IT/보안 블로그

안녕하세요
이전글에서 tlsv1.3 기반의 APM을 설치를 진행했습니다.
이번에는 실제 tlsv1.3이 인증서에서 적용이 되었는지 확인하기 위해서 무료 인증서 letsencrypt를 이용해서 설치를 진행하겠습니다.
기존 letsencrypt는 90일 기간이지만 무료인증서중 180일 보장하는 buypass 인증서가 있어 이것으로 인증서를 설치하겠습니다.

간단한 웹페이지를 만들겠습니다.
디렉토리도 만들겠습니다.

도메인이름은 test.co.kr 으로 하겠습니다.

mkdir -p /home/test.co.kr/public_html
echo "TEST test.co.kr index Page" >> /home/test.co.kr/public_html/index.html



# vi /usr/local/apache/conf/extra/httpd-vhosts.conf

<VirtualHost *:80>
ServerAdmin root@localhost
DocumentRoot "/home/test.co.kr/public_html"
ServerName test.co.kr
ServerAlias www.test.co.kr
ErrorLog "logs/test.co.kr-error_log"
CustomLog "logs/test.co.kr-access_log" common

<Directory "/home/test.co.kr/public_html/*">
AllowOverride All
Options FollowSymLinks
Require all granted
</Directory>

</VirtualHost>

# vi /usr/local/apache/conf/httpd.conf

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_http_module modules/mod_proxy_http.so

LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
-> 주석처리 풀기

#Include conf/extra/httpd-vhosts.conf
Include conf/extra/httpd-vhosts.conf
-> 주석처리 해제 후 저장

# apachectl -t
Syntax OK

# apachectl -S

VirtualHost configuration:
*:80 test.co.kr (/usr/local/apache/conf/extra/httpd-vhosts.conf:32)
ServerRoot: "/usr/local/apache"
Main DocumentRoot: "/usr/local/apache/htdocs"
Main ErrorLog: "/usr/local/apache/logs/error_log"
Mutex authdigest-client: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ldap-cache: using_defaults
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/usr/local/apache/logs/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex cache-socache: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex rewrite-map: using_defaults
PidFile: "/usr/local/apache/logs/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="nobody" id=99
Group: name="nobody" id=99

apache 설정파일 적용및 실행
# /etc/init.d/apachectl graceful

SSL 관련 모듈 확인
# apachectl -l
Compiled in modules:
core.c
mod_so.c -> 동적 방식 (DSO)로 설치되어있다. 만약 정적방식일 경우 mod_ssl.c로 설치가 되어있습니다.
http_core.c
prefork.c

mod_ssl.so 모듈이 실제 있는지 확인
ll /usr/local/apache/modules/ | grep ssl
-rwxr-xr-x 1 root root 615936 Jul 26 06:26 mod_ssl.so

# vi /usr/local/apache/conf/httpd.conf
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule socache_dbm_module modules/mod_socache_dbm.so
LoadModule socache_memcache_module modules/mod_socache_memcache.so
LoadModule ssl_module modules/mod_ssl.so
Include conf/extra/httpd-ssl.conf
-> 해당 부분 주석처리 해제 후 저장

무료인증서 툴 certbot 관련 설치

yum install -y certbot* certbot-apache certbot-nginx

무료인증서를 받는 방식중에서 webroot 방식으로 하겠습니다.

90일 인증서 발급 명령어
# certbot certonly --webroot --agree-tos -m [서버관리자이메일] -w [웹루트 디렉토리 위치] -d [도메인 1] -d [도메인 2(보통 www.원도메인)] -d [도메인 3] --rsa-key-size 4096

180일 인증서 발급 명령어
# certbot certonly --webroot --agree-tos --server https://api.buypass.com/acme/directory -m [서버관리자이메일] -w [웹루트 디렉토리 위치] -d [도메인 1] -d [도메인 2(보통 www.원도메인)] -d [도메인 3] --rsa-key-size 4096

마지막에 --dry-run 을 붙이면 테스트도 가능합니다.

dry-run 하면 결과값을 알 수 있습니다. 성공을 한다면 저렇게 나옵니다.
IMPORTANT NOTES:
- The dry run was successful.

아래 그림은 인증서를 발급 결과와 발급받은 인증서 위치 입니다.

ssl.conf를 원본을 백업 복사해주자
cp -arp /usr/local/apache/conf/extra/httpd-ssl.conf /usr/local/apache/conf/extra/httpd-ssl.conf_ori

# vi /usr/local/apache/conf/extra/httpd-ssl.conf

Listen 443
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLHonorCipherOrder on
SSLProtocol all +TLSv1.2 +TLSv1.3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
<VirtualHost *:443>
ServerAdmin root@localhost
DocumentRoot "/home/test.co.kr/public_html"
ServerName test.co.kr
ServerAlias www.test.co.kr
ErrorLog "logs/ssl-test.co.krr-error_log"
TransferLog "logs/ssl-test.co.kr-access_log"

<Directory "/home/test.co.kr/public_html/*">
AllowOverride All
Options FollowSymLinks
Require all granted
</Directory>

SSLEngine on
SSLCertificateKeyFile /etc/letsencrypt/live/test.co.kr/privkey.pem
SSLCertificateFile /etc/letsencrypt/live/test.co.kr/cert.pem
SSLCertificateChainFile /etc/letsencrypt/live/test.co.kr/fullchain.pem
#SSLCACertificatePath "/usr/local/apache/conf/ssl.crt"

<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/local/apache/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

CustomLog "/usr/local/apache/logs/ssl_request_log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>
ssl.conf 파일 내용 추가 및 변경하고 저장

# apachectl -t
Syntax OK

Apache에 연동된 도메인 목록 확인
# apache -S
VirtualHost configuration:
*:80 test.co.kr (/usr/local/apache/conf/extra/httpd-vhosts.conf:32)
*:443 test.co.kr (/usr/local/apache/conf/extra/httpd-ssl.conf:121)

apache 설정파일 변경후 적용 실행
/etc/init.d/apachectl graceful

https://도메인이름.co.kr

적용된 인증서 180일 인증기간

실제 서버에서 인증서 만료기간 확인 명령어
# openssl x509 -in /etc/letsencrypt/live/test.co.kr/fullchain.pem -noout -dates
notBefore=Jul 26 02:33:30 2022 GMT
notAfter=Jan 21 22:59:00 2023 GMT


TLS 버전 확인 사이트
https://www.ssllabs.com/ssltest/index.html
TLS Checker - Instant Results | CDN77.com


2번째 링크에서 해당 도메인을 TLS 검사를 해봤을때 TLS 1.3 1.2는 enable로 나와있습니다.
그러나 TLS1.1, TLS1.0도 enable로 되어 있디만 앞에 deprecated, 즉 권장하지 않는다고 나와 있습니다.
그렇기 때문에 이것을 변경하고자 합니다.
TLSv1.2, TLSv1.3 을 제외한 나머지를 disabled로 변경해봅니다.

ssl.conf 에서 TLSv1.2, TLSv1.3 을 제외한 나머지를 disabled로 변경하기위해 아래 설정을 변경합니다.
# vi /usr/local/apache/conf/extra/httpd-ssl.conf
SSLProtocol all +TLSv1.2 +TLSv1.3 -> 이 설정은 all 때문에 모두 포함됩니다.
아래와 같이 변경해줍니다.
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

변경 후 apachectl -t 문법검사 후 통과가 된다면 세션때문에 재시작을 해줍니다.
/etc/init.d/apachectl restart

위 그림과 같이 disabled로 변경되어 안전하게 사이트를 운영할 수 있습니다.

