10. -rw-r--r--. 1 named named 508 Mar 16 14:25 192.168.11.zone
  11. -rw-r--r--. 1 named named 475 Mar 16 14:25 opnlab.edu.zone
  12.  
  13. # 可以在本机上测试
  14. [root@node02 ~]# nslookup
  15. > server 192.168.11.138
  16. Default server: 192.168.11.138
  17. Address: 192.168.11.138#53
  18. > www.openlab.edu
  19. Server:         192.168.11.138
  20. Address:        192.168.11.138#53
  21.  
  22. Name:   www.openlab.edu
  23. Address: 192.168.11.111
  24. > 192.168.11.111
  25. 111.11.168.192.in-addr.arpa     name = www.openlab.edu.
  26. 111.11.168.192.in-addr.arpa     name = web.openlab.edu.
区域增量传送(主从DNS)
  1. [root@master named]# cat openlab.edu.zone
  2. $TTL 1D
  3. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  4.                                         2023031603      ; serial
  5.                                         1D      ; refresh
  6.                                         1H      ; retry
  7.                                         1W      ; expire
  8.                                         3H )    ; minimum
  9.         NS      dns1.openlab.edu.
  10.         NS      dns2.openlab.edu.
  11.         MX 5    mail.openlab.edu.
  12. dns1    A       192.168.11.148
  13. dns2    A       192.168.11.138
  14. mail    A       192.168.11.222
  15. www     A       192.168.11.111
  16. web     CNAME   www
  17. ftp     A       192.168.11.112
  18. [root@master named]# cat 192.168.11.zone
  19. $TTL 1D
  20. @       IN SOA  dns1.openlab.edu. admin.openlab.edu. (
  21.                                         2023031603      ; serial
  22.                                         1D      ; refresh
  23.                                         1H      ; retry
  24.                                         1W      ; expire
  25.                                         3H )    ; minimum
  26.         NS      dns1.openlab.edu.
  27.         NS      dns2.oppenlab.edu.
  28. dns1.openlab.edu.       A       192.168.11.148
  29. dns2.openlab.edu.       A       192.168.11.148
  30. 148     PTR     dns1.openlab.edu.
  31. 138     PTR     dns2.openlab.edu.
  32. 111     PTR     www.openlab.edu.
  33. 111     PTR     web.openlab.edu.
  34. 222     PTR     mail.openlab.edu.
  35. 112     PTR     ftp.openlab.edu.

重启服务

[root@master named]# systemctl restart named.service

测试

  1. [root@node02 named]# nslookup ftp.openlab.edu 192.168.11.138
  2. Server:         192.168.11.138
  3. Address:        192.168.11.138#53
  4.  
  5. Name:   ftp.openlab.edu
  6. Address: 192.168.11.112
  7.  
  8. [root@node02 named]# nslookup 192.168.11.148  192.168.11.138
  9. 148.11.168.192.in-addr.arpa     name = dns1.openlab.edu.

web服务器

1、安装软件

[root@node01 ~]# yum install httpd -y

2、设置为开机自启动

[root@node01 ~]# systemctl enable --now httpd

3、查看状态

[root@node01 ~]# systemctl status httpd

4、查看进程

  1. [root@node01 ~]# ps -ef | grep httpd
  2. root        2447       1  0 15:57 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
  3. root        2521    2146  0 15:58 pts/2    00:00:00 grep --color=auto httpd

5、查看端口

  1. [root@node01 ~]# netstat -lntup | grep 80
  2. tcp6       0      0 :::80                   :::*                    LISTEN      2447/httpd
  3. [root@node01 ~]# ss -lntup | grep 80
  4. tcp   LISTEN 0      128                *:80              *:*    users:(("httpd",pid=2573,fd=4),("httpd",pid=2572,fd=4),("httpd",pid=2571,fd=4),("httpd",pid=2447,fd=4))

