모든 설정은
개인서버기준이므로..
sudo passwd root
위 명령어로 루트로 로그인하도록한다
패스워드 설정해주면된다
앞으로
sudo 슈퍼유저두~ 는 빼도록한다
root@linux:/# mkdir -pv /var/www/html/virtualhost
root@linux:/# chmod 775 -R /var/www/html/virtualhost
root@linux:/# vi /var/www/html/virtualhost/index.php
아래 내용을 넣어주고 저장하자
<html> <body> <p>virtual host </p> </body> </html>
root@linux:/# vi /etc/apache2/sites-available/virtualhost.conf
<VirtualHost *:80> # ServerAdmin webmaster@virtualhost.net ServerName www.virtualhost.net ServerAlias virtualhost.net DocumentRoot /var/www/html/virtualhost.net DirectoryIndex index.html ErrorLog $/virtualhost.net_error.log CustomLog $/virtualhost.net_access.log combined </VirtualHost> <Directory /var/www/html/virtualhost.net> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory>
root@linux:/# a2ensite virtualhost.conf
root@linux:/# apache2ctl configtest
위와같은 오류가뜬다
root@linux:/# grep ServerName /etc/apache2/apache2.conf
ServerName이 지정되지 않았다.
root@linux:/# echo "ServerName localhost" >> /etc/apache2/apache2.conf
root@linux:/# grep ServerName /etc/apache2/apache2.conf
root@linux:/# systemctl reload apache2
root@linux:/# vi /etc/hosts
127.0.0.1 localhost
127.0.1.1 anonymous-desktop
127.0.2.1 virtualhost.net
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.2.1 virtualhost.net 를 추가해준다
OpenSSL 패키지 설치해주자
root@linux:/# apt install openssl
root@linux:/# openssl version
root@linux:/# mkdir -pv /etc/ssl/ssc
root@linux:/# cd /etc/ssl/ssc
root@linux:/etc/ssl/ssc# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout virtualhost.net.key -out virtualhost.net.key.crt
req req 명령은 주로 PKCS #10 형식으로 인증서 요청을 만들고 처리합니다. 예를 들어 루트 CA로 사용할 자체 서명된 인증서를 추가로 만들 수 있음-x509 x.509는 암호학에서 공개키 인증서와 인증 알고리즘의 표준 가운데 공개키 기반(PKI)의 ITU-T 표준OpenSSL에서 이 옵션을 사용한다는 것은 인증서 요청(CSR) 대신 자체 서명된 인증서를 출력합니다. 일반적으로 테스트 인증서 또는 자체 서명된 루트 CA를 생성하는 데 사용-nodes 개인키를 생성 시 암호화하지 않음-days 365 해당 인증서의 유효 기간을 설정합니다. 이 옵션을 지정하지 않으면 기본값으로 30일이 지정-newkey rsa:2048 새 인증서 요청과 새 개인키를 생성합니다. 뒤이어 오는 인수는 쌍점(:)으로 구별되어 전자는 암호 알고리즘이고, 후자는 비트수즉, rsa:2048는 RSA 알고리즘으로 2048비트 수의 RSA 키를 생성-keyout virtualhost.net.key 새로 생성된 개인키를 사용할 파일을 지정합니다. -out virtualhost.net.key.crt 기본적으로 기록할 출력 파일 이름 또는 표준 출력을 지정.
생성되었는지 확인
root@linux:/etc/ssl/ssc# ls -l
확장자가 key인 파일은 SSLCertificateKeyFile
확장자가 crt인 파일은 SSLCertificateFile과 SSLCertificateChainFile
인증서 디렉터리와 파일 소유권 및 권한 조정을 통한 보안 설정
root@linux:/# chown -R root:root /etc/ssl/ssc
root@linux:/# chmod 600 /etc/ssl/ssc/*.*
root@linux:/# chmod 700 /etc/ssl/ssc
방화벽 설정
방화벽 활성화
root@linux:/# ufw enable
방화벽확인
root@linux:/# ufw status
방화벽확인방법 포트번호화 프로톸로도 확인가능
root@linux:/# ufw status verbose
root@linux:/# ufw allow "Apache Full"
root@linux:/# ufw status
root@linux:/# ufw allow 1980
root@linux:/# ufw allow ssh
Apache2 서버 설정
root@linux:/# a2enmod ssl
a2enmod a2enmod는 인수로 지정한 모듈을 활성화시키는 명령입니다. 이 명령은 /etc/apache2/mods-available 디렉터리에 존재하는 모듈들 중 지정한 모듈 관련 파일에 대한 심볼릭 링크를 /etc/apache2/mods-enabled 디렉터리에 생성하는 것입니다. a2dismod 활성화된 모듈을 비활성화하고자 한다면 'a2dismod 모듈명' 명령을 사용하시면 됩니다.
