2017年11月9日 星期四

[CentOS7] Ngnix 搭配 PHP-FPM + APACHE 設定SSL

CentOS 7下(包含安裝EPEL)

wget http://dl.fedoraproject.org/pub/epel/ ... l-release-7-11.noarch.rpm
wget http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
rpm -Uvh remi-release-7*.rpm epel-release-7*.rpm

首先移除舊的
yum remove php-common

安裝相關套件
yum install php56w php56w-mysql php56w-gd php56w-ldap php56w-odbc php56w-pear
php56w-xml php56w-xmlrpc php56w-mbstring php56w-snmp php56w-mcrypt php56w-common php56w-opcache php56w-fpm php56w-imap


設定 PHP 設定檔
vim /etc/php.ini
session.save_handler = files
session.save_path = "/var/lib/php/session" 
 date.timezone = "Asia/Taipei" 
error_reporting = E_ALL & ~E_NOTICE 
display_errors = On 
magic_quotes_gpc = Off
post_max_size = 8M


設定 PHP-FPM 設定檔
vim  /etc/php-fpm.conf
include=/etc/php-fpm.d/*.conf 

 [global]
 pid = /var/run/php-fpm/php-fpm.pid 
 error_log = /var/log/php-fpm/error.log


設定 PHP-FPM 的 POOL 設定檔 
vim /etc/php-fpm.d/www.conf
[www] 
 listen = /var/run/php-fpm/php-fpm.sock
 listen.owner = nobody
 listen.group = nobody
 user = nginx
 group = nginx
 pm = dynamic
 pm.max_children = 50
 pm.start_servers = 5
 pm.min_spare_servers = 5
 pm.max_spare_servers = 35
 slowlog = /var/log/php-fpm/www-slow.log
 php_admin_value[error_log] = /var/log/php-fpm/www-error.log 
 php_admin_flag[log_errors] = on
 php_value[session.save_handler] = files
 php_value[session.save_path] = /var/lib/php/session

預設 Log 檔的權限
#chown -R nginx:nginx /var/log/php-fpm

預設 PHP SESSION 檔的權限
#mkdir /var/lib/php/session 
#chmod 766 /var/lib/php/session
#chown -R nginx:nginx /var/lib/php

啟用 php-fpm 
#systemctl start php-fpm 
#systemctl enable php-fpm


安裝 Apache mod_ssl

首先用 YUM 安裝 mod_ssl:
# yum install mod_ssl

取得憑證的CSR CRT跟CA檔

# vim /etc/httpd/conf.d/ssl.conf
DocumentRoot “/var/www/html”
ServerName www.yourdomain.com

SSLCertificateFile /ssl/ca.crt
SSLCertificateKeyFile /ssl/myserver.key
SSLCACertificateFile /ssl/ca_myserver.crt

因為使用 SSLv3 或以下有安全問題, 需要關閉 SSLv3, 找到以下一行:
SSLProtocol all -SSLv2
改為:
SSLProtocol all -SSLv2 -SSLv3

儲存檔案後離開, 並重新啟動 Apache:
# systemctl restart apache

若出現 php5-fpm.sock failed (13: Permission denied) 解法

沒有留言: