DYMripper's Blog
Linux 上安装 Apache Web 服务器
2024-09-13
计算机
0
请注意，本文编写于 100 天前，最后修改于 100 天前，其中某些信息可能已经过时。

目录

Apache 简介
主要特点
常见用例
1. 安装 Apache
在 Ubuntu / Debian 上
在 CentOS/RHEL (8 及以上版本) / Rocky Linux / Fedora 上
对于 Ubuntu / Debian
对于 CentOS / RHEL / Fedora
2. 生成 SSL 证书
使用 OpenSSL 生成自签名证书
3. 配置 Apache 使用 SSL
在 Ubuntu / Debian 上
对于 Ubuntu / Debian
对于 CentOS / RHEL / Fedora
对于 Ubuntu / Debian
对于 CentOS / RHEL / Fedora
总结

Apache 简介

Apache HTTP Server，简称 Apache，是一个开源的 Web 服务器软件，由 Apache 软件基金会维护和开发。它是互联网上最早的 Web 服务器之一，并且在很多年的发展中成为了最受欢迎的 Web 服务器之一。Apache 以其稳定性、灵活性和丰富的功能而著称。

主要特点

  1. 稳定性和可靠性： Apache 在处理各种负载时表现出色，经过多年的优化和改进，它已被广泛应用于生产环境中，证明了其稳定性和可靠性。

  2. 模块化设计： Apache 采用模块化设计，支持通过加载和卸载模块来扩展功能。模块包括核心功能和附加功能，如身份验证、URL 重写、代理和缓存等。用户可以根据需求定制其功能。

  3. 虚拟主机支持： Apache 支持两种类型的虚拟主机：基于名称的虚拟主机和基于 IP 地址的虚拟主机。通过虚拟主机，Apache 可以在同一台服务器上托管多个域名。

  4. 强大的配置能力： Apache 的配置文件结构复杂但灵活，允许详细的控制和自定义。它支持 .htaccess 文件，允许在目录级别进行配置，而无需修改主配置文件。

  5. 支持多种操作系统： Apache 支持多种操作系统，包括 Unix、Linux、Windows 和 macOS，使其在不同平台上都能发挥作用。

  6. 安全性： Apache 提供多种安全功能，如访问控制、身份验证、加密和日志记录。它支持通过 SSL/TLS 加密连接，保障数据传输的安全性。

  7. 丰富的文档和社区支持： Apache 拥有丰富的官方文档和强大的社区支持。无论是在配置、调优还是解决问题时，用户都可以找到大量的资源和帮助。

常见用例

  • Web 服务器： Apache 作为 Web 服务器能够提供静态和动态内容，支持 CGI 脚本、PHP、Perl 和其他语言。
  • 代理服务器： Apache 可以配置为反向代理或正向代理服务器，处理客户端和后端服务器之间的请求。
  • 虚拟主机： 利用虚拟主机功能，Apache 可以在同一服务器上托管多个网站。

在现代 web 环境中，确保网站的安全性至关重要。使用 HTTPS 加密传输的数据可以保护用户隐私和数据安全。如果你在开发或测试环境中需要配置 HTTPS，可以通过以下步骤在 Linux 系统中安装 Apache、生成 SSL 证书并将 HTTP 请求重定向到 HTTPS。我们将使用 OpenSSL 或 mkcert 来生成证书。

