Connection:keep-alive

1. 客户主机依然正常运行，并从服务器可达。客户的TCP响应正常，而服务器也知道对方是正常的，服务器在两小时后将保活定时器复位。
2. 客户主机已经崩溃，并且关闭或者正在重新启动。在任何一种情况下，客户的TCP都没有响应。服务端将不能收到对探测的响应，并在75秒后超时。服务器总共发送10个这样的探测 ，每个间隔75秒。如果服务器没有收到一个响应，它就认为客户主机已经关闭并终止连接。
3. 客户主机崩溃并已经重新启动。服务器将收到一个对其保活探测的响应，这个响应是一个复位，使得服务器终止这个连接。
4. 客户机正常运行，但是服务器不可达，这种情况与2类似，TCP能发现的就是没有收到探查的响应。

一、安装环境

二、服务器端安装配置​

[root@local /]# rpm -qa | grep "rpcbind"

rpcbind-0.2.0-11.el6.x86_64

[root@local /]# rpm -qa | grep "nfs"

nfs-utils-1.2.3-39.el6.x86_64

nfs4-acl-tools-0.3.3-6.el6.x86_64

nfs-utils-lib-1.1.5-6.el6.x86_64

[root@local /]# yum -y install nfs-utils rpcbind

[root@local /]# mkdir /sharestore

[root@local /]# vi /etc/exports

/sharestore     *(rw,sync,no_root_squash)

/sharestore   10.10.0.0/8(rw,sync,no_subtree_check,anonuid=48,anongid=48)

[root@local /]# service rpcbind start

Starting rpcbind:                                          [  OK  ]

[root@local /]# service nfs start

Starting NFS services:                                     [  OK  ]

Starting NFS quotas:                                       [  OK  ]

Starting NFS mountd:                                       [  OK  ]

Stopping RPC idmapd:                                       [  OK  ]

Starting RPC idmapd:                                       [  OK  ]

Starting NFS daemon:                                       [  OK  ]

[root@local /]#

[root@local /]# chkconfig rpcbind on

[root@local /]# chkconfig nfs on

三、客户端挂载配置

[root@localhost ~]# mkdir /mnt/store

[root@localhost /]# showmount -e 192.168.0.10

Export list for 192.168.0.10:

/sharestore *

[root@localhost ~]# mount -t nfs 192.168.0.10:/sharestore /mnt/store

[root@localhost ~]# mount

/dev/mapper/VolGroup-lv_root on / type ext4 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

tmpfs on /dev/shm type tmpfs (rw)

/dev/sda1 on /boot type ext4 (rw)

/dev/mapper/VolGroup-lv_home on /home type ext4 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

nfsd on /proc/fs/nfsd type nfsd (rw)

192.168.0.10:/mailstore1/ on /mailstore_new type nfs (rw,vers=4,addr=192.168.0.10,clientaddr=192.168.0.11)

当前状态

服务器A：内网网卡：eth0  内网IP：192.168.0.10

 

服务器B：内网网卡：eth0  内网IP：192.168.0.20

        外网网卡：eth1  外网IP：203.195.32.138

实现方法

echo 1 > /proc/sys/net/ipv4/ip_forward

编辑/etc/sysctl.conf

找到net.ipv4.ip_forward = 0 修改为 net.ipv4.ip_forward = 1 最后保存。

 

执行sysctl -p命令使配置生效：

# sysctl -p

# iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.10 -j SNAT --to 203.195.32.138

# service iptables save

# route add default gw 192.168.0.20

# route -n

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0

0.0.0.0         192.168.0.20    0.0.0.0         UG    0      0        0 eth0

delalloc:

lat (usec): min=2 , max=193466 , avg= 5.86, stdev=227.91



nodelalloc:

lat (usec): min=3 , max=16388 , avg= 7.00, stdev=28.92

1. Buffer IO
2. 写操作过程中会涉及磁盘块的分配，主要是记录日志这类追加写操作；
3. 每次写操作后没有刷新数据，而是等待系统自动进行回写；
4. 对延迟有较高要求。

1、mount -t ext4 -o remount,nodelalloc /${dev} /${mnt};

2、编辑/etc/fstab中相关mount项，添加nodelalloc挂载参数

分享原文：http://www.cnblogs.com/cobbliu/p/5603472.html  

wget的常见用法

wget http://place.your.url/here

wget -r http://place.your.url/here

wget -m http://place.your.url/here

wget -c http://the.url.of/incomplete/file

wget -i download.txt

wget -m –reject=gif http://target.web.site/subdirectory

–http-user=USER    设置HTTP用户

–http-passwd=PASS   设置HTTP密码

http-proxy = 111.111.111.111:8080

ftp-proxy = 111.111.111.111:8080

–proxy-user=USER       设置代理用户

–proxy-passwd=PASS     设置代理密码

wget的使用格式

Usage: wget [OPTION]… [URL]…

wget -r -p -np -k http://dsec.pku.edu.cn/~usr_name/

or

wget -m http://dsec.pku.edu.cn/~usr_name/

wget -t 0 -w 31 -c http://dsec.pku.edu.cn/BBC.avi -o down.log &

wget -t 0 -w 31 -c -B ftp://dsec.pku.edu.cn/linuxsoft -i filelist.txt -o down.log &

wget -Y on -p -k https://sourceforge.net/projects/wvware/

export PROXY=http://211.90.168.99:8080/

http_proxy = http://proxy.yoyodyne.com:18023/

ftp_proxy = http://proxy.yoyodyne.com:18023/

wget各种选项分类列表

-V, –version 显示wget的版本后退出

-h, –help 打印语法帮助

-b, –background 启动后转入后台执行

-e, –execute=COMMAND 执行`.wgetrc’格式的命令，wgetrc格式参见/etc/wgetrc或~/.wgetrc

-o, –output-file=FILE 把记录写到FILE文件中

-a, –append-output=FILE 把记录追加到FILE文件中

-d, –debug 打印调试输出

-q, –quiet 安静模式(没有输出)