실제 타 서버에서 해당 서버가 tls 버전이 어떻게 되는지 확인해봅시다.

openssl 작업을 하지 않은 순정 서버에서 확인해봅시다.

# openssl s_client -connect test.co.kr:443 -tls1

# openssl s_client -connect test.co.kr:443 -tls1_1

# openssl s_client -connect test.co.kr:443 -tls1_2

# openssl s_client -connect test.co.kr:443 -tls1_3
참고로 저 명령어는 애초에 서버에 설치되어 있는 openssl 버전 기반으로 하기 때문에 순정 CentOS 에서는 불가능합니다.
그래서 openssl 소스업그레이드를 한 CentOS7버전에서 저 명령어를 입력해야합니다.

만약 간단하게 소스업그레이드를 안하고 확인하고 싶다면
# yum install -y openssl11*
# openssl11 s_client -connect test.co.kr:443 -tls1_3

이상입니다.
========================================== 끝 ===============================================

안녕하세요. 이전 글에서 CentOS 7 에서 TLSv1.3을 설치 및 연동하기위해서 openssl, curl를 설치진행 했습니다.
이것들을 이용하여 APM또한 TLSv1.3을 연동설치 진행을 해보겠습니다.
모든 APM은 최신버전으로 설치하겠습니다.

설치할 버전들
apr-1.7.0
apr-iconv-1.2.2
apr-util-1.6.1
pcre-8.45
apache-2.4.54
mod_url-apache2-1.25
cmake-3.23.1
mariadb-10.6.8
pcre2-10.37
libgd-2.3.2
libzip-1.8.0
php-8.0.21
mcrypt-1.0.4
imagick-3.7.0
mysql php모듈 - git 버전

설치 순서는 다음과 같습니다.
기본적인 패키지devel 및 gcc 와 심볼릭링크 설정 -> apr -> apr-iconv -> apr-util -> pcre -> apache -> mod_url -> cmake -> mariadb -> pcre2, libgd, libzip -> php -> php 추가모듈 Opcache, mcrypt, imagick, mysql

디폴트환경변수

echo " " >> /etc/profile
echo "####default PATH#####" >> /etc/profile
echo "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:" >> /etc/profile
echo "#####################" >> /etc/profile


필수 라이브러리 설치
yum install -y libdb-devel enchant-devel libxslt libxslt-devel net-snmp-devel readline-devel readline aspell-devel unixODBC unixODBC-devel libicu-devel icu libicu libc-client libc-client-devel libc-client-2007f freetype-devel freetype* freetype libXpm libXpm-devel libpng-devel libpng* libvpx-devel libvpx libcurl libcurl-devel curl* curl-devel curl tcp_wrappers-devel libzip environment-modules uw-imap-utils uw-imap-devel uw-imap uw-imap-static pam-devel libldb-devel openldap-devel cyrus-sasl-devel bzip2-devel bzip2 bzip2-libs ncurses-devel ncurses mysql-devel libjpeg-devel libjpeg* libjpeg-devel openssl-devel openssl* openssl-libs libxml* libxml2 libxml2-devel libmcrypt libmcrypt-devel libmcrypt* mcrypt mhash* mhash mhash-devel libmhash libmhash-devel expat-devel expat expat* gmp* gmp gmp-devel krb5* krb5-devel db4 db4-devel wget make cmake libtool* pcre* gdbm* gdbm gdbm-devel libtiff* libtiff libtiff-devel flex zlib* zlib-devel zlib gd* gd gd-devel patch t1lib t1lib-devel readline libedit-devel libtidy libtidy-devel gcc* gcc gcc-c++ libtermcap-devel dialog sqlite-devel oniguruma oniguruma-devel libzip5 mod_ssl postgresql-devel lcov systemtap-sdt-devel mod_ldap elfutils-devel libwebp-devel libwebp git gzip libnghttp2-devel valgrind* mod_proxy* editline editline-devel patchelf systemd-devel ImageMagick-devel libzstd-devel libffi libffi-devel libraqm-devel libraqm libsodium libsodium-devel brotli* libssh2* c-ares*


imap 호환
ln -s /usr/lib64/libc-client.a /usr/lib/libc-client.a
unlink /usr/include/db.h
ln -s /usr/include/libdb4/db.h /usr/include/db.h
ln -s /usr/include/sqlext.h /usr/local/include/sqlext.h
ln -s /usr/lib64/libgdbm_compat.so /usr/local/lib64/libdbm.so

openldap 호환
\cp -arpf /usr/lib64/libldap* /usr/lib/
ln -sf /usr/lib64/libm.so /usr/lib/libm.so
ln -sf /usr/lib64/libssl.so /usr/lib/libssl.so


libXpm 모듈 32비트 호환
ln -s /usr/lib64/libXpm.so /usr/lib/
ln -s /usr/lib64/libXpm.so.4 /usr/lib/
ln -s /usr/lib64/libXpm.so.4.11.0 /usr/lib/

PKG_CONFIG_PATH 디폴트 설정
echo " " >> /etc/profile
echo "export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig:/usr/lib64/pkgconfig:/usr/lib/pkgconfig" >> /etc/profile
echo " " >> /etc/profile
source /etc/profile

