OS : Centos 7
nginx : 1.17.8
php : 7.3.14
mariadb : mariadb 10.4.7
oepnssl : 1.1.1d
tls 1.3 enable , log geoip , php-fpm 구동
1. mariadb 설치 yum repo에 추가 후 설치 진행
|
1 2 3 4 5 6 7 8 |
[root@localhost ~]# vi /etc/yum.repos.d/MariaDB.repo #추가 [mariadb] name = MariaDB baseurl = http://yum.mariadb.org/10.4/centos7-amd64 gpgkey = https://yum.mariadb.org/RPM-GPG-KEY-MariaDB gpgcheck = 1 |
2. yum으로 mariadb 10.4.7 install
|
1 |
[root@localhost ~]# yum -y install MariaDB |
3. mariadb는 설치가 완료되었으며 이제 시작만 하면 되지만 사용자마다 mysql 을 설치하는 디렉토리가 모두 다르므로 해당 경로를 지정해서 설치해주자
기본 바로 시작을 하게 되면 경로는 /var/lib/mysql 이 기본경로이다
설치는 우리는 /free/mysql_data 에 진행하려고 한다 / 설치 진행 후 권한을 변경
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
[root@localhost ~]# mysql_install_db --datadir=/free/mysql_data ### 데이터저장소가 /home/mysql_data에 지정하려고 하면 다음과 같이 명령어 [root@localhost ~]# mysql_install_db --datadir=/home/mysql_data [root@localhost ~]# ls -l /free/mysql_data/ -rw-rw---- 1 root root 24576 8??14 16:03 aria_log.00000001 -rw-rw---- 1 root root 52 8??14 16:03 aria_log_control -rw-rw---- 1 root root 972 8??14 16:03 ib_buffer_pool -rw-rw---- 1 root root 134217728 8??14 16:03 ib_logfile0 -rw-rw---- 1 root root 134217728 8??14 16:03 ib_logfile1 -rw-rw---- 1 root root 134217728 8??14 16:03 ib_logfile2 -rw-rw---- 1 root root 77594624 8??14 16:03 ibdata1 drwx------ 2 root root 4096 8??14 16:03 mysql drwx------ 2 root root 20 8??14 16:03 performance_schema drwx------ 2 root root 20 8??14 16:03 test |
4. 해당 데이터베이스의 USER 권한이 root 이므로 이것을 mysql로 변경해주자
|
1 |
[root@localhost ~]# chown mysql /free/mysql_data/ |
5. 기본 여러지 환경설정값을 변경해서 사용하므로 /etc/my.cnf.d/server.cnf 해당 파일을 아래와 같이 수정해준다
기본 엔진 myisam / 만약 innodb를 사용하려면 6번의 server.cnf 파일을 참고한다
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
[server] [mysqld] bind-address=0.0.0.0 skip-external-locking key_buffer_size = 384M max_allowed_packet = 512M table_open_cache = 2048 sort_buffer_size = 2M read_buffer_size = 2M read_rnd_buffer_size = 8M myisam_sort_buffer_size = 64M thread_cache_size = 8 #dns query skip-name-resolve <span class="crayon-i">sql_mode</span>=<span class="crayon-i">NO_AUTO_CREATE_USER</span><span class="crayon-sy">,</span><span class="crayon-i">NO_ENGINE_SUBSTITUTION</span> #connection max_connections = 1000 max_connect_errors = 1000 wait_timeout= 60 #slow-queries #slow_query_log = /var/lib//mysql/slow-queries.log #long_query_time = 3 #log-slow-queries = /var/lib/mysql/mysql-slow-queries.log ##timestamp explicit_defaults_for_timestamp symbolic-links=0 <span class="crayon-i">sql_mode</span>=<span class="crayon-i">NO_AUTO_CREATE_USER</span><span class="crayon-sy">,</span><span class="crayon-i">NO_ENGINE_SUBSTITUTION</span> ###chracter character-set-client-handshake=FALSE init_connect = SET collation_connection = utf8_general_ci init_connect = SET NAMES utf8 character-set-server = utf8 collation-server = utf8_general_ci ### MyISAM Spectific options default-storage-engine = myisam key_buffer_size = 32M bulk_insert_buffer_size = 64M myisam_sort_buffer_size = 128M myisam_max_sort_file_size = 10G myisam_repair_threads = 1 ### INNODB Spectific options #default-storage-engine = InnoDB skip-innodb #innodb_additional_mem_pool_size = 16M #innodb_buffer_pool_size = 1024MB #innodb_data_file_path = ibdata1:10M:autoextend #innodb_write_io_threads = 8 #innodb_read_io_threads = 8 #innodb_thread_concurrency = 16 #innodb_flush_log_at_trx_commit = 1 #innodb_log_buffer_size = 8M #innodb_log_file_size = 128M #innodb_log_files_in_group = 3 #innodb_max_dirty_pages_pct = 90 #innodb_lock_wait_timeout = 120 [mysqldump] #default-character-set = utf8 max_allowed_packet = 512M [myisamchk] key_buffer_size = 512M sort_buffer_size = 512M read_buffer = 8M write_buffer = 8M # # * Galera-related settings # [galera] # Mandatory settings #wsrep_on=ON #wsrep_provider= #wsrep_cluster_address= #binlog_format=row #default_storage_engine=InnoDB #innodb_autoinc_lock_mode=2 # Optional setting #wsrep_slave_threads=1 |