1. 安装 Apache

首先，我们需要在 Linux 系统中安装 Apache。不同 Linux 发行版的安装命令有所不同：

在 Ubuntu / Debian 上

bash
sudo apt update
sudo apt install apache2

在 CentOS/RHEL (8 及以上版本) / Rocky Linux / Fedora 上

bash
sudo dnf update
sudo dnf install httpd

安装完成后，可以使用以下命令启动 Apache 服务，并设置其在系统启动时自动启动：

对于 Ubuntu / Debian

bash
sudo systemctl start apache2
sudo systemctl enable apache2

对于 CentOS / RHEL / Fedora

bash
sudo systemctl start httpd
sudo systemctl enable httpd

2. 生成 SSL 证书

在测试环境中，我们可以使用 OpenSSL 或 mkcert 生成自签名证书或本地受信证书。

使用 OpenSSL 生成自签名证书

  1. 生成私钥

    bash
    openssl genrsa -out /path/to/cert.key 2048

  2. 生成证书签名请求 (CSR)

    bash
    openssl req -new -key /path/to/cert.key -out /path/to/cert.csr

  3. 生成自签名证书

    bash
    openssl req -x509 -nodes -days 365 -signkey /path/to/cert.key -in /path/to/cert.csr -out /path/to/cert.crt

使用 mkcert 生成证书

  1. 安装 mkcert

    在 Ubuntu / Debian 上

    bash
    sudo apt install libnss3-tools
wget -O mkcert https://dl.filippo.io/mkcert/latest?for=linux/amd64
chmod +x mkcert
sudo mv mkcert /usr/local/bin/

    在 CentOS / RHEL / Fedora 上

    bash
    sudo dnf install nss-tool
wget -O mkcert https://dl.filippo.io/mkcert/latest?for=linux/amd64
chmod +x mkcert
sudo mv mkcert /usr/local/bin/

  2. 生成根证书和私钥

    bash
    mkcert -install

  3. 生成本地证书

    bash
    mkcert MyIP 127.0.0.1 ::1

    这会生成 *.pem 和 *-key.pem 文件。

3. 配置 Apache 使用 SSL

编辑 Apache 配置文件，启用 SSL 并设置 HTTP 到 HTTPS 的重定向。

在 Ubuntu / Debian 上

  1. 启用 SSL 模块和默认 SSL 站点

    bash
    sudo a2enmod ssl
sudo a2ensite default-ssl

  2. 编辑默认 SSL 配置文件

    修改 /etc/apache2/sites-available/default-ssl.conf 文件：

    apache
    <VirtualHost *:443>
    ServerAdmin webmaster@example.com
    ServerName example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /path/to/*.crt  # 如果使用 OpenSSL
    SSLCertificateKeyFile /path/to/*.key  # 如果使用 OpenSSL
    # SSLCertificateFile /path/to/*.pem;  # 如果使用 mkcert
    # SSLCertificateKeyFile /path/to/*-key.pem;  # 如果使用 mkcert

    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride All
        require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

  3. 设置 HTTP 到 HTTPS 的重定向

    在 /etc/apache2/sites-available/000-default.conf 文件中添加以下内容：

    apache
    <VirtualHost *:80>
     
    #将所有 HTTP 请求重定向到 HTTPS
    Redirect permanent / https://X.X.X.X/ # 替换成你的IP地址
</VirtualHost>

在 CentOS / RHEL / Fedora 上

  1. 编辑 httpd 配置文件

    编辑 /etc/httpd/conf/httpd.conf 文件：

    apache
     #
 # This is the main Apache HTTP server configuration file.  It contains the
 # configuration directives that give the server its instructions.
 # See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
 # In particular, see
 # <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
 # for a discussion of each configuration directive.
 #
 # See the httpd.conf(5) man page for more information on this configuration,
 # and httpd.service(8) on using and configuring the httpd service.
 #
 # Do NOT simply read the instructions in here without understanding
 # what they do.  They're here only as hints or reminders.  If you are unsure
 # consult the online docs. You have been warned.
 #
 # Configuration and logfile names: If the filenames you specify for many
 # of the server's control files begin with "/" (or "drive:/" for Win32), the
 # server will use that explicit path.  If the filenames do *not* begin
 # with "/", the value of ServerRoot is prepended -- so 'log/access_log'
 # with ServerRoot set to '/www' will be interpreted by the
 # server as '/www/log/access_log', where as '/log/access_log' will be
 # interpreted as '/log/access_log'.

