{"id":408,"date":"2016-07-03T09:45:24","date_gmt":"2016-07-03T01:45:24","guid":{"rendered":"http:\/\/blogs.woria.cn\/?p=408"},"modified":"2023-02-19T11:27:45","modified_gmt":"2023-02-19T03:27:45","slug":"centos7-safe-setup-sshd-firewall-selinux-nginx-php-mariadb-svn-hooks","status":"publish","type":"post","link":"https:\/\/blogs.woria.cn\/?p=408","title":{"rendered":"\u5982\u4f55\u5b89\u5168\u7684\u4f7f\u7528centos7\u6765\u642d\u5efa\u4e00\u53f0nginx+php+mariadb+svn\u7684web\u670d\u52a1\u5668,\u5e76\u4f7f\u7528svn\u7684hooks\u81ea\u52a8\u53d1\u5e03\u7f51\u7ad9\uff01"},"content":{"rendered":"

==============
\n\u5982\u4f55\u5b89\u5168\u7684\u4f7f\u7528centos7\u6765\u642d\u5efa\u4e00\u53f0nginx+php+mariadb+svn\u7684web\u670d\u52a1\u5668\uff1f
\n\u4f7f\u7528svn\u901a\u9053\u501f\u52a9hooks\u5b89\u5168\u53d1\u5e03\u751f\u4ea7\u73af\u5883\uff01
\n==============
\n\u4eca\u65e5\u5728\u670d\u52a1\u5668\u5b89\u5168\u4e0a\u505a\u4e86\u4e00\u4e9b\u7814\u7a76\u3002
\n\u867d\u7136\u5165\u95e8\u90fd\u672a\u8fbe\u5230\uff0c\u4f46\u662f\u4e3a\u4e86\u65b9\u4fbf\u81ea\u5df1\u3002
\n\u8fd8\u662f\u8981\u8bb0\u5f55\u4e0b\u6765\uff0c\u4ee5\u5907\u4e0d\u65f6\u4e4b\u9700\uff01
\n\u5b89\u88c5\u7ed3\u675f\u9996\u6b21\u767b\u5165\uff1a
\n\u9996\u5148\u66f4\u65b0\u7cfb\u7edf
\nyum update
\n\u68c0\u5bdfselinux\u662f\u5426\u5f00\u542f\u3002
\ngetenforce
\n\u5982\u679c\u663e\u793aEnforcing\u8bf4\u660e\u5df2\u7ecf\u5f00\u542f\u3002\u672a\u5f00\u542f\u7684\u8bdd
\nvi \/etc\/selinux\/config
\n\u627e\u5230\u914d\u7f6eSELINUX\u4fee\u6539\u4e3aenforcing
\nSELINUX=enforcing
\n\u67e5\u770b\u4e3b\u673a\u540d
\necho $HOSTNAME
\n\u53d1\u73b0\u4e0d\u5408\u5fc3\u610f\uff0c
\nvi \/etc\/hostname
\n\u4fee\u6539\u4e3a\u81ea\u5df1\u60f3\u770b\u5230\u7684\u540d\u5b57\uff0c\u8fd9\u6837\u505a\u7684\u597d\u5904\u662f\u5728\u7ec8\u7aef\u4e2d\u4f60\u53ef\u4ee5\u5f88\u65b9\u4fbf\u7684\u8bc6\u522b\u662f\u54ea\u4e00\u53f0\u4e3b\u673a\u3002
\n\u8fd9\u8fd9\u91cc\u6211\u4eec\u53ef\u4ee5\u91cd\u542f\u4e00\u4e0b\uff0c\u8ba9\u66f4\u65b0\u548c\u4e3b\u673a\u540d\u53ef\u4ee5\u6b63\u5f0f\u5e94\u7528\u3002
\nreboot<\/p>\n

\u91cd\u65b0\u767b\u9646\u540e\u9996\u5148\u6dfb\u52a0\u4e00\u4e2a\u666e\u901a\u7528\u6237\u7528\u4e8e\u767b\u9646\u3002
\nadduser a
\npasswd a<\/p>\n