6. 기본 여러지 환경설정값을 변경해서 사용하므로 /etc/my.cnf.d/server.cnf 해당 파일을 아래와 같이 수정해준다
기본 엔진 innodb
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
[server] [mysqld] bind-address=0.0.0.0 skip-external-locking key_buffer_size = 384M max_allowed_packet = 512M table_open_cache = 2048 sort_buffer_size = 2M read_buffer_size = 2M read_rnd_buffer_size = 8M myisam_sort_buffer_size = 64M thread_cache_size = 8 #dns query skip-name-resolve <span class="crayon-i">sql_mode</span>=<span class="crayon-i">NO_AUTO_CREATE_USER</span><span class="crayon-sy">,</span><span class="crayon-i">NO_ENGINE_SUBSTITUTION</span> #connection max_connections = 1000 max_connect_errors = 1000 wait_timeout= 60 #slow-queries #slow_query_log = /var/lib//mysql/slow-queries.log #long_query_time = 3 #log-slow-queries = /var/lib/mysql/mysql-slow-queries.log ##timestamp explicit_defaults_for_timestamp <span class="crayon-i">sql_mode</span>=<span class="crayon-i">NO_AUTO_CREATE_USER</span><span class="crayon-sy">,</span><span class="crayon-i">NO_ENGINE_SUBSTITUTION</span> symbolic-links=0 ###chracter character-set-client-handshake=FALSE init_connect = SET collation_connection = utf8_general_ci init_connect = SET NAMES utf8 character-set-server = utf8 collation-server = utf8_general_ci ### MyISAM Spectific options #default-storage-engine = myisam key_buffer_size = 32M bulk_insert_buffer_size = 64M myisam_sort_buffer_size = 128M myisam_max_sort_file_size = 10G myisam_repair_threads = 1 ### INNODB Spectific options default-storage-engine = InnoDB #skip-innodb #innodb_additional_mem_pool_size = 16M innodb_buffer_pool_size = 1024MB innodb_data_file_path = ibdata1:10M:autoextend innodb_write_io_threads = 8 innodb_read_io_threads = 8 innodb_thread_concurrency = 16 innodb_flush_log_at_trx_commit = 1 innodb_log_buffer_size = 8M innodb_log_file_size = 128M innodb_log_files_in_group = 3 innodb_max_dirty_pages_pct = 90 innodb_lock_wait_timeout = 120 [mysqldump] #default-character-set = utf8 max_allowed_packet = 512M [myisamchk] key_buffer_size = 512M sort_buffer_size = 512M read_buffer = 8M write_buffer = 8M # * Galera-related settings # [galera] # Mandatory settings #wsrep_on=ON #wsrep_provider= #wsrep_cluster_address= #binlog_format=row #default_storage_engine=InnoDB #innodb_autoinc_lock_mode=2 # Optional setting #wsrep_slave_threads=1 |
7. 이제 mysql ( mariadb)를 시작해보자
|
1 |
[root@localhost ~]# systemctl start mysql |
8. mysql을 접속해서 환경를 확인해보자
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 |
[root@localhost ~]# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 3 Server version: 10.4.7-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> \s -------------- mysql Ver 15.1 Distrib 10.4.7-MariaDB, for Linux (x86_64) using readline 5.1 Connection id: 3 Current database: Current user: root@localhost SSL: Not in use Current pager: stdout Using outfile: '' Using delimiter: ; Server: MariaDB Server version: 10.4.7-MariaDB MariaDB Server Protocol version: 10 Connection: Localhost via UNIX socket Server characterset: utf8 Db characterset: utf8 Client characterset: utf8 Conn. characterset: utf8 UNIX socket: /var/lib/mysql/mysql.sock Uptime: 38 sec Threads: 2 Questions: 4 Slow queries: 0 Opens: 16 Flush tables: 1 Open tables: 9 Queries per second avg: 0.105 -------------- MariaDB [(none)]> MariaDB [(none)]> MariaDB [(none)]> SHOW