タグ: Apache

Apache2.4 header情報を追加する

2018年4月20日2019年4月20日 | by 優 | にコメントを残す

Apacheにはmod_headerモジュールによって、Header情報は削除したり、追加したりすることが出来ます。 @see https://httpd.apache.org/docs/2.4/ja/mod/mod_headers.html サーバのrootパスワードをHeaderに追加して脆弱なサーバを作ってみる [crayon-5d5d4ce8abb …

の続きを読む

Linux

Apache 2.2系(CentOS6)とApache2.4系(CentOS7)のSSL証明書設定の違い

2018年2月20日2018年2月20日 | by 優 | にコメントを残す

大きな違い Apache2.4系ではSSLCertificateChainFileがない。 ※クロスルート証明書を設定すると、不特定多数のユーザからのアクセスを望む場合は、ユーザのクライアント環境が古い場合にアクセスできない場合があります。証明書の設定の違い Apache2.2系(2.2~2.4.7) SSLCertificateKeyFile – 秘密鍵 …

の続きを読む

Linux

Apache ProxyPass フレームワーク公開用内部リダイレクト

2018年2月13日2019年2月13日 | by 優 | にコメントを残す

やりたいこと http://www.sample.net/userlist/detail/アクセスで、サーバ内部のフレームワークへhttp://app.laravel.local/userlist/detailとしてアクセスをさせるなぜやりたいのか？一部の処理だけフレームワークで処理を行いたい http://www.sample.net/のURL, / …

の続きを読む

Linux

Apache アクセスログ集計

2018年1月24日2018年1月24日 | by 優 | にコメントを残す

時間単位

# grep "21/Jan/" example.com_access_log-20180122 | awk '{print $4}' | cut -b 1-15 | sort | uniq -c

   7564 [21/Jan/2018:03
  11325 [21/Jan/2018:04
  10546 [21/Jan/2018:05
  12907 [21/Jan/2018:06
  26018 [21/Jan/2018:07
  32649 [21/Jan/2018:08

(略)

# grep "21/Jan/" example.com_access_log-20180122 | awk '{print $4}' | cut -b 1-15 | sort | uniq -c

7564 [21/Jan/2018:03

11325 [21/Jan/2018:04

10546 [21/Jan/2018:05

12907 [21/Jan/2018:06

26018 [21/Jan/2018:07

32649 [21/Jan/2018:08

(略)

10分単位

# grep "21/Jan/" example.com_access_log-20180122 | awk '{print $4}' | cut -b 1-17 | sort | uniq -c

   2519 [21/Jan/2018:03:3
   3125 [21/Jan/2018:03:4
   1927 [21/Jan/2018:03:5
   2472 [21/Jan/2018:04:0
   1552 [21/Jan/2018:04:1
   1665 [21/Jan/2018:04:2
   1681 [21/Jan/2018:04:3
   2392 [21/Jan/2018:04:4
   1554 [21/Jan/2018:04:5
   1145 [21/Jan/2018:05:0
   1658 [21/Jan/2018:05:1
   1578 [21/Jan/2018:05:2

(略)

# grep "21/Jan/" example.com_access_log-20180122 | awk '{print $4}' | cut -b 1-17 | sort | uniq -c

2519 [21/Jan/2018:03:3

3125 [21/Jan/2018:03:4

1927 [21/Jan/2018:03:5

2472 [21/Jan/2018:04:0

1552 [21/Jan/2018:04:1

1665 [21/Jan/2018:04:2

1681 [21/Jan/2018:04:3

2392 [21/Jan/2018:04:4

1554 [21/Jan/2018:04:5

1145 [21/Jan/2018:05:0

1658 [21/Jan/2018:05:1

1578 [21/Jan/2018:05:2

(略)

の続きを読む

Linux

ApacheからFluentdにログを送信

2018年1月11日 | by 優 | にコメントを残す

WEBサーバ TCP, UDPの24224番ポートを解放しておくこと。

# vi /etc/sysconfig/selinux


SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

# vi /etc/sysconfig/selinux

SELINUX=disabled

# SELINUXTYPE= can take one of three two values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

# yum install httpd httpd-devel php php-mysql mysql mariadb-server mariadb

# systemctl start httpd
# systemctl enable httpd

# yum install httpd httpd-devel php php-mysql mysql mariadb-server mariadb

# systemctl start httpd

# systemctl enable httpd

# yum install unzip wget

# yum groupinstall "Development Tools" "Base"

# yum install gcc gcc-c++ pcre-devel zlib-devel make wget openssl-devel libxml2 libxml2-devel libxslt-devel libxslt libxslt-devel gd-devel perl-ExtUtils-Embed GeoIP-devel gperftools-devel flex