APM_Setup 디렉토리 만들기
mkdir -p /usr/local/src/APM_Setup

apr 설치
cd /usr/local/src/APM_Setup
wget https://archive.apache.org/dist/apr/apr-1.7.0.tar.gz
tar zxvf apr-1.7.0.tar.gz
cd /usr/local/src/APM_Setup/apr-1.7.0
./configure --prefix=/usr/local/apr && make -j && make install

apr-iconv 설치
cd /usr/local/src/APM_Setup
wget https://archive.apache.org/dist/apr/apr-iconv-1.2.2.tar.gz
tar zxvf apr-iconv-1.2.2.tar.gz
cd /usr/local/src/APM_Setup/apr-iconv-1.2.2
./configure --prefix=/usr/local/apr --with-apr=/usr/local/apr/bin/apr-1-config && make -j && make install

apr-util 설치
cd /usr/local/src/APM_Setup
wget https://archive.apache.org/dist/apr/apr-util-1.6.1.tar.gz
tar zxvf apr-util-1.6.1.tar.gz
cd /usr/local/src/APM_Setup/apr-util-1.6.1
./configure --prefix=/usr/local/apr --with-apr=/usr/local/apr/bin/apr-1-config --with-apr-iconv=/usr/local/apr/bin/apriconv --with-crypto --with-openssl=/usr/local --with-nss --with-lber --with-ldap --with-ldap-include=/usr/include --with-ldap-lib=/usr/lib64/ && make -j && make install

-> 여기서 암호화 모듈과 업그레이드한 openssl 연동 --with-openssl=/usr/local 입니다.

pcre 1 설치
cd /usr/local/src/APM_Setup
wget https://ftp.exim.org/pub/pcre/pcre-8.45.tar.gz
tar zxvf pcre-8.45.tar.gz
cd /usr/local/src/APM_Setup/pcre-8.45
./configure --prefix=/usr/local/pcre --enable-pcre8 --enable-pcre16 --enable-pcre32 --enable-jit --enable-utf8 --enable-pcregrep-libz --enable-pcregrep-libbz2 --enable-pcretest-libreadline --enable-valgrind
make -j16 && make install

httpd 설치
cd /usr/local/src/APM_Setup
wget https://archive.apache.org/dist/httpd/httpd-2.4.54.tar.gz
tar zxvf httpd-2.4.54.tar.gz
cd /usr/local/src/APM_Setup/httpd-2.4.54

## 소스 설치시 httpd 동시 접속자 수 기본 default 값에서 늘려주기.(최소 4코어 8쓰레드, 16GB 이상)
원래값 256의 8배 -> 2048
sed -i "s/#define DEFAULT_SERVER_LIMIT 256/#define DEFAULT_SERVER_LIMIT 2048/g" ./server/mpm/prefork/prefork.c
sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 64/g" ./server/mpm/worker/worker.c
sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 64/g" ./server/mpm/event/event.c

## 소스 설치시 httpd 동시 접속자 수 기본 default 값에서 늘려주기.(최소 8코어 16쓰레드, 32GB 이상)
sed -i "s/#define DEFAULT_SERVER_LIMIT 256/#define DEFAULT_SERVER_LIMIT 4096/g" ./server/mpm/prefork/prefork.c
sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 128/g" ./server/mpm/worker/worker.c
sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 128/g" ./server/mpm/event/event.c

openssl, curl를 소스설치 했기 때문에 기본적으로 configure를 소스설치한곳을 먼저 바라보게 하는 설정

export LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/ -L/usr/lib64/ -L/usr/lib/"
-> 해당설정이 매우 중요합니다.
명령어로 적용하기
echo 'export LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/ -L/usr/lib64/ -L/usr/lib/"' >> /etc/profile
source /etc/profile

httpd 소스 컴파일 옵션
./configure --prefix=/usr/local/apache --enable-load-all-modules --enable-maintainer-mode --enable-debugger-mode --enable-pie --enable-modules=all --enable-mods-shared=all --enable-imagemap --enable-authnz-ldap --enable-authnz-fcgi --enable-allowmethods --enable-isapi --enable-file-cache --enable-cache --enable-cache-disk --enable-cache-socache --enable-socache-shmcb --enable-socache-dbm --enable-socache-memcache --enable-socache-redis --enable-so --enable-rewrite --enable-ssl --with-ssl=/usr/local --with-curl=/usr/local/bin/curl-config --enable-expires --enable-proxy-fcgi --enable-proxy-scgi --enable-proxy-html --enable-cgi --enable-cgid --enable-xml2enc --enable-cern-meta --enable-case-filter --enable-ident --with-apr=/usr/local/apr/bin/apr-1-config --with-apr-util=/usr/local/apr/bin/apu-1-config --with-pcre=/usr/local/pcre/bin/pcre-config --with-mpm=prefork --enable-http --disable-http2 --enable-modules=all

굵게 표시된 부분을 본다면 소스설치한곳을 연동하여 컴파일하는 옵션들입니다.
--with-ssl=/usr/local // openssl 소스설치한곳 연동
--with-curl=/usr/local/bin/curl-config // curl 소스설치한곳 연동, apache는 버그로인해 디렉토리로 설정한다면 못찾고 넘어가기 때문에 curl-config 라는 파일을 직접적으로 연동해줍니다.
--with-apr=/usr/local/apr/bin/apr-1-config // apr 소스설치 연동
--with-apr-util=/usr/local/apr/bin/apu-1-config // apr-util 소스설치 연동
--with-pcre=/usr/local/pcre/bin/pcre-config // pcre 소스설치 연동

컴파일 후 결과값 // 이부분을 잘봐야합니다.

Server Version: 2.4.54
Install prefix: /usr/local/apache
C compiler: gcc -std=gnu99
CFLAGS: -g -O2 -pthread -std=c89 -Werror -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wdeclaration-after-statement -Wpointer-arith -Wformat -Wformat-security -Wunused -O0 -Werror=declaration-after-statement
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE -DAP_DEBUG
LDFLAGS: -L/usr/local/lib/ -L/usr/local/lib64/ -L/usr/lib64/ -L/usr/lib/ -L/usr/local/lib
LIBS:
C preprocessor: gcc -E

LDFLAGS 이부분이 지금 보시면 /usr/local/lib -> /usr/local/lib64 -> /usr/lib64 -> /usr/lib -> /usr/local/lib 이렇게 바라보고 있는겁니다. 그렇기 때문에 소스 설치한 라이브러리를 먼저 보고 그다음 패키지가 저장되는 라이브러리를 확인하는 구조입니다.