6、关闭防火墙或者放行服务

  1. [root@node01 ~]# firewall-cmd --permanent --add-service=http
  2. success
  3. [root@node01 ~]# firewall-cmd --reload
  4. success

7、默认测试

8、默认测试路径

  1. [root@node01 ~]# echo "欢迎来我的web页面" > /var/www/html/index.html
  2. [root@node01 ~]# curl 192.168.11.104
  3. 欢迎来我的web页面

虚拟目录别名

1、创建虚拟目录存放位置及虚拟目录默认首页文件

  1. [root@node01 ~]# mkdir /openlab/xxgc -p
  2. [root@node01 ~]# cat /var/www/html/index.html
  3. 欢迎访问信息工程系主页！

2、创建、编辑虚拟目录子配置文件

  1. [root@node01 ~]# cat /etc/httpd/conf.d/vdir.conf
  2. Alias /xxgcx "/openlab/xxgc"
  3. <Directory "/openlab/xxgc">
  4.     AllowOverride None
  5.     Options Indexes FollowSymLinks
  6.     Require all granted
  7. </Directory>

3、语法检测+重启服务

  1. [root@node01 ~]# httpd -t
  2. Syntax OK
  3. [root@node01 ~]# setenforce 0
  4. [root@node01 ~]# systemctl restart httpd.service

4、测试页面

虚拟主机

三类：

  • 基于IP：一台服务器申请多个IP
  • 基于端口：同一个IP，不同的端口
  • 基于域名：使用同样的IP，同样的端口，不同的域名

如何配？

安装一个在线帮助文档，查看帮助配置

  1. [root@node01 ~]# yum install httpd-manual -y
  2. [root@node01 ~]# systemctl restart httpd.service

基于IP

1、创建目录，准备测试页面

  1. [root@node01 ~]# mkdir -p /openlab/{news,blog,bbs}
  2. [root@node01 ~]# echo "新闻测试页！" > /openlab/news/index.html
  3.  
  4. [root@node01 ~]# echo "blog测试页！" > /openlab/blog/index.html
  5.  
  6. [root@node01 ~]# echo "bbs测试页！" > /openlab/bbs/index.html

2、给网卡添加IP，绑定对应的测试页面

  1. news:192.168.11.104
  2. blog:192.168.11.110
  3. bbs:192.168.11.120
  4. [root@node01 ~]# nmcli connection modify ens160 +ipv4.addresses 192.168.11.110/24
  5. [root@node01 ~]# nmcli connection modify ens160 +ipv4.addresses 192.168.11.120/24
  6. [root@node01 ~]#
  7. [root@node01 ~]# nmcli connection up ens160
  8. Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2)
  9. [root@node01 ~]# ip a
  10. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
  11.     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  12.     inet 127.0.0.1/8 scope host lo
  13.        valid_lft forever preferred_lft forever
  14.     inet6 ::1/128 scope host
  15.        valid_lft forever preferred_lft forever
  16. 2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
  17.     link/ether 00:0c:29:6b:0b:72 brd ff:ff:ff:ff:ff:ff
  18.     inet 192.168.11.110/24 brd 192.168.11.255 scope global noprefixroute ens160
  19.        valid_lft forever preferred_lft forever
  20.     inet 192.168.11.120/24 brd 192.168.11.255 scope global secondary noprefixroute ens160
  21.        valid_lft forever preferred_lft forever
  22.     inet 192.168.11.104/24 brd 192.168.11.255 scope global secondary dynamic noprefixroute ens160
  23.        valid_lft 1796sec preferred_lft 1796sec
  24.     inet6 fe80::20c:29ff:fe6b:b72/64 scope link noprefixroute
  25.        valid_lft forever preferred_lft forever

3、配置虚拟主机

  1. [root@node01 ~]# cd /etc/httpd/conf.d/
  2. [root@node01 conf.d]#
  3. [root@node01 conf.d]# ls
  4. autoindex.conf  manual.conf  README  userdir.conf  vdir.conf  welcome.conf
  5. [root@node01 conf.d]# vim VirtualHost.conf
  6. [root@node01 conf.d]# cat VirtualHost.conf
  7. <Directory "/openlab/">
  8.     AllowOverride None
  9.     Options Indexes FollowSymLinks
  10.     Require all granted
  11. </Directory>	
  12.  
  13. <VirtualHost 192.168.11.104:80>
  14.     DocumentRoot "/openlab/news/"
  15.     ServerName news.openlab.edu
  16.     ErrorLog "/openlab/news/error_log"
  17.     CustomLog "/openlab/news/access_log" combined
  18. </VirtualHost>
  19.  
  20. <VirtualHost 192.168.11.110:80>
  21.     DocumentRoot "/openlab/blog/"
  22.     ServerName blog.openlab.edu
  23.     ErrorLog "/openlab/blog/error_log"
  24.     CustomLog "/openlab/blog/access_log" combined
  25. </VirtualHost>
  26.  
  27.  
  28.  
  29. <VirtualHost 192.168.11.120:80>
  30.     DocumentRoot "/openlab/bbs/"
  31.     ServerName bbs.openlab.edu
  32.     ErrorLog "/openlab/bbs/error_log"
  33.     CustomLog "/openlab/bbs/access_log" combined
  34. </VirtualHost>

4、语法检测+重启服务

  1. [root@node01 conf.d]# httpd -t
  2. Syntax OK
  3. [root@node01 conf.d]# systemctl restart httpd.service

5、测试

6、恢复环境

  1. [root@node01 conf.d]# nmcli connection modify ens160 -ipv4.addresses 192.168.11.120/24
  2. [root@node01 conf.d]# nmcli connection modify ens160 -ipv4.addresses 192.168.11.110/24
  3. [root@node01 conf.d]# nmcli connection up ens160

基于端口

1、修改配置文件

  1. [root@node01 conf.d]# cat VirtualHost.conf
  2. <VirtualHost 192.168.11.104:80>
  3.     DocumentRoot "/openlab/news/"
  4.     ServerName news.openlab.edu
  5.     ErrorLog "/openlab/news/error_log"
  6.     CustomLog "/openlab/news/access_log" combined
  7. </VirtualHost>
  8.  
  9. <VirtualHost 192.168.11.104:81>
  10.     DocumentRoot "/openlab/blog/"
  11.     ServerName blog.openlab.edu
  12.     ErrorLog "/openlab/blog/error_log"
  13.     CustomLog "/openlab/blog/access_log" combined
  14. </VirtualHost>
  15.  
  16.  
  17.  
  18. <VirtualHost 192.168.11.104:82>
  19.     DocumentRoot "/openlab/bbs/"
  20.     ServerName bbs.openlab.edu
  21.     ErrorLog "/openlab/bbs/error_log"
  22.     CustomLog "/openlab/bbs/access_log" combined
  23. </VirtualHost>
  24.  
  25. <Directory "/openlab/">
  26.     AllowOverride None
  27.     Options Indexes FollowSymLinks
  28.     Require all granted
  29. </Directory>
  30. Listen 81
  31. Listen 82

2、重启服务 + 关闭防火墙 +selinux

  1. [root@node01 conf.d]# systemctl restart httpd.service
  2. [root@node01 conf.d]# systemctl stop firewalld.service
  3. [root@node01 conf.d]# setenforce 0
  4. [root@node01 conf.d]# systemctl restart httpd.service
  5. [root@node01 conf.d]# ss -lntup | grep 81
  6. tcp   LISTEN 0      128                *:81              *:*    users:(("httpd",pid=39951,fd=9),("httpd",pid=39601,fd=9),("httpd",pid=39600,fd=9),("httpd",pid=39599,fd=9),("httpd",pid=39476,fd=9))
  7. [root@node01 conf.d]# ss -lntup | grep 82
  8. tcp   LISTEN 0      128                *:82              *:*    users:(("httpd",pid=39951,fd=11),("httpd",pid=39601,fd=11),("httpd",pid=39600,fd=11),("httpd",pid=39599,fd=11),("httpd",pid=39476,fd=11))
  9. [root@node01 conf.d]# ss -lntup | grep 80
  10. tcp   LISTEN 0      128                *:80              *:*    users:(("httpd",pid=39951,fd=4),("httpd",pid=39601,fd=4),("httpd",pid=39600,fd=4),("httpd",pid=39599,fd=4),("httpd",pid=39476,fd=4))