# yum install gcc tcl readline-devel

# yum install unzip wget

# yum groupinstall "Development Tools" "Base"

# yum install gcc gcc-c++ pcre-devel zlib-devel make wget openssl-devel libxml2 libxml2-devel libxslt-devel libxslt libxslt-devel gd-devel perl-ExtUtils-Embed GeoIP-devel gperftools-devel flex

# yum install gcc tcl readline-devel

[crayon-5d5d4ce8accdb23 …

の続きを読む

Linux

CentOS7+Apache+PHP+Redisセッションストア

2018年1月11日2018年1月11日 | by 優 | にコメントを残す

CentOS7 ApacheでRedisをセッションストアとして利用する寄稿しました。 WEB

[centos@ip-172-31-17-156 ~]$ sudo su -

[root@ip-172-31-17-156 ~]#

[centos@ip-172-31-17-156 ~]$ sudo su -

[root@ip-172-31-17-156 ~]#

# vi /etc/sysconfig/selinux


SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

# vi /etc/sysconfig/selinux

SELINUX=disabled

# SELINUXTYPE= can take one of three two values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

# reboot now

1	# reboot now

[crayon-5d …

の続きを読む

Linux

Apache, Nginxログの肥大化防止 logrotate

2018年1月4日2018年9月27日 | by 優 | にコメントを残す

CentOS7の場合

# vi /etc/logrotate.d/httpd


/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}


↓変更



#/var/log/httpd/*log {
#    missingok
#    notifempty
#    sharedscripts
#    delaycompress
#    postrotate
#        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
#    endscript
#}




/var/log/httpd/*log {
    daily
    missingok
    notifempty
    sharedscripts
    rotate 12
    weekly
    delaycompress
    postrotate
        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
    endscript
}

# vi /etc/logrotate.d/httpd

/var/log/httpd/*log {

missingok

notifempty

sharedscripts

delaycompress

postrotate

/sbin/service httpd reload > /dev/null 2>/dev/null || true

endscript

}

↓変更

#/var/log/httpd/*log {

# missingok

# notifempty

# sharedscripts

# delaycompress

# postrotate

# /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true

# endscript

/var/log/httpd/*log {

daily

missingok

notifempty

sharedscripts

rotate 12

weekly

delaycompress

postrotate

/bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true

endscript

}

CentOS6の場合

# vi /etc/logrotate.d/httpd


/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}


↓変更


/var/log/httpd/*log {
    daily
    missingok
    notifempty
    sharedscripts
    rotate 12
    weekly
    compress
    postrotate
        /bin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

# vi /etc/logrotate.d/httpd

/var/log/httpd/*log {

missingok

notifempty

sharedscripts

delaycompress

postrotate

/sbin/service httpd reload > /dev/null 2>/dev/null || true

endscript

}

↓変更

/var/log/httpd/*log {

daily

missingok

notifempty

sharedscripts

rotate 12

weekly

compress

postrotate

/bin/service httpd reload > /dev/null 2>/dev/null || true

endscript

}

ドライランでテスト

# logrotate -dv /etc/logrotate.d/httpd


running postrotate script
running script with arg /var/log/httpd/*log : "
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
"
removing old log /var/log/httpd/access_log.8
error: error opening /var/log/httpd/access_log.8: No such file or directory

# logrotate -dv /etc/logrotate.d/httpd

running postrotate script

running script with arg /var/log/httpd/*log : "

/sbin/service httpd reload > /dev/null 2>/dev/null || true

removing old log /var/log/httpd/access_log.8

error: error opening /var/log/httpd/access_log.8: No such file or directory

[crayon-5d5d4ce8ae928887805 …

の続きを読む

AWS

AWS ELB配下のNginx, ApacheのTimeout推奨設定

2017年12月6日2018年12月6日 | by 優 | にコメントを残す

ELB のバックエンドサーバーとして Apache または NGINX を使用するための最適な設定を教えてください https://aws.amazon.com/jp/premiumsupport/knowledge-center/apache-backend-elb/ ELBとALBどちらを使うべき？ ALB ALBファーストで考えて、ELBでは対応しているがALBで …

