LNMP 运行环境搭建 on 七三的小站

Nginx 从源码安装与配置

Mon, 15 Jun 2026 00:00:00 +0800

一、环境准备

1.1. 下载软件包

`OpenSSL`

# https://github.com/openssl/openssl/releases/
wget https://github.com/openssl/openssl/releases/download/openssl-4.0.1/openssl-4.0.1.tar.gz && \
sudo tar -zxf openssl-4.0.1.tar.gz -C /usr/local/src

`Pcre2`

# https://github.com/PhilipHazel/pcre2/releases
wget -c https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz && \
sudo tar -zxf pcre2-10.47.tar.gz -C /usr/local/src

`FancyIndex`

# https://github.com/aperezdc/ngx-fancyindex/releases
wget -c https://github.com/aperezdc/ngx-fancyindex/releases/download/v0.6.0/ngx-fancyindex-0.6.0.tar.xz && \
xz -d ngx-fancyindex-0.6.0.tar.xz && \
sudo tar -xf ngx-fancyindex-0.6.0.tar -C /usr/local/src

`NJS`

# https://github.com/nginx/njs/tags
wget https://github.com/nginx/njs/archive/refs/tags/0.9.9.tar.gz -O njs-0.9.9.tar.gz && \
sudo tar -zxf njs-0.9.9.tar.gz -C /usr/local/src

`GeoIP2`

# https://github.com/leev/ngx_http_geoip2_module/releases
wget -c https://github.com/leev/ngx_http_geoip2_module/archive/refs/tags/3.4.tar.gz -O ngx_http_geoip2_module-3.4.tar.gz && \
sudo tar -zxf ngx_http_geoip2_module-3.4.tar.gz -C /usr/local/src

`Nginx`

# https://nginx.org/en/download.html
wget -c http://nginx.org/download/nginx-1.30.2.tar.gz && \
sudo tar -zxf nginx-1.30.2.tar.gz -C /usr/local/src

1.2. 新增用户和组 (可选)

本文使用自带的 www-data 用户和组

# On Ubuntu/Debian:
sudo adduser \
 --system \
 --shell /bin/bash \
 --gecos 'Nginx web server' \
 --group \
 --disabled-password \
 --home /var/www \
 nginx
  
# On Fedora/RHEL/CentOS:
sudo groupadd --system nginx
sudo adduser \
 --system \
 --shell /bin/bash \
 --comment 'Nginx web server' \
 --gid nginx \
 --home-dir /home/nginx \
 --create-home \
 nginx

二、编译安装

2.1. 安装编译工具

# On Ubuntu/Debian:
sudo apt -y install build-essential libzip-dev libxml2-dev libxslt-dev

# On Fedora/RHEL/CentOS:
# sudo yum -y groupinstall 'Development Tools'
sudo yum install -y gcc gcc-c++ zlib-devel

2.2. 安装扩展工具

安装 MaxmindDB

# https://github.com/maxmind/libmaxminddb/releases
# sudo yum install libmaxminddb libmaxminddb-devel -y
sudo apt install libmaxminddb-dev mmdb-bin -y

# https://github.com/P3TERX/GeoLite.mmdb
sudo mkdir -p /usr/share/geoip/

# 国内
sudo wget -c --no-check-certificate -P /usr/share/geoip \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/geoip/{GeoLite2-ASN.mmdb,GeoLite2-City.mmdb,GeoLite2-Country.mmdb}

# 国外
sudo wget -c --no-check-certificate -P /usr/share/geoip \
     https://git.io/{GeoLite2-ASN.mmdb,GeoLite2-City.mmdb,GeoLite2-Country.mmdb}

mmdblookup --file /usr/share/geoip/GeoLite2-Country.mmdb --ip 43.138.171.130 country names en
mmdblookup --file /usr/share/geoip/GeoLite2-City.mmdb --ip 43.138.171.130 city names en

安装 Perl (可选)

# https://www.cpan.org/src/
wget -c https://code.wangyan.cloud//wangyan/packages/releases/download/perl/perl-5.42.1.tar.gz
wget -c https://www.cpan.org/src/5.0/perl-5.42.1.tar.gz
tar -xzf perl-5.42.1.tar.gz -C /usr/local/src && \
cd /usr/local/src/perl-5.41.5 && \
./Configure -des -Dprefix=/usr/local/perl && \
make && make install && \
perl -v

2.3. 编译安装

注意修改 openssl 、pcre 、ngx-fancyindex 、ngx_http_geoip2_module 版本号。

部分组件不需要，可以删减。

cd /usr/local/src/nginx-1.30.2

sudo ./configure \
 --prefix=/usr/local/nginx \
 --user=www-data \
 --group=www-data  \
 --with-stream \
 --with-http_ssl_module \
 --with-http_v2_module \
 --with-http_realip_module \
 --with-http_sub_module \
 --with-http_gzip_static_module \
 --with-http_stub_status_module \
 --with-openssl=/usr/local/src/openssl-4.0.1 \
 --with-pcre=/usr/local/src/pcre2-10.47 \
 --http-client-body-temp-path=/usr/local/nginx/temp/client_body \
 --http-proxy-temp-path=/usr/local/nginx/temp/proxy \
 --http-fastcgi-temp-path=/usr/local/nginx/temp/fastcgi \
 --http-uwsgi-temp-path=/usr/local/nginx/temp/uwsgi \
 --http-scgi-temp-path=/usr/local/nginx/temp/scgi \
 --add-dynamic-module=/usr/local/src/ngx-fancyindex-0.6.0 \
 --add-dynamic-module=/usr/local/src/ngx_http_geoip2_module-3.4 \
 --add-dynamic-module=/usr/local/src/njs-0.9.9/nginx

sudo make && sudo make install

sudo ln -s /usr/local/nginx/conf/ /etc/nginx && \
sudo ln -s /usr/local/nginx/sbin/nginx  /usr/bin/ && \
sudo mv -f /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bak

2.5. 设置环境变量

sudo vim /etc/profile

PATH=$PATH:/usr/local/mysql/bin:/usr/local/php/bin:/usr/local/nginx/sbin
export PATH

三、配置

3.1. 配置文件目录

缓存目录

sudo mkdir -p /usr/local/nginx/temp/{client_body,proxy,fastcgi,uwsgi,scgi} && \
sudo chown -R www-data:www-data /usr/local/nginx/temp/

日志目录

sudo mkdir -p /var/log/nginx && \
sudo chmod 711 /var/log/nginx && \
sudo chown -R www-data:www-data /var/log/nginx

配置文件目录

复制配置文件

cd ~/nginx && \
sudo cp -r resources/conf/* /usr/local/nginx/conf/ && \
sudo cp -r resources/geoip /usr/share/ && \
sudo chown -R www-data:www-data /usr/share/geoip

下载配置文件（可选）

sudo mkdir -p /usr/local/nginx/conf/{conf.d,custom-config,error-pages,modules-available,modules-enabled,rewrite-rules,sites-available,sites-enabled,ssl-certs}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/nginx.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/conf.d \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/conf.d/default_server.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/custom-config \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/custom-config/{fancyindex.conf,general.conf,geoip.conf,ips.conf,php_fastcgi.conf,reverse-proxy.conf,security.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/error-pages \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/error-pages/{400.html,403.html,404.html,500.html,502.html}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/modules-available \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/modules-available/{ngx_http_fancyindex.conf,ngx_http_geoip2_module.conf,ngx_http_js.conf,ngx_stream_geoip2.conf,ngx_stream_js.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/rewrite-rules \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/rewrite-rules/wordpress.conf