3、测试

基于域名

1、修改配置文件

  1. [root@node01 conf.d]# cat VirtualHost.conf
  2. <VirtualHost 192.168.11.104:80>
  3.     DocumentRoot "/openlab/news/"
  4.     ServerName news.openlab.edu
  5.     ErrorLog "/openlab/news/error_log"
  6.     CustomLog "/openlab/news/access_log" combined
  7. </VirtualHost>
  8.  
  9. <VirtualHost 192.168.11.104:80>
  10.     DocumentRoot "/openlab/blog/"
  11.     ServerName blog.openlab.edu
  12.     ErrorLog "/openlab/blog/error_log"
  13.     CustomLog "/openlab/blog/access_log" combined
  14. </VirtualHost>
  15.  
  16.  
  17.  
  18. <VirtualHost 192.168.11.104:80>
  19.     DocumentRoot "/openlab/bbs/"
  20.     ServerName bbs.openlab.edu
  21.     ErrorLog "/openlab/bbs/error_log"
  22.     CustomLog "/openlab/bbs/access_log" combined
  23. </VirtualHost>
  24.  
  25. <Directory "/openlab/">
  26.     AllowOverride None
  27.     Options Indexes FollowSymLinks
  28.     Require all granted
  29. </Directory>

2、重启服务

[root@node01 conf.d]# systemctl restart httpd.service

3、没有DNS情况下修改hosts文件

  1. [root@node01 conf.d]# cat /etc/hosts
  2. 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
  3. ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
  4.  
  5. 192.168.11.104 news.openlab.edu blog.openlab.edu bbs.openlab.edu

4、测试

  1. [root@node01 conf.d]# curl news.openlab.edu
  2. 新闻测试页！
  3. [root@node01 conf.d]# curl blog.openlab.edu
  4. blog测试页！
  5. [root@node01 conf.d]# curl bbs.openlab.edu
  6. bbs测试页！

个人页面网站

1、修改redhat权限

  1. [root@node01 conf.d]# cd /home/redhat/
  2. [root@node01 redhat]# chmod 711 /home/redhat/

2、创建public_html目录

[root@node01 redhat]# mkdir public_html

3、写index.html默认页面

[root@node01 redhat]# echo "这是redhat个人测试页面" > public_html/index.html

4、关闭防火墙和selinux

  1. [root@node01 redhat]# systemctl is-active firewalld.service
  2. inactive
  3. [root@node01 redhat]# getenforce
  4. Permissive

5、修改配置文件

  1. [root@node01 conf.d]# vim userdir.conf
  2. <IfModule mod_userdir.c>
  3.     #UserDir disabled
  4.     UserDir public_html
  5. </IfModule>

6、语法检测+重启服务

  1. [root@node01 conf.d]# httpd -t
  2. Syntax OK
  3. [root@node01 conf.d]# systemctl restart httpd.service

加密解密

案例：基于https的静态站点

第一阶段：制作CA根证书

1、制作CA秘钥

操作过程：设置CA秘钥口令(123456)

  1. [root@node01 httpd]# mkdir /etc/httpd/ssl
  2. [root@node01 httpd]# cd /etc/httpd/ssl/
  3. [root@node01 ssl]# openssl genrsa -des3 -out ca.key 2048
  4. Generating RSA private key, 2048 bit long modulus (2 primes)
  5. ............+++++
  6. ............................................................................................................................................................+++++
  7. e is 65537 (0x010001)
  8. Enter pass phrase for ca.key:
  9. Verifying - Enter pass phrase for ca.key:

2、制作CA根证书申请

  1. [root@node01 ssl]# openssl req -new -key ca.key  -out ca.csr
  2. Enter pass phrase for ca.key:
  3. You are about to be asked to enter information that will be incorporated
  4. into your certificate request.
  5. What you are about to enter is what is called a Distinguished Name or a DN.
  6. There are quite a few fields but you can leave some blank
  7. For some fields there will be a default value,
  8. If you enter '.', the field will be left blank.
  9. -----
  10. Country Name (2 letter code) [XX]:CN
  11. State or Province Name (full name) []:SX
  12. Locality Name (eg, city) [Default City]:Sx
  13. Organization Name (eg, company) [Default Company Ltd]:openlab
  14. Organizational Unit Name (eg, section) []:openlab
  15. Common Name (eg, your name or your server's hostname) []:tom
  16. Email Address []:
  18. Please enter the following 'extra' attributes
  19. to be sent with your certificate request
  20. A challenge password []:
  21. An optional company name []:

3、生成根签名证书

  1. [root@node01 ssl]# openssl x509 -req -days 3650 -signkey ca.key -in ca.csr -out ca.crt
  2. Signature ok
  3. subject=C = CN, ST = SX, L = Sx, O = openlab, OU = openlab, CN = tom
  4. Getting Private key
  5. Enter pass phrase for ca.key:
  6.  
  7. [root@node01 ssl]# ls
  8. ca.crt  ca.csr  ca.key

第二阶段：制作服务器证书

1、制作服务器秘钥

  1. [root@node01 ssl]# openssl genrsa -des3 -out server.key 2048
  2. Generating RSA private key, 2048 bit long modulus (2 primes)
  3. ..........................................................................................+++++
  4. ..................................+++++
  5. e is 65537 (0x010001)
  6. Enter pass phrase for server.key:
  7. Verifying - Enter pass phrase for server.key:

2、制作服务器证书签名申请

  1. [root@node01 ssl]# openssl req -new -key server.key -out server.csr
  2. Enter pass phrase for server.key:
  3. You are about to be asked to enter information that will be incorporated
  4. into your certificate request.
  5. What you are about to enter is what is called a Distinguished Name or a DN.
  6. There are quite a few fields but you can leave some blank
  7. For some fields there will be a default value,
  8. If you enter '.', the field will be left blank.
  9. -----
  10. Country Name (2 letter code) [XX]:CN
  11. State or Province Name (full name) []:SC
  12. Locality Name (eg, city) [Default City]:cd
  13. Organization Name (eg, company) [Default Company Ltd]:it
  14. Organizational Unit Name (eg, section) []:it
  15. Common Name (eg, your name or your server's hostname) []:www.it.edu
  16. Email Address []:
  18. Please enter the following 'extra' attributes
  19. to be sent with your certificate request
  20. A challenge password []:
  21. An optional company name []:

3、签署证书

  1. [root@node01 ssl]# openssl x509 -req -days 3560 -CA ca.crt -CAkey ca.key  -CAcreateserial -in server.csr -out server.crt
  2. Signature ok
  3. subject=C = CN, ST = SC, L = cd, O = it, OU = it, CN = www.it.edu
  4. Getting CA Private Key
  5. Enter pass phrase for ca.key:
  6. [root@node01 ssl]# ls
  7. ca.crt  ca.csr  ca.key  ca.srl  server.crt  server.csr  server.key