-v, –verbose 冗长模式(这是缺省设置)

-nv, –non-verbose 关掉冗长模式，但不是安静模式

-i, –input-file=FILE 下载在FILE文件中出现的URLs

-F, –force-html 把输入文件当作HTML格式文件对待

-B, –base=URL 将URL作为在-F -i参数指定的文件中出现的相对链接的前缀

–sslcertfile=FILE 可选客户端证书

–sslcertkey=KEYFILE 可选客户端证书的KEYFILE

–egd-file=FILE 指定EGD socket的文件名

–bind-address=ADDRESS 指定本地使用地址(主机名或IP，当本地有多个IP或名字时使用)

-t, –tries=NUMBER 设定最大尝试链接次数(0 表示无限制).

-O –output-document=FILE 把文档写到FILE文件中

-nc, –no-clobber 不要覆盖存在的文件或使用.#前缀

-c, –continue 接着下载没下载完的文件

–progress=TYPE 设定进程条标记

-N, –timestamping 不要重新下载文件除非比本地文件新

-S, –server-response 打印服务器的回应

–spider 不下载任何东西

-T, –timeout=SECONDS 设定响应超时的秒数

-w, –wait=SECONDS 两次尝试之间间隔SECONDS秒

–waitretry=SECONDS 在重新链接之间等待1…SECONDS秒

–random-wait 在下载之间等待0…2*WAIT秒

-Y, –proxy=on/off 打开或关闭代理

-Q, –quota=NUMBER 设置下载的容量限制

–limit-rate=RATE 限定下载输率

-nd –no-directories 不创建目录

-x, –force-directories 强制创建目录

-nH, –no-host-directories 不创建主机目录

-P, –directory-prefix=PREFIX 将文件保存到目录 PREFIX/…

–cut-dirs=NUMBER 忽略 NUMBER层远程目录

–http-user=USER 设定HTTP用户名为 USER.

–http-passwd=PASS 设定http密码为 PASS.

-C, –cache=on/off 允许/不允许服务器端的数据缓存 (一般情况下允许).

-E, –html-extension 将所有text/html文档以.html扩展名保存

–ignore-length 忽略 `Content-Length’头域

–header=STRING 在headers中插入字符串 STRING

–proxy-user=USER 设定代理的用户名为 USER

–proxy-passwd=PASS 设定代理的密码为 PASS

–referer=URL 在HTTP请求中包含 `Referer: URL’头

-s, –save-headers 保存HTTP头到文件

-U, –user-agent=AGENT 设定代理的名称为 AGENT而不是 Wget/VERSION.

–no-http-keep-alive 关闭 HTTP活动链接 (永远链接).

–cookies=off 不使用 cookies.

–load-cookies=FILE 在开始会话前从文件 FILE中加载cookie

–save-cookies=FILE 在会话结束后将 cookies保存到 FILE文件中

-nr, –dont-remove-listing 不移走 `.listing’文件

-g, –glob=on/off 打开或关闭文件名的 globbing机制

–passive-ftp 使用被动传输模式 (缺省值).

–active-ftp 使用主动传输模式

–retr-symlinks 在递归的时候，将链接指向文件(而不是目录)

-r, –recursive 递归下载－－慎用!

-l, –level=NUMBER 最大递归深度 (inf 或 0 代表无穷).

–delete-after 在现在完毕后局部删除文件

-k, –convert-links 转换非相对链接为相对链接

-K, –backup-converted 在转换文件X之前，将之备份为 X.orig

-m, –mirror 等价于 -r -N -l inf -nr.

-p, –page-requisites 下载显示HTML文件的所有图片

-A, –accept=LIST 分号分隔的被接受扩展名的列表

-R, –reject=LIST 分号分隔的不被接受的扩展名的列表

-D, –domains=LIST 分号分隔的被接受域的列表

–exclude-domains=LIST 分号分隔的不被接受的域的列表

–follow-ftp 跟踪HTML文档中的FTP链接

–follow-tags=LIST 分号分隔的被跟踪的HTML标签的列表

-G, –ignore-tags=LIST 分号分隔的被忽略的HTML标签的列表

-H, –span-hosts 当递归时转到外部主机

-L, –relative 仅仅跟踪相对链接

-I, –include-directories=LIST 允许目录的列表

-X, –exclude-directories=LIST 不被包含目录的列表

-np, –no-parent 不要追溯到父目录

^(?=.*\\d)(?=.*[a-z])(?=.*[A-Z]).{8,10}$

^[\\u4e00-\\u9fa5]{0,}$

^\\w+$

[\\w!#$%&'*+/=?^_`{|}~-]+(?:\\.[\\w!#$%&'*+/=?^_`{|}~-]+)*@(?:[\\w](?:[\\w-]*[\\w])?\\.)+[\\w](?:[\\w-]*[\\w])?

