Apache HTTP Server部署全攻略(最新整理)

# 检查系统版本
cat /etc/redhat-release
# 检查内核版本
uname -r
# 检查磁盘空间
df -h
# 检查内存
free -m

# 更新系统软件包
sudo yum update -y
# 安装常用工具
sudo yum install -y wget vim net-tools

# 检查防火墙状态
sudo systemctl status firewalld
# 开放端口
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

# 检查 selinux 状态
getenforce
# 临时关闭（如需）
sudo setenforce 0
# 永久关闭（如需）
sudo sed -i 's/selinux=enforcing/selinux=disabled/g' /etc/selinux/config

# 安装httpd主程序
sudo yum install -y httpd
# 验证安装版本
httpd -v
# 启动服务并设置开机自启
sudo systemctl start httpd
sudo systemctl enable httpd
# 检查服务状态（应显示active/running）
sudo systemctl status httpd
# 查看监听端口（默认80）
sudo netstat -tulnp | grep httpd

# 查看防火墙状态
sudo firewall-cmd --state
# 永久开放http(80)和https(443)服务
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
# 如果需要开放自定义端口（如8080）
sudo firewall-cmd --permanent --add-port=8080/tcp
# 重新加载防火墙配置
sudo firewall-cmd --reload
# 查看当前开放的端口和服务
sudo firewall-cmd --list-all

/etc/httpd/
├── conf/                  # 主配置目录
│   ├── httpd.conf         # 主配置文件
│   └── magic              # 文件类型识别
├── conf.d/                # 附加配置文件目录
│   ├── autoindex.conf     # 目录列表配置
│   ├── userdir.conf       # 用户目录配置
│   └── welcome.conf       # 默认欢迎页
├── conf.modules.d/        # 模块配置文件
├── logs -> ../../var/log/httpd  # 日志目录
├── modules/               # 模块文件
├── run/                   # pid文件
└── state/                 # 状态文件
/var/www/html/             # 默认网站根目录
/var/log/httpd/            # 日志目录（access_log, error_log）

sudo vim /etc/httpd/conf/httpd.conf

# 全局配置
serverroot "/etc/httpd"       # 服务器根目录
listen 80                     # 监听端口
user apache                   # 运行用户
group apache                  # 运行组
serveradmin webmaster@example.com # 管理员邮箱
# 主服务器配置
servername www.example.com:80 # 服务器域名
documentroot "/var/www/html"  # 网站根目录
errorlog "logs/error_log"     # 错误日志路径
# 目录权限设置
<directory "/var/www/html">
    options indexes followsymlinks  # 允许目录列表和符号链接
    allowoverride none        # 是否允许.htaccess覆盖
    require all granted       # 访问控制
</directory>
# 日志格式定义
logformat "%h %l %u %t \"%r\" %>s %b" common
logformat "%{referer}i -> %u" referer
logformat "%{user-agent}i" agent

sudo mkdir -p /var/www/example.com/public_html
sudo mkdir -p /var/www/test.com/public_html
sudo chown -r apache:apache /var/www/example.com
sudo chown -r apache:apache /var/www/test.com

sudo vim /etc/httpd/conf.d/vhosts.conf

# 第一个虚拟主机
<virtualhost *:80>
    serveradmin admin@example.com
    servername example.com
    serveralias www.example.com
    documentroot /var/www/example.com/public_html
    errorlog /var/log/httpd/example.com-error.log
    customlog /var/log/httpd/example.com-access.log combined
    <directory "/var/www/example.com/public_html">
        options -indexes +followsymlinks
        allowoverride all
        require all granted
    </directory>
    # 重定向非www到www
    rewriteengine on
    rewritecond %{http_host} ^example\.com [nc]
    rewriterule ^(.*)$ http://www.example.com$1 [l,r=301]
</virtualhost>
# 第二个虚拟主机
<virtualhost *:80>
    servername test.com
    documentroot /var/www/test.com/public_html
    ...
</virtualhost>

# 在httpd.conf中添加
servertokens prod       # 仅显示apache
serversignature off     # 关闭页脚签名
traceenable off         # 禁用trace方法

<directorymatch "^/.*/\.(svn|git|ht)/">
    require all denied
</directorymatch>
<files ".ht*">
    require all denied
</files>

<location "/">
    <limitexcept get post head>
        deny from all
    </limitexcept>
</location>

sudo yum install -y mod_ssl openssl

# 创建证书目录
sudo mkdir /etc/httpd/ssl
sudo chmod 700 /etc/httpd/ssl
# 生成自签名证书（测试用）
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/httpd/ssl/server.key \
    -out /etc/httpd/ssl/server.crt \
    -subj "/c=cn/st=beijing/l=beijing/o=example inc/cn=example.com"

