开源中文网

您的位置: 首页 > FreeBSD > 正文

FreeBSD服务器搭建手挡

来源:  作者:

DNS : 202.101.107.55
IP : ?
NETMASK: ?
GATEWAY: ?
-----------------------------------------------------------------------------
* 确定硬件是否兼容
* 删除没必要的用户
* 关掉SSH的DNS反向解析
查看CPU个数 : # sysctl hw.ncpu
查看开启的服务: # sockstat -4l
-----------------------------------------------------------------------------
安装与配置FreeBSD7 Create by bianyuan
-----------------------------------------------------------------------------
1 安装FreeBSD操作系统,请最小化安装即可!(理由:更简洁,更好的控制,更加的安全!)
-----------------------------------------------------------------------------
2 Reboot进入FreeBSD
* 修改/boot/defaults/loader.conf 将 #autoboot_delay="10" 将#号去掉替换10为1
* ntpdate 210.72.145.44
-----------------------------------------------------------------------------
3 安装cvsup
安装方式:还是用pkg_add -r cvsup-without-gui
-----------------------------------------------------------------------------
4 升级port和内核源代码:
FreeBSD# cp /usr/share/examples/cvsup/ports-supfile /etc
FreeBSD# cp /usr/share/examples/cvsup/stable-supfile /etc
CVSUP升级源 (中国大陆)
#default host=cvsup.cn.FreeBSD.org

#default host=cvsup.FreeBSDChina.org
升级ports:
FreeBSD# cvsup -g -L 2 /etc/ports-supfile
升级源代码:
FreeBSD# cvsup -g -L 2 /etc/stable-supfile
-----------------------------------------------------------------------------
到这为止你的系统还没有升级!底子是打好了!
进入/usr/src
FreeBSD# make buildworld
FreeBSD# cd /usr/src
编译内核:[删除不需要的驱动]
FreeBSD# make buildkernel KERNCONF=MYKERNEL
安装新内核:
FreeBSD# make installkernel KERNCONF=MYKERNEL
-----------------------------------------------------------------------------
reboot 进入单用户模式 # mount -a 挂载全部分区
FreeBSD# mergemaster -P
-----------------------------------------------------------------------------
FreeBSD# make installworld
FreeBSD# mergemaster
-----------------------------------------------------------------------------
6 检查服务器硬件并做记录->编译内核使用
FreeBSD# dmesg
-----------------------------------------------------------------------------
5 检查与修复档案系统
FreeBSD# fsck -y
-----------------------------------------------------------------------------
7 检查硬盘容量
FreeBSD# df -h
-----------------------------------------------------------------------------
常用套件:
/usr/ports/shells/bash
/usr/ports/editors/vim-lite
/usr/ports/security/sudo [配置/usr/local/etc/sudoers]
-----------------------------------------------------------------------------
檢查系統版本
FreeBSD# uname -a
-----------------------------------------------------------------------------
防火墙
/etc/rc.conf 添加入如:
firewall_enable="YES"
firewall_type="open"
启用日志
/etc/sysctl.conf 添加如下:
net.inet.ip.fw.verbose=1
net.inet.ip.fw.verbose_limit=5
-----------------------------------------------------------------------------
# 停掉Sendmail
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"

-----------------------------------------------------------------------------
# 配置远程管理webmin
安装:
[root@FreeBSD /usr/ports/sysutils/webmin]# make install clean

配置:[更改默认端口]
注意两点:
1. 更改默认端口:修改为8888
2. 必须启用SSL
[root@FreeBSD /usr/local/lib/webmin]# ./setup.sh

开机启动
/etc/rc.conf中追加: webmin_enable="YES"

访问:https://IP:PORT/
-----------------------------------------------------------------------------
# 配置防端口扫描套件 PortSentry
#+++++++++++++++++++++++++++++++++++++++++++
安装:
[root@FreeBSD]# cd /usr/ports/security/portsentry/
[root@FreeBSD]# make install clean
#+++++++++++++++++++++++++++++++++++++++++++

#+++++++++++++++++++++++++++++++++++++++++++
配置: 添加一些指定的需要防扫描的端口
[root@FreeBSD]# cp portsentry.conf.default portsentry.conf
找到Dropping Routes這部份,选择阻擋(block)可疑主機的方式,有二種:
1.用IPFW
2.block-hole route (若無IPFW時,用這種)
#+++++++++++++++++++++++++++++++++++++++++++