**아래는 설정하지 않고 한 컴파일 결과값입니다.**
( export LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/ -L/usr/lib64/ -L/usr/lib/" )

Server Version: 2.4.54
Install prefix: /usr/local/apache
C compiler: gcc -std=gnu99
CFLAGS: -g -O2 -pthread -std=c89 -Werror -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wdeclaration-after-statement -Wpointer-arith -Wformat -Wformat-security -Wunused -O0 -Werror=declaration-after-statement
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE -DAP_DEBUG
LDFLAGS: -L/usr/local/lib -L/usr/lib64/
LIBS:
C preprocessor: gcc -E

LDFLAGS 이 /usr/local/lib를 먼저 바라보지만 curl은 /usr/local/lib 에 라이브러리들이 있지만, openssl은 /usr/local/lib64에 있습니다.

httpd 컴파일 후 소스설치
make -j && make install

mod_url 설치 (한글 파일 언어 인식 패치)
cd /usr/local/src/APM_Setup
wget https://kldp.net/modurl/release/2188-mod_url-apache2-1.25.tar.bz2
tar xvf 2188-mod_url-apache2-1.25.tar.bz2
cd /usr/local/src/APM_Setup/mod_url-apache2-1.25/
/usr/local/apache/bin/apxs -iac mod_url.c

echo "" >> /usr/local/apache/conf/httpd.conf
echo "<IfModule mod_url.c>
CheckURL On
ServerEncoding EUC-KR
ClientEncoding UTF-8
</IfModule>" >> /usr/local/apache/conf/httpd.conf
echo "" >> /usr/local/apache/conf/httpd.conf

httpd 설정파일 수정 (mod_php연동 및 기본적인 설정)
sed -i "s/`grep '^User ' /usr/local/apache/conf/httpd.conf`/User nobody/g" /usr/local/apache/conf/httpd.conf
sed -i "s/`grep '^Group ' /usr/local/apache/conf/httpd.conf`/Group nobody/g" /usr/local/apache/conf/httpd.conf
sed -i 's/#ServerName www.example.com:80/ServerName localhost:80/g' /usr/local/apache/conf/httpd.conf
sed -i 's/DirectoryIndex index.html/DirectoryIndex index.html index.php index.jsp/g' /usr/local/apache/conf/httpd.conf
sed -i 's/ServerAdmin you@example.com/ServerAdmin root@localhost/g' /usr/local/apache/conf/httpd.conf
sed -i 's/#AddHandler cgi-script .cgi/AddHandler cgi-script .cgi/g' /usr/local/apache/conf/httpd.conf

Apache - mod_php 연동 설정
sed -i '/AddType application\/x-gzip .tgz/a\ #PHP Enable' /usr/local/apache/conf/httpd.conf
sed -i '/\ #PHP Enable/a \ AddType application/x-httpd-php-source .phps' /usr/local/apache/conf/httpd.conf
sed -i '/\ #PHP Enable/a \ AddType application/x-httpd-php .php .jsp .html' /usr/local/apache/conf/httpd.conf

Home Web Source File 설정
echo "" >> /usr/local/apache/conf/httpd.conf
echo "<Directory \"/home/*\">
AllowOverride All
Options Indexes FollowSymLinks
Require all granted
</Directory>" >> /usr/local/apache/conf/httpd.conf
echo "" >> /usr/local/apache/conf/httpd.conf

httpd 실행 스크립트 파일 및 부팅시 자동시작 설정
cp -arp /usr/local/apache/bin/apachectl /etc/init.d/
chmod 700 /etc/init.d/apachectl
sed -i '/#!\/bin\/sh/a # chkconfig: 2345 90 90' /etc/init.d/apachectl
sed -i '/#!\/bin\/sh/a # description: init file for Apache server daemon.\' /etc/init.d/apachectl
sed -i '/#!\/bin\/sh/a # processname: /usr/local/apache/bin/apachectl' /etc/init.d/apachectl
sed -i '/#!\/bin\/sh/a # config: /usr/local/apache/conf/httpd.conf' /etc/init.d/apachectl
sed -i '/#!\/bin\/sh/a # pidfile: /usr/local/apache/logs/httpd.pid' /etc/init.d/apachectl

apachectl 서비스 등록
echo '[Unit]
Description=The Apache HTTP Server

[Service]
Type=forking
#EnvironmentFile=/usr/local/apache/bin/envvars
PIDFile=/usr/local/apache/logs/httpd.pid
ExecStart=/usr/local/apache/bin/apachectl start
ExecReload=/usr/local/apache/bin/apachectl graceful
ExecStop=/bin/kill -WINCH '${MAINPID}'
#ExecStop=/usr/local/apacher/bin/apachectl stop
KillSignal=SIGCONT
PrivateTmp=true

[Install]
WantedBy=multi-user.target' > /usr/lib/systemd/system/apachectl.service

chkconfig --add apachectl
chkconfig apachectl on
systemctl enable apachectl

Apache 로그로테이트 설정
echo "/usr/local/apache/logs/*_log {" > /etc/logrotate.d/apache
echo "weekly" >> /etc/logrotate.d/apache
echo "rotate 4" >> /etc/logrotate.d/apache
echo "size 1G" >> /etc/logrotate.d/apache
echo "missingok" >> /etc/logrotate.d/apache
echo "create 0600 root root" >> /etc/logrotate.d/apache
echo "postrotate" >> /etc/logrotate.d/apache
echo "/bin/kill -HUP \`cat /usr/local/apache/logs/httpd.pid 2>/dev/null\` 2> /dev/null || true" >> /etc/logrotate.d/apache
echo "endscript" >> /etc/logrotate.d/apache
echo "}" >> /etc/logrotate.d/apache

==========
httpd 설치 끝.
==========

최신 DB 설치를 위한 패키지 설치
yum install -y libtermcap-devel gdbm-devel zlib* libxml* freetype* libpng* libjpeg* iconv flex gmp ncurses-devel make gcc* cmake expat* bzip2 openssl-* lz4* msgpack* libxml2* java-1.8.0* zeromq zeromq-devel jemalloc* boost boost-devel bzip2-devel zstd snappy snappy-devel Judy Judy-devel libzstd* perl-Judy bison bison* libcurl* curl* git libpmem*

cmake 최신버전 업그레이드 설치
CentOS 7 cmake 기본버전이 2.8.12 입니다.
그렇기 때문에 cmake 안정화 최신버전을 설치해줍니다. 버전 3.23.2

cd /usr/local/src/APM_Setup
wget https://github.com/Kitware/CMake/releases/download/v3.23.2/cmake-3.23.2.tar.gz
tar zxvf cmake-3.23.2.tar.gz
cd cmake-3.23.2
./bootstrap --prefix=/usr/local
make -j && make install

mariadb-10.6 LTS설치 / mysql-8.0.29 버전은 너무 무겁기 때문에 보다 가벼운 mariadb 안정화 최신버전을 설치합니다.