root@linux:/# systemctl restart apache2
root@linux:/# cd /etc/apache2/sites-available
파일확인
root@linux:/etc/apache2/sites-available# ls
virtualhost.comf 파일을 아래와같이 수정해주자
<IfModule mod_ssl.c> <VirtualHost _default_:443> ServerName virtualhost.co.kr ServerAlias virtualhost.co.kr DocumentRoot /var/www/virtualhost DirectoryIndex index.php ErrorLog $/ssl-t_error.log CustomLog $/ssl-nt_access.log combined LogLevel info ssl:warn #Include conf-available/serve-cgi-bin.conf SSLEngine on SSLCertificateFile /etc/ssl/ssc/virtualhost.co.kr.key.crt SSLCertificateKeyFile /etc/ssl/ssc/virtualhost.co.kr.key #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars </FilesMatch> <Directory /usr/lib/cgi-bin> SSLOptions +StdEnvVars </Directory> # BrowserMatch "MSIE [2-6]" \ # nokeepalive ssl-unclean-shutdown \ # downgrade-1.0 force-response-1.0 </VirtualHost> </IfModule>
구문검사
root@linux:/# apache2ctl configtest
오류를 찾아서 수정해준다
보통 에러는 찬찬히 읽어보면 워가 잘못된건지 알려준다
경로가 잘못되었다
ErrorLog /var/log/apache2/ssl-virtualhost_error.log CustomLog /var/log/apache2/ssl-virtualhost_access.log combined
요렇게 수정해주자
root@linux:/# sudo systemctl reload apache2
라고했는데..
여기까지는 자체인증서네??
장난치나..ㅡㅡ;
나는 Encrypt 를 이용해서 하고싶다고~!
위에서 만든 자체 인증서는 바로 칼 삭.
다시
root@linux:/etc#
cd /etc/apache2/sites-available/
root@linux:/etc/apache2/sites-available#
ll
root@linux:/etc/apache2/sites-available#
cp default-ssl.conf mydomin.conf
root@linux:/#
ln -s /etc/apache2/sites-available/mydomin.co.kr /etc/apache2/sites-enabled/
Certbot 설치하기
root@linux:/#
apt install certbot python3-certbot-apache -y
Ubuntu VirtualHost 설정 파일 수정
root@linux:/#
vi /etc/apache2/sites-available/mydomin.co.kr
<VirtualHost *:443>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html -> DocumentRoot /var/mydomin
그리고 아래 두줄을 6,7번라인이나 아무곳이나 추가해준다
ServerName mydomin.co.kr ServerAlias mydomin.co.kr
/etc/apache2/sites-available/000-default.conf
파일에 아래 내용 하단에 추가
<VirtualHost *:80>
ServerName jump
ServerAlias jump
DocumentRoot /var/www/jump
</VirtualHost>
위내용은 아이피주소로 접속할경우 jump 폴더로 보내주는 것
<VirtualHost *:80>
ServerName mydomin.kr
ServerAlias mydomin .kr
DocumentRoot /var/www/mydomin
</VirtualHost>
</virtualhost *:80>
ServerName www.mydomin.kr
ServerAlias www.mydomin .kr
DocumentRoot /var/www/mydomin
</virtualhost *:80>
mydomin.kr 로 접속시 mydomin 폴더로 연결하기
그리고저장
/var/www 폴더에 mydomin 폴더 만들어주기
root@linux:/#
mkdir /var/www/mydomin
root@linux:/# /etc/apache2/sites-available#
apache2ctl configtest
Ubuntu VirtualHost 설정 파일 수정
root@linux:/# vim /etc/apache2/sites-available/000-default.conf
DocumentRoot /var/www/html 내용을 /var/www 로 수정
Apache2 재실행
root@linux:/#
systemctl restart apache2
도메인 접속경로 수정
root@linux:/# /etc/apache2/sites-available/mydomin.conf
하단에 아래 내용을 추가후 저장
<VirtualHost *:80> ServerName mydomin .kr ServerAlias mydomin .kr DocumentRoot /var/www/mydomin </VirtualHost>
여러사이트라면
여러게 추가하면됨
<VirtualHost *:80>
ServerName mydomin2.kr
ServerAlias mydomin2.kr
DocumentRoot /var/www/ mydomin2
</VirtualHost>
SSL인증서 발급받기
아래 내용에 #옆에 한글로 적은건 그냥 설명이니까 그런갑다 하면된다.실제로 명령어를 적는건아니다.
root@linux:/etc/apache2/sites-available#
certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel): mydomin234234234234234@naver.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: mydomin .co.kr
2: http://www. mydomin .co.kr
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for mydomin .co.kr and http://www. mydomin .co.kr
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/ mydomin .co.kr/fullchain.pem
Key is saved at: /etc/letsencrypt/live/ mydomin .co.kr/privkey.pem
This certificate expires on 2024-11-07.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for mydomin .co.kr to /etc/apache2/sites-available/000-default-le-ssl.conf
Successfully deployed certificate for http://www. mydomin .co.kr to /etc/apache2/sites-available/000-default-le-ssl.conf
Congratulations! You have successfully enabled HTTPS on https:// mydomin .co.kr and https://www. mydomin .co.kr
We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@server2:/etc/apache2/sites-available#
Saving debug log to /var/log/letsencrypt/letsencrypt.log Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): mydomin@naver.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y Account registered. Please enter the domain name(s) you would like on your certificate (comma and/or space separated) (Enter 'c' to cancel): mydomin.co.kr Requesting a certificate for mydomin.co.kr Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/ mydomin.co.kr/fullchain.pem Key is saved at: /etc/letsencrypt/live/ mydomin.co.kr/privkey.pem This certificate expires on 2024-11-07. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. Deploying certificate Successfully deployed certificate for mydomin.co.kr to /etc/apache2/sites-available/000-default-le-ssl.conf Congratulations! You have successfully enabled HTTPS on https:// mydomin .co.krWe were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@linux:/etc/apache2/sites-available#
systemctl restart apache2
2024-08-09
뭔가 중간에 설정이 잘못되었는지.....certbot 경로가 잘못지정되어있다
/etc/apache2/sites-available/000-default-le-ssl.conf 파일을 열어서
아래 내용의 경로를 수정해주고
재시작을하자
DocumentRoot /var/www -> DocumentRoot /var/www/mydomin
root@linux:/etc/apache2/sites-available# systemctl restart apache2
root@linux:/etc/apache2/sites-available# certbot --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): mydomin.mydomin@gmail.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (A)gree/(C)ancel: a #뭔진몰라도 동의할꺼지?- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o:
y #그래 뭔지몰라도 yes
No names were found in your configuration files. Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): mydomin.co.kr #인증받을 도메인을 적어주자Obtaining a new certificate Performing the following challenges: http-01 challenge for Enabled Apache rewrite module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 #http로 들어오면 자동으로 https 로 쏴줄끼여? 그럴거면 2번~Enabled Apache rewrite module Redirecting vhost in /etc/apache2/sites-enabled/000-default.conf to ssl vhost in /etc/apache2/sites-available/000-default-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://mydomin.co.kr You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=mydomin.co.kr- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live//fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/privkey.pem Your cert will expire on 2022-05-06. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le root@linux:/etc/apache2/sites-available#
위와깉이 뜬다면 완성~!
자..이제.../etc/apache2/sites-available/에 들어가보면
이렇게 ssl 용 컨피그 파일이 있는걸 확인할 수 있다.
기본적으로 apache2용 certbot 패키지는 하루에2번씩 인증서 기간을 체크해서 30일 이하가 남았을경우 자동으로 갱신을 도와주기 때문에 참고
갱신 테스트 명령어는
root@linux:/# certbot renew --dry-run
나중에 크론탭에 넣어두면 편하다.
여기까지했으면..이제 서버셋팅은끝났으니
mysql 관리를 위해서 phpmyadmin 을 설치하러 가자
다음글을보면된다
'얕고넓은지식 > linux' 카테고리의 다른 글
| 인덱스(index) 페이지에 특정 게시판 리스트로 하기 게시판 첫화면 리스트로 amina (0) | 2022.03.08 |
|---|---|
| php 정규 표현식 (0) | 2022.03.05 |
| php 정규식 태그제거 (0) | 2022.03.05 |
| phpmyadmin mysql 그누보드 내용찾아 바꾸기 (0) | 2022.02.26 |
| ubuntu 20.04 웹서버 한방에 따라하기 3 phpmyadmin 설치하기 및 root 접속하기 (4) | 2022.02.06 |
| ubuntu 20.04 웹서버 한방에 따라하기 (0) | 2022.02.05 |
| ubuntu 20.04 ssh root 외부접속하기 (0) | 2022.02.05 |
| ubuntu 버전확인 (1) | 2022.02.04 |
| rocky linux php 7.4 설치하기 (0) | 2022.01.07 |
| 리눅스 mysql 복원시 ERROR 1046 (3D000) at line 22: No database selected (0) | 2021.12.28 |