基于FreeBSD 8.0 Ports配置nginx+php+mysql高性能web平台[服务器安全]

FreeBSD简介:

FreeBSD,是AT＆T的后代间接通过Berkeley Software Distribution（BSD）伯克利软件发行版UNIX,其冗长而骚动的历史可以追溯到1993年.差别于Linux发行版,这被定义为集成 Linux内核和数以千计的利用软件构成的办理筹划,FreeBSD是一个精密集成的操作系统基于BSD kernel和所谓的"userland（用户制作）"（因此,乃至没有额外的扩大程序）.发行版宏大失去了在普通电脑系统安装的机会 ? 像很多Linux发行版本,一个易于安装的（大部份）开放源码的利用扩大供应了FreeBSD的核心,但这些普通是由第三方捐助者供应的和不严峻的 FreeBSD的一部份.团购网

FreeBSD开爆发为一个快速,高性能和极端安定的操作系统,特别是合适网络服务器和近似任务.很多大型搜索引擎网站,或组织的关键任务计算底子设备上布置和利用,并在他们的计算机系统上运行FreeBSD多年.相较于Linux操作系统,FreeBSD是分布在一个更宽松的答应证,这几近可以无限制地反复利用和源代码改正成任何目的.即便是出名的苹果的Mac OS X也是从BSD派生.除了核心的操作系统,该项目还供应超越15,000种二进制和源代码情势

FreeBSD软件便利的利用于BSD核心安装.固然可以必定的是FreeBSD可以作为桌面操作系统利用,但它在这方面不具有Linux发行版风行.文本情势的安装程序供应的系统硬件检测或系统配置方面并没有,留下复杂的工作,这让在安装后的用户来设置.在现代的硬件支持方面,FreeBSD广泛滞后Linux操作系统,分外是在支持笔记本电脑和上网本等小工具,如无线网卡或风行数码相机.这些用户追求现有的桌面FreeBSD的项目是考虑操纵FreeBSD在台式机或工作站的速度和安定,而不是FreeBSD的自身.

一．安装预备:

1.1、操作系统安装:拜见http://bbs.linuxtone.org/thread-6422-1-1.html附件

默许FreeBSD不答应Root直接ssh登陆,在安装系统时刻可以增添一个wheel组的用户.以确保FreeBSD系统安全!牢记:FreeBSD只答应wheel组的用户可以ssh登陆.

比方:pw useradd coralzd -g coralzd

1.2 系统环境

FreeBSD 8.0 I386

Nginx 0.7.65

PHP 5.2.13

Mysql 5.5.4 M3

复制代码

2、系统初始化

2.1 更新ports

用portsnap 更新ports树,已得到最新的软件.

改正portsnap配置文件的server 为国内的镜像

ee /etc/porsnap.conf

将SERVERNAME=portsnap.freebsd.org

改正成SERVERNAME=portsnap.hshh.org

#初次运行portsnap fetch extract

今后运行portsnap fetch update

复制代码

2.2 优化rc.conf配置文档

增添syslogd_flags="-ss"

sendmail_enable="NONE"

2.3 内核增添IPFW防火墙

cd /usr/src/sys/i386/conf

cp GENERIC IPFW

ee IPFW

将ident GENERIC

改正成ident IPFW

在下面增添

options IPFIREWALL

options IPFIREWALL_VERBOSE

options IPFIREWALL_VERBOSE_LIMIT=10

options IPFIREWALL_DEFAULT_TO_ACCEPT

复制代码

编译内核

# cd ../compile/IPFW

# make cleandepend && make depend

# make && make install

复制代码

编译完成后在/etc/rc.conf 最后增添以下语句

firewall_enable="YES"

firewall_script="YES"

firewall_script="/etc/ipfw.conf"

firewall_quiet="NO"

firewall_logging_enable="YES"

复制代码

:编辑/etc/syslog.conf文件

在文件最后加入以下内容:

!ipfw *.* /var/log/ipfw.log

这行的作用是将IPFW的日记写到/var/log/ipfw.log文件里

ee /etc/ipfw.conf

#!/bin/sh

IPFW='/sbin/ipfw -q'

