一、
系统约定
RPM包和源码包存放位置
/usr/local/src
源码包编译安装位置(prefix)
/usr/local/xxx
脚本以及维护程序存放位置
/usr/local/sbin
MySQL 数据库位置
/var/lib/mysql
Apache 网站根目录
/data/wwwroot
Apache 虚拟主机日志根目录
/data/logs/www
Apache 运行账户
www:www
yum RPM包信息文件
/etc/yum.list
二、系统环境部署及调整
1. 检查系统是否正常
# more /var/log/messages （检查有无系统内核级错误信息）
# demesg （检查硬件设备是否有错误信息）
# ifconfig（检查网卡设置是否正确）
# ping
www.sina.com.cn （检查网络是否正常）
2. 关闭不需要的服务
# ntsysv
以下仅列出需要启动的服务，未列出的服务一律关闭：
crond
irqbalance （仅当服务器CPU为S.M.P架构或支持双核心、HT技术时，才
需开启，否则关闭。）
microcode_ctl
network
random
sendmail
sshd
syslog
3. 对TCP/IP网络参数进行调整，加强抗SYN Flood能力
# echo 'net.ipv4.tcp_syncookies = 1' >> /etc/sysctl.conf
# sysctl -p
4. 配置yum
# rpm --import /usr/share/doc/centos-release-3/RPM-GPG-KEY-CentOS-3
# yum list | tee /etc/yum.list
5. 修改命令history记录
# vi /etc/profile
找到 HISTSIZE=1000 改为 HISTSIZE=50
6. 定时校正服务器时间
# yum install ntp
# crontab -e
加入一行：
*/15 * * * * ntpdate 210.72.145.44
7. 重新启动系统
# init 6
8. 使用 yum 程序安装所需开发包（以下为标准的 RPM 包名称）
gcc
gcc-c++
gcc-g77
flex
autoconf
bzip2-devel
ncurses-devel
libjpeg-devel
libpng-devel
libtiff-devel
freetype-devel
pam-devel
9. 源码编译安装所需包(Source)
(1) GD2
# cd /usr/local/src
# wget
http://download.discuz.net/env/gd-2.0.33.tar.gz
# tar xzvf gd-2.0.33.tar.gz
# cd gd-2.0.33
# ./configure --prefix=/usr/local/gd2 --mandir=/usr/share/man
# make
# make install
(1) Apache日志截断程序
# cd /usr/local/src
# wget
http://download.discuz.net/env/cronolog-1.6.2.tar.gz
# tar xzvf cronolog-1.6.2.tar.gz
# cd cronolog-1.6.2
# ./configure –prefix=/usr/local/cronolog
# make
# make install
10. 升级OpenSSL和OpenSSH
# cd /usr/local/src
# wget
http://download.discuz.net/env/openssl-0.9.7j.tar.gz
# wget
http://download.discuz.net/env/openssh-4.2p1.tar.gz
# tar xzvf openssl-0.9.7j.tar.gz
# cd openssl-0.9.7j
# ./config --prefix=/usr/local/openssl
# make
# make test
# make install
# cd ..
# tar xzvf openssh-4.2p1.tar.gz
# cd openssh-4.2p1
# ./configure --prefix=/usr --with-pam --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man
# make
# make install
禁止root直接登录，此处先建立一个普通系统用户：
# useradd username
# passwd username
# echo 'Protocol 2' >> /etc/ssh/sshd_config
# echo 'Protocol 2' >> /usr/etc/sshd_config
# echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
# echo 'PermitRootLogin no' >> /usr/etc/sshd_config
# /etc/rc.d/init.d/sshd restart
三、编译安装L.A.M.P环境
1. 下载软件
# cd /usr/local/src
# wget
http://download.discuz.net/env/httpd-2.0.59.tar.bz2
# wget
http://download.discuz.net/env/mysql-5.0.24a.tar.gz
# wget
http://download.discuz.net/env/php-4.4.4.tar.bz2
# wget
http://download.discuz.net/env/Z ... glibc21-i386.tar.gz
2. 编译安装MySQL
# tar xzvf mysql-5.0.24a.tar.gz
# cd mysql-5.0.24a
# CHOST="i686-pc-linux-gnu" CFLAGS="-O3 -msse2 -mmmx -mfpmath=sse -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" CXXFLAGS="-O3 -msse2 -mmmx -mfpmath=sse -funroll-loops -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" ./configure --prefix=/usr/local/mysql --localstatedir=/var/lib/mysql --mandir=/usr/share/man --with-mysqld-user=mysql --without-debug --with-zlib --with-big-tables --with-charset=gbk --with-collation=latin1 --with-extra-charsets=all --with-server-suffix=-Comsenz --with-pthread --with-raid --enable-thread-safe-client --with-client-ldflags=-all-static --with-mysqld-ldflags=-all-static --enable-assembler --without-isam --without-innodb
