yum -y install vim-enhanced mv /bin/vi /bin/vi.save ln -s /usr/bin/vim /bin/vi cp /etc/vimrc /etc/vimrc.save sed -i “39 s/^/ set number /n filetype on/n set history=1000/n syntax on/n set tabstop=4/n set showmatch/n set vb t_vb=/n set mouse=a/n set ignorecase/n set autowrite/n /” /etc/vimrc
cd /usr/local/src vi install.sh ###############################################
#安裝openssl cd /usr/local/src tar zxvf openssl-0.9.8h.tar.gz cd openssl-0.9.8h ./config shared zlib make make test make install mv /usr/bin/openssl /usr/bin/openssl.save mv /usr/include/openssl /usr/include/openssl.save mv /usr/lib/libssl.so /usr/lib/libssl.so.save ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl ln -s /usr/local/ssl/include/openssl /usr/include/openssl ln -sv /usr/local/ssl/lib/libssl.so.0.9.8 /usr/lib/libssl.so cd ..
#!/bin/bash # # Startup script for the Apache Web Server # # chkconfig: - 85 15 # description: Apache is a World Wide Web server. It is used to serve / # HTML files and CGI. # processname: httpd # pidfile: /usr/local/apache2/logs/httpd.pid # config: /usr/local/apache2/conf/httpd.conf
# Source function library. . /etc/rc.d/init.d/functions
if [ -f /etc/sysconfig/httpd ]; then . /etc/sysconfig/httpd fi
# This will prevent initlog from swallowing up a pass-phrase prompt if # mod_ssl needs a pass-phrase from the user. INITLOG_ARGS=”"
# Path to the apachectl script, server binary, and short-form for messages. apachectl=/usr/local/apache2/bin/apachectl httpd=/usr/local/apache2/bin/httpd pid=/usr/local/apache2/logs/httpd.pid prog=httpd RETVAL=0
# The semantics of these two functions differ from the way apachectl does # things — attempting to start while running is a failure, and shutdown # when not running is also a failure. So we just do it the way init scripts # are expected to behave here. start() { echo -n $”Starting $prog: “ daemon $httpd $OPTIONS RETVAL=$? echo [ $RETVAL = 0 ] && touch /var/lock/subsys/httpd return $RETVAL } stop() { echo -n $”Stopping $prog: “ killproc $httpd RETVAL=$? echo [ $RETVAL = 0 ] && rm -f /var/lock/subsys/httpd $pid } reload() { echo -n $”Reloading $prog: “ killproc $httpd -HUP RETVAL=$? echo }
# See how we were called. case “$1″ in start) start ;; stop) stop ;; status) status $httpd RETVAL=$? ;; restart) stop start ;; condrestart) if [ -f $pid ] ; then stop start fi ;; reload) reload ;; graceful|help|configtest|fullstatus) $apachectl $@ RETVAL=$? ;; *) echo $”Usage: $prog {start|stop|restart|condrestart|reload|status” echo $”|fullstatus|graceful|help|configtest}” exit 1 esac
vi /usr/local/apache2/conf/extra/httpd-default.conf
Timeout 15 KeepAlive Off MaxKeepAliveRequests 50 KeepAliveTimeout 5 UseCanonicalName Off AccessFileName .htaccess ServerTokens Prod ServerSignature Off HostnameLookups Off
cd /usr/local/src tar zxvf phpMyAdmin-2.11.8.1-all-languages-utf-8-only.tar.gz cp -rf phpMyAdmin-2.11.8.1-all-languages-utf-8-only /data/www/wwwroot/test.com/phpmyadmin cd /data/www/wwwroot/test.com/phpmyadmin
cp config.sample.inc.php config.inc.php
sed -i -e “/^/$cfg/['blowfish_secret'/]/{ s@”;@’88888888888888888′;@; }” config.inc.php
3、系統(tǒng)環(huán)境部署及調(diào)整 (1)檢查系統(tǒng)是否正常 # more /var/log/messages //檢查有無系統(tǒng)內(nèi)核級錯誤信息 # dmesg //檢查硬件設(shè)備是否有錯誤信息 # ifconfig //檢查網(wǎng)卡設(shè)置是否正確 # ping www.163.com // 檢查網(wǎng)絡(luò)是否正常 (2)關(guān)閉不需要的服務(wù) # export LANG='en_US' //設(shè)置語言 # setup //選擇啟動的服務(wù) 進(jìn)入system service 選項。 以space 鍵選定所需服務(wù)。 以下僅列出需要啟動的服務(wù),未列出的服務(wù)一律關(guān)閉: crond irqbalance 僅當(dāng)服務(wù)器CPU為S.M.P架構(gòu)或支持雙核心、HT技術(shù)時,才需開啟,否則關(guān)閉。 microcode_ctl network iptables vsftpd sshd syslog yum-updatesd (3)修改/etc/yum.repos.d/CentOS-Base.repo,將鏡象站點地址改為在中國的鏡象站點地址。不然我們通過yum安裝軟件速度會極慢。修改如下: # CentOS-Base.repo # # This file uses a new mirrorlist system developed by Lance Davis for CentOS. # The mirror system uses the connecting IP address of the client and the # update status of each mirror to pick mirrors that are updated to and # geographically close to the client. You should use this for CentOS updates # unless you are manually picking other mirrors. # # If the mirrorlist= does not work for you, as a fall back you can try the # remarked out baseurl= line instead. # # [base] name=CentOS-$releasever - Base baseurl=http://mirrors.shlug.org/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 protect=1 #released updates [updates] name=CentOS-$releasever - Updates baseurl=http://mirrors.shlug.org/centos/$releasever/updates/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 protect=1 #packages used/produced in the build but not released [addons] name=CentOS-$releasever - Addons baseurl=http://mirrors.shlug.org/centos/$releasever/addons/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 protect=0 #additional packages that may be useful [extras] name=CentOS-$releasever - Extras baseurl=http://mirrors.shlug.org/centos/$releasever/extras/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 protect=0 #additional packages that extend functionality of existing packages [centosplus] name=CentOS-$releasever - Plus baseurl=http://mirrors.shlug.org/centos/$releasever/centosplus/$basearch/ gpgcheck=1 enabled=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 protect=1 #contrib - packages by Centos Users [contrib] name=CentOS-$releasever - Contrib baseurl=http://mirrors.shlug.org/centos/$releasever/contrib/$basearch/ gpgcheck=1 enabled=0 protect=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5 保存文件。 (4)更新系統(tǒng),我們使用yum, 運行: # yum upgrade 建議更新所有列出的程序,包括內(nèi)核,rhel 5.X的穩(wěn)定性還要繼續(xù)努力呢。 (5)定時校正服務(wù)器時間 # yum install –y ntp # crontab -e 0 23 * * * /usr/sbin/ntpdate 210.72.145.44 以上命令設(shè)置好后存盤。 # /sbin/service crond reload 重載計劃任務(wù)配置 您的機(jī)器將在每天的23:00根據(jù)中國國家授時中心的NTP服務(wù)器時間自動校準(zhǔn)時間。 (6)FTP服務(wù)器的配置 vi /etc/vsftpd/vsftpd.conf 把anonymous_enable=YES 修改為anonymous_enable=No不允許匿名登錄。 