DB 관련 소유자, 소유그룹 만들어주기
groupadd -g 400 mysql
useradd -u400 -g400 -d /usr/local/mysql -s /bin/false mysql

DB 설치
cd /usr/local/src/APM_Setup
wget https://dlm.mariadb.com/2298160/MariaDB/mariadb-10.6.8/source/mariadb-10.6.8.tar.gz
tar zxvf mariadb-10.6.8.tar.gz
mkdir /usr/local/src/APM_Setup/mariadb-10.6.8/build
cd /usr/local/src/APM_Setup/mariadb-10.6.8/build

DB 컴파일 옵션
cmake ../ \
-DCMAKE_INSTALL_PREFIX=/usr/local/mysql \
-DMYSQL_DATADIR=/usr/local/mysql/data \
-DDEFAULT_CHARSET=utf8mb4 \
-DDEFAULT_COLLATION=utf8mb4_general_ci \
-DINSTALL_SYSCONFDIR=/etc \
-DINSTALL_SYSCONF2DIR=/etc/my.cnf.d \
-DWITH_EXTRA_CHARSETS=all \
-DMYSQL_TCP_PORT=3306 \
-DTMPDIR=/usr/local/mysql/tmp \
-DMYSQL_UNIX_ADDR=/usr/local/mysql/tmp/mysql.sock \
-DENABLED_LOCAL_INFILE=1 \
-DWITH_INNOBASE_STORAGE_ENGINE=1 \
-DWITH_PARTITION_STORAGE_ENGINE=1 \
-DWITH_FEDERATEDX_STORAGE_ENGINE=1 \
-DWITH_BLACKHOLE_STORAGE_ENGINE=1 \
-DWITH_MYISAM_STORAGE_ENGINE=1 \
-DWITH_ARIA_STORAGE_ENGINE=1 \
-DWITH_XTRADB_STORAGE_ENGINE=1 \
-DWITH_ARCHIVE_STORAGE_ENGINE=1 \
-DWITH_PERFSCHEMA_STORAGE_ENGINE=1 \
-DWITH_LOCALES=1 \
-DWITH_ZLIB=auto \
-DWITH_READLINE=1 \
-DWITH_PCRE=auto \
-DWITH_LIBWRAP=1 \
-DWITH_JEMALLOC=1 \
-DPROFILING=1 \
-DUSE_GCOV=1 \
-DUSE_VALGRIND=1 \
-DWITH_CONNECT_STORAGE_ENGINE=1 \
-DWITH_METADATA_LOCK_INFO=1 \
-DWITH_PIC=1 \
-DWITH_SEQUENCE_STORAGE_ENGINE=1 \
-DWITH_SPHINX_STORAGE_ENGINE=1 \
-DWITH_VALGRIND=1

-> 보통 컴파일 옵션에서 mysql.sock 파일은 /tmp/mysql.sock 가 default 이지만 혹시나 모를 패키지가 또 설치되어 있을 수 있기 때문에 /usr/local/mysql/tmp/mysql.sock 으로 변경해줍니다.

make -j && make install

mysql 설정파일 my.cnf 변경 및 실행 파일 스크립트파일 만들기
mv -f /etc/my.cnf /etc/my.cnf_source_before
cp -arp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld
chkconfig --add mysqld
chkconfig mysqld on

===========================================
echo "#
#
[client]
#password = [your_password]
port = 3306
socket = /usr/local/mysql/tmp/mysql.sock
default-character-set = utf8mb4

# *** Application-specific options follow here ***

#
# The MariaDB server
#
[mysqld]

# generic configuration options
basedir = /usr/local/mysql
datadir = /usr/local/mysql/data
port = 3306
socket = /usr/local/mysql/tmp/mysql.sock

skip-character-set-client-handshake
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
init-connect = SET NAMES utf8mb4

# back_log is the number of connections the operating system can keep in
# the listen queue, before the MariaDB connection manager thread has
# processed them. If you have a very high connection rate and experience
# "connection refused" errors, you might need to increase this value.
# Check your OS documentation for the maximum value of this parameter.
# Attempting to set back_log higher than your operating system limit
# will have no effect.
back_log = 50

# Don't listen on a TCP/IP port at all. This can be a security
# enhancement, if all processes that need to connect to mysqld run
# on the same host. All interaction with mysqld must be made via Unix
# sockets or named pipes.
# Note that using this option without enabling named pipes on Windows
# (via the "enable-named-pipe" option) will render mysqld useless!
#skip-networking

max_connections = 1000
max_connect_errors = 10
table_open_cache = 2048

# Enable external file level locking. Enabled file locking will have a
# negative impact on performance, so only use it in case you have
# multiple database instances running on the same files (note some
# restrictions still apply!) or if you use other software relying on
# locking MyISAM tables on file level.
#external-locking

max_allowed_packet = 16M
binlog_cache_size = 1M
max_heap_table_size = 64M
read_buffer_size = 2M
read_rnd_buffer_size = 16M
sort_buffer_size = 8M
join_buffer_size = 8M
thread_cache_size = 8

###warning_option
###thread_concurrency = 8

query_cache_size = 64M
query_cache_limit = 2M
ft_min_word_len = 4

#memlock
#default-storage-engine = MYISAM
default-storage-engine = InnoDB

thread_stack = 240K
transaction_isolation = REPEATABLE-READ
tmp_table_size = 64M

log-bin=mysql-bin
binlog_format=mixed
#log_slave_updates
#log
#log_warnings
slow_query_log
long_query_time = 3

server-id = 1

#*** MyISAM Specific options
key_buffer_size = 32M
bulk_insert_buffer_size = 64M
myisam_sort_buffer_size = 128M
myisam_max_sort_file_size = 10G
myisam_repair_threads = 1
myisam_recover

# *** INNODB Specific options ***
# Use this option if you have a MariaDB server with InnoDB support enabled
# but you do not plan to use it. This will save memory and disk space
# and speed up some things.
#skip-innodb

# Additional memory pool that is used by InnoDB to store metadata
# information. If InnoDB requires more memory for this purpose it will
# start to allocate it from the OS. As this is fast enough on most
# recent operating systems, you normally do not need to change this
# value. SHOW INNODB STATUS will display the current amount used.