 #
 # ServerRoot: The top of the directory tree under which the server's
 # configuration, error, and log files are kept.
 #
 # Do not add a slash at the end of the directory path.  If you point
 # ServerRoot at a non-local disk, be sure to specify a local disk on the
 # Mutex directive, if file-based mutexes are used.  If you wish to share the
 # same ServerRoot for multiple httpd daemons, you will need to change at
 # least PidFile.
 #
 ServerRoot "/etc/httpd"

 #
 # Listen: Allows you to bind Apache to specific IP addresses and/or
 # ports, instead of the default. See also the <VirtualHost>
 # directive.
 #
 # Change this to Listen on a specific IP address, but note that if
 # httpd.service is enabled to run at boot time, the address may not be
 # available when the service starts.  See the httpd.service(8) man
 # page for more information.
 #
 #Listen 12.34.56.78:80
 #Listen 443

 #
 # Dynamic Shared Object (DSO) Support
 #
 # To be able to use the functionality of a module which was built as a DSO you
 # have to place corresponding `LoadModule' lines at this location so the
 # directives contained in it are actually available _before_ they are used.
 # Statically compiled modules (those listed by `httpd -l') do not need
 # to be loaded here.
 #
 # Example:
 # LoadModule foo_module modules/mod_foo.so
 #
 Include conf.modules.d/*.conf

 #
 # If you wish httpd to run as a different user or group, you must run
 # httpd as root initially and it will switch.
 #
 # User/Group: The name (or #number) of the user/group to run httpd as.
 # It is usually good practice to create a dedicated user and group for
 # running httpd, as with most system services.
 #
 User apache
 Group apache

 # 'Main' server configuration
 #
 # The directives in this section set up the values used by the 'main'
 # server, which responds to any requests that aren't handled by a
 # <VirtualHost> definition.  These values also provide defaults for
 # any <VirtualHost> containers you may define later in the file.
 #
 # All of these directives may appear inside <VirtualHost> containers,
 # in which case these default settings will be overridden for the
 # virtual host being defined.
 #

 #
 # ServerAdmin: Your address, where problems with the server should be
 # e-mailed.  This address appears on some server-generated pages, such
 # as error documents.  e.g. admin@your-domain.com
 #
 <VirtualHost *:443>
     SSLEngine on
 #    SSLCertificateFile /etc/ssl/certs/apache.crt  # 如果使用 OpenSSL，替换成证书路径
 #    SSLCertificateKeyFile /etc/ssl/private/apache.key  # 如果使用 OpenSSL，替换成证书路径
     SSLCertificateFile "/path/to/*.pem" # 如果使用mkcert，替换成证书路径
     SSLCertificateKeyFile "/path/to/*-key.pem" # 如果使用mkcert，替换成证书路径
 </VirtualHost>
 ServerAdmin root@localhost
 ServerName X.X.X.X:443 # 替换成你的IP地址
 #
 # ServerName gives the name and port that the server uses to identify itself.
 # This can often be determined automatically, but we recommend you specify
 # it explicitly to prevent problems during startup.
 #
 # If your host doesn't have a registered DNS name, enter its IP address here.
 #

 #
 # Deny access to the entirety of your server's filesystem. You must
 # explicitly permit access to web content directories in other
 # <Directory> blocks below.
 #
 <Directory />
     AllowOverride none
     Require all denied
 </Directory>

 #
 # Note that from this point forward you must specifically allow
 # particular features to be enabled - so if something's not working as
 # you might expect, make sure that you have specifically enabled it
 # below.
 #

 #
 # DocumentRoot: The directory out of which you will serve your
 # documents. By default, all requests are taken from this directory, but
 # symbolic links and aliases may be used to point to other locations.
 #
 DocumentRoot "/var/www/html"

 #
 # Relax access to content within /var/www.
 #
 <Directory "/var/www">
     AllowOverride None
     # Allow open access:
     Require all granted
 </Directory>

