概述：
承接上篇，本篇為介紹下利用rpm包，實現LAMP組合，其中httpd和php的結合方式為fastcgi，也就是php運行為獨立的服務，監聽的某個套接字上，接受請求，提供服務
包括LAMP安裝過程（http、php-fpm、mysql-server、php-mysql）
https的實現
利用xcache提升php對動態內容的處理能力
環境
可以將httpd、php、mysql都裝在一個主機上，也可以單獨安裝，本例中使用將三者分開,具體環境為：
準備安裝httpd服務的系統為CentOS7系統，IP為10.1.32.72
準備安裝php的系統為CentOS7系統，IP為10.1.32.73
準備安裝mysql的系統為CentOS6系統，IP為10.1.32.68
第一部分 在10.1.32.72上安裝httpd
1、安裝httpd
2、對httpd進行簡單配置，啟動服務，看服務是否正常
第二部分 在10.1.32.73上安裝php-fpm、php-mysql
php與httpd結合方式為fastcgi方式時，要安裝的軟件包不是php而是php-fpm
安裝php連接mysql的php的擴展模塊php-mysql
1、安裝php-fpm、php-mysql
2、對php-fpm進行簡單配置，讓其能與前端httpd連接
3、確保httpd的proxy模塊被裝載，修改httpd的配置文件，讓httpd接收到的php請求，都代理至php-fpm的主機上進行處理
本處，我們將原有的httpd原有的中心主機注銷，利用新建虛擬主機來實現
4、在php-fpm服務器上，提供php測試頁面，進行訪問測試
因為前端httpd服務接收到用戶對php頁面的請求時，是直接將請求轉交給php來處理，所以，php的頁面資源應該存放在php自身的服務器上
測試訪問
5、查看php-fpm的狀態頁面和ping測試頁面
編譯httpd的配置文件，讓httpd將對php的status頁面的請求和ping測試頁面的請求都反代到php-fpm的服務器上
在php-fpm主機上編輯php-fpm的配置文件，啟用php-fpm的status頁面和ping頁面，修改完配置文件，重啟php-fpm服務
測試訪問
第三部分 在10.1.32.68上安裝mysql-server
1、安裝mysql服務
2、配置mysql，啟動服務，授權一個賬號，供php連接使用
3、在php-fpm上提供頁面，查看數據庫連接是否正常
第四部分 https的實現
1、在任意一個服務上建立私有CA(本例在mysql所在的節點上構建私有CA)
##################生成私鑰文件##################
[root@mysql ~]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...............+++
...........................+++
e is 65537 (0x10001)
[root@mysql ~]# ##################確保CA工作的目錄存在certs、newcerts、crl##################
[root@mysql ~]# ls /etc/pki/CA/
certs crl newcerts private
[root@mysql ~]# ##################創建CA工作需要的證書序列號文件和證書數據庫索引文件##################
[root@mysql ~]# touch /etc/pki/CA/{serial,index.txt}
[root@mysql ~]# ##################提供證書初始編號##################
[root@mysql ~]# echo 01 > /etc/pki/CA/serial
[root@mysql ~]# ##################生成CA自簽證書##################
[root@mysql ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
----- ##################填入相關信息##################
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:nwccompany
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:ca.nwc.com
Email Address []:caadmin@nwc.com
[root@mysql ~]#
2、在httpd服務器上生成證書簽署請求，發送給私有CA所在服務器
[root@httpd ~]# mkdir /etc/httpd/ssl ######生成證書相關文件存放目錄####### [root@httpd ~]# ######生成私鑰文件####### [root@httpd ~]# (umask 077;openssl genrsa -out /etc/httpd/ssl/httpd.key 1024) Generating RSA private key, 1024 bit long modulus ......................++++++ .............++++++ e is 65537 (0x10001) [root@httpd ~]# [root@httpd ~]# [root@httpd ~]# ######生成證書簽署請求####### [root@httpd ~]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- ######填入相關信息，注意hostname要與用戶訪問時的域名一致####### Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BeiJing Locality Name (eg, city) [Default City]:BeiJing Organization Name (eg, company) [Default Company Ltd]:nwccompany Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:www.a.com Email Address []:wwwadmin@a.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@httpd ~]# ######拷貝證書簽署請求到私有CA服務器####### [root@httpd ~]# scp /etc/httpd/ssl/httpd.csr 10.1.32.68:/tmp root@10.1.32.68's password: httpd.csr 100% 696 0.7KB/s 00:00 [root@httpd ~]#
3、在私有CA服務器上進行證書的簽署，并將簽署后的證書發送給httpd服務器
[root@mysql ~]# ls /tmp httpd.csr yum.log [root@mysql ~]# ####### 簽署證書 ######## [root@mysql ~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jul 13 09:46:29 2016 GMT Not After : Jul 13 09:46:29 2017 GMT Subject: countryName = CN stateOrProvinceName = BeiJing organizationName = nwccompany organizationalUnitName = ops commonName = www.a.com emailAddress = wwwadmin@a.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 42:AF:40:00:F2:CD:2F:05:2E:91:C3:AB:66:DB:04:D4:8C:E2:90:A4 X509v3 Authority Key Identifier: keyid:55:E3:92:99:17:92:2B:53:19:AE:57:29:34:AA:D0:1E:C3:04:88:54 Certificate is to be certified until Jul 13 09:46:29 2017 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@mysql ~]# ####### 復制證書到httpd服務器 ######## [root@mysql ~]# scp /etc/pki/CA/certs/httpd.crt 10.1.32.72:/etc/httpd/ssl/ The authenticity of host '10.1.32.72 (10.1.32.72)' can't be established. RSA key fingerprint is 61:20:77:df:ac:5c:a5:5c:8d:05:54:dc:f0:77:bc:ba. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.1.32.72' (RSA) to the list of known hosts. root@10.1.32.72's password: httpd.crt 100% 3845 3.8KB/s 00:00 [root@mysql ~]# [root@mysql ~]#