\u4fee\u6539ssh\uff0c\u66f4\u6539\u7aef\u53e3\u4ee5\u53ca\u7981\u6b62root\u76f4\u63a5\u767b\u5165\u3002
\nvi \/etc\/ssh\/sshd_config
\n\u4fee\u6539\u5176\u4e2d\u767b\u9646\u7aef\u53e3\u4e3a1984\uff0c\u7981\u6b62root\u76f4\u63a5\u767b\u5165
\nPort 1984
\nPermitRootLogin no
\n\u91cd\u542fssh\u670d\u52a1\uff08\u5343\u4e07\u4e0d\u8981\u5173\u95ed\u7ec8\u7aef\uff01\uff09
\nsystemctl restart sshd.service
\n\u65b0\u5efa\u4e00\u4e2a\u7ec8\u7aef\u7a97\u53e3\u5c1d\u8bd5\u8fde\u63a5\uff0c\u4ee5\u786e\u8ba4\u4fee\u6539\u662f\u5426\u751f\u6548\uff01
\n\u5982\u679c\u4f60\u8fd0\u6c14\u597d\uff0c\u53d1\u73b0\u6839\u672c\u8fde\u4e0d\u4e0a\u3002
\n\u4f60\u4e00\u5b9a\u89c9\u5f97\u8fd9\u662f\u9632\u706b\u5899\u5728\u4f5c\u602a\uff0c\u6765\u8bd5\u4e00\u8bd5\uff1a
\nfirewall-cmd –state
\n\u662f\u4e0d\u662f\u89c1\u4e86\u9b3c\u4e86\uff0c\u55ef\u9632\u706b\u5899\u538b\u6839\u5c31\u6ca1\u5de5\u4f5c\u3002
\n
\n\u5176\u5b9e\u8fd9\u662fselinux\u5728\u641e\u4e8b\uff01\u6ca1\u6709\u7ecf\u8fc7selinux\u6388\u6743\uff0c\u4f60\u79c1\u81ea\u66f4\u6539\u7aef\u53e3\u53f7\u662f\u6ca1\u6cd5\u7528\u7684\u3002
\n\u5e78\u597d\uff0c\u4f60\u4ecd\u7136\u4fdd\u6301\u4e00\u4e2a\u7ec8\u7aef\u5728\u8fde\u63a5\u3002\u6211\u4eec\u73b0\u5728\u5bf9selinux\u8fdb\u884c\u4e00\u4e9b\u914d\u7f6e\u5de5\u4f5c\u3002\u5728\u6b64\u4e4b\u524d\uff0c\u6211\u4eec\u5148\u6309\u88c5selinux\u7684\u914d\u7f6e\u5de5\u5177
\nyum -y install policycoreutils-python
\n\u7136\u540e\u628a\u4fee\u6539\u7684\u7aef\u53e3\u6ce8\u518c\u6388\u6743\u7ed9ssh
\nsemanage port -a -t ssh_port_t -p tcp 1984
\n\u7a0d\u7b49\u51e0\u79d2\u79cd\uff0c\u6ce8\u518c\u6210\u529f\u540e\uff0c\u65b0\u5efa\u4e00\u4e2a\u7ec8\u7aef\u8fde\u63a5\uff0c\u7aef\u53e3\u4e3a\u4f60\u8bbe\u7f6e\u7684\u7aef\u53e3\u3002O shit!\u8fde\u4e0a\u4e86\u3002
\n\u6211\u4eec\u8fd9\u91cc\u67e5\u770b\u4e00\u4e0bselinux\u6388\u6743\u7684ssh\u7aef\u53e3
\nsemanage port -l | grep ssh
\n\u53d1\u73b0\u9ed8\u8ba422\u548c1984\uff0c\u5bf9\u4e8e\u6211\u8fd9\u6837\u7684\u5f3a\u8feb\u75c7\u4e00\u5b9a\u60f3\u7ed9\u90a3\u4e2a22\u7ed9\u5220\u9664\u6389\u3002
\nsemanage port -d -t ssh_port_t -p tcp 22
\n\u5c45\u7136\u53d1\u73b0\u5220\u9664\u4e0d\u4e86\u3002\u6700\u7ec8\u786e\u8ba4\uff0c\u8fd9\u79cd\u5173\u952e\u9879\uff0c\u6ca1\u6cd5\u5220\u9664\u539f\u59cb\u6570\u636e\uff01\uff01\uff01
\n\u597d\u4e86\uff0c\u5148\u629b\u5f00selinux\u3002
\n\u6211\u4eec\u628a\u7cfb\u7edf\u9632\u706b\u5899\u5f00\u5f00\uff0c\u8bf7\u968f\u673a\u542f\u52a8\u3002
\nsystemctl enable firewalld.service
\nsystemctl restart firewalld.service
\n\u91cd\u542f\u53f7\u4e4b\u540e\uff0c\u5728\u65b0\u5efa\u4e00\u4e2a\u7a97\u53e3\u6765\u5c1d\u8bd5\u8fde\u63a5\u3002O shit!\u53c8\u8fde\u4e0d\u4e0a\u4e86\u3002
\n\u6765\u67e5\u4e00\u4e0b\u9632\u706b\u5899\u5f00\u653e\u7684\u7aef\u53e3
\nfirewall-cmd –list-all-zones
\n\u8fd9\u91cc\u6211\u4eec\u53ea\u9700\u770bpublic\u533a\u57df\u5c31\u884c\u4e86\u3002
\n\u4f60\u4f1a\u53d1\u73b0\u9ed8\u8ba4\u5f00\u542f\u4e86dhcp \u548c ssh\uff0c\u4e0d\u8fc7\u521a\u521a\u6211\u4eec\u5df2\u7ecf\u628assh\u7684\u7aef\u53e3\u4fee\u6539\u4e3a\u65b0\u7aef\u53e3\u4e86\u3002\u6240\u4ee5\u8fd9\u91cc\u9700\u8981\u628a\u65b0\u7aef\u53e3\u3010\u6c38\u4e45\u3011\u653e\u884c
\nfirewall-cmd –zone=public –add-port=1984\/tcp –permanent
\n\u91cd\u65b0\u67e5\u8be2\u5df2\u7ecf\u770b\u5230\u653e\u884c\u4e86\uff0c\u91cd\u8f7d\u6216\u8005\u91cd\u542f\u4e00\u4e0b\u9632\u706b\u5899\u3002
\nfirewall-cmd –reload
\n\u7136\u540e\u8bd5\u8bd5\uff0c\u679c\u7136\u8fde\u4e0a\u4e86\u3002\u5728\u67e5\u8be2\u4e00\u4e0b\u5f00\u653e\u670d\u52a1\u3002\u90a3\u4e2assh\u53c8\u8ba9\u6211\u4e0d\u592a\u723d\u4e86\u3002\u597d\uff0c\u53d6\u6d88\u5b83\uff01
\nfirewall-cmd –zone=public –remove-service=ssh<\/p>\n