$IPFW -f flush

$IPFW add 2000 allow ip from any to any via lo*

$IPFW add 2010 deny log ip from 127.0.0.0/8 to any in

$IPFW add 2020 deny log ip from any to 127.0.0.0/8 in

$IPFW add 2030 deny log ip from 224.0.0.0/3 to any in

$IPFW add 2040 deny log tcp from any to 224.0.0.0/3 in

$IPFW add 2050 allow log tcp from any to any out

$IPFW add 2060 allow log tcp from any to any established

$IPFW add 2070 allow log tcp from any to any 22 in

$IPFW add 2080 allow log tcp from any to any 80 in

$IPFW add deny log tcp from any to any

复制代码

2.4 安装axel提高ports的安装速度

cd /usr/ports/ftp/axel

make install

#改正 /et/make.conf

ee /etc/make.conf

#加入以下内容

FETCH_CMD=axel

FETCH_BEFORE_ARGS= -n 10 -a

FETCH_AFTER_ARGS=

DISABLE_SIZE=yes

MASTER_SITE_OVERRIDE?=\

http://ports.hshh.org/${DIST_SUBDIR}/\

http://ports.cn.freebsd.org/${DIST_SUBDIR}/\

ftp://ftp.freeBSDchina.org/pub/FreeBSD/ports/distfiles/${DIST_SUBDIR}/

MASTER_SITE_OVERRIDE?=${MASTER_SITE_BACKUP

复制代码

2.5 优化内核

ee /etc/sysctl.conf

security.bsd.see_other_uids=0

net.inet.tcp.sendspace=

net.inet.tcp.recvspace=

#net.inet.udp.sendspace=

net.inet.udp.maxdgram=

net.local.stream.sendspace=

net.inet.tcp.rfc1323=1

#net.inet.tcp.rfc1644=1

net.inet.tcp.rfc3042=1

net.inet.tcp.rfc3390=1

kern.ipc.maxsockbuf=

kern.maxfiles=

kern.maxfilesperproc=

net.inet.tcp.delayed_ack=0

net.inet.icmp.drop_redirect=1

net.inet.icmp.log_redirect=1

net.inet.ip.redirect=0

net.inet.icmp.bmcastecho=0

net.inet.icmp.maskrepl=0

net.inet.icmp.icmplim=100

net.inet.icmp.icmplim_output=0

#net.inet.tcp.drop_synfin=1

net.inet.tcp.always_keepalive=1

net.inet.ip.intr_queue_maxlen=1000 (这儿太大了.信团网倡议不用或小点值)

net.inet.tcp.msl=7500 (太大了.倡议2500-2000左右)

net.inet.tcp.blackhole=2

net.inet.tcp.inflight.enable=1

net.inet.ip.fastforwarding=0

kern.ipc.somaxconn=

kern.securelevel=0

#net.inet.tcp.log_in=1

#net.inet.udp.log_in=1

net.inet.udp.checksum=1

net.inet.tcp.syncookies=1

kern.ipc.shm_use_phys=1

kern.ipc.shmmax=

kern.ipc.shmall=

kern.coredump=0

net.local.stream.recvspace=

net.local.dgram.maxdgram=

net.local.dgram.recvspace=

#net.inet.tcp.mssdflt=1460

#net.inet.tcp.minmss=1640

net.inet.raw.maxdgram=

net.inet.raw.recvspace=

net.inet.ip.fw.dyn_max=

net.inet.ipf.fr_tcpidletimeout=

复制代码

ee /boot/loader.conf

kern.dfldsiz="" # Set the initial data size limit

kern.maxdsiz="" # Set the max data size

kern.ipc.nmbclusters="0" # Set the number of mbuf clusters

kern.ipc.nsfbufs="" # Set the number of sendfile(2) bufs

复制代码

3、配置mysql php nginx

3.1 安装mysql 5.5.4 m3

cd /usr/ports/databases/mysql55-server

ee Makefile

在第30行下面加上下面的参数

--enable-thread-safe-client \

--disable-dtrace \

--enable-assembler \

--enable-assembler \

--with-big-tables \

--with-ssl \

--with-embedded-server \

--with-local-infile \

--with-plugins=partition,innobase,myisammrg

然后

#make install clean

复制代码

3.2 初始化数据库

/usr/local/bin/mysql_install_db --user=mysql

cp /usr/local/share/mysql/my-medium.cnf /etc/my.cnf

复制代码

3.3 /etc/rc.conf 增添mysql_enable="YES"

echo 'mysql_enable="YES"' >> /etc/rc.conf

复制代码

3.4 安装php

cd /usr/ports/lang/php52

#make config ##配置编译参数

[X] CLI Build CLI version

[X] CGI Build CGI version

[ ] APACHE Build Apache module

[ ] DEBUG Enable debug

[X]] SUHOSIN Enable Suhosin protection system

[X] MULTIBYTE Enable zend multibyte support

[ ] IPV6 Enable ipv6 support

[X] REDIRECT Enable force-cgi-redirect support (CGI only)

[X] DISCARD Enable discard-path support (CGI only)

[X] FASTCGI Enable fastcgi support (CGI only)

[X] PATHINFO Enable path-info-check support (CGI only)

make install clean

复制代码

# cp /usr/local/etc/php.ini-dist /usr/local/etc/php.ini

3.5 配置php.ini

ee php.ini

找到以下语句

;open_basedir =

disable_functions =

expose_php = On

expose_php = Off

display_errors = On

output_buffering = Off

复制代码

改正成

open_basedir = /data/www/wwwroot:/tmp

disable_functions =

phpinfo,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsock

open,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server

display_errors = Off

output_buffering = On

复制代码

3.6 安装php52-extensions

# cd /usr/ports/lang/php52-extensions/

#make config

Options for php52-extensions 1.3

-------------------------------------------------

[X] CURL CURL support

[X] FTP FTP support

[X] GD

[X] GETTEXT

[X] MBSTRING multibyte string support

[X] MCRYPT Encryption support

[X] MYSQL

[X] PCRE Perl Compatible Regular Expression support

[ ] POSIX //去掉

[ ] SQLITE //去掉.

[X] ZIP ZIP support

[X] ZLIB

# make install clean

复制代码

3.7 安装php扩大模块安装eaccelerator

cd /usr/ports/www/eaccelerator

make install clean

复制代码

ee /usr/local/etc/php.ini

在背面加上

zend_extension="/usr/local/lib/php/extensions/no-debug-non-zts-

/eaccelerator.so"