[웹서버] apache+ssl+openssl+mysql+php 설치

[Apache + mod_ssl + openssl + php + mySQL]

ftp://ftp.openssl.org/source/

ftp://ftp.modssl.org/source/

/****** 설치 순서 *******/

1) openssl 설치

2) mod_ssl을 apache 소스트리에 포함시키기

3) apache configure 실행

4) php configure 그리고 apache 소스트리에 포함시키기

5) mod_ssl, php 를 포함한 apache 컴파일 및 설치

/***** openssl installation ********/

[/usr/local/src/openssl-0.9.6a]#./config

[/usr/local/src/openssl-0.9.6a]# make

[/usr/local/src/openssl-0.9.6a]# make test

[/usr/local/src/openssl-0.9.6a]# make install

/* RSA Private Key 작성 */

[/usr/local/ssl/bin]# ./openssl genrsa -des3 -rand T1:T2:T3:T4:T5 1024 > \\

../private/secure.test.co.kr.key <enter>

————————————————————————–

0 semi-random bytes loaded

Generating RSA private key, 1024 bit long modulus

………++++++

……………………………………++++++

e is 65537 (0x10001)

Enter PEM pass phrase: ****** <enter>

Verifying password – Enter PEM pass phrase:  ****** <enter>

————————————————————————–

[/usr/local/ssl/bin]# cat secure.test.co.kr.key

—————————————————————-

—–BEGIN RSA PRIVATE KEY—–

Proc-Type: 4,ENCRYPTED

DEK-Info: DES-EDE3-CBC,5B495C1D8FCAA406

  

+rfid1mS03Zfxu9DQRRN/BOyhHd/nDRsG4p2zey9FZsbkr2xxzKNdczF9CAfsXIi

PlHez1BoJ5o8NEgPmWfgCRvaICzwsSOofuizCynx6ZFhxcB6KIw7TAbF00qV5dcY

3S0ov8IeO+v7IuQBVotzJqNV6sDE1OIwqRhEqz71IpnAonZg33i8NB5Uqu895HbC

MZyVGj3cVI2jb4fiQUmc6GwY4AvtG2RQHrpE3RTXTlgW+OnX5kIByQ==

—–END RSA PRIVATE KEY—–  

—————————————————————-

/* CSR 작성 */

[/usr/local/ssl/bin]# ./openssl req -new -key \\

../private/secure.test.co.kr.key -out \\

secure.test.co.kr.csr

————————————————————————————-

Using configuration from /usr/local/ssl/openssl.cnf

Enter PEM pass phrase: ****** <enter>

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

—–

Country Name (2 letter code) [AU]:KR <enter>

State or Province Name (full name) [Some-State]:. <enter>

Locality Name (eg, city) []:Seoul <enter>

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Mediachannel inc.

<enter>

Organizational Unit Name (eg, section) []:Solution Team <enter>

Common Name (eg, YOUR name) []:Jang Won Cheol <enter>

Email Address []:telnet99 at

test.co.kr <enter>

  

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []: **** <enter>

An optional company name []:. <enter>

————————————————————————————-

[/usr/local/ssl/bin]# cat secure.test.co.kr.csr

—————————————————————–

—–BEGIN CERTIFICATE REQUEST—–

MIIB7DCCAVUCAQAwgZYxCzAJBgNVBAYTAktSMQ4wDAYDVQQHEwVTZW91bDEaMBgG

A1UEChMRTWVkaWFjaGFubmVsIGluYy4xFjAUBgNVBAsTDVNvbHV0aW9uIFRlYW0x

FzAVBgNVBAMTDkphbmcgV29uIENoZW9sMSowKAYJKoZIhvcNAQkBFht0ZWxuZXQ5

NszSMLAaP8YJ0Wq+lZqWqA==

—–END CERTIFICATE REQUEST—–

—————————————————————–

/* self-signed certificate 작성 */

[/usr/local/ssl/bin]# ./openssl req -x509 -key \\

../private/secure.test.co.kr.key -in \\

secure.test.co.kr.csr > \\

secure.test.co.kr.crt

——————————————————————

Using configuration from /usr/local/ssl/openssl.cnf

Enter PEM pass phrase: ******* <enter>

——————————————————————

[/usr/local/ssl/bin]# cat secure.test.co.kr.crt

—————————————————————–

—–BEGIN CERTIFICATE—–

MIIDmzCCAwSgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBljELMAkGA1UEBhMCS1Ix