4、配置虚拟主机

  1. [root@node01 ssl]# vim /etc/httpd/conf.d/vhost.conf
  2. <VirtualHost *:443>
  3. DocumentRoot /var/www/web
  4. ServerName www.openlab.edu
  5. SSLEngine on
  6. SSLProtocol all -SSLv2
  7. SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!IDEA
  8. SSLCertificateFile /etc/httpd/ssl/server.crt
  9. SSLCertificateKeyFile /etc/httpd/ssl/server.key
  10. SSLCertificateChainFile  /etc/httpd/ssl/ca.crt
  11. </VirtualHost>

5、测试页面

  1. [root@node01 ~]# mkdir /var/www/web
  2. [root@node01 ~]# echo "https测试页面！..."> /var/www/web/index.html

6、重启服务

  1. [root@node01 ssl]# systemctl restart httpd.service
  2. Enter TLS private key passphrase for www.openlab.edu:443 (RSA) : ******

image-20230317091124090

LAMP环境

1、安装软件

[root@node01 ~]# yum install httpd mariadb-server php  php-gd php-mysqlnd.x86_64  -y

2、测试环境

Apache和php协同

  1. [root@node01 ~]# cd /var/www/html/
  2. [root@node01 html]# vim phpinfo.php
  3. [root@node01 html]# cat phpinfo.php
  4. <?php
  5. phpinfo();
  6. ?>
  7. [root@node01 html]# systemctl enable --now httpd php-fpm.service

image-20230317092554688

php与mariadb协同

启动数据库

[root@node01 html]# systemctl enable --now mariadb

初始安全设置

  1. [root@node01 html]# mysql_secure_installation
  2.  
  3. NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
  4.       SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!
  5.  
  6. In order to log into MariaDB to secure it, we'll need the current
  7. password for the root user.  If you've just installed MariaDB, and
  8. you haven't set the root password yet, the password will be blank,
  9. so you should just press enter here.
  11. Enter current password for root (enter for none):
  12. OK, successfully used password, moving on...
  14. Setting the root password ensures that nobody can log into the MariaDB
  15. root user without the proper authorisation.
  17. Set root password? [Y/n] y
  18. New password:
  19. Re-enter new password:
  20. Password updated successfully!
  21. Reloading privilege tables..
  22.  ... Success!
  25. By default, a MariaDB installation has an anonymous user, allowing anyone
  26. to log into MariaDB without having to have a user account created for
  27. them.  This is intended only for testing, and to make the installation
  28. go a bit smoother.  You should remove them before moving into a
  29. production environment.
  31. Remove anonymous users? [Y/n] y
  32.  ... Success!
  34. Normally, root should only be allowed to connect from 'localhost'.  This
  35. ensures that someone cannot guess at the root password from the network.
  37. Disallow root login remotely? [Y/n] y
  38.  ... Success!
  40. By default, MariaDB comes with a database named 'test' that anyone can
  41. access.  This is also intended only for testing, and should be removed
  42. before moving into a production environment.
  44. Remove test database and access to it? [Y/n] y
  45.  - Dropping test database...
  46.  ... Success!
  47.  - Removing privileges on test database...
  48.  ... Success!
  50. Reloading the privilege tables will ensure that all changes made so far
  51. will take effect immediately.
  53. Reload privilege tables now? [Y/n] y
  54.  ... Success!
  56. Cleaning up...
  58. All done!  If you've completed all of the above steps, your MariaDB
  59. installation should now be secure.
  60.  
  61. Thanks for using MariaDB!

测试php数据库

  1. [root@node01 html]# cat php_mysql.php
  2. <?php
  3. $con = new Mysqli("localhost","root","123456");
  4. if ($con->connect_error)
  5.   {
  6.   die('Could not connect: ' . $con->connect_error);
  7.   }
  8. else{
  9. echo "Success!";
  10. }
  11. // some code
  12. mysql_close($con);
  13. ?>

image-20230317093918211

测试完毕！删除这俩个文件！

3、部署php应用

博客 论坛 门户网站

1> 上传软件

2> 解压到指定目录

3> 修改权限

4> 向导安装

FTP服务器

服务端：

1、安装软件

[root@node01 ~]# yum install vsftpd.x86_64 -y

2、重启服务

[root@node01 ~]# systemctl restart vsftpd.service

3、查看状态

[root@node01 ~]# systemctl status vsftpd.service

4、查看端口

  1. [root@node01 ~]# ss -lntup | grep ftp
  2. tcp   LISTEN 0      32                 *:21              *:*    users:(("vsftpd",pid=2669,fd=3))