添加兩句 chroot_local_user=yes listen_port=2121 將用戶鎖定在主目錄,并將FTP監(jiān)聽端口修改為2121 把ftpd_banner=*前的注釋去掉。后面改成你的歡迎信息(這樣設(shè)置可以避免顯示ftp服務(wù)器的版本信息) 然后保存,service vsftpd start就可以了。 這時應(yīng)當(dāng)添加用戶,因為root默認(rèn)不能通過FTP方式登錄,也不安全。 groupadd upload useradd upload -g upload -d /usr/local/apache2/htdocs/ -M 如果FTP登錄時出現(xiàn) ftp服務(wù)器連接失敗,錯誤提示: 500 OOPS: cannot change directory:/home/******* 500 OOPS: child died 解決方法: # setsebool ftpd_disable_trans 1 # service vsftpd restart 這樣對于我們上傳一些文件到系統(tǒng)中很方便。 大家有興趣的可以看下這篇文章對vsftpd進(jìn)行一個比較詳細(xì)的了解 http://blog.chinaunix.net/u/10047/showart_198837.html 4、重新啟動系統(tǒng) # init 6 此時系統(tǒng)啟動成功,可以刪除老的內(nèi)核
7、編譯mysql 5.0.50 mysql 5.0.50是企業(yè)版本,貌似雙數(shù)版本都是企業(yè)版本了。個人覺得代碼質(zhì)量要比社區(qū)版本要好一些。大家可以下載,免費使用。并不需要向mysql公司交錢。 #cd /usr/local/src # wget http://mirror.provenscaling.com/mysq...-5.0.50.tar.gz # tar xzvf mysql-5.0.50.tar.gz # cd mysql-5.0.50 修改mysql 客戶端最大連接數(shù), 默認(rèn)的只有100,遠(yuǎn)遠(yuǎn)達(dá)不到我們的要求。 # vi sql/mysqld.cc 搜索找到下面一行: {"max_connections", OPT_MAX_CONNECTIONS, "The number of simultaneous clients allowed.", (gptr*) &max_connections, (gptr*) &max_connections, 0, GET_ULONG, REQUIRED_ARG, 100, 1, 16384, 0, 1, 0}, 將其中的100改為1500, 當(dāng)然小點也可以,根據(jù)你的需要來,不建議改的太大。 {"max_connections", OPT_MAX_CONNECTIONS, "The number of simultaneous clients allowed.", (gptr*) &max_connections, (gptr*) &max_connections, 0, GET_ULONG, REQUIRED_ARG, 1500, 1, 16384, 0, 1, 0}, 保存。 # CHOST="i686-pc-linux-gnu" CFLAGS="-O3 -msse2 -mmmx -Wall -W -mfpmath=sse -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" CXXFLAGS="-O3 -msse2 -mmmx -Wall -W -mfpmath=sse -funroll-loops -mcpu=pentium4 -march=pentium4 -pipe -felide-constructors -fno-exceptions -fno-rtti -fomit-frame-pointer" ./configure --prefix=/usr/local/mysql --localstatedir=/var/lib/mysql --with-comment=Source --with-server-suffix=-enterprise-gpl --with-mysqld-user=mysql --without-debug --with-big-tables --with-charset=utf8 --with-collation=utf8_general_ci --with-extra-charsets=gbk,latin1 --with-pthread --enable-static --with-client-ldflags=-all-static --with-mysqld-ldflags=-all-static --enable-assembler --without-innodb --without-ndb-debug --without-isam --enable-local-infile --with-readline --with-raid 配置成功會提示: MySQL has a Web site at http://www.mysql.com/ which carries details on the latest release, upcoming features, and other information to make your work or play with MySQL more productive. There you can also find information about mailing lists for MySQL discussion. Remember to check the platform specific part of the reference manual for hints about installing MySQL on your platform. Also have a look at the files in the Docs directory. Thank you for choosing MySQL! # make 編譯的時間可能會比較長,畢竟優(yōu)化的比較厲害。 # make install 編譯安裝完成后執(zhí)行后續(xù)操作: # useradd mysql //添加 mysql 用戶 # cd /usr/local/mysql # bin/mysql_install_db --user=mysql # chown -R root:mysql . //設(shè)置權(quán)限,注意后面有一個 "." # chown -R mysql /var/lib/mysql //設(shè)置 mysql 目錄權(quán)限 # chgrp -R mysql . //注意后面有一個 "." # cp share/mysql/my-medium.cnf /etc/my.cnf # cp share/mysql/mysql.server /etc/rc.d/init.d/mysqld //開機(jī)自動啟動 mysql。 # chmod 755 /etc/rc.d/init.d/mysqld # chkconfig --add mysqld #添加LIB PATH echo "/usr/local/mysql/lib" >> /etc/ld.so.conf && ldconfig vi /etc/my.cnf 修改 MySQL 配置,增加部分優(yōu)化參數(shù),如下: [mysqld] ft_min_word_len=2 運行以下命令即可啟動 MySQL 服務(wù)器: # /etc/rc.d/init.d/mysqld start //啟動 MySQL # bin/mysqladmin -u root password "password_for_root" # service mysqld stop //關(guān)閉 MySQL
9、編譯php 5.2.5 Suhosin是php增強型安全補丁,可以編譯到靜態(tài)內(nèi)核中,也可以編譯成php動態(tài)擴(kuò)展。我個人強烈你建議安裝成靜態(tài)內(nèi)核。Suhosin已經(jīng)進(jìn)入 Gentoo Linux、FreeBSD、OpenSuSE Linux、Mandriva Linux、Debian Linux官方包。下面的以下先說靜態(tài)安裝步驟。當(dāng)然你也可以在安裝php后將它編譯成php的動態(tài)擴(kuò)展。 # cd /usr/local/src # wget http://cn.php.net/get/php-5.2.5.tar.gz/from/this/mirror wget http://www.hardened-php.net/suhosin/...9.6.2.patch.gz # tar zxvf php-5.2.5.tar.gz # gunzip suhosin-patch-5.2.5-0.9.6.2.patch.gz # cd php-5.2.5 # patch -p 1 -i ../suhosin-patch-5.2.5-0.9.6.2.patch # ./buildconf --force # CHOST="i686-pc-linux-gnu" CFLAGS="-O3 -msse2 -mmmx -Wall -W -mfpmath=sse -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" CXXFLAGS="-O3 -msse2 -mmmx -Wall -W -mfpmath=sse -funroll-loops -mcpu=pentium4 -march=pentium4 -pipe -felide-constructors -fno-exceptions -fno-rtti -fomit-frame-pointer" ./configure --prefix=/usr/local/php --with-apxs2=/usr/local/apache2/bin/apxs --with-pear=/usr/share/php --with-zlib-dir --with-bz2 --with-libxml-dir=/usr --with-gd=/usr/local/gd2 --enable-gd-native-ttf --enable-gd-jis-conv --with-freetype-dir --with-jpeg-dir --with-png-dir --with-ttf=shared,/usr --enable-mbstring --with-mysql=/usr/local/mysql --with-mysqli=/usr/local/mysql/bin/mysql_config --with-config-file-path=/etc --with-iconv --disable-ipv6 --enable-static --enable-zend-multibyte --enable-inline-optimization --enable-zend-multibyte --enable-sockets --enable-soap --with-openssl --with-gettext --enable-suhosin 配置成功會提示: +--------------------------------------------------------------------+ | License: | | This software is subject to the PHP License, available in this | | distribution in the file LICENSE. By continuing this installation | | process, you are bound by the terms of this license agreement. | | If you do not agree with the terms of this license, you must abort | | the installation process at this point. | +--------------------------------------------------------------------+ Thank you for using PHP. # make # make test # make install # cp php.ini-recommended /etc/php.ini # echo "/usr/local/php/lib" >> /etc/ld.so.conf && ldconfig 在這里也順便說一下將suhosin安裝成為php的動態(tài)擴(kuò)展的方法。畢竟網(wǎng)上根本不見它的中文安裝教程。 雖然我個人不推薦這種方式。 wget http://www.hardened-php.net/suhosin/...sin-0.9.20.tgz tar zxvf suhosin-0.9.20.tgz cd suhosin-0.9.20 ./configure --with-php-config=/usr/local/php/bin/php-config make make install 會提示編譯的模塊存在的目錄,記住它。 Installing shared extensions: /usr/local/php/lib/php/extensions/no-debug-zts-20060613/ 然后在php.ini中增加一行下列語句。 extension="/usr/local/php/lib/php/extensions/no-debug-zts-20060613/suhosin.so"