DjAMBgNVBAcTBVNlb3VsMRowGAYDVQQKExFNZWRpYWNoYW5uZWwgaW5jLjEWMBQG

A1UECxMNU29sdXRpb24gVGVhbTEXMBUGA1UEAxMOSmFuZyBXb24gQ2hlb2wxKjAo

BgkqhkiG9w0BCQEWG3RlbG5ldDk5QG1lZGlhY2hhbm5lbC5jby5rcjAeFw0wMTA1

—–END CERTIFICATE—–  

—————————————————————–

/***** mod_ssl을 apache소스에 포함시키기 ********/

[root@test mod_ssl-2.8.2-1.3.19]# pwd

/usr/local/src/mod_ssl-2.8.2-1.3.19

[root@test mod_ssl-2.8.2-1.3.19]# ./configure –with-apache=/usr/local/src/apach

e_1.3.19    

—————————————————————————

Configuring mod_ssl/2.8.2 for Apache/1.3.19

+ Apache location: /usr/local/src/apache_1.3.19 (Version 1.3.19)

+ Auxiliary patch tool: ./etc/patch/patch (local)

+ Applying packages to Apache source tree:

   o Extended API (EAPI)

   o Distribution Documents

   o SSL Module Source

   o SSL Support

   o SSL Configuration Additions

   o SSL Module Documentation

   o Addons

Done: source extension and patches successfully applied.

  

Now proceed with the following commands (Bourne-Shell syntax):

$ cd /usr/local/src/apache_1.3.19

$ SSL_BASE=/path/to/openssl ./configure … –enable-module=ssl

$ make

$ make certificate

$ make install

—————————————————————————

/***** apache configure 실행 ********/

[root@test apache_1.3.19]# ./configure –prefix=/usr/local/httpd \\

> –enable-module=all –enable-shared=max

—————————————————————————

Configuring for Apache, Version 1.3.19

+ using installation path layout: Apache (config.layout)

Creating Makefile

Creating Configuration.apaci in src

  

Creating Makefile in src

+ configured for Linux platform

+ setting C compiler to gcc

+ setting C pre-processor to gcc -E

+ checking for system header files

+ adding selected modules

    o rewrite_module uses ConfigStart/End

+ using -lndbm for DBM support

      enabling DBM support for mod_rewrite

    o dbm_auth_module uses ConfigStart/End

    o db_auth_module uses ConfigStart/End

      using Berkeley-DB/2.x for mod_auth_db (-ldb)

    o ssl_module uses ConfigStart/End

      + SSL interface: mod_ssl/2.8.2

      + SSL interface build type: DSO

      + SSL interface compatibility: enabled

      + SSL interface experimental code: disabled

      + SSL interface conservative code: disabled

      + SSL interface vendor extensions: disabled

      + SSL interface plugin: Built-in SDBM

      + SSL library path: /usr/local/ssl

      + SSL library version: OpenSSL 0.9.6a 5 Apr 2001

      + SSL library type: installed package (stand-alone)

+ enabling Extended API (EAPI)

+ using -ldl for vendor DSO support

+ checking sizeof various data types

+ doing sanity check on compiler and options

Creating Makefile in src/support

Creating Makefile in src/regex

Creating Makefile in src/os/unix

Creating Makefile in src/ap

Creating Makefile in src/main

Creating Makefile in src/lib/expat-lite

Creating Makefile in src/modules/experimental

Creating Makefile in src/modules/standard

Creating Makefile in src/modules/extra

Creating Makefile in src/modules/proxy

Creating Makefile in src/modules/example

Creating Makefile in src/modules/ssl

—————————————————————————

/***** php configure & 아파치 소스트리에 포함시키기 ********/

[/usr/local/src/php-4.0.4pl1]# CFLAGS=’-02 -l/usr/local/ssl/openssl/include’ \\

> ./configure –with-apache=/usr/local/src/apache_1.3.19 \\

> –with-mysql=/usr/local/mysql \\

> –enable-memory-limit=yes \\

> –enable-debug=no \\

> –enable-track-vars \\

> –enable-versioning \\

> –with-config-file-path=/usr/local/httpd

+——————————————————————–+

| License:                                                           |

| This software is subject to the PHP License, available in this     |

| distribution in the file LICENSE.  By continuing this installation |

| process, you are bound by the terms of this license agreement.     |

| If you do not agree with the terms of this license, you must abort |

| the installation process at this point.                            |

+——————————————————————–+

  

Thank you for using PHP.            

[/usr/local/src/php-4.0.4pl1]# make

[/usr/local/src/php-4.0.4pl1]# make install

/***** mod_ssl, php 를 포함한 apache 컴파일 및 설치 ********/

[root@test apache_1.3.19]# SSL_BASE=/usr/local/ssl \\

> ./configure –prefix=/usr/local/httpd \\

> –enable-module=all –enable-shared=max \\

> –activate-module=src/modules/php4/libphp4.a \\

> –enable-module=php4  

—————————————————————————

Configuring for Apache, Version 1.3.19

+ using installation path layout: Apache (config.layout)

+ activated php4 module (modules/php4/libphp4.a)