VARIABLES LIKE 'max%'; +----------------------------+----------------------+ | Variable_name | Value | +----------------------------+----------------------+ | max_allowed_packet | 536870912 | | max_binlog_cache_size | 18446744073709547520 | | max_binlog_size | 1073741824 | | max_binlog_stmt_cache_size | 18446744073709547520 | | max_connect_errors | 1000 | | max_connections | 1000 | | max_delayed_threads | 20 | | max_digest_length | 1024 | | max_error_count | 64 | | max_heap_table_size | 16777216 | | max_insert_delayed_threads | 20 | | max_join_size | 18446744073709551615 | | max_length_for_sort_data | 1024 | | max_long_data_size | 536870912 | | max_password_errors | 4294967295 | | max_prepared_stmt_count | 16382 | | max_recursive_iterations | 4294967295 | | max_relay_log_size | 1073741824 | | max_rowid_filter_size | 131072 | | max_seeks_for_key | 4294967295 | | max_session_mem_used | 9223372036854775807 | | max_sort_length | 1024 | | max_sp_recursion_depth | 0 | | max_statement_time | 0.000000 | | max_tmp_tables | 32 | | max_user_connections | 0 | | max_write_lock_count | 4294967295 | +----------------------------+----------------------+ 27 rows in set (0.002 sec) |
9. 리부팅 또는 서버가 시작될 경우 자동으로 해당 데몬을 서비스하게 구성
|
1 2 3 4 |
[root@localhost ~]# systemctl enable mysql ### 또는 [root@localost ~]# systemctl enable mariadb |
10. TLS 1.3 지원하기 위해서 openssl install
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
[root@localhost ~]# wget https://www.openssl.org/source/openssl-1.1.1d.tar.gz [root@localhost ~]# tar xvfz openssl-1.1.1d.tar.gz [root@localhost ~]# cd openssl-1.1.1d [root@localhost openssl-1.1.1d]# ./config --prefix=/usr/local/openssl shared zlib-dynamic [root@localhost openssl-1.1.1d]# make -j `grep processor /proc/cpuinfo | wc -l` [root@localhost openssl-1.1.1d]# make install [root@localhost openssl-1.1.1d]# echo "/usr/local/openssl/lib" >> /etc/ld.so.conf.d/openssl.conf [root@localhost openssl-1.1.1d]# ldconfig [root@localhost openssl-1.1.1d]# mv /usr/bin/openssl /usr/bin/openssl.old [root@localhost openssl-1.1.1d]# ln -s /usr/local/openssl/bin/openssl /usr/bin/ |
11. tls 1.3 지원여부 명령어로 확인
|
1 2 3 4 |
[root@localhost openssl-1.1.1d]# openssl ciphers -v | grep TLSv1.3 TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD |
12. nginx 에 geoip 모듈을 설치하기 위해서 geoip 설치
|
1 |
[root@xinet nginx-1.17.8]# yum -y install GeoIP-* |
13. nginx 다운로드 및 comfile 진행 및 유저 추가
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 |
[root@xinet tmp]# wget https://nginx.org/download/nginx-1.17.8.tar.gz [root@xinet tmp]# tar xvfz nginx-1.17.8.tar.gz [root@localhost ~]# cd nginx-1.17.8 [root@xinet nginx-1.17.8]# useradd nginx [root@localhost nginx-1.17.8]# ./configure --prefix=/usr/local/nginx \ --sbin-path=/usr/sbin/nginx \ --modules-path=/usr/local/nginx/modules \ --conf-path=/usr/local/nginx/conf/nginx.conf \ --error-log-path=/usr/local/nginx/logs/error.log \ --http-log-path=/usr/local/nginx/logs/access.log \ --pid-path=/var/run/nginx.pid \ --lock-path=/var/run/nginx.lock \ --http-client-body-temp-path=/var/cache/nginx/client_temp \ --http-proxy-temp-path=/var/cache/nginx/proxy_temp \ --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \ --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \ --http-scgi-temp-path=/var/cache/nginx/scgi_temp \ --user=nginx --group=nginx \ --with-compat \ --with-file-aio \ --with-threads \ --with-http_addition_module \ --with-http_auth_request_module \ --with-http_dav_module \ --with-http_flv_module \ --with-http_gunzip_module \ --with-http_gzip_static_module \ --with-http_mp4_module \ --with-http_random_index_module \ --with-http_realip_module \ --with-http_secure_link_module \ --with-http_slice_module \ --with-http_ssl_module \ --with-http_stub_status_module \ --with-http_sub_module \ --with-http_v2_module \ --with-http_geoip_module \ --with-stream_geoip_module \ --with-pcre \ --with-mail \ --with-mail_ssl_module \ --with-stream \ --with-stream_realip_module \ --with-stream_ssl_module \ --with-stream_ssl_preread_module --with-openssl=../openssl-1.1.1d |