#+++++++++++++++++++++++++++++++++++++++++++
启动PortSentry:
[root@FreeBSD]# cd /usr/local/etc/rc.d
[root@FreeBSD]# ./portsentry.sh start
#+++++++++++++++++++++++++++++++++++++++++++

#+++++++++++++++++++++++++++++++++++++++++++
查看监听的端口:
[root@FreeBSD]# sockstat
#+++++++++++++++++++++++++++++++++++++++++++

#+++++++++++++++++++++++++++++++++++++++++++
查看受攻击日志:
[root@FreeBSD ~]# vi /usr/local/etc/portsentry.blocked.tcp
[root@FreeBSD ~]# vi /usr/local/etc/portsentry.blocked.udp
#+++++++++++++++++++++++++++++++++++++++++++
#+++++++++++++++++++++++++++++++++++++++++++
忽略一些IP
/usr/local/etc/portsentry.ignore
#+++++++++++++++++++++++++++++++++++++++++++
-----------------------------------------------------------------------------
流量查看软件
[root@FreeBSD ~]# whereis iftop
[root@FreeBSD ~]# cd /usr/ports/net-mgmt/iftop/
[root@FreeBSD /usr/ports/net-mgmt/iftop]# make install clean
-----------------------------------------------------------------------------
安装Apache
#+++++++++++++++++++++++++++++++++++++++++++
vi /boot/defaults/loader.conf
accf_http_load="NO" 修改成: accf_http_load="YES"
#+++++++++++++++++++++++++++++++++++++++++++

[root@FreeBSD ~]# cd /usr/ports/www/apache22
[root@FreeBSD ~]# make WITH_MPM=worker
[root@FreeBSD ~]# make install; make clean
修改httpd.conf
Include etc/apache22/extra/httpd-mpm.conf //把#去掉
修改/usr/local/etc/apache22/extra/httpd-mpm.conf
调节:mpm_worker_module里的参数
修改/etc/rc.conf追加:
apache22_enable="YES"

运行 Apache
[root@FreeBSD ~]# /usr/local/sbin/apachectl start

#+++++++++++++++++++++++++++++++++++++++++++
# ERROR1
httpd: apr_sockaddr_info_get() failed for
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[Wed Jun 06 18:13:13 2007] [warn] (2)No such file or directory: Failed to enable
运行:# hostname localhost
修改/etc/rc.conf 中的hostname="localhost"
-----------------------------------------------------------------------------
安装PHP
[root@FreeBSD ~]# cd /usr/ports/lang/php5
[root@FreeBSD ~]# make install clean

[root@FreeBSD ~]# cp /usr/local/etc/php.ini-recommended /usr/local/etc/php.ini

LoadModule php5_module libexec/apache/libphp5.so
没有发现libphp5.so 是因为编译php的时候没有 选择apache
[root@FreeBSD ~]# cd /usr/ports/lang/php5-extensions/
[root@FreeBSD ~]# make
[root@FreeBSD ~]# make install; make clean

重装使用:
[root@localhost ~]# make install FORCE_PKG_REGISTER="yes"
----------------------------------------------------------------------------
安装Zend Optimizer
[root@FreeBSD ~]# cd /usr/ports/devel/ZendOptimizer/
[root@FreeBSD ~]# make install clean
[Zend]
zend_optimizer.optimization_level=15
zend_extension_manager.optimizer="/usr/local/lib/php/20060613-zts/Optimizer"
zend_extension_manager.optimizer_ts="/usr/local/lib/php/20060613-zts/Optimizer_TS"
zend_extension="/usr/local/lib/php/20060613-zts/ZendExtensionManager.so"
zend_extension_ts="/usr/local/lib/php/20060613-zts/ZendExtensionManager_TS.so"
----------------------------------------------------------------------------
安装Mysql
[root@FreeBSD ~]# cd /usr/ports/databases/mysql50-server
[root@FreeBSD ~]# make WITH_CHARSET=utf8 WITH_XCHARSET=all
[root@FreeBSD ~]# make install
[root@FreeBSD ~]# make clean
[root@FreeBSD ~]# cd /usr/ports/databases/mysql50-scripts/
[root@FreeBSD ~]# make install clean;
[root@FreeBSD ~]# /usr/local/bin/mysql_install_db