15位：

^[1-9]\\d{7}((0\\d)|(1[0-2]))(([0|1|2]\\d)|3[0-1])\\d{3}$



18位：

^[1-9]\\d{5}[1-9]\\d{3}((0\\d)|(1[0-2]))(([0|1|2]\\d)|3[0-1])\\d{3}([0-9]|X)$

^(?:(?!0000)[0-9]{4}-(?:(?:0[1-9]|1[0-2])-(?:0[1-9]|1[0-9]|2[0-8])|(?:0[13-9]|1[0-2])-(?:29|30)|(?:0[13578]|1[02])-31)|(?:[0-9]{2}(?:0[48]|[2468][048]|[13579][26])|(?:0[48]|[2468][048]|[13579][26])00)-02-29)$

^[0-9]+(.[0-9]{2})?$

^(13[0-9]|14[5|7]|15[0|1|2|3|5|6|7|8|9]|18[0|1|2|3|5|6|7|8|9])\\d{8}$

^.*MSIE [5-8](?:\\.[0-9]+)?(?!.*Trident\\/[5-9]\\.0).*$

\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b

(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))

if (!s.match(/^[a-zA-Z]+:\\/\\//)) {    s = 'http://' + s;}

^(f|ht){1}(tp|tps):\\/\\/([\\w-]+\\.)+[\\w-]+(\\/[\\w- ./?%&=]*)?

^([a-zA-Z]\\:|\\\\)\\\\([^\\\\]+\\\\)*[^\\/:*?"<>|]+\\.txt(l)?$

^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$

\\< *[img][^\\\\>]*[src] *= *[\\"\\']{0,1}([^\\"\\'\\ >]*)

([^>]*)(href="https?:\\/\\/)((?!(?:(?:www\\.)?'.implode('|(?:www\\.)?', $follow_list).'))[^"]+)"((?!.*\\brel=)[^>]*)(?:[^>]*)>

^\\s*[a-zA-Z\\-]+\\s*[:]{1}\\s[a-zA-Z0-9\\s.#]+[;]{1}

<\\/?\\w+((\\s+\\w+(\\s*=\\s*(?:".*?"|'.*?'|[\\^'">\\s]+))?)+\\s*|\\s*)\\/?>

一、常用配置

Listen[IP:]PORT

Listen 12.24.34.56:80

Listen 8080

# 省略ip表示监听本机所有IP;Listen可重复出现多次；

KeepAive On # 开启

MaxKeepAliveRequests 0  # 一个持久TCP最多允许的请求数，这里设置0表示不限制)

KeepAliveTimeout 15 # 表示15秒

   echo "Apache进程号:". getmypid();

?>

StartServers       8    #服务启动时启动的子进程数

MinSpareServers    5    #最少空闲子进程数

MaxSpareServers   20

ServerLimit      256    #同时启动的子进程数上限

MaxClients       256    #同时服务的客户端数上限（支持的并发数上限）

MaxRequestsPerChild  4000   #每个子进程在其生命周期内处理的请求数上限



 



StartServers         4   #服务启动时启动的子进程数

MaxClients         300

MinSpareThreads     25

MaxSpareThreads     75

ThreadsPerChild     25    #每个子进程可启动的线程数

MaxRequestsPerChild  0    #每个子进程可处理的请求数，0表示无限制

配置指令实现模块加载

LoadModule  

#要卸载某个模块直接将其注释掉即可，不用重读配置文件就可立即生效；模块路径为相对于ServerRoot而言的路径

显示DSO动态装载的模块：

# httpd -D DUMP_MODULES

Loaded Modules:

 core_module (static)

 mpm_prefork_module (static)

 http_module (static)

 so_module (static)

 auth_basic_module (shared)

 auth_digest_module (shared)

 authn_file_module (shared)

 authn_alias_module (shared)

 ...

# httpd -l

Compiled in modules:

  core.c

  prefork.c

  http_core.c

  mod_so.c

# httpd.worker -l

Compiled in modules:

  core.c

  worker.c

  http_core.c

  mod_so.c

DocumentRoot "/path/to/somefile"

文档路径映射：

DocumentRoot 指向的路径为URL路径的起始位置；

DocumentRoot "/var/www/html"   #默认为这个位置

test/index.html-->http://HOST:PORT/test/index.html

文件系统路径：



...



[~] "/path/to/somewhere">

...



基于URL访问路径做访问控制：



...



#另外，路径可做模式匹配，但若非迫不得已不建议使用

#如果即能使用Diretoory控制，也能使用Location控制，建议使用Directory

(1)Options

所有可用特性：Indexes,Includes,FollowSymLinks,SymLinksifOwnerMatch 

         ExecCGI,MultiViews,None,All

Indexes:索引；在无默认主页面又无欢迎页时，将所有资源以列表形式呈现给用户。

     危险，慎用；在选项前添加减号即为禁用。如-Indexes

FollowSymlinks：允许跟踪符号链接文件；

# vim /etc/httpd/conf/httpd.conf



    Options Indexes FollowSymLinks   #默认是开启的

    AllowOverride None

    Order allow,deny

    Allow from all



（2）AllowOverride

支持在每个页面目录下创建.htaccess用于实现对此目录中资源访问时的访问控制功能；

.htaccess文件会影响httpd的性能

（3）基于IP做访问控制机制

    Order：检查次序

        Order allow,deny

        Allow form 192.168.10.0/24

            form后面能够接受的地址格式：

                IP，Network Address

                网络地址格式较为灵活：

                    172.16

                    172.16.0.0

                    172.16.0.0/16

                    172.16.0.0/255.255.0.0

DirecotryIndex index.htm lindex.html.var

ErrorLog "/path/to/error_log"   #错误日志，路径为相对于ServerRoot而言的路径

LogLevel {debug|info|notice|warn|error|crit|alert|emerg}

   指定级别及比其更高级别的信息都会被记录      

LogFormat 格式 格式名

  %h: 客户端地址

  %l: 远程登录名，通常为-

  %u: 认证时输入用户名，没有认证时为-

  %t: 服务器收到 用户请求时的时间

  %r：请求报名的起始行

  %>s: 响应状态码

  %b: 响应报文的长度，单位是字节

  %{HEADER_NAME}i: 记录指定首部对应的值

例如 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined    

#格式中若要使用引号则要使用反斜线转义

    CustomLog "/path/to/access_log" LogFormat_Name

# mkdir test hello

# cat test/a.html 

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

# cat hello/b.html 

bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

# vim /etc/httpd/conf/httpd.conf

Alias /test/ "/www/html/hello/"