\u81f3\u6b64\uff0c\u9632\u706b\u5899\uff0cselinux\uff0c\u8fd8\u6709ssh\u767b\u9646\u544a\u4e00\u6bb5\u8def\u3002\u6211\u4eec\u53ef\u4ee5reboot\u4e00\u4e0b\u3002
\nreboot<\/p>\n

===========================<\/p>\n

yum install epel-release
\nyum update \/\/\u66f4\u65b0yum\u6e90<\/p>\n

nginx\u5b98\u65b9\u5b89\u88c5\u6e90\uff01
\nrpm -Uvh http:\/\/nginx.org\/packages\/centos\/7\/noarch\/RPMS\/nginx-release-centos-7-0.el7.ngx.noarch.rpm<\/p>\n

\u73b0\u5728\u4e5f\u90fd\u662fphp8\u7684\u65f6\u4ee3\u4e86\u3002\u6211\u4eec\u9996\u5148\u8bbe\u7f6e\u9ed8\u8ba4php5 \u6210\u4e3aphp8<\/code><\/p>\n

\n
y<\/span>um -y install https:\/<\/span>\/<\/span>mirrors.aliyun.com\/<\/span>remi\/<\/span>enterprise\/<\/span>remi-release-7<\/span>.rpm<\/div>\n<\/div>\n
\n
y<\/span>um -y install yum-utils<\/div>\n
yum repolist all |grep php<\/div>\n
yum-config-manager –enable remi-php<\/div>\n
<\/div>\n<\/div>\n

\u73b0\u5728\u6211\u4eec\u6765\u5b89\u88c5\u4e00\u4e9b\u8f6f\u4ef6\u3002
\nyum install nginx mariadb* lighttpd-fastcgi php-cli php-mysql php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-mcrypt php-mssql php-snmp php-soap php-tidy php-common php-devel php-fpm php php-mysqli –skip-broken<\/p>\n

centos7\u4e2dmysql\u5df2\u7ecf\u88ab\u66ff\u6362\u6210\u4e3amariadb\u3002\u4f46\u662f\u5728\u4f7f\u7528\u4e0a\u6ca1\u4ec0\u4e48\u533a\u522b\u3002\u5982\u679c\u6ca1\u6cd5\u5b89\u88c5nginx\u3002\u90a3\u4e48\u9996\u5148\u6dfb\u52a0
\n\u5b89\u88c5\u7ed3\u675f\u4e4b\u540e\uff0c\u6211\u4eec\u5728\u5b89\u88c5\u4e00\u4e2a\u53ef\u80fd\u4f1a\u7528\u5230\u7684php\u7ec4\u4ef6ImageMagick
\nyum install ImageMagick ImageMagick-devel gcc
\n\u5b89\u88c5\u7ed3\u675f\u540e\u6267\u884c
\npecl install imagick<\/p>\n