<virtualhost *:443>
    servername example.com
    documentroot "/var/www/example.com/public_html"
    sslengine on
    sslcertificatefile /etc/httpd/ssl/server.crt
    sslcertificatekeyfile /etc/httpd/ssl/server.key
    # 强制http跳转到https
    rewriteengine on
    rewritecond %{https} off
    rewriterule ^(.*)$ https://%{http_host}%{request_uri} [l,r=301]
    # 启用hsts
    header always set strict-transport-security "max-age=63072000; includesubdomains; preload"
</virtualhost>

sudo vim /etc/httpd/conf.modules.d/00-mpm.conf

loadmodule mpm_event_module modules/mod_mpm_event.so

<ifmodule mpm_event_module>
    startservers             3
    minsparethreads         75
    maxsparethreads        250
    threadsperchild         25
    maxrequestworkers      400
    maxconnectionsperchild   0
</ifmodule>

loadmodule deflate_module modules/mod_deflate.so
<ifmodule mod_deflate.c>
    addoutputfilterbytype deflate text/html text/plain text/css text/javascript application/javascript
    deflatecompressionlevel 6
    setoutputfilter deflate
</ifmodule>

loadmodule expires_module modules/mod_expires.so
<ifmodule mod_expires.c>
    expiresactive on
    expiresbytype image/jpg "access plus 1 month"
    expiresbytype text/css "access plus 1 week"
    expiresdefault "access plus 2 days"
</ifmodule>

sudo bash -c 'cat > /var/www/html/index.html <<eof
<!doctype html>
<html>
<head>
    <title>apache test page</title>
    <meta charset="utf-8">
</head>
<body>
    <h1>apache http server works!</h1>
    <p>server time: <?php echo date("y-m-d h:i:s"); ?></p>
</body>
</html>
eof'

sudo httpd -t

sudo systemctl reload httpd
# 或完全重启
sudo systemctl restart httpd

# 查看错误日志
sudo tail -50 /var/log/httpd/error_log
# 查看访问日志
sudo tail -f /var/log/httpd/access_log
# 测试端口连通性
telnet your-server-ip 80
nc -zv your-server-ip 80
# selinux相关检查
sudo ausearch -m avc -ts recent  # 查看安全事件
sudo sealert -a /var/log/audit/audit.log  # 分析selinux问题

# 临时设置
sudo setenforce 0   # 宽松模式
sudo setenforce 1   # 强制模式
# 永久设置（编辑/etc/selinux/config）
selinux=enforcing  # 强制模式
selinux=permissive # 仅记录不阻止
selinux=disabled   # 完全禁用
# 调整文件上下文标签
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?"
sudo restorecon -rv /var/www/html

loadmodule rewrite_module modules/mod_rewrite.so
<directory "/var/www/html">
    rewriteengine on
    # 示例1：重定向旧url
    rewriterule ^oldpage\.html$ newpage.html [r=301,l]
    # 示例2：隐藏.php扩展名
    rewritecond %{request_filename} !-d
    rewritecond %{request_filename}\.php -f
    rewriterule ^(.*)$ $1.php [l]
</directory>

loadmodule proxy_module modules/mod_proxy.so
loadmodule proxy_http_module modules/mod_proxy_http.so
<location "/app/">
    proxypass http://localhost:8080/
    proxypassreverse http://localhost:8080/
</location>

sudo yum install -y mod_http2

loadmodule http2_module modules/mod_http2.so
protocols h2 http/1.1
<virtualhost *:443>
    ...
    protocols h2 http/1.1
    h2direct on
</virtualhost>

# 安装goaccess日志分析工具
sudo yum install -y goaccess
# 生成html报告
goaccess /var/log/httpd/access_log -a -o /var/www/html/report.html

# 检查配置更改
sudo apachectl configtest
# 优雅重启（不中断连接）
sudo apachectl graceful
# 查看已加载模块
sudo apachectl -m
# 查看完整配置
sudo apachectl -s

sudo vim /etc/logrotate.d/httpd

/var/log/httpd/*log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    sharedscripts
    postrotate
        /bin/systemctl reload httpd > /dev/null 2>/dev/null || true
    endscript
}

# 安装mod_status用于服务器状态监控
sudo yum install -y mod_status

<location "/server-status">
    sethandler server-status
    require ip 192.168.1.0/24  # 限制访问ip
</location>

# 备份配置文件
sudo tar czvf httpd_conf_backup.tar.gz /etc/httpd/
# 备份网站数据
sudo tar czvf web_content_backup.tar.gz /var/www/
# 备份ssl证书
sudo tar czvf ssl_certs_backup.tar.gz /etc/httpd/ssl/

# 停止服务
sudo systemctl stop httpd
# 恢复配置
sudo tar xzvf httpd_conf_backup.tar.gz -c /
# 恢复网站内容
sudo tar xzvf web_content_backup.tar.gz -c /
# 恢复证书
sudo tar xzvf ssl_certs_backup.tar.gz -c /
# 重启服务
sudo systemctl start httpd