# service httpd restart

停止 httpd：                                               [确定]

正在启动 httpd：                                           [确定]

 

# curl http://localhost/test/a.html









Not Found


The requested URL /test/a.html was not found on this server.




Apache/2.2.15 (CentOS) Server at localhost Port 80




# curl http://localhost/test/b.html

bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

AddDefaultCharset UTF-8

# 字符集：GBK,GB2312,GB18030

用户认证类型：

  基本认证：Basic，明文发送

  摘要认证：digest

虚拟用户：仅用于访问某服务或获取某资源的凭证；

  账号和密码的存储机制：

    文本文件：.htpasswd

    SQL数据库

    dbm：数据库引擎，提供API

    ldap:

案例：基于文件做访问控制

(1)基于用户进行认证

    

        Options none

        AllowOverride AuthConfig

        AuthType Basic

        AuthName "admin area"

        AuthBasicProvider file

        AuthUserFile /etc/httpd/conf/.htpasswd

        Require valid-user

    

    # Require valid-user：文件中所有用户均可访问

    # Require user USERNAME,... 指定用户访问

(2)提供认证文件

    htpasswd [option] passwdfile username

    选项：

    -c：创建一个passwdfile，如果passwdfile已经存在，那么它会重新写入并删除原有内容

    -m：以md5的格式编码存储用户的密码信息

    -s：sha1加密用户密码；

    -D：删除指定用户

(3)基于组认证

    

        Options none

        AllowOverride AuthConfig

        AuthType Basic

        AuthName "admin area"

        AuthBasicProvider file

        AuthUserFile /etc/httpd/conf/.htpasswd

        AuthGroupFile /etc/httpd/conf/.htgroup

        Require group GROUP_NAME

    

    组文件（.htgroup）格式    组名：user1 user2 user3

例如：

# cd /var/www/html

# mkdir admin

# cat admin/admin.html  

The user is admin.  

# vim /etc/httpd/conf/httpd.conf

    

    Options none

    AllowOverride AuthConfig

    AuthType Basic

    AuthName "admin area"

    AuthBasicProvider file

    AuthUserFile /etc/httpd/conf/.htpasswd

    Require valid-user

    

# htpasswd -c -m /etc/httpd/conf/.htpasswd bjwf #创建第一个用户时必须创建文件

New password: 

Re-type new password: 

Adding password for user bjwf

# htpasswd -m /etc/httpd/conf/.htpasswd tom   #创建第二个用户

New password: 

Re-type new password: 

Adding password for user tom

# service httpd restart

有三种实现方案：

  基于ip：为每个虚拟主机准备至少一个ip地址；

  基于port：为每个虚拟主机准备至少一个专用port；实践中很少使用；

  基于hostname：为每个虚拟主机准备至少一个专用hostname；

可混合使用上述三种方式中任意方式；

注意：一般虚拟主机莫与中心主机混用，所以，要使用虚拟主机，先禁用中心主机；

禁用中心主机：注释DocumentRoot

每个虚拟主机都有专用配置：



SeverName

DocumentRoot""



ServerAlias:虚拟主机的别名；

ErrorLog

CustomLog





 

示例1：基于ip

  

    ServerName web1.magedu.com

    DocumentRoot"/vhosts/web1/htdocs"

  

 

  

    ServerName web2.magedu.com

    DocumentRoot "/vhosts/web2/htdocs"

  

示例2：基于port

  

    ServerNameweb2.magedu.com

    DocumentRoot"/vhosts/web2/htdocs"

  

 

  

    ServerName web3.magedu.com

    DocumentRoot "/vhosts/web3/htdocs"

  

示例3：基于hostname

  

    ServerName web1.magedu.com

    DocumentRoot "/vhosts/web1/htdocs"

  

 

  

    ServerName web2.magedu.com

    DocumentRoot "/vhosts/web2/htdocs"

  

 

  

    ServerName web3.magedu.com

    DocumentRoot "/vhosts/web3/htdocs"

  

#注：一般要启用虚拟主机，最好是新建一个文档在/etc/httpd/conf.d/vhost.conf里面，这样一来虚拟主机

设定的参数可以随便修改，而且不会影响到主配置文件，而主配置文件httpd.conf中有个include的参数可以

将/etc/httpd/conf.d/*.conf都包含进来。

# mkdir /var/www/html/{a.com,b.net,c.org} -pv

mkdir: 已创建目录 "/var/www/html/a.com"

mkdir: 已创建目录 "/var/www/html/b.net"

mkdir: 已创建目录 "/var/www/html/c.org"

# echo a.com > /var/www/html/a.com/index.html

# echo b.net > /var/www/html/b.net/index.html

# echo c.org > /var/www/html/c.org/index.html

# cat vhost.conf （基于IP的虚拟主机）



    ServerName www.a.com

    DocumentRoot "/var/www/html/a.com"



 



    ServerName www.b.net

    DocumentRoot "/var/www/html/b.net"



