建立一個帶寬、線程可控的下載型WEB網站

class="21822"> APACHE+MYSQL+PHP+PROFTPD+MOD_LIMITIP+MOD_BANDWIDTH

一、前言

本人結合網上資料和個人的實踐，利用一個下午的時間寫出了這個適用於資源下載型網站的典型配置。這種配置的WEB網站初步實現了IP線程和線程流量的管理，同時proftpd用於上傳資源，ssh用於主機管理。無疑這樣可以自己支配寶貴的網絡帶寬，文章後面有個簡單的防火牆配置僅供參考，我用的linux版本是redhat as 3.0。希望大家在看了這篇文章後多多和我交流， MAIL:[email protected]

二、軟件版本

apache-1.3.29
mysql-4.0.16
php-4.3.4
proftpd-1.2.9
mod_limitipconn-0.04
mod_bandwidth-2.0.4

三、安裝配置Mysql

# cd mysql-4.0.16

# ./configure --prefix=/usr/local/mysql --localstatedir=/usr/local/mysql/data
--disable-maintainer-mode –with-mysqld-user=mysql --enable-large-files-without-debug

# make
# make install

添加mysql用戶

# /usr/sbin/groupadd mysql

Then we create a user called mysql which belongs to the mysql group;

# /usr/sbin/useradd -g mysql mysql

安裝數據庫文件：

#./scripts/mysql_install_db

設置文件權限：

# chown -R root:mysql /usr/local/mysql
# chown -R mysql:mysql /usr/local/mysql/data

配置ld.so.conf

# vi /etc/ld.so.conf

增加下面一句：

/usr/local/mysql/lib/mysql

建立mysql的啟動文件：

# cp support-files/mysql.server /etc/init.d/mysql
# cp support-files/my-medium.cnf /etc/my.cnf

以安全模式啟動mysql：

# /usr/local/mysql/bin/mysqld_safe –user=mysql &

設置mysql的root密碼：

# /usr/local/mysql/bin/mysqladmin -u root password new_password

把mysql服務設置為開機啟動：

# chmod 755 /etc/init.d/mysql
# chkconfig –-add mysql
# chkconfig mysql on


四、安裝配置PHP

#cd php-4.3.4

#./configure --prefix=/usr/local/php --with-apxs=/usr/local/apache/bin/apxs --with-mysql=/usr/local/mysql

#make
#make install

建立php的配置文件：

# cp php.ini-dist /usr/local/php/lib/php.ini

修改php的配置文件：

#vi /usr/local/php/lib/php.ini

doc_root= “/home/www/”
file_uploads=Off
register-golbals = On

建立測試php頁面

# vi /home/www/test.php

<?php phpinfo(); ?>

# chomd 755 /home/www/test.php


五、安裝apache-1.3.29

# tar zvxf apache_1.3.29.tar.gz
# cd apache_1.3.29
# cp ../mod_bandwidth.c mod_bandwidth.c

修改src/include/httpd.h 增大最大線程數
# vi src/include/httpd.h

修改其中的
#define HARD_SERVER_LIMIT 256
為
#define HARD_SERVER_LIMIT 2560

# ./configure --prefix=/usr/local/apache --enable-module=so
--enable-module=rewrite --enable-shared=max
--htdocsdir=/home/www --add-module=mod_bandwidth.c
--permute-module=BEGIN:bandwidth

# make
# make install

建立啟動文件：

#cp apachectl /etc/init.d/httpd

修改apache的配置文件：

#vi /usr/local/apache/conf/httpd.conf

修改、添加和確認存在下列配置項：

addDefaultCharset GB2312 注釋掉“addDefaultCharset ISO8859*”
ExtendedStatus On
LoadModule php4_module modules/libphp4.so
DirectoryIndex index.html index.html.var index.php
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps
LoadModule limitipconn_module libexec/mod_limitipconn.so
AddModule mod_limitipconn.c

安裝mod_limitipconn-0.04

# tar xzf mod_limitipconn-0.04.tar.gz
# cd mod_limitipconn-0.04
# vi Makefile

APXS = /usr/local/apache/bin/apxs

# make
# make install

使用mod_limitip模塊需要在httpd.conf中增加這個設置

<IfModule mod_limitipconn.c>
<Location /home/www/> 設置要控制的目錄
MaxConnPerIP 2 限制每個IP的最大線程數
</Location>
</IfModule>

完成mod_bandwidth模塊的安裝

創建 mod_bandwidth 運行需要的目錄

mkdir /var/apachebw
mkdir /var/apachebw/link
mkdir /var/apachebw/master
chmod -R 777 /var/apachebw

修改httpd.conf增加下列內容

<IfModule mod_bandwidth.c>
BandWidthDataDir "/var/apachebw/"
BandWidthModule on

<Directory /home/www>
BandWidth 192.168.0 0 200000 制局域網內用戶的下載速度為200k
BandWidth all 51200 限制其他用戶的下載速度為每秒 51200 字節
</Directory>

</IfModule>

修改/etc/init.d/httpd

# vi /etc/init.d/httpd

在三行之後添加如下內容：
#!/bin/sh
#
# Startup script for the Apache Web Server
# chkconfig: - 85 15
# description: Apache is a World Wide Web server. It is used to serve
# HTML files and CGI.
# processname: httpd
# pidfile: /usr/local/apache/log/httpd.pid
# config: /usr/local/apache/conf/httpd.conf

把apache服務設置為開機啟動：

# chkconfig –-add httpd
# chmod 755 /etc/init.d/httpd
# chkconfig httpd on

六、安裝porftpd-1.2.9

# tar –zxvf proftpd-1.2.9.tar.gz
# cd proftpd-1.2.9
# ./configure --prefix=/usr/local/proftpd
# make
# make　install　

建立啟動文件、把proftpd設置為開機啟動

# cp ./contrib/dist/rpm/proftpd.init.d /etc/rc.d/init.d/proftpd


# chkconfig --add proftpd
# chmod 755 /etc/rc.d/init.d/proftpd

# vi /etc/rc.d/init.d/functions
export PATH="/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/proftpd/
sbin"

# vi /etc/rc.d/init.d/proftpd
config: /usr/local/proftpd/etc/proftpd.conf
PATH="$PATH:/usr/local/proftpd/sbin"

# chkconfig proftpd on

建立帳號和目錄：

# mkdir /home/test
# chmod 755 /home/test
# adduser -d /home/test -g ftp -s /sbin/nologin test
# passwd test

# adduser -d /home/upload -g ftp -s /sbin/nologin upload
# passwd upload

配置/usr/local/proftpd/etc/proftpd.conf，禁用匿名登陸

ServerName "llzqq's ftp service"
ServerType standalone
DefaultServer on

# Port 21 is the standard FTP port.
Port 21

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022

MaxInstances 10

# Set the user and group under which the server will run.
User nobody
Group ftp

# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~

# Normally, we want files to be overwriteable.
<Directory />
AllowOverwrite on
</Directory>

# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message
RequireValidShell no

#Limit User of being enbled login ftp server
<Limit LOGIN>
AllowGroup ftp
DenyAll
</Limit>
#
<Directory /home/test>
<Limit WRITE>
DenyGroup ftp
</Limit>
TransferRate RETR 51200 group ftp
</Directory>
<Directory /home/upload>
<Limit RMD RNFR DELE RETR>
DenyGroup ftp
</Limit>
TransferRate STOR 256000 group ftp
</Directory>

ServerIdent off
MaxClientsPerHost 2
TimeoutIdle 600
TimeoutLogin 300
TimeoutNoTransfer 300
TimeoutStalled 300


七、reboot計算機

# shutdown –r now

打開浏覽器輸入：http://loaclhost/test.php

如果你看到了關於：mysql;apache;php的一大堆信息，恭喜，你的安裝基本上成功了，下一步可以測試一下proftp和帶寬的設置了。


八、建立一個簡單有效的防火牆

export PATH=/sbin:/usr/sbin:/bin:/usr/bin

modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc

echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0