\n

\u56e0\u4e3a\u6211\u4eec\u5347\u7ea7\u4e86php8 \u6240\u6709pecl\u65e0\u6cd5\u4f7f\u7528\uff0c\u9700\u8981\u66f4\u65b0\u5230\u6700\u65b0\u7684pecl<\/p>\n

wget http:\/\/pear.php.net\/go-pear.phar<\/p>\n

php go-pear.phar<\/p>\n

\n

\u7136\u540e\u52a0\u8f7d\u8fd9\u4e2a\u7ec4\u4ef6
\necho ‘extension=imagick.so’ > \/etc\/php.d\/imagick.ini<\/p>\n

\u542f\u52a8\u5404\u79cd\u670d\u52a1\uff0c\u5e76\u8bbe\u7f6e\u5f00\u673a\u542f\u52a8\u3002
\nsystemctl enable nginx.service
\nsystemctl enable mariadb.service
\nsystemctl enable php-fpm.service
\nsystemctl start nginx.service
\nsystemctl start mariadb.service
\nsystemctl start php-fpm.service
\n\u521d\u59cb\u5316\u8bbe\u7f6e\u4e00\u4e0b\u6570\u636e\u5e93
\nmysql_secure_installation
\ngrant all privileges on *.* to ‘root’@’%’ identified by ‘*Pa55Word*’ with grant option;
\nflush privileges;<\/p>\n

\u9ed8\u8ba4\u6ca1\u6709\u5bc6\u7801\uff0c\u9996\u6b21\u56de\u8f66\u3002
\n\u7136\u540e\u6839\u636e\u63d0\u793a\u8bbe\u7f6eroot\u5bc6\u7801\uff0c\u662f\u5426\u8fdc\u7a0b\u767b\u5f55\uff0c\u79fb\u9664test\u6570\u636e\uff0c\u91cd\u8f7d\u6743\u9650\u3002\u7ed3\u675f\u540e\u6700\u597d\u3002
\nsystemctl restart mariadb.service<\/p>\n

\u6765\uff0c\u8bd5\u8bd5\u80fd\u4e0d\u80fd\u6253\u5f00web\u3002\u8f93\u5165\u4f60\u7684ip\u6216\u8005\u7ed1\u5b9a\u57df\u540d\u3002O shit!\u6253\u4e0d\u5f00\u3002
\n\u88ab\u6211\u4eec\u4f1f\u5927\u7684\u9632\u706b\u5899\u7ed9\u963b\u6b62\u4e86\uff0c\u6765\u6dfb\u52a0\u4e24\u6761\u6761\u6c38\u4e45\u653e\u884c\uff01
\nfirewall-cmd –zone=public –add-service=http –permanent
\nfirewall-cmd –zone=public –add-service=https –permanent
\n\u91cd\u8f7d
\nfirewall-cmd –reload
\n\u518d\u8bd5\u8bd5\uff0c\u901a\u5566\uff01<\/p>\n

\u8fd9\u91cc\u544a\u4e00\u6bb5\u6bb5\u843d\uff0c\u6211\u4eecreboot\u4e00\u4e0b\uff0c\u5f00\u59cb\u914d\u7f6enginx\u548cphp<\/p>\n

——————–
\n\u8fd9\u91cc\u5907\u6ce8\u51e0\u4e2a\u547d\u4ee4\u3002
\nlsof -i:1984
\nchcon
\n——————–<\/p>\n\n\n

yum install svn<\/p>\n\n\n\n

yum -y install cyrus-sasl cyrus-sasl-devel cyrus-sasl-plain<\/p>\n\n\n\n

vi \/etc\/sysconfig\/saslauthd<\/p>\n\n\n\n

\u4fee\u6539\u9a8c\u8bc1\u65b9\u5f0f\u4e3a\uff1aMECH=ldap<\/p>\n\n\n\n

\u7136\u540e\u6211\u4eec\u521b\u5efa\u597d\u901a\u7528svn\u914d\u7f6e\u6587\u4ef6<\/p>\n\n\n\n