 



    ServerName www.c.org

    DocumentRoot "/var/www/html/c.org"



# curl http://192.168.130.250

a.com

# curl http://192.168.130.251

b.net

# curl http://192.168.130.252

c.org

 

# cat vhost.conf  （基于主机名的虚拟主机）

NameVirtualHost *:80



    ServerName www.a.com

    DocumentRoot "/var/www/html/a.com"



 



    ServerName www.b.net

    DocumentRoot "/var/www/html/b.net"



 



    ServerName www.c.org

    DocumentRoot "/var/www/html/c.org"



# cat /etc/hosts

192.168.130.250 kvm.jlc.com

192.168.130.250 www.a.com

192.168.130.250 www.b.net

192.168.130.250 www.c.org

# curl http://www.a.com

a.com

# curl http://www.b.net

b.net

# curl http://www.c.org

c.org

# vim httpd.conf 



    SetHandler server-status

    Order allow,deny

    Allow from 192.168.130.0/24

    Allow from 192.168.120.0/24

    Deny from all



# httpd -t  #检查配置文件语法

Syntax OK

# service httpd reload

用法：curl [option] URL

常用选项：

    -A/--user-agent  设置用户代理发送给服务器

    -basic 使用HTTP基本认证

    --tcp-nodelay 使用TCP_NODELAY选项

    -e/--referer  来源网址

    --cacert  CA证书 (SSL)

    --compressed 要求返回是压缩的格式

    -H/--header 自定义首部信息传递给服务器

    -I/--head 只显示响应报文首部信息

    --limit-rate  设置传输速度

    -u/--user [:password]>设置服务器的用户和密码

    -0/--http1.0 使用HTTP 1.0

# mod_deflate configuration

                  

# Restrict compression to these MIME types

AddOutputFilterByType DEFLATE text/plain 

AddOutputFilterByType DEFLATE text/html

AddOutputFilterByType DEFLATE application/xhtml+xml

AddOutputFilterByType DEFLATE text/xml

AddOutputFilterByType DEFLATE application/xml

AddOutputFilterByType DEFLATE application/x-javascript

AddOutputFilterByType DEFLATE text/javascript

AddOutputFilterByType DEFLATE text/css

          

# Level of compression (Highest 9 - Lowest 1)

DeflateCompressionLevel 9   #指定压缩比

              

# Netscape 4.x has some problems.

BrowserMatch ^Mozilla/4 gzip-only-text/html  #针对特定浏览器的特殊指定

              

# Netscape 4.06-4.08 have some more problems

BrowserMatch ^Mozilla/4\.0[678] no-gzip

              

# MSIE masquerades as Netscape, but it is fine

BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html

配置文件：/etc/httpd/conf.d/ssl.conf

DocumentRoot

ServerName

SSLCertificateFile

SSLCertificateKeyFile

# openssl s_client [-connect host:port] [-cert filename] [-CApath directory] [-CAfile filename]

1、httpd上生成证书

# mkdir /etc/httpd/ssl

# cd /etc/httpd/ssl

# (umask 077;openssl genrsa -out httpd.key 1024)

Generating RSA private key, 1024 bit long modulus

..........................................++++++

..............++++++

e is 65537 (0x10001)

[root@kvm ssl]# openssl req -new -key httpd.key -out httpd.csr -days 3655

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:BJ

Locality Name (eg, city) [Default City]:BJ

Organization Name (eg, company) [Default Company Ltd]:JLC

Organizational Unit Name (eg, section) []:JSB

Common Name (eg, your name or your server's hostname) []:www.bjwf.com

Email Address []:admin@bjwf.com        

 

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

2、自建CA

# cd /etc/pki/CA

# (umask 077;openssl genrsa -out private/cakey.pem 2048)

Generating RSA private key, 2048 bit long modulus

...............................................................+++

......+++

e is 65537 (0x10001)

[root@kvm CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:BJ

Locality Name (eg, city) [Default City]:BJ

Organization Name (eg, company) [Default Company Ltd]:JLC

Organizational Unit Name (eg, section) []:JSB

Common Name (eg, your name or your server's hostname) []:ca.bjwf.com

Email Address []:ca@bjwf.com

# touch index.txt serial   #准备文件

# echo 01 > serial

# openssl ca -in httpd.csr -out httpd.crt -days 365  #CA签署证书

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: Jun 23 08:06:22 2016 GMT

            Not After : Jun 23 08:06:22 2017 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = BJ

            organizationName          = JLC

            organizationalUnitName    = JSB

            commonName                = www.bjwf.com

            emailAddress              = admin@bjwf.com

        X509v3 extensions:

            X509v3 Basic Constraints: 

                CA:FALSE

            Netscape Comment: 

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier: 

                83:60:A6:B7:E5:EF:E1:50:A6:69:E2:BD:3A:60:50:AF:A6:36:1B:39

            X509v3 Authority Key Identifier: 

                keyid:B2:5F:33:01:B3:1A:B5:B9:2B:0F:C0:A5:37:48:AE:FD:3E:49:09:5F

 

Certificate is to be certified until Jun 23 08:06:22 2017 GMT (365 days)

Sign the certificate? [y/n]:y

 

 

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

3、配置https

# yum -y install mod_ssl

# cd /etc/httpd/conf.d

# vim ssl.conf 



...

DocumentRoot "/var/www/html/a.com"

ServerName a.com:443

... 

SSLCertificateFile /etc/httpd/ssl/httpd.crt   #指明服务器证书的位置

...