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/sites-available \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/sites-available/{example.com.conf,proxy.example.com.conf}

sudo wget -c --no-check-certificate -P /usr/local/nginx/conf/ssl-certs \
     https://code.wangyan.cloud//wangyan/nginx/raw/branch/main/resources/conf/ssl-certs/dhparam.pem

设置目录权限

sudo chown 0:0 /usr/local/nginx/conf -R && \
find /usr/local/nginx/conf -type f -exec sudo chmod 644 {} \; && \
find /usr/local/nginx/conf -type d -exec sudo chmod 755 {} \;

证书特殊权限

sudo chmod 777 /usr/local/nginx/conf/ssl-certs && \
sudo chmod o+t /usr/local/nginx/conf/ssl-certs

3.2. 开机自启动

sudo vim /usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target
  
[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
  
[Install]
WantedBy=multi-user.target

sudo chmod +x /usr/lib/systemd/system/nginx.service && \
sudo systemctl enable --now nginx.service

3.3. 防火墙设置

Fedora/RHEL/CentOS:

systemctl enable --now firewalld.service 
sudo firewall-cmd --permanent --zone=public --add-service=http && \
sudo firewall-cmd --permanent --zone=public --add-service=https && \
sudo firewall-cmd --reload

Ubuntu/Debian:

sudo apt install ufw

sudo vim /etc/ufw/applications.d/ufw-mysqlserver

[MySQL]
title=MySQL database server
description=MySQL database server
ports=3306/tcp

sudo ufw allow 'WWW Full'
sudo ufw allow 'OpenSSH'
sudo ufw allow 'MySQL'
sudo ufw enable

sudo ufw status verbose
sudo ufw delete allow 80/tcp

sudo ufw status numbered
sudo ufw delete 1

Nginx 配置 SSL 可信证书

Thu, 15 Jan 2026 00:00:00 +0800

1. 使用 acme.sh 签发 ZeroSSL 证书

1.1. 安装依赖

# On Ubuntu/Debian:
sudo apt install cron socat -y

# On Fedora/RHEL/CentOS:
sudo yum install nc socat -y

1.2. 安装 acme.sh

1.2.1. 一键安装

# https://github.com/acmesh-official/acme.sh/wiki/说明
curl https://get.acme.sh | sh -s email=service@wangyan.org

1.2.2. 自定义安装（可选）

git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
sudo ./acme.sh --install  \
--home /usr/local/acmesh \
--config-home /usr/local/acmesh/data \
--cert-home  /usr/local/acmesh/data \
--accountemail  "service@wangyan.org"

1.3. 签发证书（DNS 模式）

1.3.1. 注册 ZeroSSL

获取 eab-kid 和 eab-hmac-key替换 xxxx

acme.sh --register-account --server zerossl \
        --eab-kid xxxx \
        --eab-hmac-key xxxx

1.3.2. 导入域名注册商 KEY

dnsapi

##acmesh-official / ##acme.sh

# Cloudflare
export CF_Key="" && \
export CF_Email=""

# DNSPod
export DP_Id="" && \
export DP_Key=""

# West
export WEST_Username="" && \
export WEST_Key=""

1.3.3. 签发 ECC 证书

注意修改 dns_west_cn 为 dns_cf 或者其他 dns_dp

acme.sh --register-account --server zerossl \
        --eab-kid xxx \
        --eab-hmac-key xxxxx

acme.sh --server zerossl --issue --force \
        -d 'wangyan.cloud/' -d '*.wangyan.cloud/' \
        --dns dns_cf --keylength ec-256

ln -s wangyan.cloud/_ecc /usr/local/nginx/conf/ssl-certs/

1.3.4. 撤销 && 删除

acme.sh --revoke -d 'wangyan.cloud/' -d '*.wangyan.cloud/' --ecc
acme.sh --list

2. 二、Nginx SSL 配置

2.1. 生成 dhparam

sudo chmod 777 /usr/local/nginx/conf/ssl-certs && \
sudo chmod o+t /usr/local/nginx/conf/ssl-certs

sudo openssl dhparam -out /etc/nginx/ssl-certs/dhparam.pem 2048
sudo curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ssl-certs/dhparam.pem

PHP 8 从源码安装与配置

Wed, 16 Jul 2025 00:00:00 +0800

1. 一、安装依赖

1.1. 安装编译工具及依赖

CentOS Stream 8/9

#sudo yum groupinstall 'Development Tools'
sudo yum install -y \
    gcc gcc-c++ autoconf \
    systemd-devel openssl-devel libcurl-devel \
    oniguruma-devel zlib-devel \
    libwebp-devel libjpeg-turbo-devel freetype-devel libpng-devel \
    libxml2-devel libxslt-devel \
    libsq3-devel libzip-devel file-devel

Debian/Ubuntu

sudo apt install -y pkg-config gcc autoconf \
	libsystemd-dev libssl-dev libcurl4-openssl-dev \
	libonig-dev libzip-dev libsqlite3-dev \
	libwebp-dev libjpeg-dev libfreetype6-dev libpng-dev \
	libxml2-dev  libxslt-dev libgmp-dev libsodium-dev

1.2. 安装 libiconv

wget https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.18.tar.gz
tar -zxf libiconv-1.18.tar.gz &&\
cd libiconv-1.18 &&\
./configure --prefix=/usr/local/ &&\
make &&\
sudo make install &&\
sudo ln -s /usr/local/lib/libiconv.so.2.7.0 /usr/lib64/ &&\
sudo ldconfig

1.3. 安装 libzip（已过时，选做）

1.3.1. 通过 RPM 安装

https://pkgs.org/download/libzip

yum remove -y libzip
rpm -Uvh http://rpms.remirepo.net/enterprise/7/remi/x86_64//libzip-last-1.1.3-1.el7.remi.x86_64.rpm
rpm -Uvh http://rpms.remirepo.net/enterprise/7/remi/x86_64//libzip-last-devel-1.1.3-1.el7.remi.x86_64.rpm

1.3.2. 手动编译安装

安装 cmake

wget https://cmake.org/files/v3.26/cmake-3.26.1-linux-x86_64.sh && \
chmod +x cmake-3.26.1-linux-x86_64.sh && \
./cmake-3.26.1-linux-x86_64.sh

mv cmake-3.26.1-linux-x86_64 /usr/local/cmake
ln -s /usr/local/cmake/bin/cmake /usr/local/bin/cmake

编译安装 libzip

wget https://libzip.org/download/libzip-1.10.0.tar.gz &&\
tar -zxf libzip-1.10.0.tar.gz &&\
cd libzip-1.10.0 &&\
mkdir build &&\
cd build &&\
cmake .. &&\
make &&\
make install

更新 lib

echo '/usr/local/lib64
/usr/local/lib
/usr/lib
/usr/lib64'>>/etc/ld.so.conf.d/local.conf

ldconfig

1.4. 安装 imap（已过时，选做）

centOS7 已经没有了 libc-client，需要编译安装

注：epel 源可以找到 libc-client-devel uw-imap-devel uw-imap-static uw-imap-utils，但直接安装还是会出现一些问题。

编译安装

wget ftp://ftp.cac.washington.edu/imap/imap-2007f.tar.gz
tar -zxf imap-2007f.tar.gz
cd imap-2007f
make lr5 PASSWDTYPE=std SSLTYPE=unix.nopwd EXTRACFLAGS=-fPIC IP=4
mkdir -p /usr/local/imap-2007f/{include,lib,c-client}
cp c-client/*.h /usr/local/imap-2007f/include/ && \
cp c-client/*.c /usr/local/imap-2007f/lib/  && \
cp c-client/*.c /usr/local/imap-2007f/c-client/  && \
cp c-client/c-client.a /usr/local/imap-2007f/lib/libc-client.a  && \
cp c-client/c-client.a /usr/local/imap-2007f/c-client/libc-client.a

备注：在 64 位下编译时 make 参数需要带 EXTRACFLAGS=-fPIC ，在 32 位下则不需要。

1.5. 其他（已过时，选做）

yum install -y libicu-devel libmcrypt-devel pam-devel bison bison-devel re2c

libmcrypt-devel 需要使用 epel 源

dnf config-manager --set-enabled powertools
dnf install epel-release epel-next-release

2. 二、安装 PHP

2.1. 下载软件包

mkdir ~/packages && cd ~/packages && \
wget http://us.php.net/distributions/php-8.4.10.tar.gz  && \
sudo tar zxf php-8.4.10.tar.gz -C /usr/local/src

2.2. 新增用户和组 (选做)

# On Ubuntu/Debian:
sudo addgroup --system --gid 37 www-data  && \
sudo adduser \
    --system \
    --home /usr/local/php \
    --shell /bin/false \
    --uid 37 \
    --gecos 'PHP Server' \
    --gid 37 \
    --disabled-password \
    www-data

# On Fedora/RHEL/CentOS:
sudo groupadd --system www-data  && \
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'PHP server' \
   --gid www-data \
   --home-dir /usr/local/php \
   --create-home \
   www-data

2.3. 编译安装

cd /usr/local/src/php-8* && \
sudo ./configure \
  --prefix=/usr/local/php \
  --with-config-file-path=/usr/local/php/etc  \
  --with-config-file-scan-dir=/usr/local/php/conf.d  \
  --enable-fpm  \
  --with-fpm-user=www-data  \
  --with-fpm-group=www-data  \
  --with-fpm-systemd  \
  --with-openssl \
  --with-zlib \
  --enable-bcmath \
  --enable-calendar \
  --with-curl  \
  --enable-exif \
  --enable-ftp \
  --enable-gd  \
  --with-webp  \
  --with-jpeg  \
  --with-freetype  \
  --with-gettext  \
  --with-gmp \
  --with-iconv=/usr/local \
  --with-mhash \
  --enable-mbstring \
  --with-mysqli=mysqlnd \
  --enable-pcntl \
  --with-pdo-mysql=mysqlnd \
  --enable-sockets \
  --with-xsl \
  --with-zip \
  --enable-mysqlnd \
  --with-sodium

#make ZEND_EXTRA_LIBS='-liconv' -j4
sudo make -j4
sudo make install

3. 三、php 配置

3.1. php-fpm.conf 设置

sudo mkdir /var/log/php-fpm/ & \
sudo cp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf

sudo vim /usr/local/php/etc/php-fpm.conf

pid = /var/run/php-fpm.pid
error_log = /var/log/php-fpm/error.log

3.2. www.conf 设置

sudo vim /usr/local/php/etc/php-fpm.d/www.conf

[www]
user = www-data
group = www-data

listen = /dev/shm/php-fpm.sock
listen.allowed_clients = 127.0.0.1
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
listen.allowed_clients = 127.0.0.1

pm = dynamic
pm.max_children = 30
pm.start_servers = 15
pm.min_spare_servers = 10
pm.max_spare_servers = 20
pm.max_requests = 1024

pm.status_path = /status
ping.path = /ping
access.log = /var/log/php-fpm/$pool.access.log
slowlog = /var/log/php-fpm/$pool.log.slow
request_slowlog_timeout = 10s
request_terminate_timeout = 60

3.3. php.ini 设置

sudo cp php.ini-production /usr/local/php/etc/php.ini

sudo sed -i "s|;*date.timezone =.*|date.timezone = PRC|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*memory_limit =.*|memory_limit = 1024M|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*upload_max_filesize =.*|upload_max_filesize = 2G|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*max_file_uploads =.*|max_file_uploads = 50|i" /usr/local/php/etc/php.ini && \
sudo sed -i "s|;*post_max_size =.*|post_max_size = 2G|i" /usr/local/php/etc/php.ini

3.4. 开机自启动

sudo cp sapi/fpm/php-fpm.service  /usr/lib/systemd/system/ && \
sudo systemctl enable --now php-fpm

3.5. 配置环境变量

sudo vim /etc/profile

PATH=$PATH:/usr/local/mysql/bin:/usr/local/php/bin:/usr/local/nginx/sbin
export PATH

source /etc/profile

4. 四、安装 PHP 扩展

4.1. PHPRedis

git clone https://github.com/phpredis/phpredis.git && \
cd phpredis && \
/usr/local/php/bin/phpize && \
./configure --with-php-config=/usr/local/php/bin/php-config && \
make && sudo make install

4.2. ImageMagick

https://pecl.php.net/package/imagick

安装依赖

sudo yum install autoconf gcc gcc-c++ ImageMagick-devel

下载安装

wget https://pecl.php.net/get/imagick-3.7.0.tgz && \
tar xf imagick-3.7.0.tgz && \
cd imagick-3.7.0 && \
/usr/local/php/bin/phpize && \
./configure --with-php-config=/usr/local/php/bin/php-config && \
make && sudo make install

4.3. php.ini添加扩展

sudo vim /usr/local/php/etc/php.ini

extension=redis
zend_extension=opcache

sudo systemctl restart php-fpm

5. 五、安装 Composer

curl -O https://getcomposer.org/composer.phar && \
sudo mv composer.phar /usr/local/bin/composer && \
sudo chmod +x /usr/local/bin/composer

Nginx 从软件源安装与配置

Wed, 14 May 2025 00:00:00 +0800

一、安装

1.1. 安装依赖

# ubuntu
sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring

# debian
sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring

# Fedora/RHEL/CentOS
sudo yum install yum-utils

1.2. 添加软件源

# On Fedora/RHEL/CentOS:
sudo sh -c "cat > /etc/yum.repos.d/nginx.repo" <<EOF
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

# Ubuntu/Debian:
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

# Debian
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

# Ubuntu
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

1.3. 安装运行

# On Fedora/RHEL/CentOS:
sudo yum-config-manager --enable nginx-mainline
sudo yum install nginx

# On Ubuntu/Debian:
sudo apt update
sudo apt install nginx

1.4. 防火墙设置

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

二、配置

默认配置文件路径

默认网站根目录 /usr/share/nginx/html
默认网站根配置文件 /etc/nginx/conf.d/default.conf
其他网站配置文件 /etc/nginx/conf.d/
全局配置文件 /etc/nginx/nginx.conf

新建额外配置目录

mkdir -p /etc/nginx/{sites-available,sites-enabled,conf.d,rewrite-rules,ssl-certs} && \
chmod 755 /etc/nginx/{sites-available,sites-enabled,conf.d,rewrite-rules,ssl-certs}

# vim /etc/nginx/nginc.conf
nclude /etc/nginx/sites-enabled/*.conf;

SSL 证书目录

chmod 777 /etc/nginx/ssl-certs && \
chmod o+t /etc/nginx/ssl-certs
  
openssl dhparam -out /etc/nginx/ssl-certs/dhparam.pem 2048
curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ssl-certs/dhparam.pem

运行 Nginx

查看主机IP地址

ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'

运行

sudo systemctl enable --now nginx

Mariadb 二进制版安装与配置

Wed, 05 Mar 2025 00:00:00 +0800

一、准备工作

1.1. 下载 Mariadb

根据系统选择相应版本版本，然后下载解压。

下载地址：https://downloads.mariadb.org/

wget https://mirrors.xtom.com.hk/mariadb//mariadb-11.4.5/bintar-linux-systemd-x86_64/mariadb-11.4.5-linux-systemd-x86_64.tar.gz
sudo tar zxf mariadb-11.4.5-linux-systemd-x86_64.tar.gz -C /usr/local/src
sudo ln -s /usr/local/src/mariadb-11.4.5-linux-systemd-x86_64 /usr/local/mysql

1.2. 安装依赖

# On Ubuntu/Debian:
sudo apt -y install build-essential libaio-dev
sudo apt -y install libncurses5

# On Fedora/RHEL/CentOS:
yum -y install libaio-devel numactl-libs (centos)
dnf -y install ncurses-devel (centos8)
ln -s /usr/lib64/libncurses.so.6 /usr/lib64/libncurses.so.5
ln -s /usr/lib64/libtinfo.so.6 /usr/lib64/libtinfo.so.5

1.3. 新增用户和组

# On Ubuntu/Debian:
sudo addgroup --system --gid 36 mysql
sudo adduser \
    --system \
    --home /var/lib/mysql \
    --shell /bin/false \
    --uid 36 \
    --gecos 'MariaDB Server' \
    --gid 36 \
    --disabled-password \
    mysql

# On Fedora/RHEL/CentOS:
sudo groupadd --system mysql
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'MariaDB server' \
   --gid mysql \
   --home-dir /var/lib/mysql \
   --create-home \
   mysql

1.4. 创建工作目录

# 日志目录
sudo mkdir /var/log/mariadb && \
sudo chown mysql:mysql /var/log/mariadb

# 安全目录
sudo mkdir /var/lib/mysql-files && \
sudo chown mysql:mysql /var/lib/mysql-files && \
sudo chmod 750 /var/lib/mysql-files

二、配置文件

2.1. 主配置文件

Configuring MariaDB with Option Files

sudo mkdir -p /etc/mysql/conf.d
sudo vim /etc/mysql/my.cnf

sudo sh -c "cat > /etc/mysql/my.cnf" <<EOF
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/tmp/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/mysql/conf.d/
EOF

2.2. 客户端配置文件

sudo vim /etc/mysql/conf.d/client.cnf

sudo sh -c "cat > /etc/mysql/conf.d/client.cnf" <<EOF
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

2.3. 服务端配置文件

sudo vim /etc/mysql/conf.d/server.cnf

sudo sh -c "cat > /etc/mysql/conf.d/server.cnf" <<EOF
#
# This groups are read by MariaDB server.
# Use it for options that only the server (but not clients)
#
[server]

#
# This group is read both by the MariaDB Server and MySQL Server.
#
[mysqld]

# Basic Settings
datadir=/var/lib/mysql
bind-address=0.0.0.0
pid-file=/var/lib/mysql/mariadb.pid

# Character Settings
character-set-server=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

# InnoDB Settings
# innodb_buffer_pool_size=6G

# Connection settings
# max_connections=500

#
# This group is only read by MariaDB servers, not by MySQL.
#
[mariadb]
server_id=1

# Error Log
log_error=/var/log/mariadb/error.log
aria_log_dir_path=/var/log/mariadb

# General Query Log
general_log=0
general_log_file=/var/log/mariadb/general_query.log

# Binary Log

log-bin=/var/log/mariadb/master-bin
log-bin-index=/var/log/mariadb/master-bin.index
binlog-format=mixed
#binlog-do-db=mydb
#binlog-ignore-db=test
expire-logs-days=3

# Slow Query Log
slow_query_log=1
slow_query_log_file=/var/log/mariadb/slow_query.log
long_query_time=5.0
log_queries_not_using_indexes=0

# MariaDB Audit Plugin
#https://mariadb.com/kb/en/mariadb-audit-plugin-options-and-system-variables
plugin-load=server_audit=server_audit.so
server_audit=FORCE_PLUS_PERMANENT
server_audit_events=CONNECT,QUERY,TABLE
server_audit_logging=ON
server_audit_file_rotate_size=20M
server_audit_file_rotations=10
server_audit_file_path=/var/log/mariadb/audit.log
EOF

三、安装启动

3.1. 初始化数据目录

cd /usr/local/mysql
sudo ./scripts/mariadb-install-db --user=mysql

3.2. 开机自启动

方法1： systemd

sudo cp support-files/systemd/mariadb.service /usr/lib/systemd/system/mariadb.service
sudo systemctl daemon-reload
sudo systemctl enable --now mariadb.service
sudo systemctl disable mariadb.service

方法2：不推荐

sudo cp support-files/mysql.server /etc/init.d/mysql
sudo chkconfig mysql on
sudo service mysql start

方法3：手动启动

export PATH=$PATH:/usr/local/mysql/bin/
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> ~/.bashrc
mysqld_safe --user=mysql &

三、设置 MariaDB

3.1. 初始化设置

MariaDB 10.4+ 以后，root 帐号认证机制已经变更，详见官网说明：

Authentication in MariaDB 10.4 — Understanding the Changes

mysql 帐号登录：

# root@localhost 和 mysql@localhost 均是系统自动创建的账号
sudo mysql #root
mysql #mysql

如果报错 sudo: mysql: command not found 请检查 sudo 配置是否开启了 secure_path

sudo visudo

# 注释以下内容
Defaults secure_path="......"

不想使用 unix_socke 方式登陆？设置 root 密码：

ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");

MariaDB 10.4 以前版本继续使用以下方法设置root密码：

/usr/local/mysql/bin/mysqladmin -u root -h 'hosts-name' password 'verysecret'
/usr/local/mysql/bin/mysql_secure_installation

3.2. 开启远程登录

sudo mysql
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'verysecret' WITH GRANT OPTION;
FLUSH PRIVILEGES;

3.3. 创建数据库、用户、授权

# 创建数据库
CREATE DATABASE mydb CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

# 创建用户
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypasswd';

# 授权
GRANT ALL ON mydb.* TO 'myuser'@'localhost';

# 刷新生效
FLUSH PRIVILEGES;

3.4. 数据备份

导出为SQL文件

mysqldump -u root -p --opt [database name] > [database name].sql

迁移至另一台主机

mysqldump -u root -pPassword --all-databases | ssh user@new_host.host.com 'cat - | mysql -u root -pPassword'

加密sql文件

zip --encrypt dump.zip db.sql
unzip -P your-password dump.zip

导入SQL文件

mysql -u root -p newdatabase < /path/to/newdatabase.sql

3.5. 其他

错误修复

mysqlcheck --all-databases --check-upgrade --auto-repair
mysql_upgrade -uroot -p --force

官方文档：

Installing MariaDB Binary Tarballs

Server System Variables

Configuring MariaDB with Option Files

MySQL 二进制版安装与配置

Wed, 05 Mar 2025 00:00:00 +0800

一、准备工作

1.1. 下载 MySQL

根据系统选择相应版本版本，然后下载解压。

下载地址：https://dev.mysql.com/downloads/mysql/

wget https://dev.mysql.com/get/Downloads/MySQL-8.4/mysql-8.4.5-linux-glibc2.28-x86_64.tar.xz && \
sudo tar xvf mysql-8.4.5-linux-glibc2.28-x86_64.tar.xz -C /usr/local/src && \
sudo ln -s /usr/local/src/mysql-8.4.5-linux-glibc2.28-x86_64 /usr/local/mysql && \
export PATH=/usr/local/mysql/bin:$PATH