10、整合apache 與php # vi /usr/local/apache2/conf/httpd.conf 在最后一行加上: AddType application/x-httpd-php .php 查找:(設(shè)置 WEB 默認(rèn)文件) DirectoryIndex index.html 修改為: DirectoryIndex index.php index.html index.htm 找到這一段: # AllowOverride controls what directives may be placed in .htaccess files. # It can be "All", "None", or any combination of the keywords: # Options FileInfo AuthConfig Limit # AllowOverride none 更改為AllowOverride all 允許apache rewrite 保存httpd.conf,退出。 # /usr/local/apache2/bin/apachectl restart //重啟 Apache 這時會出現(xiàn)錯誤: /usr/local/apache2/bin/apachectl start httpd: Syntax error on line 107 of /usr/local/apache2/conf/httpd.conf: Cannot load /usr/local/apache2/modules/libphp5.so into server: /usr/local/apache2/modules/libphp5.so: cannot restore segment prot after reloc: Permission denied 不急,我們慢慢解決。 這個Permission denied問題,在centos 5下面一般是Selinux引起的,作為生產(chǎn)用服務(wù)器,我建議你千萬別草率地關(guān)掉Selinux一了百了。就像家里的防盜網(wǎng),阻礙了你的貓自由進(jìn)出窗戶,你不能為了貓方便,就把防盜網(wǎng)簡單拆除是同樣的道理。我看見網(wǎng)上許多人建議把Selinux簡單關(guān)閉來解決這個問題,這是削足適履的做法,不值得提倡。 我們可以這樣操作: # audit2allow -a //查看究竟問題出在什么地方
allow unconfined_t usr_t:file execmod; allow useradd_t var_log_t:file { read write }; 然后 # cd /etc/selinux/targeted/modules/ # audit2allow -M local -d 屏幕產(chǎn)生如下提示: Generating type enforcment file: local.te Compiling policy checkmodule -M -m -o local.mod local.te semodule_package -o local.pp -m local.mod ******************** IMPORTANT *********************** In order to load this newly created policy package into the kernel, you are required to execute semodule -i local.pp 我們運行 # semodule -i local.pp 這樣就讓Selinux加載了新的規(guī)則。 更詳細(xì)的內(nèi)容請看我在BLOG上的轉(zhuǎn)貼: http://www.cnprint.org/bbs/blogs/1/blog48.html 重啟apache 哈哈,apache不會再報錯了吧? 這樣我保留了selinux的功能,同時apache也能正常運行。 PHP5.1.x開始需要設(shè)置時區(qū),默認(rèn)時區(qū)與中國時區(qū)差8個小時,這種情況需要在php.ini中這么設(shè)置,找到date.timezone,去掉前面的分號,修改為以下值,大陸地區(qū)可用的值是:Asia/Chongqing ,Asia/Shanghai ,Asia/Urumqi (依次為重慶,上海,烏魯木齊) 不然一些php程序的時間老是和中國標(biāo)準(zhǔn)時間相差8個小時。我的我的VBB論壇在windows上就是這樣。這兒有亞洲地區(qū)的對應(yīng)時區(qū)。 http://www.php.net/manual/en/timezones.asia.php 11、安裝 Zend Optimizer # cd /usr/local/src # wget http://downloads.zend.com/optimizer/...21-i386.tar.gz # tar xzvf ZendOptimizer-3.3.0-linux-glibc21-i386.tar.gz # ./ZendOptimizer-3.3.0-linux-glibc21-i386/install.sh 按照它的提示一步步進(jìn)行就行了。 總之一句話。如果你的服務(wù)器環(huán)境不需要ZendOptimizer,那么能不安就不安裝這個。避免和eaccelerator沖突。 12. 查看確認(rèn) L.A.M.P 環(huán)境信息 vi /usr/local/apache2/htdocs/phpinfo.php 新增加下面一行,并保存。
//用于提供perl訪問mysql數(shù)據(jù)庫的接口規(guī)范,請確認(rèn)你已經(jīng)安裝了perl,一般默認(rèn)系統(tǒng)都裝上了。 因為我們要用到mysqlhotcopy功能,需要這兩個小程序的支持。 # wget http://mirrors.xueron.com/CPAN/autho...I-1.601.tar.gz 首先,安裝DBI包: # tar zxvf DBI-1.061.tar.gz # cd DBI-1.061 # perl Makefile.PL # make # make test # make install