vi svnserve.conf<\/p>\n\n\n\n

[general]\nanon-access = none\nauth-access = write\nauthz-db = authz\nrealm = svn_name\n\n[sasl]\nuse-sasl = true\n<\/code><\/pre>\n\n\n\n
\u8bbe\u7f6eauthz<\/p>\n\n\n\n
[groups]\ndev = 18638582808\n\n[\/]\n*=\n\n[wiosn:\/]\n@dev = rw\n<\/code><\/pre>\n\n\n\n
\u63a5\u4e0b\u6765\u6211\u4eec\u6765\u914d\u7f6e<\/p>\n\n\n\n
vi \/etc\/saslauthd.conf<\/p>\n\n\n\n
ldap_servers: ldap:\/\/127.0.0.1\nldap_search_base: ou=s2,dc=xiaowei-group,dc=com\nldap_filter: (x-uid=%u)\n<\/code><\/pre>\n\n\n\n
\u8bbe\u7f6esvn\u4e13\u7528\u7684\u9a8c\u8bc1\u65b9\u5f0f<\/p>\n\n\n\n
vi \/etc\/sasl2\/svn.conf<\/p>\n\n\n\n
pwcheck_method: saslauthd\nmech_list: PLAIN LOGIN\n<\/code><\/pre>\n\n\n\n
\u91cd\u542f\u8ba4\u8bc1\u670d\u52a1<\/p>\n\n\n\n
systemctl restart saslauthd.service<\/p>\n\n\n\n
\u9a8c\u8bc1\u662f\u5426\u53ef\u4ee5\u6210\u529f<\/p>\n\n\n\n
testsaslauthd -u18638582808 -p<\/p>\n\n\n\n
\u63d0\u793a\uff1a<\/p>\n\n\n\n
0: OK “Success.”<\/p>\n\n\n\n
\u641e\u5b9a\uff01\u68c0\u51fa\u4e00\u4e0bsvn<\/p>\n\n\n\n
\u5f00\u59cb\u914d\u7f6esvn\u670d\u52a1<\/p>\n\n\n\n
vi \/etc\/sysconfig\/svnserve<\/p>\n\n\n\n
OPTIONS=\"-r \/wiosn\/svnroot\/repository --config-file \/wiosn\/svnroot\/svnserve.conf --listen-port 3690\"\n<\/code><\/pre>\n\n\n\n
–listen-port 3690 \u4ee3\u8868\u6307\u5b9a\u76d1\u542c\u7aef\u53e3\uff0csvn\u9ed8\u8ba4\u662f3690\uff0c<\/p>\n\n\n\n
\u7136\u540e\u91cd\u542fsvn\u3002\u5c31\u53ef\u4ee5\u672c\u5730\u68c0\u51fa\u4e86\uff01<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u6211\u4eec\u6765\u6363\u9f13\u81ea\u52a8\u53d1\u5e03\uff01<\/p>\n\n\n\n
\u8fdb\u5165\u4f60\u7684svnroot\u76ee\u5f55\uff0c\u4fee\u6539hook\u7684\u811a\u672c<\/p>\n\n\n\n
vi post-commit<\/p>\n\n\n\n
#!\/bin\/sh\n\nREPOS=\"$1\"\nREV=\"$2\"\n\necho svn $REPOS,update to $REV >> \/home\/wiosn\/svnroot\/cache\/logs\/hooks.log\nsvn up \/home\/wiosn\/svnroot\/cache\/wiosn\necho svn temdir update >> \/home\/wiosn\/svnroot\/cache\/logs\/hooks.log\necho rsync to wwwroot >> \/home\/wiosn\/svnroot\/cache\/logs\/hooks.log\nrsync -avz --exclude-from=\/home\/wiosn\/svnroot\/cache\/exclude --progress --delete \/home\/wiosn\/svnroot\/cache\/wiosn\/ \/var\/www\/html\/wiosn\/<\/code><\/pre>\n\n\n\n
\u4e0d\u8981\u5fd8\u8bb0 chmod +x post-commit<\/p>\n\n\n\n
\u7136\u540e\u6267\u884c\u4e00\u4e0b.\/post-commit<\/p>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u5df2\u7ecf\u81ea\u52a8\u53d1\u5e03\u4e86\u3002<\/p>\n\n\n\n
\u6253\u5b8c\u6536\u5de5\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
============== \u5982\u4f55\u5b89\u5168\u7684\u4f7f\u7528centos7\u6765\u642d\u5efa\u4e00\u53f0nginx+php+mariadb+svn…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,8,9,4,5],"tags":[],"class_list":["post-408","post","type-post","status-publish","format-standard","hentry","category-technique","category-master","category-programmer","category-windtalker","category-magician"],"_links":{"self":[{"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/posts\/408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=408"}],"version-history":[{"count":6,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/posts\/408\/revisions"}],"predecessor-version":[{"id":601,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=\/wp\/v2\/posts\/408\/revisions\/601"}],"wp:attachment":[{"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.woria.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}