1.2. 安装 libaio 依赖

# On Debian:
sudo apt install -y libaio1 libnuma-dev libncurses-dev

# On Ubuntu:
sudo apt install -y libaio-dev libnuma-dev libncurses-dev
cd /usr/lib/x86_64-linux-gnu/
sudo ln -s libaio.so.1t64.0.2 libaio.so.1

1.3. 新增用户和组

# On Ubuntu/Debian:
sudo addgroup --system --gid 36 mysql && \
sudo adduser \
    --system \
    --home /var/lib/mysql \
    --shell /bin/false \
    --uid 36 \
    --gecos 'MySQL Server' \
    --gid 36 \
    --disabled-password \
    mysql

# On Fedora/RHEL/CentOS:
sudo groupadd --system mysql && \
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'MariaDB server' \
   --gid mysql \
   --home-dir /var/lib/mysql \
   --create-home \
   mysql

1.4. 创建工作目录

日志目录

sudo mkdir /var/log/mysql && \
sudo chown mysql:mysql /var/log/mysql

安全目录

sudo mkdir /var/lib/mysql-files && \
sudo chown mysql:mysql /var/lib/mysql-files && \
sudo chmod 750 /var/lib/mysql-files

pid 文件目录

sudo mkdir /var/run/mysqld/ && \
sudo chown mysql:mysql /var/run/mysqld/

配置文件目录

sudo mkdir -p /etc/mysql/conf.d/ && \
sudo chown -R mysql:mysql /etc/mysql/

二、配置文件

2.1. 主配置文件

sudo sh -c "cat > /etc/mysql/my.cnf" <<EOF
# The MySQL database server configuration file.
#
# You can copy this to one of:
# - "/etc/mysql/my.cnf" to set global options,
# - "~/.my.cnf" to set user-specific options.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# * IMPORTANT: Additional settings that can override those from this file!
#   The files must end with '.cnf', otherwise they'll be ignored.

!includedir /etc/mysql/conf.d/
EOF

2.2. 客户端配置文件

sudo sh -c "cat > /etc/mysql/conf.d/client.cnf" <<EOF
# The MySQL database client configuration file
#
# Ref to https://dev.mysql.com/doc/refman/en/mysql-command-options.html

[mysql]
default-character-set=utf8mb4
socket=/var/run/mysqld/mysqld.sock
EOF

2.3. 服务端配置文件

sudo sh -c "cat > /etc/mysql/conf.d/server.cnf" <<EOF
# The MySQL database server configuration file.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# Here is entries for some specific programs
# The following values assume you have at least 8G ram

[mysqld]

# Basic Settings
user=mysql
bind-address=0.0.0.0
mysqlx-bind-address=0.0.0.0
port=3306
pid-file=/var/run/mysqld/mysqld.pid
socket=/var/run/mysqld/mysqld.sock
datadir=/var/lib/mysql
secure_file_priv=/var/lib/mysql-files
local_infile=OFF

# Character Settings
character-set-server=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

# InnoDB Settings
innodb_buffer_pool_size=2G

# Connection settings
max_connections=300

# Error Log
log_error=/var/log/mysql/error.log
log_error_verbosity=2

# General Query Log
general_log=0
general_log_file=/var/log/mysql/general_query.log

# Binary Log
log-bin=/var/log/mysql/mysql-bin
log-bin-index=/var/log/mysql/mysql-bin.index
binlog-do-db=mysql
binlog-ignore-db=test
binlog_expire_logs_seconds=604800
binlog_expire_logs_auto_purge=1
max_binlog_size=1G

# Slow Query Log
slow_query_log=1
slow_query_log_file=/var/log/mysql/slow_query.log
long_query_time=5.0
log_slow_admin_statements=1
log_queries_not_using_indexes=0
EOF

三、安装启动

3.1. 初始化数据目录

# 指定配置文件初始化
sudo /usr/local/mysql/bin/mysqld --defaults-file=/etc/mysql/my.cnf --initialize

# 不指定配置文件初始化
sudo /usr/local/mysql/bin/mysqld --initialize --user=mysql \
  --basedir=/usr/local/mysql \
  --datadir=/var/lib/mysql

3.2. 数据目录权限设置

sudo chmod 750 /var/lib/mysql && \
sudo chown mysql:mysql /var/lib/mysql

3.3. 使用 systemd 启动服务器

sudo vim /usr/lib/systemd/system/mysql.service

[Unit]
Description=MySQL Server
Documentation=man:mysqld(8)
Documentation=http://dev.mysql.com/doc/refman/en/using-systemd.html
After=network.target
After=syslog.target

[Install]
WantedBy=multi-user.target

[Service]
User=mysql
Group=mysql

# Have mysqld write its state to the systemd notify socket
Type=notify

# Disable service start and stop timeout logic of systemd for mysqld service.
TimeoutSec=0

# Start main service
ExecStart=/usr/local/mysql/bin/mysqld --defaults-file=/etc/mysql/my.cnf $MYSQLD_OPTS 

# Use this to switch malloc implementation
EnvironmentFile=/etc/sysconfig/mysql

# Sets open_files_limit
LimitNOFILE = 10000

Restart=on-failure

RestartPreventExitStatus=1

# Set environment variable MYSQLD_PARENT_PID. This is required for restart.
Environment=MYSQLD_PARENT_PID=1

PrivateTmp=false

sudo mkdir /etc/sysconfig/ && \
sudo vim /etc/sysconfig/mysql

TZ=Asia/Shanghai
NO_INIT=true

开启自启动

sudo systemctl daemon-reload
sudo systemctl enable --now mysql.service
sudo systemctl disable mysql.service
systemctl status mysql
journalctl -u mysql.service

四、常用命令

4.1. 重置 root 密码

初始化后，mysql 会生成临时密码,可通过 sudo cat /var/log/mysql/error.log | grep password 获得。

# 更改当前账号密码
mysql -u root -p
ALTER USER USER() IDENTIFIED BY 'password';

# 更改指定用户密码
ALTER USER 'myuser'@'localhost'
  IDENTIFIED BY 'password';

4.2. 开启远程连接

UPDATE mysql.user SET Host='%' WHERE Host='localhost' AND User='root';
FLUSH PRIVILEGES;
SELECT DISTINCT Host,User FROM mysql.user;

4.3. 创建数据库、用户、授权

# 创建数据库
CREATE DATABASE mydb CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

# 创建用户
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypasswd';

# 授权
GRANT ALL ON mydb.* TO 'myuser'@'localhost';

# 刷新生效
FLUSH PRIVILEGES;

4.4. 数据库导入导出

mysqldump -u myuser -p mydb > mydb.sql
mysql -u myuser -p mydb < /var/lib/mysql-files/mydb.sql

参考文档：

MariaDB 常用 SQL 语句

Thu, 07 Nov 2024 00:00:00 +0800

一、MariaDB 账户管理

1.1. 查询在线用户

SHOW processlist;
mysqladmin -u admin -p processlist

1.2. 查询全部用户

SELECT DISTINCT User,Host,Password,plugin FROM mysql.user;

1.3. 创建普通用户

CREATE USER 'wangyan'@'%' IDENTIFIED BY 'xxx';
GRANT ALL PRIVILEGES ON wangyan\_%.* TO 'wangyan'@'%' IDENTIFIED BY 'xxx';