 # Further relax access to the default document root:
 <Directory "/var/www/html">
     #
     # Possible values for the Options directive are "None", "All",
     # or any combination of:
     #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
     #
     # Note that "MultiViews" must be named *explicitly* --- "Options All"
     # doesn't give it to you.
     #
     # The Options directive is both complicated and important.  Please see
     # http://httpd.apache.org/docs/2.4/mod/core.html#options
     # for more information.
     #
     Options Indexes FollowSymLinks

     #
     # AllowOverride controls what directives may be placed in .htaccess files.
     # It can be "All", "None", or any combination of the keywords:
     #   Options FileInfo AuthConfig Limit
     #
     AllowOverride None

     #
     # Controls who can get stuff from this server.
     #
     Require all granted
 </Directory>

 #
 # DirectoryIndex: sets the file that Apache will serve if a directory
 # is requested.
 #
 <IfModule dir_module>
     DirectoryIndex index.html
 </IfModule>

 #
 # The following lines prevent .htaccess and .htpasswd files from being
 # viewed by Web clients.
 #
 <Files ".ht*">
     Require all denied
 </Files>

 #
 # ErrorLog: The location of the error log file.
 # If you do not specify an ErrorLog directive within a <VirtualHost>
 # container, error messages relating to that virtual host will be
 # logged here.  If you *do* define an error logfile for a <VirtualHost>
 # container, that host's errors will be logged there and not here.
 #
 ErrorLog "logs/error_log"

 #
 # LogLevel: Control the number of messages logged to the error_log.
 # Possible values include: debug, info, notice, warn, error, crit,
 # alert, emerg.
 #
 LogLevel warn

 <IfModule log_config_module>
     #
     # The following directives define some format nicknames for use with
     # a CustomLog directive (see below).
     #
     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
     LogFormat "%h %l %u %t \"%r\" %>s %b" common

     <IfModule logio_module>
       # You need to enable mod_logio.c to use %I and %O
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
     </IfModule>

     #
     # The location and format of the access logfile (Common Logfile Format).
     # If you do not define any access logfiles within a <VirtualHost>
     # container, they will be logged here.  Contrariwise, if you *do*
     # define per-<VirtualHost> access logfiles, transactions will be
     # logged therein and *not* in this file.
     #
     #CustomLog "logs/access_log" common

     #
     # If you prefer a logfile with access, agent, and referer information
     # (Combined Logfile Format) you can use the following directive.
     #
     CustomLog "logs/access_log" combined
 </IfModule>

 <IfModule alias_module>
     #
     # Redirect: Allows you to tell clients about documents that used to
     # exist in your server's namespace, but do not anymore. The client
     # will make a new request for the document at its new location.
     # Example:
     # Redirect permanent /foo http://www.example.com/bar

     #
     # Alias: Maps web paths into filesystem paths and is used to
     # access content that does not live under the DocumentRoot.
     # Example:
     # Alias /webpath /full/filesystem/path
     #
     # If you include a trailing / on /webpath then the server will
     # require it to be present in the URL.  You will also likely
     # need to provide a <Directory> section to allow access to
     # the filesystem path.

     #
     # ScriptAlias: This controls which directories contain server scripts.
     # ScriptAliases are essentially the same as Aliases, except that
     # documents in the target directory are treated as applications and
     # run by the server when requested rather than as documents sent to the
     # client.  The same rules about trailing "/" apply to ScriptAlias
     # directives as to Alias.
     #
     ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

 </IfModule>

 #
 # "/var/www/cgi-bin" should be changed to whatever your ScriptAliased
 # CGI directory exists, if you have that configured.
 #
 <Directory "/var/www/cgi-bin">
     AllowOverride None
     Options None
     Require all granted
 </Directory>

 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
     # filename extension to MIME-type.
     #
     TypesConfig /etc/mime.types