SSLCertificateKeyFile /etc/httpd/ssl/httpd.key    #指明服务器密钥的位置

...



# httpd -t

Syntax OK

# service httpd restart   #查看https服务端口是否监听

停止 httpd：                                               [确定]

正在启动 httpd：                                           [确定]

[root@kvm conf.d]# netstat -tnlp|grep 443

tcp        0      0 :::443        :::*       LISTEN      15378/httpd  

# openssl s_client -connect 192.168.130.250:443 -CAfile /etc/pki/CA/cacert.pem

CONNECTED(00000003)

---

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384

Server public key is 1024 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

    Session-ID: 82D9C7A1676D82AB28F73C8C0A6322A023689B8F73491E3E78B73F7E

    Session-ID-ctx: 

    Master-Key: 340D147D1F4B479A0226EC9708728C9D872BFAF1B20B02C3403C9EDA98578D4

    Key-Arg   : None

    Krb5 Principal: None

    PSK identity: None

    PSK identity hint: None

    TLS session ticket lifetime hint: 300 (seconds)

    TLS session ticket:

    0000 - 31 a3 1a 34 ba e5 11 99-77 6e e2 86 7b dc cf 3f   1..4....wn..{..?

    0010 - d0 a9 3f 22 f0 77 4e ec-31 52 6b dd a7 70 41 44   ..?".wN.1Rk..pAD

    0020 - e9 02 25 1f ee 24 56 d3-77 ac 56 10 e7 99 12 63   ..%..$V.w.V....c

    0030 - 2e 8c d9 09 15 32 59 21-46 17 8e 77 de 0f ff e8   .....2Y!F..w....

    0040 - 31 b4 e1 57 63 02 09 a1-31 42 8f f2 3f e3 49 c6   1..Wc...1B..?.I.

    0050 - e7 66 ee 95 8b 1c 6a 7f-cc 8e 9b 5e 83 c2 c9 2f   .f....j....^.../

    0060 - 8e 26 62 1b 0b 39 4b 79-50 80 5e de c6 dc 01 f9   .&b..9KyP.^.....

    0070 - 81 16 c7 3b 5a 90 3a a2-85 27 b4 7c ea 20 d5 83   ...;Z.:..'.|. ..

    0080 - 7e fe 9f 37 8b b3 66 3e-e1 e8 a6 fd 32 9b d0 82   ~..7..f>....2...

    0090 - 9f b0 be 7e a4 cf cf 6d-85 0d 93 ca 2b 70 c5 cf   ...~...m....+p..

    00a0 - 55 57 07 f7 bc fc 1d a2-df 30 d0 b6 05 6c 25 15   UW.......0...l%.

    00b0 - ee 32 51 6c 87 51 25 b9-55 3b 96 d3 50 4a 03 b6   .2Ql.Q%.U;..PJ..

 

    Start Time: 1466669780

    Timeout   : 300 (sec)

    Verify return code: 0 (ok)

---

 

GET /index.html HTTP/1.1

HOST: www.a.com

 

HTTP/1.1 200 OK

Date: Thu, 23 Jun 2016 08:16:51 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 23 Jun 2016 06:27:07 GMT

ETag: "260639-6-535ec24af4cd1"

Accept-Ranges: bytes

Content-Length: 6

Connection: close

Content-Type: text/html; charset=UTF-8

 

a.com

closed

二、httpd自带工具

1、httpd：apache服务器程序

  常用选项：

    -t：测试配置文件

    -l：显示静态编译进httpd的模块

    -D DUMP_MODULES：列出DSO模块

    -M：相当于-t -D DUMP_MODULES

    -D DUMP_VHOSTS：列出所有虚拟主机

2、htpasswd：为基于文件的basic认证创建和更新用户认证文件

  常用选项：

    -c：创建一个passwdfile，如果passwdfile已经存在，那么它会重新写入并删除所有内容

    -m：以md5的格式编码存储用户的密码信息

    -s：sha1加密用户密码

    -D：删除指定用户

3、apachectl：脚本，httpd服务控制工具

  常用选项：

    start：启用服务

    stop：关闭服务

    status：查看服务

    configtest：测试服务配置文件

4、ab：apache benchmark，httpd的基准性能测试工具

  用法：ab [options] [http[s]://]hostname[:port]/path/to/somefile

  常用选项：

    -c #：模拟的并发数

    -n #：模拟的请求数，-n的值一定要大于等于-c的值

  同类工具：http_load，webbench，seige

5、apxs：httpd得以扩展使用第三方模块的工具

6、htcacheclean：磁盘缓存清理工具

7、htdigest：为digest认证创建和更新用户认证文件

8、httxt2dbm：为rewrite map创建dbm格式的文件

9、rotatelogs：滚动日志，不关闭httpd而切换其使用日志文件的工具

    access_log, access_log.1, access_log.2,

10、suexec：当httpd进程需要以另外的用户的身份去访问某些资源时，可以以suexec作临时切换；

三、资源限定

可以使用ulimit命令临时的修改各种资源的软限制：

  ulimit -n [#]：显示或设置能同事打开的文件句柄数

    linux内核允许普通用户最多同时打开1024个文件

  ulimit -u [#]：显示或设备能同时启动的进程数

  ulimit -a：显示当前资源限定的设定

要长期有效，需要修改配置文件

  /etc/security/limits.conf

  /etc/security/limits.d/*.conf

 