1.4. 删除普通用户

DROP USER 'wangyan'@'%';
DELETE FROM mysql.user WHERE host = '%' AND user = 'wangyan';

1.5. 修改用户密码

SET PASSWORD=PASSWORD("xxx");
SET PASSWORD for "wangyan"@"%"=PASSWORD("xxx");
ALTER USER 'root'@'localhost' IDENTIFIED BY 'xxx';

1.6. ROOT密码找回

vim /etc/my.cnf.d/server.cnf
在Mysqld区域添加skip-grant-table语句，重启
sudo mysql -u root -p #免密码登陆数据库
UPDATE mysql.user SET password = password('123') WHERE user = 'root';
修改完成后将skip-grant-table属性去掉

二、MariaDB 权限管理

2.1. 查询所有权限

SHOW GRANTS FOR wangyan; #查询指定用户权限
SHOW GRANTS FOR 'wangyan'@'%';
FLUSH PRIVILEGES;

2.2. 收回用户授权

REVOKE ALL ON . FROM 'wangyan'@'%';
FLUSH PRIVILEGES;

2.3. 快速创建数据库和用户

DROP USER IF EXISTS 'wangyan'@'%';
DROP DATABASE IF EXISTS wangyan_gitea;
CREATE DATABASE wangyan_gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

三、MariaDB 数据操作

3.1. 导入导出

mysqldump  -u wangyan -p databasename > databasename.sql
mysql -u wangyan -p databasename < /var/lib/mysql-files/databasename.sql

MariaDB 从 Yum 源安装与配置

Thu, 07 Nov 2024 00:00:00 +0800

一、安装 MariaDB

https://lug.ustc.edu.cn/wiki/mirrors/help/mariadb

1.1. 添加 MariaDB Yum 源

方法一：官方一键设置脚本（推荐）

curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | bash

方法二：命令行工具

使用 MariaDB Repository Configuration Tool 生成一份配置，保存为 /etc/yum.repos.d/mariadb.repo

cat >/etc/yum.repos.d/mariadb.repo<<'EOF'
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.4/centos8-amd64
module_hotfixes=1
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
EOF

然后执行以下命令替换源地址：

sudo sed -i 's#yum\.mariadb\.org#mirrors.ustc.edu.cn/mariadb/yum#' /etc/yum.repos.d/mariadb.repo
# 建议使用 HTTPS
sudo sed -i 's#http://mirrors\.ustc\.edu\.cn#https://mirrors.ustc.edu.cn#g' /etc/yum.repos.d/mariadb.repo

sudo dnf install MariaDB-server
sudo systemctl start mariadb

1.2. 安装 MariaDB

sudo yum install -y MariaDB-server MariaDB-client MariaDB-shared
sudo apt-get install mariadb-server mariadb-client MariaDB-shared

RHEL 8

yum module install mariadb -y
rpm -qi mariadb-server
systemctl enable --now mariadb

MariaDB MaxScale:（选做）

sudo yum install maxscale
sudo apt-get install maxscale

Percona XtraBackup:

sudo yum install percona-xtrabackup
sudo apt-get install percona-xtrabackup

cracklib_password_check:

https://mariadb.com/kb/en/cracklib-password-check-plugin/

sudo yum install MariaDB-cracklib-password-check

1.3. 启动 MariaDB

sudo systemctl start mariadb
sudo systemctl enable mariadb

二、设置 MariaDB

2.1. 初始化

mysql_secure_installation

初始密码为空，直接回车。
设置 root 密码
是否移除匿名用户
是否禁止 root 远程登录
是否删除 ’test’ 测试数据库

2.2. 解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

/etc/my.cnf

[client]
...
default-character-set = utf8mb4
...
[mysql]
...
default-character-set = utf8mb4

...
[mysqld]
...
character-set-server  = utf8mb4
character-set-filesystem = utf8mb4
collation-server      = utf8mb4_general_ci
...

2.3. 完整配置文件

vim /etc/my.cnf

cat >/etc/my.cnf<<'EOF'
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/dev/shm/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF

vim /etc/my.cnf.d/client.cnf

cat >/etc/my.cnf.d/client.cnf<<'EOF'
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

/etc/my.cnf.d/mariadb-server.cnf

#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see
#
# See the examples of server my.cnf files in /usr/share/mysql/
#

# this is read by the standalone daemon and embedded servers
[server]

# this is only for the mysqld standalone daemon
# Settings user and group are ignored when systemd is used.
# If you need to run mysqld under a different user or group,
# customize your systemd unit file for mysqld/mariadb according to the
# instructions in http://fedoraproject.org/wiki/Systemd
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
log-error=/var/log/mariadb/mariadb.log
pid-file=/run/mariadb/mariadb.pid
character-set-server=utf8mb4
character-set-system=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

#
# * Galera-related settings
#
[galera]
# Mandatory settings
#wsrep_on=ON
#wsrep_provider=
#wsrep_cluster_address=
#binlog_format=row
#default_storage_engine=InnoDB
#innodb_autoinc_lock_mode=2
#
# Allow server to accept connections on all interfaces.
#
#bind-address=0.0.0.0
#
# Optional setting
#wsrep_slave_threads=1
#innodb_flush_log_at_trx_commit=0

# this is only for embedded server
[embedded]

# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]

# This group is only read by MariaDB-10.3 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.3]

/etc/my.cnf.d/mysql-clients.cnf

#
# These groups are read by MariaDB command-line tools
# Use it for options that affect only one utility
#

[mysql]
default-character-set=utf8mb4

[mysql_upgrade]

[mysqladmin]

[mysqlbinlog]

[mysqlcheck]

[mysqldump]

[mysqlimport]

[mysqlshow]

[mysqlslap]

/etc/my.cnf.d/auth_gssapi.cnf

[mariadb]
plugin-load-add=auth_gssapi.so

/etc/my.cnf.d/enable_encryption.preset

#
# !include this file into your my.cnf (or any of *.cnf files in /etc/my.cnf.d)
# and it will enable data at rest encryption. This is a simple way to
# ensure that everything that can be encrypted will be and your
# data will not leak unencrypted.
#
# DO NOT EDIT THIS FILE! On MariaDB upgrades it might be replaced with a
# newer version and your edits will be lost. Instead, add your edits
# to the .cnf file after the !include directive.
#
# NOTE that you also need to install an encryption plugin for the encryption
# to work. See https://mariadb.com/kb/en/mariadb/data-at-rest-encryption/#encryption-key-management
#
[mariadb]
aria-encrypt-tables
encrypt-binlog
encrypt-tmp-disk-tables
encrypt-tmp-files
loose-innodb-encrypt-log
loose-innodb-encrypt-tables

三、测试 MariaDB

mysqladmin -u root -p version

查看效果

mysql -uroot -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

参考配置文件：/usr/share/mysql/
数据文件夹：/var/lib/mysql/
执行文件：/usr/bin/mysql

参考文档：

Mariadb 启用 TLS 安全连接

Thu, 07 Nov 2024 00:00:00 +0800

一、概述

默认情况下，MariaDB 在服务器和客户端之间传输数据时不加密。当服务器和客户端运行在同一主机上保证处于安全的网络中时，这通常是可以接受的。然而，如果服务器和客户端位于不同的网络上或者位于高风险网络中，缺乏加密确实会带来安全问题，因为恶意行为者可能会窃听通过服务器和客户端之间的网络发送的流量。