     #
     # AddType allows you to add to or override the MIME configuration
     # file specified in TypesConfig for specific file types.
     #
     #AddType application/x-gzip .tgz
     #
     # AddEncoding allows you to have certain browsers uncompress
     # information on the fly. Note: Not all browsers support this.
     #
     #AddEncoding x-compress .Z
     #AddEncoding x-gzip .gz .tgz
     #
     # If the AddEncoding directives above are commented-out, then you
     # probably should define those extensions to indicate media types:
     #
     AddType application/x-compress .Z
     AddType application/x-gzip .gz .tgz

     #
     # AddHandler allows you to map certain file extensions to "handlers":
     # actions unrelated to filetype. These can be either built into the server
     # or added with the Action directive (see below)
     #
     # To use CGI scripts outside of ScriptAliased directories:
     # (You will also need to add "ExecCGI" to the "Options" directive.)
     #
     #AddHandler cgi-script .cgi

     # For type maps (negotiated resources):
     #AddHandler type-map var

     #
     # Filters allow you to process content before it is sent to the client.
     #
     # To parse .shtml files for server-side includes (SSI):
     # (You will also need to add "Includes" to the "Options" directive.)
     #
     AddType text/html .shtml
     AddOutputFilter INCLUDES .shtml
 </IfModule>

 #
 # Specify a default charset for all content served; this enables
 # interpretation of all content as UTF-8 by default.  To use the
 # default browser choice (ISO-8859-1), or to allow the META tags
 # in HTML content to override this choice, comment out this
 # directive:
 #
 AddDefaultCharset UTF-8

 <IfModule mime_magic_module>
     #
     # The mod_mime_magic module allows the server to use various hints from the
     # contents of the file itself to determine its type.  The MIMEMagicFile
     # directive tells the module where the hint definitions are located.
     #
     MIMEMagicFile conf/magic
 </IfModule>

 #
 # Customizable error responses come in three flavors:
 # 1) plain text 2) local redirects 3) external redirects
 #
 # Some examples:
 #ErrorDocument 500 "The server made a boo boo."
 #ErrorDocument 404 /missing.html
 #ErrorDocument 404 "/cgi-bin/missing_handler.pl"
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #

 #
 # EnableMMAP and EnableSendfile: On systems that support it,
 # memory-mapping or the sendfile syscall may be used to deliver
 # files.  This usually improves server performance, but must
 # be turned off when serving from networked-mounted
 # filesystems or if support for these functions is otherwise
 # broken on your system.
 # Defaults if commented: EnableMMAP On, EnableSendfile Off
 #
 #EnableMMAP off
 EnableSendfile on

 # Supplemental configuration
 #
 # Load config files in the "/etc/httpd/conf.d" directory, if any.
 IncludeOptional conf.d/*.conf

  2. 设置 HTTP 到 HTTPS 的重定向

    在 /etc/httpd/conf.d/vhost.conf 文件中添加以下内容：

    apache
    <VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://X.X.X.X/ # 替换成你的IP地址
</VirtualHost>

4. 测试 Apache 配置并重新加载

在修改了配置文件后，检查 Apache 配置是否正确：

对于 Ubuntu / Debian

bash
sudo apache2ctl configtest

对于 CentOS / RHEL / Fedora

bash
sudo httpd -t

如果没有错误，重新加载 Apache 配置：

对于 Ubuntu / Debian

bash
sudo systemctl reload apache2

对于 CentOS / RHEL / Fedora

bash
sudo systemctl reload httpd

总结

你现在已经成功安装了 Apache、配置了 SSL 并设置了 HTTP 到 HTTPS 的重定向。通过这些步骤，你可以确保你的 Web 服务器使用加密的 HTTPS 连接，从而增强了安全性。如果在实际生产环境中使用，建议使用由认证机构签发的证书。

如果对你有用的话，可以打赏哦
打赏
ali pay
wechat pay

本文作者:DYMripper

本文链接:

版权声明:本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！