更多选项：参考博客文档收集

ulimit -a 用来显示当前的各种用户进程限制。

Linux对于每个用户，系统限制其最大进程数。为提高性能，可以根据设备资源情况，设置各linux用户

的最大进程数，下面我把某linux用户的最大进程数设为10000个：

ulimit -u 10000

其他建议设置成无限制（unlimited）的一些重要设置是：

数据段长度：ulimit -d unlimited

最大内存大小：ulimit -m unlimited

堆栈大小：ulimit -s unlimited

CPU 时间：ulimit -t unlimited

虚拟内存：ulimit -v unlimited

linux对用户有默认的ulimit限制，而这个文件可以配置用户的硬配置和软配置，硬配置是个上限。

超出上限的修改就会出“不允许的操作”这样的错误。

   

       

# ulimit -n

1024

# ulimit -n 65535

# ulimit -n

65535

 

#                 

#

 

#*               soft    core            0

#*               hard    rss             10000

#@student        hard    nproc           20

#@faculty        soft    nproc           20

#@faculty        hard    nproc           50

#ftp             hard    nproc           0

#@student        -       maxlogins       4

 

# End of file

*        soft    noproc 10240

*        hard    noproc 10240

*        soft    nofile 10240

*        hard    nofile 10240     这就可以限定用户打开的最大线程及文件为10240个

四、AB测试

# ab -c 300 -n 3000 http://www.a.com/index.html

This is ApacheBench, Version 2.3 <$Revision: 655654 $>

Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/

Licensed to The Apache Software Foundation, http://www.apache.org/

 

Benchmarking www.a.com (be patient)

Completed 300 requests

Completed 600 requests

Completed 900 requests

Completed 1200 requests

Completed 1500 requests

Completed 1800 requests

Completed 2100 requests

Completed 2400 requests

Completed 2700 requests

Completed 3000 requests

Finished 3000 requests

 

 

Server Software:        Apache/2.2.15

Server Hostname:        www.a.com

Server Port:            80

 

Document Path:          /index.html

Document Length:        6 bytes   #请求的资源大小

 

Concurrency Level:      300     #并发数

Time taken for tests:   0.630 seconds  #测试的总时长

Complete requests:      3000    #请求总数

Failed requests:        0     #失败的请求

Write errors:           0

Total transferred:      816272 bytes   #总共传输了多少字节

HTML transferred:       18006 bytes    #整个场景中HTML内容传输量

Requests per second:    4760.79 [#/sec] (mean)  #每秒处理的请求个数

Time per request:       63.015 [ms] (mean)      #每处理一个并发单位所经过的时长

Time per request:       0.210 [ms] (mean, across all concurrent requests) #处理单个请求的时长

Transfer rate:          1265.01 [Kbytes/sec] received  #传输速率

 

Connection Times (ms)

              min  mean[+/-sd] median   max

Connect:        0    2   3.4      1      16

Processing:     1   47 129.2     18     608

Waiting:        1   47 129.2     18     608

Total:          8   49 131.4     19     619

 

Percentage of the requests served within a certain time (ms)

  50%     19

  66%     19

  75%     20

  80%     20

  90%     21

  95%    617

  98%    618

  99%    618

 100%    619 (longest request)

#redis

100.10.32.54:6400 主库

100.10.32.55:6400 从库

100.10.32.250 VIP



#sentinel

100.10.32.54:26400 sentinel 本地节点

100.10.32.55:26400 sentinel 本地节点 

100.10.32.57:26400 sentinel 仲裁节点

yum -y install redis

vim /etc/redis_6400.conf

 

daemonize yes

pidfile "/var/run/redis_6400.pid"

port 6400

tcp-backlog 65535

bind 0.0.0.0

timeout 0

tcp-keepalive 0

loglevel notice

logfile "/var/log/redis/redis_6400.log"

maxmemory 8gb

maxmemory-policy allkeys-lru

databases 16

save 900 1

save 300 10

save 60 10000

stop-writes-on-bgsave-error yes

rdbcompression yes

rdbchecksum yes

dbfilename "dump.rdb"

dir "/data/redis/6400"

slave-serve-stale-data yes

slave-read-only yes

repl-disable-tcp-nodelay no

slave-priority 100

appendonly no

appendfilename "appendonly.aof"

appendfsync everysec

no-appendfsync-on-rewrite no

auto-aof-rewrite-percentage 100

auto-aof-rewrite-min-size 64mb

lua-time-limit 5000

slowlog-log-slower-than 10000

slowlog-max-len 128

notify-keyspace-events ""

hash-max-ziplist-entries 512

hash-max-ziplist-value 64

list-max-ziplist-entries 512

list-max-ziplist-value 64

set-max-intset-entries 512

zset-max-ziplist-entries 128

vim /etc/redis-sentinel6400.conf

 

daemonize yes

port 26400

dir "/data/redis/redis_sentinels"

pidfile "/var/run/redis/sentinel6400.pid"

logfile "/data/redis/redis_sentinels/sentinel6400.log"

sentinel monitor master6400 100.10.32.54 6400 2

sentinel down-after-milliseconds master6400 6000

sentinel failover-timeout master6400 18000

sentinel client-reconfig-script master6400 /opt/notify_master6400.sh   ##仲裁节点无需添加这行配置，client-reconfig-script参数是在sentinel做failover的过程中调用脚本漂vip到新的master上

vim /opt/notify_master6400.sh

 

#!/bin/bash

MASTER_IP=$6

LOCAL_IP='100.10.32.54' #从库修改为100.10.32.55

VIP='100.10.32.250'

NETMASK='24'         