为了减轻这种担忧，MariaDB 允许您使用传输层安全 (TLS) 协议对服务器和客户端之间传输的数据进行加密。 TLS 以前称为安全套接字层 (SSL)，但严格来说，SSL 协议是 TLS 的前身，该版本的协议现在被认为是不安全的。MariaDB 文档仍然使用 SSL 术语表述，是出于兼容性原因，但实际上，MariaDB 仅支持 TLS。

二、创建自签署证书

OpenSSL 自签署证书生成

生成服务器证书和客户端证书

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert
cd /tmp/gen-ssl-cert
make init

# 根证书
make gen-ca-key
make gen-ca-csr
make gen-ca-cert

# 中间证书
make gen-ica-key
make gen-ica-csr
make gen-ica-cert
make gen-ica-chain

# 服务器证书
make gen-server-key
make gen-server-csr
make gen-server-cert

# 客户端证书
make gen-client-key
make gen-client-csr
make gen-client-cert
make gen-client-pkcs12

准备证书文件

#准备目录
sudo mkdir /etc/my.cnf.d/certificates && \
sudo chmod 777 /etc/my.cnf.d/certificates && \
sudo chmod o+t /etc/my.cnf.d/certificates

# 服务端证书
cp /tmp/gen-ssl-cert/ica/certs/ica-chain-cert.crt /etc/my.cnf.d/certificates/ca.pem && \
cp /tmp/gen-ssl-cert/ica/certs/server-cert.crt /etc/my.cnf.d/certificates/server-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/server-key.pem /etc/my.cnf.d/certificates/server-key.pem

# 客户端证书
cp /tmp/gen-ssl-cert/ica/certs/client-cert.crt /etc/my.cnf.d/certificates/client-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/client-key.pem /etc/my.cnf.d/certificates/client-key.pem

# 修改权限
sudo chown mysql:mysql -R /etc/my.cnf.d/certificates/

二、MariaDB 服务端启用 TLS

ssl_cert 设置服务器的 X509 证书的路径。

ssl_key 设置服务器私钥的路径。

ssl_ca 设置证书颁发机构 (CA) 链的路径，用来验证服务器证书。

sudo sh -c "cat >/etc/my.cnf.d/enable_tls.cnf" <<EOF
[mariadb]
# Use Secure Connections to transfer data
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl_cert = /etc/my.cnf.d/certificates/server-cert.pem
ssl_key = /etc/my.cnf.d/certificates/server-key.pem
EOF

重启 & 检查

# 重启
sudo systemctl restart mariadb

# 动态刷新证书，可不用重启
FLUSH SSL

# 检查 TLS 是否已启用
SHOW GLOBAL VARIABLES LIKE 'have_ssl';
SHOW SESSION STATUS LIKE 'Ssl_cipher';

三、MariaDB 客户端启用 TLS

3.1. 什么是证书验证？

服务端证书验证

客户端根据证书中的某些属性检查服务器的主机名和 IP 地址来验证服务器证书。对于大多数客户端，默认情况下禁用服务器证书验证，并且仅在指定选项（例如ssl-verify-server-cert指定）时才启用它。
为了验证服务器的证书，客户端和实用程序将根据服务器的主机名和 IP 地址检查位于证书主题字段中的通用名称 (CN)属性。如果公用名 (CN)与其中任何一个匹配，则证书通过验证。
使用主题备用名称 (SAN) 也叫 subjectAltName 进行服务器证书验证。当使用支持使用 subjectAltName 字段进行服务器证书验证的客户端时，如果服务器证书包含任何 subjectAltName 字段，则还将根据服务器的主机名和 IP 地址检查这些字段。

客户端证书验证

服务器通过SUBJECT根据客户端证书中的主题属性检查客户端的已知信息来验证客户端证书。

3.2. 双向 TLS

双向 TLS 意味着客户端和服务器都提供私钥和 X509 证书，客户端和服务器都要验证彼此身份。

即客户端要对服务端证书进行验证。同时，服务端也要对客户端的证书进行验证。

（1）通过配置文件：

sudo sh -c "cat >>/etc/my.cnf.d/enable_tls.cnf" <<EOF

[client-mariadb]
ssl_cert = /etc/my.cnf.d/certificates/client-cert.pem
ssl_key = /etc/my.cnf.d/certificates/client-key.pem
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert
EOF

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-cert=/etc/my.cnf.d/certificates/client-cert.pem \
   --ssl-key=/etc/my.cnf.d/certificates/client-key.pem \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.3. 单向 TLS

当在没有客户端证书的情况下使用 TLS 时，称为单向 TLS，因为只有服务器提供私钥和 X509 证书，因此只能在一个方向进行身份验证。然而，双向加密仍然是可能的。服务器证书验证是指客户端验证证书是否属于服务器。

（1）通过配置文件：

[client-mariadb]
...
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.4. 双向 vs 单向

不管是双向还是单向，都要对服务器证书进行验证。区别在于单向没有指定客户端证书，因此，服务器不能验证客户端，但客户端都能验证服务端。

当然了，还有一种情况是，启用了单向 TLS，但是也不验证服务器证书

方法如下：

（1）通过配置文件：

[client-mariadb]
...
ssl

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl

四、强制使用 TLS

4.1. 特定用户帐户使用 TLS

您可以为特定用户帐户设置 TLS 相关的限制，例如，需要访问敏感数据的用户帐户。可以使用 CREATE USER、ALTER USER 或 GRANT 语句为用户帐户启用这些限制。

(1) 必须通过 TLS 连接

ALTER USER 'alice'@'%' 
   REQUIRE SSL;

(2) 必须通过 TLS 且是有效的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE X509;

(3) 必须通过 TLS 且是特定的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland';

4.2 特定主机的特定帐户使用 TLS

CREATE USER 'alice'@'localhost' 
   REQUIRE NONE;

CREATE USER 'alice'@'%'
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
   AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter Parker/emailAddress=p.parker@marvel.com'
   AND CIPHER 'ECDHE-ECDSA-AES256-SHA384';

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert

参考文档

Secure Connections Overview

Securing Connections for Client and Server

Connecting to MariaDB

Mariadb 日志审计与密码插件

Thu, 07 Nov 2024 00:00:00 +0800

一、启用日志

1.1. 错误日志

Error Log

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# Error Log
log_error=/var/log/mariadb/error.log
log_warnings=3

日志详细程度：0-9，默认值为 2

1.2. 通用查询日志

General Query Log

通用查询日志是从客户端接收到的每个 SQL 查询以及每个客户端连接和断开连接的日志。由于它是服务器收到的每个查询的记录，因此它可能会很快变大。

但是，如果您只想记录更改数据的查询，那么最好使用二进制日志。一个重要的区别是，二进制日志仅在服务器提交事务时记录查询，而通用查询日志在服务器接收到查询后立即记录查询。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# General Query Log
general_log
log_output=FILE
general_log_file=/var/log/mariadb/queries.log
log_disabled_statements='slave,sp'

1.3. 二进制日志

Binary Log

二进制日志包含对数据库的所有更改（数据和结构）以及每个语句执行所需时间的记录。它由一组二进制日志文件和一个索引组成。

这意味着诸如 CREATE、ALTER、INSERT、UPDATE 和 DELETE 之类的语句将被记录，但对数据没有影响的语句（如 SELECT 和 SHOW ）将不会被记录。如果您想记录这些（以性能为代价），请使用通用查询日志。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
# Binary Log
# datadir/log-basename-bin
log_bin=ON
log_basename=mariadb
binlog_format=mixed
expire_logs_days=90
max_binlog_size=512M
max_binlog_total_size=5G
--binlog-ignore-db=database_name