14. make / make install
|
1 2 3 |
[root@localhost nginx-1.17.8]# make [root@localhost nginx-1.17.8]# make install |
15. systemctl 등록
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
[root@localhost nginx-1.17.8]# vi /etc/systemd/system/nginx.service [Unit] Description=The NGINX HTTP and reverse proxy server After=syslog.target network.target remote-fs.target nss-lookup.target [Service] Type=forking PIDFile=/var/run/nginx.pid ExecStartPre=/usr/sbin/nginx -t ExecStart=/usr/sbin/nginx ExecReload=/usr/sbin/nginx -s reload ExecStop=/bin/kill -s QUIT $MAINPID PrivateTmp=true [Install] WantedBy=multi-user.target |
16. systemctl daemon-reload / enable
|
1 2 3 4 |
[root@localhost nginx-1.16.1]# systemctl daemon-reload [root@localhost nginx-1.16.1]# systemctl enable nginx.service Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /etc/systemd/system/nginx.service. |
nginx.conf 는 최종 php 설치를 완료하고 한번에 conf를 수정
17.php 다운로드 및 install
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
[root@localhost tmp]# wget https://www.php.net/distributions/php-7.3.14.tar.gz [root@localhost tmp]# tar xvfz php-7.3.14.tar.gz [root@localhost tmp]# cd php-7.3.14 [root@localhost php-7.3.14]# ./configure --prefix=/usr/local/php-fpm \ --with-config-file-path=/usr/local/php-fpm/etc --with-config-filecan-dir=/usr/local/php-fpm/etc \ --with-openssl --with-mysql-sock=/var/lib/mysql/mysql.sock --with-mysqli=shared,mysqlnd \ --with-pdo-mysql --with-libdir=lib64 --with-enchant --with-gettext --with-gd \ --with-jpeg-dir --with-png-dir --with-freetype-dir --with-zlib --with-gmp \ --with-iconv --with-gdbm --with-pcre-regex --with-bz2 --with-curl \ --with-mhash --with-xsl --with-readline --with-curl --with-pear --with-gettext \ --with-xmlrpc --with-ldap --enable-mysqlnd --enable-bcmath --enable-sockets \ --enable-pcntl --enable-ftp --enable-zip --enable-bcmath --enable-mbstring \ --enable-calendar --enable-simplexml --enable-json --enable-hash --enable-session \ --enable-soap --enable-xml --enable-wddx --enable-opcache --enable-intl --enable-cli \ --enable-maintainer-zts --enable-debug --enable-mbregex --enable-libxml --enable-dba \ --enable-wddx --enable-shmop --enable-sysvsem --enable-sysvshm --enable-sysvmsg \ --enable-exif --with-fpm-systemd --with-fpm-user=nobody --with-fpm-group=nobody --enable-fpm [root@localhost php-7.3.14]# make -j `grep processor /proc/cpuinfo | wc -l` [root@localhost php-7.3.14]# make install |
18. php.ini 환경 설정 파일 복사 및 수정
|
1 2 3 4 5 6 7 8 |
[root@localhost php-7.3.14]# cp -a php.ini-development /usr/local/php-fpm/etc/php.ini [root@localhost php-7.3.14]# vi /usr/local/php-fpm/etc/php.ini short_open_tag = On date.timezone = "Asia/Seoul" error_reporting = "E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_USER_DEPRECATED" upload_max_filesize = 12M |
19. php-fpm 파일 복사 및 수정
|
1 2 3 4 5 6 7 |
[root@localhost php-7.3.14]# cp -a /usr/local/php-fpm/etc/php-fpm.conf.default /usr/local/php-fpm/etc/php-fpm.conf [root@localhost php-7.3.14]# vi /usr/local/php-fpm/etc/php-fpm.conf pid = /var/run/php-fpm.pid error_log = /var/log/php-fpm.log daemonize = yes |
20. php www.conf 파일 수정
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