###fail_option
###innodb_additional_mem_pool_size = 16M

# InnoDB, unlike MyISAM, uses a buffer pool to cache both indexes and
# row data. The bigger you set this the less disk I/O is needed to
# access data in tables. On a dedicated database server you may set this
# parameter up to 80% of the machine physical memory size. Do not set it
# too large, though, because competition of the physical memory may
# cause paging in the operating system. Note that on 32bit systems you
# might be limited to 2-3.5G of user level memory per process, so do not
# set it too high.
innodb_buffer_pool_size = 2G

# InnoDB stores data in one or more data files forming the tablespace.
# If you have a single logical drive for your data, a single
# autoextending file would be good enough. In other cases, a single file
# per device is often a good choice. You can configure InnoDB to use raw
# disk partitions as well - please refer to the manual for more info
# about this.
innodb_data_file_path = ibdata1:10M:autoextend

# Set this option if you would like the InnoDB tablespace files to be
# stored in another location. By default this is the MariaDB datadir.
innodb_data_home_dir = /usr/local/mysql/data

# Number of IO threads to use for async IO operations. This value is
# hardcoded to 8 on Unix, but on Windows disk I/O may benefit from a
# larger number.
innodb_write_io_threads = 8
innodb_read_io_threads = 8

# If you run into InnoDB tablespace corruption, setting this to a nonzero
# value will likely help you to dump your tables. Start from value 1 and
# increase it until you're able to dump the table successfully.
#innodb_force_recovery=1

# Number of threads allowed inside the InnoDB kernel. The optimal value
# depends highly on the application, hardware as well as the OS
# scheduler properties. A too high value may lead to thread thrashing.
### warning option
##innodb_thread_concurrency = 16
# If set to 1, InnoDB will flush (fsync) the transaction logs to the
# disk at each commit, which offers full ACID behavior. If you are
# willing to compromise this safety, and you are running small
# transactions, you may set this to 0 or 2 to reduce disk I/O to the
# logs. Value 0 means that the log is only written to the log file and
# the log file flushed to disk approximately once per second. Value 2
# means the log is written to the log file at each commit, but the log
# file is only flushed to disk approximately once per second.
innodb_flush_log_at_trx_commit = 1

# Speed up InnoDB shutdown. This will disable InnoDB to do a full purge
# and insert buffer merge on shutdown. It may increase shutdown time a
# lot, but InnoDB will have to do it on the next startup instead.
#innodb_fast_shutdown

# The size of the buffer InnoDB uses for buffering log data. As soon as
# it is full, InnoDB will have to flush it to disk. As it is flushed
# once per second anyway, it does not make sense to have it very large
# (even with long transactions).
innodb_log_buffer_size = 8M

# Size of each log file in a log group. You should set the combined size
# of log files to about 25%-100% of your buffer pool size to avoid
# unneeded buffer pool flush activity on log file overwrite. However,
# note that a larger logfile size will increase the time needed for the
# recovery process.
innodb_log_file_size = 256M

# Total number of files in the log group. A value of 2-3 is usually good
# enough.
#### waring option
#innodb_log_files_in_group = 3

# Location of the InnoDB log files. Default is the MariaDB datadir. You
# may wish to point it to a dedicated hard drive or a RAID1 volume for
# improved performance
#innodb_log_group_home_dir

# Maximum allowed percentage of dirty pages in the InnoDB buffer pool.
# If it is reached, InnoDB will start flushing them out agressively to
# not run out of clean pages at all. This is a soft limit, not
# guaranteed to be held.
innodb_max_dirty_pages_pct = 90

# The flush method InnoDB will use for Log. The tablespace always uses
# doublewrite flush logic. The default value is "fdatasync", another

# option is "O_DSYNC".
#innodb_flush_method=O_DSYNC

# How long an InnoDB transaction should wait for a lock to be granted
# before being rolled back. InnoDB automatically detects transaction
# deadlocks in its own lock table and rolls back the transaction. If you
# use the LOCK TABLES command, or other transaction-safe storage engines
# than InnoDB in the same transaction, then a deadlock may arise which
# InnoDB cannot notice. In cases like this the timeout is useful to
# resolve the situation.
innodb_lock_wait_timeout = 120


[mysqldump]
max_allowed_packet = 16M

[mysql]
no-auto-rehash
default-character-set = utf8mb4

# Only allow UPDATEs and DELETEs that use keys.
#safe-updates

[myisamchk]
key_buffer_size = 512M
sort_buffer_size = 512M
read_buffer = 8M
write_buffer = 8M

[mysqlhotcopy]
interactive-timeout

[mysqld_safe]
open-files-limit = 8192" > /etc/my.cnf
===========================================

DB 권한 및 소유권 설정
mkdir -p /usr/local/mysql/data
mkdir -p /usr/local/mysql/lnnoDB/redoLogs
mkdir -p /usr/local/mysql/lnnoDB/undoLogs
mkdir -p /usr/local/mysql/logs
mkdir -p /usr/local/mysql/tmp
chmod 755 /etc/init.d/mysqld
chmod 711 /usr/local/mysql
chmod 751 /usr/local/mysql/bin
chmod 751 /usr/local/mysql/bin/*
chmod 755 /usr/local/mysql/bin/mysql
chmod 755 /usr/local/mysql/bin/mysqldump
rm -rf /usr/local/mysql/bin/rcmysql
rm -rf /etc/init.d/mysql
ln -s /etc/init.d/mysqld /usr/local/mysql/bin/rcmysql
chown -R mysql:mysql /usr/local/mysql

소스설치한 DB 라이브러리 인식시켜주기
echo "/usr/local/mysql/lib" > /etc/ld.so.conf.d/mysql.conf
ln -s /usr/local/mysql/lib /usr/local/mysql/lib64
ldconfig

DB 초기화 기본 생성
/usr/local/mysql/scripts/mysql_install_db --user=mysql --basedir=/usr/local/mysql --datadir=/usr/local/mysql/data
==========
DB 설치 끝.
==========

최신버전 pcre 2 설치
cd /usr/local/src/APM_Setup
wget https://ftp.exim.org/pub/pcre/pcre2-10.37.tar.gz
tar zxvf pcre2-10.37.tar.gz
cd /usr/local/src/APM_Setup/pcre2-10.37
./configure --prefix=/usr/local/pcre2 --enable-pcre2-8 --enable-pcre2-16 --enable-pcre2-32 --enable-jit --enable-jit-sealloc --enable-pcre2grep-jit --enable-pcre2grep-callout --enable-pcre2grep-callout-fork --enable-unicode --enable-pcre2grep-libz --enable-pcre2grep-libbz2 --enable-pcre2test-libreadline --enable-valgrind --enable-fuzz-support --enable-percent-zt --with-gnu-ld --with-pcre2grep-bufsize=20480 --with-pcre2grep-max-bufsize=1048576 --with-link-size=2 --with-parens-nest-limit=250 --with-heap-limit=20000000 --with-match-limit-depth=MATCH_LIMIT
make -j && make install

최신버전 libgd 설치
libgd-2.3.3 버전이 나왔지만 실제 설치하면 연동이 안되는 것 같습니다.
이부분에 대해 아시는분 있다면 댓글로 남겨주시길 바랍니다.

cd /usr/local/src/APM_Setup
wget https://github.com/libgd/libgd/releases/download/gd-2.3.2/libgd-2.3.2.tar.gz
tar zxvf libgd-2.3.2.tar.gz
cd /usr/local/src/APM_Setup/libgd-2.3.2
./configure --prefix=/usr/local --with-pic --with-aix-soname=both --with-x --with-gnu-ld --with-libiconv-prefix --with-zlib --with-png --with-freetype --with-raqm --with-fontconfig --with-jpeg --with-xpm --with-tiff --with-webp
make -j && make install