4、在httpd服務器上安裝https所需的httpd的模塊mod_ssl,修改httpd關于ssl的配置文件，讓其符合當前工作環境
修改配置文件
由于同一個IP只支持定義一個https，故本例中將之前定義的哪個虛擬主機定義為https的頁面
將準備定義為https的虛擬主機的定義注釋掉
在ssl的虛擬主機中定義：
5、測試https訪問
注意，因為是私有CA頒發的證書因此要將私有CA的自簽證書導入瀏覽器的可信任的根CA頒發機構后，然后進行測試訪問
第五部分 利用xcache提升php對動態內容的處理能力
加速的原理是：php在處理動態請求時，是將代碼加載進來，然后進行編譯成自檢碼(opcode)，執行后返回結果
利用php加速工具后，可以將之前已經編譯過的自檢碼緩存下來實現重復利用，而不用每次請求都重新編譯，以此來提升響應速度
本實驗結果中，xcache安裝后，php的處理能力略有提升，但是提升效果并不太明顯，
但是在生產環境中實驗的數據表明，xcache對php處理性能的提升大概3倍左右
1、測試在尚未安裝xcache時，php的處理能力
[root@mysql ~]# ab -c 200 -n 2000 http://10.1.32.72/test.php This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking 10.1.32.72 (be patient) Completed 200 requests Completed 400 requests Completed 600 requests Completed 800 requests Completed 1000 requests Completed 1200 requests Completed 1400 requests Completed 1600 requests Completed 1800 requests Completed 2000 requests Finished 2000 requests Server Software: Apache/2.4.6 Server Hostname: 10.1.32.72 Server Port: 80 Document Path: /test.php Document Length: 46074 bytes Concurrency Level: 200 Time taken for tests: 3.725 seconds Complete requests: 2000 Failed requests: 219 (Connect: 0, Receive: 0, Length: 219, Exceptions: 0) Write errors: 0 Total transferred: 92937540 bytes HTML transferred: 92551812 bytes Requests per second: 536.89 [#/sec] (mean) Time per request: 372.515 [ms] (mean) Time per request: 1.863 [ms] (mean, across all concurrent requests) Transfer rate: 24363.92 [Kbytes/sec] received Connection Times (ms) min mean[+/-sd] median max Connect: 0 23 134.8 2 1016 Processing: 3 248 404.2 193 3662 Waiting: 2 244 404.0 188 3651 Total: 28 271 425.9 196 3701 Percentage of the requests served within a certain time (ms) 50% 196 66% 201 75% 205 80% 208 90% 221 95% 416 98% 1205 99% 3682 100% 3701 (longest request)
2、在php-fpm主機上安裝php-xcache
因為xcache本身是作為php的模塊運行，故要與php安裝在一起
3、重啟php-fpm服務，查看phpinfo頁面是否有xcache的相關信息，并重新測試php的處理能力
[root@mysql ~]# ab -c 200 -n 2000 http://10.1.32.72/test.php This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking 10.1.32.72 (be patient) Completed 200 requests Completed 400 requests Completed 600 requests Completed 800 requests Completed 1000 requests Completed 1200 requests Completed 1400 requests Completed 1600 requests Completed 1800 requests Completed 2000 requests Finished 2000 requests Server Software: Apache/2.4.6 Server Hostname: 10.1.32.72 Server Port: 80 Document Path: /test.php Document Length: 46074 bytes Concurrency Level: 200 Time taken for tests: 3.091 seconds Complete requests: 2000 Failed requests: 245 (Connect: 0, Receive: 0, Length: 245, Exceptions: 0) Write errors: 0 Total transferred: 92531728 bytes HTML transferred: 92147728 bytes Requests per second: 747.01 [#/sec] (mean) Time per request: 309.112 [ms] (mean) Time per request: 1.546 [ms] (mean, across all concurrent requests) Transfer rate: 29233.07 [Kbytes/sec] received Connection Times (ms) min mean[+/-sd] median max Connect: 0 24 137.0 4 1043 Processing: 5 260 206.2 206 1808 Waiting: 4 249 206.1 196 1801 Total: 35 284 248.6 211 1914 Percentage of the requests served within a certain time (ms) 50% 211 66% 226 75% 246 80% 337 90% 426 95% 724 98% 1230 99% 1817 100% 1914 (longest request)
第六部分 利用LAMP組合，實現部署phpMyAdmin
1、下載phpMyAdmin到php-fpm所在的主機，解壓到php頁面所在的文件目錄
2、測試訪問
有可能會報缺少php組件的問題，進行安裝php-mbstring組件，安裝完后，記得重啟php-fpm服務
測試訪問
本測試環境中，為了解決上述問題，在httpd服務器上將所有資源的請求都交給php-fpm進行處理
原創文章，作者：M20-1倪文超，如若轉載，請注明出處：http://www.www58058.com/51685