5、放行服务

  1. [root@node01 ~]# firewall-cmd --permanent --add-service=ftp
  2. success
  3. [root@node01 ~]# firewall-cmd --reload
  4. success
  5. [root@node01 ~]# firewall-cmd --list-all
  6. public (active)
  7.   target: default
  8.   icmp-block-inversion: no
  9.   interfaces: ens160
  10.   sources:
  11.   services: cockpit dhcpv6-client ftp ssh
  12.   ports:
  13.   protocols:
  14.   forward: no
  15.   masquerade: no
  16.   forward-ports:
  17.   source-ports:
  18.   icmp-blocks:
  19.   rich rules:

6、修改主配置文件

  1. [root@node01 ~]# vim /etc/vsftpd/vsftpd.conf
  2. #anonymous_enable=NO
  3. anonymous_enable=yes
  4.  
  5. [root@node01 ~]# systemctl restart vsftpd.service

客户端：

1、安装软件

[root@node02 ~]# yum install ftp.x86_64  lftp -y

2、连接

  1. [root@node02 ~]# ftp 192.168.11.104
  2. Connected to 192.168.11.104 (192.168.11.104).
  3. 220 (vsFTPd 3.0.3)
  4. Name (192.168.11.104:root): anonymous
  5. 331 Please specify the password.
  6. Password:
  7. 230 Login successful.
  8. Remote system type is UNIX.
  9. Using binary mode to transfer files.
  10. ftp>bye
  11.  
  12.  
  13. [root@node02 ~]# lftp 192.168.11.104
  14. lftp 192.168.11.104:~> user ftp
  15. Password:
  16. lftp ftp@192.168.11.104:~> ls
  17. drwxr-xr-x    2 0        0               6 Apr 22  2021 pub
  18. lftp ftp@192.168.11.104:/> exit

案例：扩展学校的FTP服务器

1、建立用于维护网站的禁止登录且家目录为/var/www/web1的用户user1 设置用户密码 创建用于测试的文件

  1. [root@node01 ~]# mkdir -p /var/www/web1
  2. [root@node01 ~]# echo "www.openlab.edu" > /var/www/web1/本地用户访问ftp.txt
  3. [root@node01 ~]# chmod -R 757 /var/www/web1/
  4.  
  5. [root@node01 ~]# useradd user1 -s /bin/bash
  6.  
  7. [root@node01 ~]# echo 123456 | passwd --stdin user1
  8. Changing password for user user1.
  9. passwd: all authentication tokens updated successfully.
  10. [root@node01 ~]# chown -R user1 /var/www/web1/
  11.  
  12. [root@node01 ~]# ll -d /var/www/web1/
  13. drwxr-xrwx. 2 user1 root 39 Mar 18 14:23 /var/www/web1/

2、编辑主配置文件 重启服务

  1. [root@node01 ~]# vim /etc/vsftpd/vsftpd.conf
  2. local_enable=YES
  3. anonymous_enable=NO
  4. local_root=/var/www/web1
  5. write_enable=YES
  6. local_umask=022
  7. connect_from_port_20=YES
  8. chroot_local_user=NO
  9. chroot_list_enable=YES
  10. chroot_list_file=/etc/vsftpd/chroot_list
  11. allow_writeable_chroot=YES
  12. [root@node01 ~]# systemctl restart vsftpd.service

3、建立/etc/vsftpd/chroot_list文件，锁定用户

  1. [root@node01 ~]# cat /etc/vsftpd/chroot_list
  2. user1

4、测试

  1. [root@node02 ~]# ftp 192.168.11.104
  2. Connected to 192.168.11.104 (192.168.11.104).
  3. 220 (vsFTPd 3.0.3)
  4. Name (192.168.11.104:root): user1
  5. 331 Please specify the password.
  6. Password:
  7. 230 Login successful.
  8. Remote system type is UNIX.
  9. Using binary mode to transfer files.
  10. ftp>

案例：配置一个虚拟用户访问ftp

本地用户user2

虚拟用户z3 l4

虚拟用户目录：

z3 /ftp/public 下载

l4 /var/www/web2 上传下载

1、创建虚拟用户对应的本地用户及目录

  1. [root@node01 ~]# useradd user2 -s /sbin/nologin
  2. [root@node01 ~]# mkdir -p /ftp/public /var/www/web2
  3. [root@node01 ~]# echo "test file "> /ftp/public/f1.txt
  4. [root@node01 ~]# echo "test file "> /var/www/web2/f1.txt
  5. [root@node01 ~]# chown user2 /var/www/web2/ /ftp/public/
  6. [root@node01 ~]# chmod  -R 755 /var/www/web2/ /ftp/public/

2、创建虚拟用户文件

  1. [root@node01 ~]# cat /etc/vsftpd/vuser.list
  2. z3
  3. 123
  4. l4
  5. 456

3、转换虚拟用户文件

  1. [root@node01 ~]# db_load -T -t hash -f /etc/vsftpd/vuser.list  /etc/vsftpd/vuser.db
  2. [root@node01 ~]# chmod 600 /etc/vsftpd/vuser.*

4、创建用户用户登录时的PAM文件

  1. [root@node01 ~]# cd /etc/pam.d/
  2. [root@node01 pam.d]# cp -p vsftpd vuser.vu
  3. [root@node01 pam.d]# vim vuser.vu
  4. [root@node01 pam.d]# cat vuser.vu
  5. #%PAM-1.0
  6. auth    sufficient      pam_userdb.so   db=/etc/vsftpd/vuser
  7. account sufficient      pam_userdb.so   db=/etc/vsftpd/vuser
  8. session    optional     pam_keyinit.so    force revoke
  9. auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
  10. auth       required     pam_shells.so
  11. auth       include      password-auth
  12. account    include      password-auth
  13. session    required     pam_loginuid.so
  14. session    include      password-auth

5、修改配置文件

  1. [root@node01 ~]# vim /etc/vsftpd/vsftpd.conf
  2.  
  3. anonymous_enable=NO //禁止匿名登录
  4. local_enable=YES //允许本地用户模式，由于映射的系统用户为本地用户，因此此项必须开启
  5. guest_enable=YES //开启虚拟用户模式
  6. guest_username=user2 //指定虚拟用户账号映射到本地账号vftp
  7. pam_service_name=vuser.vu //指定pam文件
  8. chroot_local_user=YES //禁锢用户在其家目录
  9. allow_writeable_chroot=YES //允许禁锢的FTP根目录可写
  10. user_config_dir=/etc/vsftpd/vconfig //指定虚拟用户的权限配置目录
  11. userlist_enable=YES
  12. userlist_deny=YES
  13. virtual_user_local_privs=YES

6、虚拟用户配置专用文件

  1. [root@node01 ~]# mkdir  -p /etc/vsftpd/vconfig
  2.  
  3. [root@node01 ~]# cat /etc/vsftpd/vconfig/z3
  4. local_root=/ftp/public/
  5. anno_world_readable_only=YES
  6. write_enable=NO
  7. anno_max_rate=500000
  8.  
  9. [root@node01 ~]# cat /etc/vsftpd/vconfig/l4
  10. local_root=/var/www/web2/
  11. write_enable=YES
  12. anno_upload_enable=YES
  13. anno_mkdir_wirte_enable=YES
  14. anno_other_write_enable=YES
  15. anno_max_rate=500000
声明：本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号