최신버전 libzip 설치
cd /usr/local/src/APM_Setup
wget https://libzip.org/download/libzip-1.8.0.tar.gz
tar zxvf libzip-1.8.0.tar.gz
mkdir /usr/local/src/APM_Setup/libzip-1.8.0/build
cd /usr/local/src/APM_Setup/libzip-1.8.0/build
cmake ../ \
-DCMAKE_INSTALL_PREFIX=/usr/local \
-DENABLE_BZIP2=1 \
-DENABLE_COMMONCRYPTO=1 \
-DENABLE_GNUTLS=1 \
-DENABLE_LZMA=1 \
-DENABLE_MBEDTLS=1 \
-DENABLE_OPENSSL=1 \
-DENABLE_ZSTD=1 \
-DLIBZIP_DO_INSTALL=1 \
-DSHARED_LIB_VERSIONNING=1
make -j && make install

기존에 선언했던 PKG_CONFIG_PATH 재설정 (pcre2 라이브러리를 인식하기 위해서)
sed -i "s/export PKG_CONFIG_PATH=\/usr\/local\/lib\/pkgconfig:\/usr\/local\/lib64\/pkgconfig:\/usr\/lib64\/pkgconfig:\/usr\/lib\/pkgconfig/export PKG_CONFIG_PATH=\/usr\/local\/pcre2\/lib\/pkgconfig:\/usr\/local\/lib\/pkgconfig:\/usr\/local\/lib64\/pkgconfig:\/usr\/lib64\/pkgconfig:\/usr\/lib\/pkgconfig/g" /etc/profile
source /etc/profile

PHP 8 최신버전 설치
cd /usr/local/src/APM_Setup
wget https://www.php.net/distributions/php-8.0.21.tar.gz
tar zxvf php-8.0.21.tar.gz
cd /usr/local/src/APM_Setup/php-8.0.21

php 컴파일옵션 최대한 넣기
./configure --prefix=/usr/local/php --with-apxs2=/usr/local/apache/bin/apxs --enable-fpm --with-fpm-user=nobody --with-fpm-group=nobody --with-fpm-systemd --with-config-file-path=/usr/local/apache/conf --disable-debug --with-external-pcre=/usr/local/pcre/bin/pcre-config --enable-phpdbg --enable-phpdbg-debug --enable-phpdbg-readline --enable-dom --enable-bcmath --enable-cli --enable-cgi --enable-gcov --with-iconv --enable-sigchild --with-openssl=/usr/local --with-openssl-dir=/usr/local --with-system-ciphers --with-pcre-jit --with-zlib --with-zlib-dir --enable-opcache --enable-ctype --with-bz2 --enable-calendar --with-curl --enable-dba --enable-pcntl --with-pspell --with-zip --with-dbm --with-gdbm --enable-exif --with-ffi --enable-fileinfo --enable-filter --enable-ftp --enable-gd --with-external-gd --enable-gd-jis-conv --with-webp --with-jpeg --with-xpm --with-freetype --enable-shmop --with-imap --with-imap-ssl --with-kerberos --enable-mbstring --enable-mbregex --enable-huge-code-pages --enable-sockets --enable-sysvmsg --enable-sysvsem --enable-sysvshm --with-tidy --enable-tokenizer --with-xsl --enable-soap --with-ldap-sasl --with-ldap --enable-intl --with-mhash --with-gmp --with-gettext --with-enchant --enable-phar --enable-posix --enable-libgcc --with-snmp --with-libedit --with-readline --with-pear --with-libxml --enable-xmlwriter --enable-simplexml --enable-xml --enable-xmlreader --enable-session --enable-pdo --with-mysqli=mysqlnd --with-pdo-mysql=mysqlnd --enable-mysqlnd --with-mysql-sock=/usr/local/mysql/tmp/mysql.sock --enable-zts

sed -i 's/-lcrypto -lcrypt/-lcrypto -lcrypt -llber/g' /usr/local/src/APM_Setup/php-8.0.21/Makefile
make -j && make install

PHP 설정파일 생성 및 설정
cp -arp /usr/local/src/APM_Setup/php-8.0.21/php.ini-development /usr/local/apache/conf/php.ini

sed -i 's/;upload_tmp_dir =/upload_tmp_dir = \/tmp/g' /usr/local/apache/conf/php.ini
sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 100M/g' /usr/local/apache/conf/php.ini
sed -i 's/post_max_size = 8M/post_max_size = 100M/g' /usr/local/apache/conf/php.ini
sed -i 's/memory_limit = 128M/memory_limit = 256M/g' /usr/local/apache/conf/php.ini
sed -i 's/allow_url_fopen = On/allow_url_fopen = Off/g' /usr/local/apache/conf/php.ini
sed -i 's/expose_php = On/expose_php = Off/g' /usr/local/apache/conf/php.ini
sed -i 's/display_errors = Off/display_errors = On/g' /usr/local/apache/conf/php.ini
sed -i 's/log_errors = Off/log_errors = On/g' /usr/local/apache/conf/php.ini
sed -i 's/;error_log = syslog/error_log = syslog/g' /usr/local/apache/conf/php.ini
sed -i 's/short_open_tag = Off/short_open_tag = On/g' /usr/local/apache/conf/php.ini
sed -i 's/;date.timezone =/date.timezone = "Asia\/Seoul"/g' /usr/local/apache/conf/php.ini
sed -i 's/session.gc_maxlifetime = 1440 /session.gc_maxlifetime = "3600"/g' /usr/local/apache/conf/php.ini

PHP-FPM 설정파일 생성 및 수정
cp -arp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf
cp -arp /usr/local/src/APM_Setup/php-8.0.21/sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
cp -arp /usr/local/php/etc/php-fpm.d/www.conf.default /usr/local/php/etc/php-fpm.d/www.conf
cp -arp /usr/local/src/APM_Setup/php-8.0.21/sapi/fpm/php-fpm.service /lib/systemd/system/
chmod +x /etc/init.d/php-fpm
chkconfig --add php-fpm
chkconfig php-fpm off
/etc/init.d/php-fpm stop