の続きを読む

Linux

Apacheのアップデート方法

2017年11月27日2017年11月27日 | by 優 | にコメントを残す

基本的に他のパッケージでもやることは同じ。検証環境で動作するか確認してから行うこと。既存設定ファイルコピー

# rsync -arv /etc/httpd/conf/ /etc/httpd/conf_20171127/
# rsync -arv /etc/httpd/conf.d/ /etc/httpd/conf.d_20171127/

1 2	# rsync -arv /etc/httpd/conf/ /etc/httpd/conf_20171127/ # rsync -arv /etc/httpd/conf.d/ /etc/httpd/conf.d_20171127/

更新

# yum update httpd

1	# yum update httpd

※検証環境で行うこと。 httpd.conf .rpmnewなどが作成されていたら、 [crayon-5d5d …

の続きを読む

PHP, Linux

.htaccess HTML拡張子でPHP実行

2017年11月22日 | by 優 | にコメントを残す

.htaccess

AddType application/x-httpd-php .php .html
AddType text/x-component .htc

1 2	AddType application/x-httpd-php .php .html AddType text/x-component .htc

影響を与えたいWEBルートディレクトリに置くとよし。

の続きを読む

Windows Server

WebLog Expert IIS,Apacheのログ解析

2017年11月15日2018年11月15日 | by 優 | にコメントを残す

Windosアプリです。 IISのログ解析のご要望があり、 Windows7のクライアントにログをローカルにコピーしてから使用 https://www.weblogexpert.com/download.htm 試してないけれど、Apacheのログも解析出来るらしいぞ(۶•̀ᴗ•́)۶

の続きを読む

Linux

SSL証明書適用 Apache2.2系 CentOS6

2017年10月19日2017年10月19日 | by 優 | にコメントを残す

秘密鍵の作成

# cd /etc/httpd/conf/ssl

# openssl md5 * > rand.dat

# openssl genrsa -rand rand.dat -des3 2048 > 20170328-sslexample.com_r1.key


441 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
................................................................................................+++
...................................................+++
e is 65537 (0x10001)
Enter pass phrase:sslexample0721←入力
Verifying - Enter pass phrase:sslexample0511←入力

# cd /etc/httpd/conf/ssl

# openssl md5 * > rand.dat

# openssl genrsa -rand rand.dat -des3 2048 > 20170328-sslexample.com_r1.key

441 semi-random bytes loaded

Generating RSA private key, 2048 bit long modulus

................................................................................................+++

...................................................+++

e is 65537 (0x10001)

Enter pass phrase:sslexample0721←入力

Verifying - Enter pass phrase:sslexample0511←入力

パスフレーズを秘密鍵から除去

# openssl rsa -in 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.key

Enter pass phrase for 20170217-sslexamplehealthcare.com-server.key:sslexample0511
writing RSA key

# openssl rsa -in 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.key

Enter pass phrase for 20170217-sslexamplehealthcare.com-server.key:sslexample0511

writing RSA key

CSR発行

# openssl req -utf8 -new -key 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.csr

1325 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
....................+++
........+++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase:
You have mail in /var/spool/mail/root
[root@sslexample ssl]# openssl rsa -in 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.key
Enter pass phrase for 20170328-sslexample.com_r1.key:
writing RSA key
[root@sslexample ssl]# openssl req -utf8 -new -key 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Nakano-ku
Organization Name (eg, company) [Default Company Ltd]:sslexample Co., Ltd.
Organizational Unit Name (eg, section) []:Management Department
Common Name (eg, your name or your server's hostname) []:www.sslexample.com
Email Address []:postmaster@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# openssl req -utf8 -new -key 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.csr

1325 semi-random bytes loaded

Generating RSA private key, 2048 bit long modulus

....................+++

........+++

e is 65537 (0x10001)

Enter pass phrase:

Verifying - Enter pass phrase:

You have mail in /var/spool/mail/root

[root@sslexample ssl]# openssl rsa -in 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.key

Enter pass phrase for 20170328-sslexample.com_r1.key:

writing RSA key

[root@sslexample ssl]# openssl req -utf8 -new -key 20170328-sslexample.com_r1.key -out 20170328-sslexample.com_r1.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:JP

State or Province Name (full name) []:Tokyo

Locality Name (eg, city) [Default City]:Nakano-ku

Organization Name (eg, company) [Default Company Ltd]:sslexample Co., Ltd.

Organizational Unit Name (eg, section) []:Management Department

Common Name (eg, your name or your server's hostname) []:www.sslexample.com

Email Address []:postmaster@example.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

ここポイント wwwありなしの証明書にしたい場合はwww.ドメインの形でCommon Na …

の続きを読む