Creating Makefile

Creating Configuration.apaci in src

Creating Makefile in src

+ configured for Linux platform

+ setting C compiler to gcc

+ setting C pre-processor to gcc -E

+ checking for system header files

+ adding selected modules

    o rewrite_module uses ConfigStart/End

+ using -lndbm for DBM support

      enabling DBM support for mod_rewrite

    o dbm_auth_module uses ConfigStart/End

    o db_auth_module uses ConfigStart/End

      using Berkeley-DB/2.x for mod_auth_db (-ldb)

    o ssl_module uses ConfigStart/End

      + SSL interface: mod_ssl/2.8.2

      + SSL interface build type: DSO

      + SSL interface compatibility: enabled

      + SSL interface experimental code: disabled

      + SSL interface conservative code: disabled

      + SSL interface vendor extensions: disabled

      + SSL interface plugin: Built-in SDBM

      + SSL library path: /usr/local/ssl

      + SSL library version: OpenSSL 0.9.6a 5 Apr 2001

      + SSL library type: installed package (stand-alone)

    o php4_module uses ConfigStart/End

+ enabling Extended API (EAPI)

+ using -ldl for vendor DSO support

+ checking sizeof various data types

+ doing sanity check on compiler and options

Creating Makefile in src/support

Creating Makefile in src/os/unix

Creating Makefile in src/ap

Creating Makefile in src/main

Creating Makefile in src/lib/expat-lite

Creating Makefile in src/modules/experimental

Creating Makefile in src/modules/standard

Creating Makefile in src/modules/extra

Creating Makefile in src/modules/proxy

Creating Makefile in src/modules/example

Creating Makefile in src/modules/ssl

Creating Makefile in src/modules/php4  

—————————————————————————

[/usr/local/src/apache_1.3.19]# make

+———————————————————————+

| Before you install the package you now should prepare the SSL       |

| certificate system by running the ‘make certificate’ command.       |

| For different situations the following variants are provided:       |

|                                                                     |

| % make certificate TYPE=dummy    (dummy self-signed Snake Oil cert) |

| % make certificate TYPE=test     (test cert signed by Snake Oil CA) |

| % make certificate TYPE=custom   (custom cert signed by own CA)     |

| % make certificate TYPE=existing (existing cert)                    |

|        CRT=/path/to/your.crt [KEY=/path/to/your.key]                |

|                                                                     |

| Use TYPE=dummy    when you’re a  vendor package maintainer,         |

| the TYPE=test     when you’re an admin but want to do tests only,   |

| the TYPE=custom   when you’re an admin willing to run a real server |

| and TYPE=existing when you’re an admin who upgrades a server.       |

| (The default is TYPE=test)                                          |

|                                                                     |

| Additionally add ALGO=RSA (default) or ALGO=DSA to select           |

| the signature algorithm used for the generated certificate.         |

|                                                                     |

| Use ‘make certificate VIEW=1’ to display the generated data.        |

|                                                                     |

| Thanks for using Apache & mod_ssl.       Ralf S. Engelschall        |

|                                          rse at engelschall.com      

|

|                                          www.engelschall.com        |

+———————————————————————+  

[/usr/local/src/apache_1.3.19]# make certificate TYPE=existing \\

> CRT=/usr/local/ssl/bin/secure.test.co.kr.crt \\

> KEY=/usr/local/ssl/private/secure.test.co.kr.key

—————————————————————————

make[1]: Entering directory `/usr/local/src/apache_1.3.19/src’

SSL Certificate Generation Utility (mkcert.sh)

Copyright (c) 1998-2000 Ralf S. Engelschall, All Rights Reserved.

  

Using existing custom certificate [EXISTING]

______________________________________________________________________

  

RESULT: Server Certification Files

  

o  conf/ssl.key/server.key

   The PEM-encoded RSA private key file which you configure

   with the ‘SSLCertificateKeyFile’ directive (automatically done

   when you install via APACI). KEEP THIS FILE PRIVATE!

  

o  conf/ssl.crt/server.crt

   The PEM-encoded X.509 certificate file which you configure

   with the ‘SSLCertificateFile’ directive (automatically done

   when you install via APACI).

  

Congratulations that you establish your server with real certificates.

  

make[1]: Leaving directory `/usr/local/src/apache_1.3.19/src’

—————————————————————————

[/usr/local/src/apache_1.3.19]# make install

+——————————————————–+

| You now have successfully built and installed the      |

| Apache 1.3 HTTP server. To verify that Apache actually |

| works correctly you now should first check the         |

| (initially created or preserved) configuration files   |

|                                                        |

|   /usr/local/httpd/conf/httpd.conf

|                                                        |

| and then you should be able to immediately fire up     |

| Apache the first time by running:                      |

|                                                        |

|   /usr/local/httpd/bin/apachectl start

|                                                        |

| Or when you want to run it with SSL enabled use:       |

|                                                        |

|   /usr/local/httpd/bin/apachectl startssl

|                                                        |

| Thanks for using Apache.       The Apache Group        |

|                                http://www.apache.org/  |

+——————————————————–+