INTERFACE='eth0' 

if [ ${MASTER_IP} = ${LOCAL_IP} ]; then

         /sbin/ip addr add ${VIP}/${NETMASK} dev ${INTERFACE}

         /sbin/arping -q -c 3 -A ${VIP} -I ${INTERFACE}

        exit 0

else

         /sbin/ip addr del ${VIP}/${NETMASK} dev ${INTERFACE}

        exit 0

fi

exit 1

chmod +x /opt/notify_master6400.sh   #赋予可执行权限

redis-server /etc/redis_6400.conf

redis-cli -p 6400 slaveof 10.10.32.54 6400

/sbin/ip addr add 100.10.32.250/24 dev eth0

redis-server /etc/redis-sentinel6400.conf --sentinel

[root@localhost tmp]# redis-cli -h 100.10.32.54  -p 6400 info  Replication

# Replication

role:master

connected_slaves:1

slave0:ip=100.10.32.55,port=6400,state=online,offset=72669,lag=1

master_repl_offset:72669

repl_backlog_active:1

repl_backlog_size:1048576

repl_backlog_first_byte_offset:2

repl_backlog_histlen:72668

[root@localhost tmp]# redis-cli -h 100.10.32.54  -p 26400 info Sentinel

# Sentinel

sentinel_masters:1

sentinel_tilt:0

sentinel_running_scripts:0

sentinel_scripts_queue_length:0

master0:name=master6400,status=ok,address=100.10.32.54:6400,slaves=1,sentinels=3

[root@localhost tmp]# ip a |grep eth0

2: eth0:  mtu 1500 qdisc mq state UP qlen 1000

    inet 100.10.32.54/24 brd 100.10.32.255 scope global eth0

    inet 100.10.32.250/24 scope global secondary eth0

redis-cli -h 100.10.32.54  -p 6400 shutdown

[root@localhost tmp]# redis-cli -h 100.10.32.55 -p 6400 info Replication

# Replication

role:master

connected_slaves:0

master_repl_offset:0

repl_backlog_active:0

repl_backlog_size:1048576

repl_backlog_first_byte_offset:0

repl_backlog_histlen:0

[root@localhost tmp]# ip a |grep eth0

2: eth0:  mtu 1500 qdisc mq state UP qlen 1000

    inet 100.10.32.55/24 brd 100.10.32.255 scope global eth0

    inet 100.10.32.250/24 scope global secondary eth0

[root@localhost tmp]# redis-cli -p 26400 info  Sentinel

# Sentinel

sentinel_masters:1

sentinel_tilt:0

sentinel_running_scripts:0

sentinel_scripts_queue_length:0

master0:name=master6400,status=ok,address=100.10.32.55:6400,slaves=1,sentinels=3

550 Mail content denied

550 Connection denied

550 Connection frequency limited

550 5.5.0 Invalid EHLO/HELO domain

status=deferred

host xxx.mail.eo.outlook.com[xxx.xxx.163.247] said: 550

    5.7.1 Service unavailable; Client host [xxx.xxx.xxx..16] blocked using FBLW15;

    To request removal from this list please forward this message to

    delist@messaging.microsoft.com (in reply to RCPT TO command)

Please Help me out to solve the belowisuue.

My Below IP Address are showing Blacklisted on below dns address IP Address:IP xxx.xxx.xxx.xxx . Please Help me and removemy ip from black list Thank you!

xxxxx

Hello ,

Thank you for your delisting request SRX1251909371ID. Your ticket was received on (Jun 25 2014 07:59 AM UTC) and will be responded to within 24 hours.

Our team will investigate the address that you have requested to be removed from our blocklist. If for any reason we are not able to remove your address, one of our technical support representatives will respond to you with additional information.

Regards,

Technical Support

status=bounced (host mx54.dns.com.cn[220.181.130.176]said: 550 Does not like recipient,your

mail is rejected! (in reply to end of DATA command)); sender non-delivery notification: F20F2DD80FC;removed

1）status=bounced(hostmx3.qq.com[183.60.2.53]said:550Mailboxnotfound.http://service.mail.qq.com/cgi-bin/help?subtype=1&&id=20022&&no=1000728 (in reply to RCPT TO command)); sender non-delivery notification: 9CC7FDD8084; removed

2）status=bounced (host 163mx01.mxmail.netease.com[220.181.12.62] said: 550 User not found: cjld@163.com (in reply to RCPT TO command)); sender non-delivery notification: 8FD7CA00013A; removed

status=deferred(hostmxzwg4.mxhichina.com[58.68.254.104]said:450MI:IPBhttp://www.net.cn/service/faq/youx/mailsy/200905/3781.html (in reply to MAIL FROM command))

status=deferred(connecttoapllo-zm.com[60.191.124.236]:25:Connectiontimedout);from=, size=24500463, nrcpt=2 (queue active);

1）status=bounced (host sohumx1.sohu.com[220.181.26.202] said: 553 5.7.3 CONTENT REJECT:10.10.71.82.2011062016.XXD6ywq8:dspam check:5:http://mail.sohu.com/info/policy/12 (in reply to end of DATA command));

2）Recipient address rejected: User unknown in local recipient table

.Clienthostrejected: Access denied; from= to= proto=SMTP helo=

 status=bounced (host mx1.mail.cnb.yahoo.com[203.209.228.250] said: 554 delivery error: dd Sorry your message to weixing201314@yahoo.com.cn cannot be delivered. This account has been disabled or discontinued [#102]. - mta1004.mail.cnb.yahoo.com (in reply to end of DATA command)); sender non-delivery notification: 1C580DD80B4; removed

9status=bounced (message size 24864357 exceeds size limit 10240000 of server cluster4.us.messagelabs.com[98.126.139.202]); sender non-delivery notification: C6A3BDD8078; removed