1.4. 清除二进制日志

PURGE BINARY LOGS

# 列出所有日志
SHOW BINARY LOGS;

# 查看正在读取的文件
SHOW SLAVE STATUS;

# 删除所有二进制日志文件
RESET MASTER;

# 清除到指定位置
PURGE BINARY LOGS TO 'mariadb-bin.000057';

# 清除指定日期之前的
PURGE BINARY LOGS BEFORE '2019-04-02 22:46:26';

# 清除3天前的日志
#SELECT DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE MASTER LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE BINARY LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);

1.5. 慢查询日志

Slow Query Log

慢查询日志是执行时间较长的 SQL 查询的记录。

请注意，如果您的查询包含用户的密码，则慢查询日志也可能包含密码。因此，应该对其进行保护。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
## Slow Query Log
log_output=FILE
slow_query_log
slow_query_log_file=/var/log/mariadb/slow.log
long_query_time=5.0
log_queries_not_using_indexes=ON
log_slow_admin_statements=ON
log_slow_rate_limit=10

long_query_time 定义慢速查询的时间
log_queries_not_using_indexes 记录不使用索引的查询
log_slow_admin_statements 记录缓慢的管理语句
log_slow_rate_limit 限制每10次慢查询才记录一次

二、轮换日志

2.1. Logrotate

2.1.1. 身份验证

使用 MariaDB 进行身份验证的最简单方法是将用户帐户配置 root@localhost 为使用 unix_socket 身份验证。

在MariaDB 10.4及更高版本不许设置

ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket;

2.1.2. 配置文件

/etc/logrotate.conf
/etc/logrotate.d/

$ sudo tee /etc/logrotate.d/mariadb <<EOF
/var/log/mysql/* {
        su mysql mysql
        missingok
        create 660 mysql mysql
        notifempty
        daily
        minsize 1M
        maxsize 100M
        rotate 30
        dateext
        dateformat .%Y-%m-%d-%H-%M-%S
        compress
        delaycompress
        sharedscripts 
        olddir archive/
        createolddir 770 mysql mysql # only use with logrotate >= 3.8.9
    postrotate
        # just if mysqld is really running
        if test -x /usr/local/mysql/bin/mysqladmin && \
           /usr/local/mysql/bin/mariadb-admin ping &>/dev/null
        then
           /usr/local/mysql/bin/mariadb-admin --local flush-error-log \
              flush-engine-log flush-general-log flush-slow-log
        fi
    endscript
}
EOF

重要参数：

daily：每天轮换每个日志文件一次。
minsize 1M：该指令将其配置为在日志轮转期间跳过小于 1 MB 的日志文件。
maxsize 100M：此指令将其配置为在日志文件增长超过 100 MB 时比每天更频繁地轮换日志文件。
rotate 30：该指令将其配置为保留每个日志文件的 30 个旧副本。
dateext：该指令将其配置为使用日期作为扩展名，而不仅仅是数字。
olddir archive/：该指令将其配置为将轮换日志文件存档在/var/log/mariadb/archive/.

2.2. Journal

systemd-journal 是一个改进型的日志管理服务。

常见用法如下：

# 查看文件情况
du -h --max-depth=1 /var/log

# 日志总体磁盘占用情况
journalctl --disk-usage

# 硬性指定日志总体体积，删除超出部分
journalctl --vacuum-size=10M

# 只保留近一周的日志
journalctl --vacuum-time=1w

# 直接删除 /var/log/journal/ 目录下的日志文件
rm -rf /var/log/journal/f9d400c5e1e8c3a8209e990d887d4ac1

三、启用审计

3.1. 查看当前开启审计

show variables like '%audit%';

如果没有，则先查看审计插件目录

SHOW VARIABLES LIKE 'plugin_dir';

3.2. 启用审计

具体参数详见官方文档：

MariaDB Audit Plugin Options and System Variables

# /etc/my.cnf.d/server-audit.cnf

[mariadb]
## MariaDB Audit Plugin
server_audit_events=CONNECT,QUERY,TABLE,QUERY_DDL,QUERY_DML,QUERY_DCL,QUERY_DML_NO_SELECT
server_audit_file_path=/var/log/mariadb/server_audit.log
server_audit_file_rotate_size=100M
server_audit_file_rotations=10
server_audit_logging=ON
server_audit_output_type=file
server_audit=FORCE_PLUS_PERMANENT

3.3. 重启

sudo systemctl restart mariadb

四、密码插件

Password Validation Plugin API

4.1. simple_password_check

Simple Password Check Plugin

# /etc/my.cnf.d/simple_password_check.cnf
[mariadb]
# Password Validation
plugin_load_add = simple_password_check.so
simple_password_check_digits=1
simple_password_check_letters_same_case=1
simple_password_check_minimal_length=8
simple_password_check_other_characters=1

4.2. cracklib_password_check

Cracklib Password Check Plugin

sudo yum install MariaDB-cracklib-password-check
sudo apt-get install mariadb-plugin-cracklib-password-check

安装

[mariadb]
...
plugin_load_add = cracklib_password_check

LNMP 运行环境搭建 on 七三的小站

Nginx 从源码安装与配置

目录

一、环境准备

1.1. 下载软件包

OpenSSL

Pcre2

FancyIndex

NJS

GeoIP2

Nginx

1.2. 新增用户和组 (可选)

二、编译安装

2.1. 安装编译工具

2.2. 安装扩展工具

安装 MaxmindDB

安装 Perl (可选)

2.3. 编译安装

2.5. 设置环境变量

三、配置

3.1. 配置文件目录

缓存目录

日志目录

配置文件目录

3.2. 开机自启动

3.3. 防火墙设置

Nginx 配置 SSL 可信证书

目录

1. 使用 acme.sh 签发 ZeroSSL 证书

1.1. 安装依赖

1.2. 安装 acme.sh

1.2.1. 一键安装

1.2.2. 自定义安装（可选）

1.3. 签发证书（DNS 模式）

1.3.1. 注册 ZeroSSL

1.3.2. 导入域名注册商 KEY

1.3.3. 签发 ECC 证书

1.3.4. 撤销 && 删除

2. 二、Nginx SSL 配置

2.1. 生成 dhparam

PHP 8 从源码安装与配置

目录

1. 一、安装依赖

1.1. 安装编译工具及依赖

1.2. 安装 libiconv

1.3. 安装 libzip（已过时，选做）

1.3.1. 通过 RPM 安装

1.3.2. 手动编译安装

1.4. 安装 imap（已过时，选做）

1.5. 其他 （已过时，选做）

2. 二、安装 PHP

2.1. 下载软件包

2.2. 新增用户和组 (选做)

2.3. 编译安装

3. 三、php 配置

3.1. php-fpm.conf 设置

3.2. www.conf 设置

3.3. php.ini 设置

3.4. 开机自启动

3.5. 配置环境变量

4. 四、安装 PHP 扩展

4.1. PHPRedis

4.2. ImageMagick

4.3. php.ini添 加扩展

5. 五、安装 Composer

Nginx 从软件源安装与配置

目录

一、安装

1.1. 安装依赖

1.2. 添加软件源

1.3. 安装运行

1.4. 防火墙设置

二、配置

默认配置文件路径

新建额外配置目录

SSL 证书目录

运行 Nginx

Mariadb 二进制版安装与配置

目录

一、准备工作

`OpenSSL`

`Pcre2`

`FancyIndex`

`NJS`

`GeoIP2`

`Nginx`

1.5. 其他（已过时，选做）

4.3. php.ini添加扩展