[root@localhost php-7.3.14]# cp -a /usr/local/php-fpm/etc/php-fpm.d/www.conf.default /usr/local/php-fpm/etc/php-fpm.d/www.conf [root@localhost php-7.3.14]# vi /usr/local/php-fpm/etc/php-fpm.d/www.conf user = nginx group = nginx ;listen = 127.0.0.1:9000 ;socket listen = /usr/local/php-fpm/var/run/php-fpm.sock listen.owner = nginx listen.group = nginx |
21. systemctl 등록
|
1 2 3 4 5 6 7 8 |
[root@localhost php-7.3.14]# cp -a sapi/fpm/php-fpm.service /usr/lib/systemd/system/ [root@localhost php-7.3.14]# systemctl daemon-reload [root@localhost php-7.3.14]# systemctl list-unit-files | grep php php-fpm.service enabled [root@localhost php-7.3.14]# systemctl enable php-fpm |
22. php 가동 ( php-fpm)
|
1 2 3 4 5 6 |
[root@localhost php-7.3.14]# systemctl start php-fpm [root@localhost php-7.3.14]# ps -ef | grep php-fpm root 3846 1 0 17:20 ? 00:00:00 php-fpm: master process (/usr/local/php-fpm/etc/php-fpm.conf) nginx 3847 3846 0 17:20 ? 00:00:00 php-fpm: pool www nginx 3848 3846 0 17:20 ? 00:00:00 php-fpm: pool www |
23. nginx.conf 파일 수정
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
[root@xinet ~]# vi /usr/local/nginx/conf/nginx.conf #user nobody; worker_processes 8; ### cpu count 수량보다 적게 구성 worker_rlimit_nofile 8192; ### 기본값은 1024 error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid; events { worker_connections 4096; ### default 1024 } http { include mime.types; default_type application/octet-stream; index index.html index.htm index.php; ###GEOIP geoip_country /usr/share/GeoIP/GeoIP.dat; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" $geoip_country_code'; access_log logs/access.log main; sendfile on; tcp_nopush on; server_names_hash_bucket_size 128; ### vhost site count up #keepalive_timeout 0; keepalive_timeout 65; #gzip on; # include vhosts/*.conf; } |
24. 가상호스트 2개의 도메인 설정 tlstest3.xinet.kr / nginxtest.xinet.kr
tlstest3.xinet.kr / 홈경로 : /home/tlstest3/html
nginxtest.xinet.kr / 홈경로 : /home/nginxtest/html
|
1 |
[root@xinet ~]# mkdir -p /usr/local/nginx/conf/vhosts/ |
25. tlstest3.xinet.kr 가상호스트 파일 생성 ( HTTP / HTTPS ) / 만약 HTTPS 이용하지 않으려면 중간쯤 #HTTPS SERVER 하단 부분을 모두 삭제하면 된다
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
[root@localhost conf]# vi /usr/local/nginx/conf/vhosts/tlstest3.xinet.kr.conf server { root /home/tlstest3/html/; listen 80; server_name tlstest3.xinet.kr; #charset koi8-r; access_log logs/tlstest3.xinet.kr_access.log main; location / { root /home/tlstest3/html/; } #error_page 404 /404.html; error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } #PHP-FPM location ~ \.php$ { root /home/tlstest3/html/; fastcgi_pass unix:/usr/local/php-fpm/var/run/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } # HTTPS server server { listen 443 ssl http2; server_name tlstest3.xinet.kr; access_log logs/tlstest3.xinet.kr_access.log main; ssl_certificate /usr/local/nginx/conf/ssl/tlstest3.xinet.kr.cert; ssl_certificate_key /usr/local/nginx/conf/ssl/tlstest3.xinet.kr.key; #ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1 305:kEDH+AESGCM:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-S HA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SRP-RSA-AES-128-CBC-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH: !EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-GCM-SHA256; location / { root /home/tlstest3/html/; } location ~ \.php$ { root /home/tlstest3/html/; fastcgi_pass unix:/usr/local/php-fpm/var/run/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } |
26. nginxtest.xinet.kr ( http / https ) 만약 HTTPS 이용하지 않으려면 중간쯤 #HTTPS SERVER 하단 부분을 모두 삭제하면 된다
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
