一、拓扑图
二、架构说明
1）WordPress和phpMyAdmin简介
WordPress是用于搭建个人博客站点的，是一个开源的PHP程序，如果你懂PHP开发你可以在此基础上进行二次开发打造属于自己的有个性的个人博客站点；
phpMyAdmin也是一个开源的PHP程序，用于管理MySQL数据库，可以对MySQL数据库进行图形化的操作，轻松的管理MySQL数据库。
2）访问方式
客户端通过访问Web服务器上的网站，首先由DNS服务器解析网站的IP，客户端通过解析的IP地址找到服务器，由服务器分别提供不同的网站地址，服务器通过rpm包格式安装配置lamp架构，提供两个虚拟主仙，一个用于wordpress，一个用于phpMyAdmin，其中wordpress用于http://www.blog.com地址访问，phpMyAdmin提供的网站为https://www.phpadmin.com
Web服务器向CA服务器申请证书，以构建HTTPS通信，客户端把CA服务器的证书导出到浏览器受信任的根证书颁发机构中，以加密方式能Web服务器提供的HTTPS进行通信。
在访问www.phpadmin时将自动跳转到https://www.phpadmin.com，不用输入https，就能访问https://www.phpadmin.com站点，轻松的管理Mysql数据库了。
三、架构规划
1)主机规划
| 主机 | IP地址 | 提供服务 |
| 客户端 | 172.16.9.6 | - |
| DNS | 192.168.0.92 | DNS域名解析 |
| Web服务器 | 172.16.190.25 |
http://www.blog.com https://www.phpmyadmin.com |
| CA | 192.168.0.197 | 给Web服务器发证书 |
2）程序版本
bind-9.8.2-0.30.rc1.el6.x86_64
mariadb-5.5.43-linux-x86_64.tar.gz
httpd-2.2.15-39.el6.centos.x86_64
php-5.3.3-38.el6.x86_64
四、DNS配置
1）安装bind程序包
yum install bind -y
2）修改/etc/named.conf配置文件中Options中的内容，其它的不变
options { directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file"/var/named/data/named_stats.txt";
allow-query { any; };
recursionyes;
forwardfirst;
forwarders{ 172.16.0.1; };
dnssec-enableno;
dnssec-validationno;
};
3）配置区域文件/etc/named.rfc1912.zones添加以下行
#用于指www.blog.com的解析库文件zone "blog.com" IN { typemaster; file"blog.com.zone"; allow-update{ none; };};#用于指www.phpadmin.com的解析库文件zone "phpadmin.com" IN { typemaster; file"phpadmin.com.zone"; allow-update{ none; };};
4）创建区域解析库文件/var/named
[root@DSN named]# cat blog.com.zone $TTL 86400@ IN SOA ns1.blog.com. admin.blog.com. ( 2015050101 3D 7H 4D 1D) IN NS ns1ns1 IN A 192.168.0.92www IN A 172.16.190.25[root@DNS named]# cat phpadmin.com.zone $TTL 86400@ IN SOA ns1.phpadmin.com. admin.phpadmin.com. ( 2015050101 3D 7H 4D 1D) IN NS ns1ns1 IN A 192.168.0.92www IN A 172.16.190.25
5）启动bind服务
service named start
五、CA服务器配置
1）创建辅助文件
[root@CA CA]# touch index.txt[root@CA CA]# echo 01 > serial
2）创建CA私钥
[root@CA CA]# (umask 077;openssl genrsa-out private/cakey.pem 2048)Generating RSA private key, 2048 bit longmodulus......................+++..................................................................................+++e is 65537 (0x10001)[root@CA CA]# ll private/cakey.pem -rw------- 1 root root 1679 May 1 20:53 private/cakey.pem
3）创建CA根证书
[root@CA CA]# openssl req -new -x509 -keyprivate/cakey.pem -out cacert.pem -days3360You are about to be asked to enterinformation that will be incorporatedinto your certificate request.What you are about to enter is what iscalled a Distinguished Name or a DN.There are quite a few fields but you canleave some blankFor some fields there will be a defaultvalue,If you enter '.', the field will be leftblank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BJLocality Name (eg, city) [Default City]:BJOrganization Name (eg, company) [DefaultCompany Ltd]:WuDayOrganizational Unit Name (eg, section)[]:OpsCommon Name (eg, your name or your server'shostname) []:ca.comEmail Address []:admin@ca.com[root@CA CA]# ll cacert.pem -rw-r--r-- 1 root root 1350 May 1 20:57 cacert.pem
六、Web服务器lamp程序包安装
1）安装开发组件包
yum groupinstall "Developmenttools" "Server Platform Development" -y
2）安装httpd程序包
yum install httpd -y
3）安装mysql程序包
yum install mysql -yyum install mysql-server -yyum install php-mysql -y
4）安装php程序包
yum install php -yyum install php-mbstring -yyum install php-mcrypt -y
5）安装ssl模块
yum install mod_ssl -y
七、Web服务器httpd配置
1）创建用于存放站点程序的目录
mkdir /web/{wordpress,phpadmin} -p
2）修改/etc/httpd/conf/httpd.conf
#DocumentRoot "/var/www/html" #注释DocumentRootDirectoryIndex index.php index.html index.html.var #添加index.php为Web的首页NameVirtualHost *:80 #开启虚拟主机<VirtualHost *:80> ServerAdmin admin@blog.com DocumentRoot /web/wordpress #站点www.blog.com的程序存放路径 ServerName www.blog.com #域名 ErrorLog logs/error-blog.com #错误日志 CustomLog logs/access-blog.com.log combined #访问日志 <Directory "/web/wordpress"> #定义站点访问属性 Options None AllowOverride None Order allow,deny Allow from all </Directory></VirtualHost><VirtualHost *:80> ServerAdmin admin@phpadmin.com DocumentRoot /web/phpadmin ServerName www.phpadmin.com ErrorLog logs/error-phpadmin.comCustomLoglogs/access-phpadmin.com.log combined RedirectMatch^/$ https://www.phpadmin.com #重定向站点到https://www.phpadmin.com <Directory "/web/phpadmin"> Options None AllowOverride None Order allow,deny Allow from all </Directory></VirtualHost>
八、Web服务器SSL配置
1）创建证书和私钥存放目录
mkkdir /etc/httpd/ssl
cd /etc/httpd/ssl
2）创建私钥
[root@Web-Server ssl]# (umask 077;opensslgenrsa -out httpd.key 2048)Generating RSA private key, 2048 bit longmodulus.+++..........................................+++e is 65537 (0x10001)
3）创建证书申请
[root@Web-Server ssl]# openssl req -new-key httpd.key -out httpd.csr -days 3360You are about to be asked to enterinformation that will be incorporatedinto your certificate request.What you are about to enter is what iscalled a Distinguished Name or a DN.There are quite a few fields but you canleave some blankFor some fields there will be a defaultvalue,If you enter '.', the field will be leftblank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BJLocality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [DefaultCompany Ltd]:WuDayOrganizational Unit Name (eg, section)[]:OpsCommon Name (eg, your name or your server'shostname) []:www.phpadmin.comEmail Address []:admin@phpadmin.com Please enter the following 'extra'attributesto be sent with your certificate requestA challenge password []:An optional company name []:
4）把证书申请发送给CA服务器
[root@Web-Server ssl]# scp httpd.csrroot@192.168.0.197:/tmpThe authenticity of host '192.168.0.197(192.168.0.197)' can't be established.RSA key fingerprint is2e:bb:a7:50:d4:26:f7:5d:82:46:ad:9f:97:31:4f:82.Are you sure you want to continueconnecting (yes/no)? yesWarning: Permanently added '192.168.0.197'(RSA) to the list of known hosts.root@192.168.0.197's password: httpd.csr 100% 1041 1.0KB/s 00:00
4）CA服务器验证证书申请并签发