# make
# make install
# useradd mysql
# cd /usr/local/mysql
# bin/mysql_install_db --user=mysql
# chown -R root:mysql .
# chown -R mysql /var/lib/mysql
# cp share/mysql/my-huge.cnf /etc/my.cnf
# cp share/mysql/mysql.server /etc/rc.d/init.d/mysqld
# chmod 755 /etc/rc.d/init.d/mysqld
# chkconfig --add mysqld
# /etc/rc.d/init.d/mysqld start
# bin/mysql -u root password "password_for_root"
3. 编译安装Apache
# cd /usr/local/src
# tar xjvf httpd-2.0.59.tar.bz2
# cd httpd-2.0.59
# CHOST="i686-pc-linux-gnu" CFLAGS="-O3 -msse2 -mmmx -mfpmath=sse -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" ./configure --prefix=/usr/local/apache2 --mandir=/usr/share/man --enable-module=so --enable-deflate=shared --enable-expires=shared
--enable-rewrite --enable-gzip --enable-cache --enable-file-cache --enable-mem-cache --enable-disk-cache --enable-static-support --enable-static-htpasswd --enable-static-htdigest --enable-static-rotatelogs --enable-static-logresolve --enable-static-htdbm --enable-static-ab --enable-static-checkgid --disable-cgid --disable-cgi --disable-userdir --disable-asis
# make
# make install
# echo '/usr/local/apache2/bin/apachectl start ' >> /etc/rc.local
4. 编译安装PHP
# cd /usr/local/src
# tar xjvf php-4.4.4.tar.bz2
# cd php-4.4.4
# CHOST="i686-pc-linux-gnu" CFLAGS="-O3 -msse2 -mmmx -mfpmath=sse -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" CXXFLAGS="-O3 -msse2 -mmmx -mfpmath=sse -funroll-loops -mcpu=pentium4 -march=pentium4 -pipe -fomit-frame-pointer" ./configure --prefix=/usr/local/php --with-apxs2=/usr/local/apache2/bin/apxs --with-zlib-dir --with-bz2 --with-tiff-dir
--with-gd=/usr/local/gd2 --with-freetype-dir --with-jpeg-dir --with-png-dir --with-ttf --enable-mbstring --with-mysql=/usr/local/mysql --with-config-file-path=/etc --disable-ipv6 --enable-static
# make
# make install
# cp php.ini-dist /etc/php.ini
5. 安装Zend Optimizer
# cd /usr/local/src
# tar xzvf ZendOptimizer-3.0.1-linux-glibc21-i386.tar.gz
# ./ZendOptimizer-3.0.1-linux-glibc21-i386/install.sh
安装Zend Optimizer过程的最后不要选择重启Apache。
6. 整合Apache与PHP
# vi /usr/local/apache2/conf/httpd.conf
找到：
AddType application/x-gzip .gz .tgz
在该行下面添加：
AddType application/x-httpd-php .php
找到：
DirectoryIndex index.html index.html.var
将该行改为
DirectoryIndex index.html index.htm index.php
修改完成后保存退出。
# /usr/local/apache2/bin/apachectl restart
7. 查看确认L.A.M.P环境信息
# echo '#!/usr/local/php/bin/php \
<?php \
phpinfo(); \
?>
' > /usr/local/php/phpinfo.php
# chmod 755 /usr/local/php/phpinfo.php
# /usr/local/php/phpinfo.php > /usr/local/php/phpinfo
# more /usr/local/php/phpinfo
检查phpinfo中的各项信息是否正确。
三、服务器安全性设置
1. 设置系统防火墙
# touch /usr/local/sbin/fw.sh
将以下脚本命令粘贴到 fw.sh 文件中。
#! /bin/bash
# Set FTP Transfer Mode
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
# Inital iptables Chains Policy
/sbin/iptables -F -t filter
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
# Enable Native Network Transfer
/sbin/iptables -A INPUT -i lo -j ACCEPT
# ICMP Control
/sbin/iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
# WWW Service
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# FTP Service
/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT
# SSH Service
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Deny All Other Connections
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# chmod 755 /usr/local/sbin/fw.sh
# echo '/usr/local/sbin/fw.sh' >> /etc/rc.local
# /usr/local/sbin/fw.sh
====== THE END ======