[root@localhost conf]# vi /usr/local/nginx/conf/vhosts/nginxtest.xinet.kr.conf server { root /home/nginxtest/html/; listen 80; server_name nginxtest.xinet.kr; #charset koi8-r; access_log logs/nginxtest.xinet.kr_access.log main; location / { root /home/nginxtest/html/; } #error_page 404 /404.html; error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } #PHP-FPM location ~ \.php$ { root /home/nginxtest/html/; fastcgi_pass unix:/usr/local/php-fpm/var/run/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } # HTTPS server server { listen 443 ssl http2; server_name nginxtest.xinet.kr; access_log logs/nginxtest.xinet.kr_access.log main; ssl_certificate /usr/local/nginx/conf/ssl/nginxtest.xinet.kr.cer; ssl_certificate_key /usr/local/nginx/conf/ssl/nginxtest.xinet.kr.key; #ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1 305:kEDH+AESGCM:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-S HA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SRP-RSA-AES-128-CBC-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH: !EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-GCM-SHA256; location / { root /home/nginxtest/html/; } location ~ \.php$ { root /home/nginxtest/html/; fastcgi_pass unix:/usr/local/php-fpm/var/run/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } |
27. nginx.conf 에 에러가 없는지 확인 ( nginx -t )
|
1 2 3 |
[root@localhost conf]# nginx -t nginx: the configuration file /usr/local/nginx/etc/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/etc/nginx.conf test is successful |
28. 이제 아무런 문제가 없으니 nginx 시작해 보자
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
[root@localhost conf]# systemctl start nginx [root@localhost conf]# ps -ef | grep nginx nginx 16356 15916 0 2월11 ? 00:02:02 php-fpm: pool www nginx 16415 15916 0 2월11 ? 00:01:58 php-fpm: pool www nginx 47670 15916 0 10:56 ? 00:00:06 php-fpm: pool www root 64819 1 0 16:11 ? 00:00:00 nginx: master process /usr/sbin/nginx nginx 64820 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64821 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64822 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64823 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64824 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64825 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64826 64819 0 16:11 ? 00:00:00 nginx: worker process nginx 64827 64819 0 16:11 ? 00:00:00 nginx: worker process |
29. 가상호스트에 phpinfo 를 실행해서 페이지가 정상적으로 출력되는지 체크
|
1 2 3 4 5 6 7 |
[root@localhost conf]# vi /home/tlstest3/html/info.php <? echo "tlstest3.xinet.kr"; phpinfo(); ?> |
30. 웹페이지 확인 http 페이지 확인
31. 웹페이지 https 확인 및 tls 1.3 확인
32. 이미지 파일 htps 출력시 HTTP2 지원
33. LOG 파일도 확인하면 H2
|
1 2 3 4 5 6 |
[root@localhost html]# tail -n 5 /usr/local/nginx/logs/tlstest3.xinet.kr_access.log 219.146.77.213 - - [14/Feb/2020:16:18:17 +0900] "GET /favicon.ico HTTP/2.0" 404 555 "https://tlstest3.xinet.kr/nginx_tlstest.jpg" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36" "-" "KR" 219.146.77.213 - - [14/Feb/2020:16:18:35 +0900] "GET /nginx_tlstest.jpg HTTP/2.0" 200 217645 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36" "-" "KR" 219.146.77.213 - - [14/Feb/2020:16:18:35 +0900] "GET /favicon.ico HTTP/2.0" 404 555 "https://tlstest3.xinet.kr/nginx_tlstest.jpg" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36" "-" "KR" 219.145.77.213 - - [14/Feb/2020:16:18:47 +0900] "GET /nginx_tlstest.jpg HTTP/2.0" 200 217645 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36" "-" "KR" 219.145.77.213 - - [14/Feb/2020:16:18:47 +0900] "GET /favicon.ico HTTP/2.0" 404 555 "https://tlstest3.xinet.kr/nginx_tlstest.jpg" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36" "-" "KR" |
34. 다른 도메인도 웹사이트 정상 유무 체크