[root@CA CA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt Using configuration from/etc/pki/tls/openssl.cnfCheck that the request matches thesignatureSignature okCertificate Details: Serial Number: 1 (0x1) Validity Not Before: May 1 14:29:08 2015GMT Not After : Apr 30 14:29:08 2016 GMT Subject: countryName = CN stateOrProvinceName = BJ organizationName = WuDay organizationalUnitName = Ops commonName = www.phpadmin.com emailAddress =admin@phpadmin.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D2:9E:1D:5E:9B:FF:9B:F9:21:62:9A:78:CE:57:63:04:14:56:63:0F X509v3 Authority Key Identifier: keyid:93:E3:5C:A2:2C:66:DE:BF:53:02:64:64:09:6D:95:D1:4F:92:BF:56 Certificate is to be certified until Apr 3014:29:08 2016 GMT (365 days)Sign the certificate? [y/n]:y1 out of 1 certificate requests certified,commit? [y/n]yWrite out database with 1 new entriesData Base Updated
5）从CA服务器拉回证书
[root@Web-Server ssl]# scp root@192.168.0.197:/tmp/httpd.crt./root@192.168.0.197's password: httpd.crt 100% 4547 4.4KB/s 00:00 [root@Web-Server ssl]# lltotal 16-rw-r--r-- 1 root root 4547 May 1 22:23 httpd.crt-rw-r--r-- 1 root root 1041 May 1 22:18 httpd.csr-rw------- 1 root root 1675 May 1 22:16 httpd.key
6）修改/etc/httpd/conf.d/ssl.conf配置文件
<VirtualHost 172.16.190.25:443> #443端口监听在172.16.190.25DocumentRoot "/web/phpadmin"ServerName www.phpadmin.com:443SSLCertificateFile /etc/httpd/ssl/httpd.crt #指定站点证书存放位置SSLCertificateKeyFile/etc/httpd/ssl/httpd.key #指定私钥文件存放位置
九、启动httpd和mysqld服务
service httpd start
service mysqld start
十、安装wordpass和phpMyAdmin程序
1）下载wordpass和phpMyAdmin程序包
2）解压文件wordpass和phpMyAdmin程序包
[root@Web-Server ~]# unzipwordpress-3.3.1-zh_CN.zip[root@Web-Server ~]# cd wordpress[root@Web-Server wordpress]# cp -aR ./*/web/wordpress/[root@Web-Server ~]# tar xfphpMyAdmin-3.5.1-all-languages.tar.bz2[root@Web-Server ~]# cd phpMyAdmin-3.5.1-all-languages[root@Web-ServerphpMyAdmin-3.5.1-all-languages]# cp -aR ./* /web/phpadmin/
十一、创建wordpass数据库和用户和用于登录很管理数据库phpMyAdmin的root密码
[root@Web-Server wordpress]# mysqlmysql> CREATE DATABASE wordpress; #创建数据库wordpressQuery OK, 1 row affected (0.00 sec)mysql> GRANT ALL ON wordpress.* TO'wpuser'@'localhost' IDENTIFIED BY 'wordpass'; #创建用户wpuser设置密码为wordpress并授权管理wordpress库中所有表Query OK, 0 rows affected (0.00 sec) mysql> SET PASSWORD FOR'root'@'localhost'=PASSWORD('mysql'); #修改root用户的密码为mysqlQuery OK, 0 rows affected (0.00 sec)mysql> SET PASSWORD FOR'root'@'127.0.0.1'=PASSWORD('mysql'); Query OK, 0 rows affected (0.00 sec) mysql> FLUSH PRIVILEGES; #刷新数据库，让内存中的数据存回磁盘中Query OK, 0 rows affected (0.00 sec)
十二、配置wordpass程序的wp-config.php
/** WordPress 数据库的名称 */define('DB_NAME', 'wordpress'); /** MySQL 数据库用户名 */define('DB_USER', 'wpuser'); /** MySQL 数据库密码 */define('DB_PASSWORD', 'wordpass');
十三、客户端IP设置
十四、客户端安装根证书
通过CA服务器把自己的证书共享出来，客户端安装CA证书，用于验证www.phpadmin.com和加密通信。通过Xshell自带的lftp功能把证书下载到本地的操作系统上，并把cacert.pem的扩展名改为.crt,然后进行安装证书。
1）在没有安装根证书之前的访问
2）点击“继续浏览此网站（不推荐）”，虽然可以继续访问，但浏览器会提示不受信任的证书，因为我们是私建的证书，所以要把根证书导入到浏览器中，这个过程就是你访问www.12306.cn一样，你懂的噻！
3）安装根证书
安装完之后重启浏览器就能以https加密通信访问www.phpadmin.com站点了。
十五、访问www.blog.com
第一次访问www.blog.com需要进行安装，输入站点标明，用户名，密码及电子邮件后，点击安装“安装WordPress”，安装后访问就是以上效果，你可以进行登录，登录的用户名和密码就是安装wordpress输入的用户名和密码，登录就可以进行发表属于自己的个人博客站点。
十六、访问www.phpadmin.com
在访问www.phpadmin时不用输入https://www.phpadmin.com，直接输入www.phpadmin.com,Web服务器会自动的跳转至https://www.phpadmin.com,就能访问https://www.phpadmin.com站点，轻松的管理Mysql数据库了。
这个过程就像访问百度一下，百度会自动的跳转至https://www.baidu.com。
登录后轻松的管理MySQL数据库；
本文出自 “乌大宛” 博客，请务必保留此出处http://wuday.blog.51cto.com/2623944/1643597