启动mysql
/usr/local/bin/mysqld_safe &
或者/usr/local/etc/rc.d/mysql-server.sh start
[root@FreeBSD ~]# cp /usr/local/share/mysql/my-large.cnf /etc/my.cnf
mysql_enable="YES"
-----------------------------------------------------------------------------
安装与配置Apache防DDos攻击套件
[root@FreeBSD ~]# /usr/ports/www/mod_evasive
[root@FreeBSD ~]# make install
编辑httpd.conf 打开mod_evasive 的LoadModule
Apache 2.x
<IfModule mod_dosevasive20.c>
DOSHashTableSize 5000
DOSPageCount 10
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
</IfModule>
参数简单说明:
DOSHashTableSize 3097 记录和存放黑名单的哈西表大小,假如服务器访问量很大,能够加大该值
DOSPageCount 5 同一个页面在同一时间内能够被统一个用户访问的次数,超过该数字就会被列为攻击,同一时间的数值能够在DosPageInterval参数中配置。
DOSSiteCount 50 同一个用户在同一个网站内能够同时打开的访问数,同一个时间的数值在DOSSiteInterval中配置。
DOSPageInterval 2 配置DOSPageCount中时间长度标准,默认值为1。
DOSSiteInterval 2 配置DOSSiteCount中时间长度标准。
DOSBlockingPeriod 10 被封时间间隔秒,这中间会收到 403 (Forbidden) 的返回。
其他可选参数:
DOSEmailNotify lee@toplee.com 配置受到攻击时接收攻击信息提示的邮箱地址。
DOSSystemCommand “su - someuser -c ‘/sbin/… %s …’” 受到攻击时Apache运行用户执行的系统命令
DOSLogDir “/var/lock/mod_dosevasive” 攻击日志存放目录,BSD上默认是 /tmp

查看攻击记录:ls /tmp
-----------------------------------------------------------------------------
*** 时区设定:

# cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
-----------------------------------------------------------------------------
在FreeBSD下locate想要尋找某個檔案時,卻出現
locate: database too small: /var/db/locate.database訊息,可以:
运行: [root@FreeBSD ~]# /usr/libexec/locate.updatedb

-----------------------------------------------------------------------------
/usr/local/bin/mysqladmin -u root password '123456'
/usr/local/bin/mysqladmin -u root -h bsd password 'new-password'
/usr/local/bin/mysql_secure_installation

You can start the MySQL daemon with:
cd /usr/local ; /usr/local/bin/mysqld_safe &
-----------------------------------------------------------------------------
ntop流量检查
/usr/ports/net/ntop
自动启动:ntop_enable="YES" 加入/etc/rc.conf

设置密码:ntop -A

设置启动:ntop -d
-----------------------------------------------------------------------------
日志轮询
# cd /usr/ports/sysutils/cronolog/
# make install
设置apache日志部份
1.自定义日志格式
ErrorLog "|/usr/local/sbin/cronolog /var/log/httpd/%Y/%m/%d/errors.log"
CustomLog "|/usr/local/sbin/cronolog /var/log/httpd/%Y/%m/%d/access.log" combined
------------------------------------------------------------------------------
证书成生
http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz
#./new-root-ca.sh (生成根证书)
#./new-server-cert.sh server(生成server证书)
# ./sign-server-cert.sh server(签署server证书)

# 虚拟主机设置
NameVirtualHost 192.168.1.125:80
NameVirtualHost 192.168.1.125:443
<VirtualHost 192.168.1.125:80>
ServerName mybsd
ServerAlias mybsd.com
DocumentRoot "/home/www/"
</VirtualHost>
<VirtualHost 192.168.1.125:80>
ServerName mysite
ServerAlias mysite.com
DocumentRoot "/home/www/mysite/public/"
</VirtualHost>
<VirtualHost 192.168.1.125:443>
ServerName mysite
ServerAlias mysite.com
UseCanonicalName Off
DocumentRoot "/home/www/mysite/public/"
SSLEngine on
SSLVerifyClient none
SSLCertificateFile /usr/local/etc/apache22/server.crt
SSLCertificateKeyFile /usr/local/etc/apache22/server.key
<Directory /home/www/mysite/public/>
SSLRequireSSL
</Directory>
</VirtualHost> 

Tags:FreeBSD 服务器 搭建
关于开源中文网 - 联系我们 - 广告服务 - 网站地图 - 版权声明