sed -i 's/;pid = run\/php-fpm.pid/pid = \/usr\/local\/php\/var\/run\/php-fpm.pid/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;error_log = log\/php-fpm.log/error_log = \/usr\/local\/php\/var\/log\/php-fpm.log/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;syslog.facility = daemon/syslog.facility = daemon/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;syslog.ident = php-fpm/syslog.ident = php-fpm/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;log_level = notice/log_level = warning/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;log_limit = 4096/log_limit = 4096/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;log_buffering = no/log_buffering = yes/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;emergency_restart_threshold = 0/emergency_restart_threshold = 5/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;emergency_restart_interval = 0/emergency_restart_interval = 30s/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;process_control_timeout = 0/process_control_timeout = 20/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/; process.max = 128/process.max = 1024/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/; process.priority = -19/process.priority = -19/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;daemonize = yes/daemonize = yes/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;systemd_interval = 10/systemd_interval = 10/g' /usr/local/php/etc/php-fpm.conf
sed -i 's/;listen.backlog = 511/listen.backlog = 65535/g' /usr/local/php/etc/php-fpm.d/www.conf
echo "net.core.somaxconn=65535" >> /etc/sysctl.conf
sysctl -p
sed -i 's/;listen.owner = nobody/listen.owner = nobody/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;listen.group = nobody/listen.group = nobody/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;listen.mode = 0660/listen.mode = 0660/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/; process.dumpable = yes/process.dumpable = yes/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/pm = dynamic/pm = ondemand/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/pm = static/pm = ondemand/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/pm.max_children = 5/pm.max_children = 50/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;pm.process_idle_timeout/pm.process_idle_timeout/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;access.log = log/access.log = \/usr\/local\/php\/var\/log/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;access.format/access.format/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;slowlog/slowlog/g' /usr/local/php/etc/php-fpm.d/www.conf
sed -i 's/;request_slowlog_timeout = 0/;request_slowlog_timeout = 30/g' /usr/local/php/etc/php-fpm.d/www.conf

Opcache 추가모듈 설치 및 설정
cd /usr/local/src/APM_Setup/php-8.0.21/ext/opcache
/usr/local/php/bin/phpize
./configure --with-php-config=/usr/local/php/bin/php-config
make -j && make install

php.ini 설정파일에 opcache 설정 수정
echo "zend_extension=opcache.so" >> /usr/local/apache/conf/php.ini
echo "zend_extension_ts=opcache.so" >> /usr/local/apache/conf/php.ini
echo " " >> /usr/local/apache/conf/php.ini
sed -i 's/;opcache.enable=1/opcache.enable=1/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.enable_cli=0/opcache.enable_cli=1/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.memory_consumption=128/opcache.memory_consumption=128/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.interned_strings_buffer=8/opcache.interned_strings_buffer=8/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=10000/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.max_wasted_percentage=5/opcache.max_wasted_percentage=5/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.use_cwd=1/opcache.use_cwd=1/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.validate_timestamps=1/opcache.validate_timestamps=1/g' /usr/local/apache/conf/php.ini
sed -i 's/;opcache.revalidate_freq=2/opcache.revalidate_freq=10/g' /usr/local/apache/conf/php.ini

mcrypt 모듈 설치 및 php연동 (암호화모듈)
cd /usr/local/src/APM_Setup
wget https://pecl.php.net/get/mcrypt-1.0.4.tgz
tar zxvf mcrypt-1.0.4.tgz
cd /usr/local/src/APM_Setup/mcrypt-1.0.4
/usr/local/php/bin/phpize && ./configure --with-php-config=/usr/local/php/bin/php-config && make -j && make install
echo "[mcrypt]" >> /usr/local/apache/conf/php.ini
echo "extension=mcrypt.so" >> /usr/local/apache/conf/php.ini
echo " " >> /usr/local/apache/conf/php.ini

imagick 이미지 모듈 설치 및 php연동
cd /usr/local/src/APM_Setup
wget https://pecl.php.net/get/imagick-3.7.0.tgz
tar zxvf imagick-3.7.0.tgz
cd /usr/local/src/APM_Setup/imagick-3.7.0/
/usr/local/php/bin/phpize
./configure --with-php-config=/usr/local/php/bin/php-config
make -j && make install
echo "[imagick]" >> /usr/local/apache/conf/php.ini
echo "extension=imagick.so" >> /usr/local/apache/conf/php.ini
echo " " >> /usr/local/apache/conf/php.ini

mysql 구 모듈 php 연동
cd /usr/local/src/APM_Setup/php-8.0.21/ext/
git clone https://github.com/php/pecl-database-mysql mysql --recursive
cd /usr/local/src/APM_Setup/php-8.0.21/ext/mysql
/usr/local/php/bin/phpize
./configure --with-php-config=/usr/local/php/bin/php-config --with-mysql=/usr/local/mysql --with-mysql-sock=/usr/local/mysql/tmp/mysql.sock

php_mysql.c 현재 서버의 설정에 맞게 변경
sed -i 's/PHP_MYSQL_TYPE/PHP_MIME_TYPE/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c
sed -i 's/PHP_MYSQL_INCLUDE/"PHP_MYSQL_H"/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c
sed -i 's/PHP_MYSQL_LIBS/"PHP_MYSQL_H"/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c
make -j && make install

echo "[MySQL]" >> /usr/local/apache/conf/php.ini
echo "extension=mysql.so" >> /usr/local/apache/conf/php.ini

소스 설치한 APM 환경변수 설정
echo " " >> /etc/profile
echo "APACHE_HOME=/usr/local/apache" >> /etc/profile
echo "MySQL_HOME=/usr/local/mysql" >> /etc/profile
echo "PHP_HOME=/usr/local/php" >> /etc/profile
echo " " >> /etc/profile
echo "export PATH="\$"APACHE_HOME/bin:"\$"MySQL_HOME/bin:"\$"PHP_HOME/bin:"\$"PHP_HOME/sbin"\$"{PATH:+:"\$"{PATH}}" >> /etc/profile
echo " " >> /etc/profile
source /etc/profile

이제 openssl, curl 최신버전으로 연동이 되었는지 확인해봅시다.
ldd /usr/local/mysql/bin/mysql
linux-vdso.so.1 => (0x00007ffe1653a000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fa1f7f74000)
libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fa1f7ce1000)
libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fa1f77f6000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007fa1f75f2000)
libz.so.1 => /lib64/libz.so.1 (0x00007fa1f73dc000)
libncurses.so.5 => /lib64/libncurses.so.5 (0x00007fa1f71b5000)
libtinfo.so.5 => /lib64/libtinfo.so.5 (0x00007fa1f6f8b000)
libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fa1f6c83000)
libm.so.6 => /lib64/libm.so.6 (0x00007fa1f6981000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fa1f676b000)
libc.so.6 => /lib64/libc.so.6 (0x00007fa1f639d000)
/lib64/ld-linux-x86-64.so.2 (0x00007fa1f87d9000)

DB가 아래 2개 부분이 위그림과 같이 초록색으로 소스설치한곳으로 연동이 되어 있습니다.
libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fa1f7ce1000)
libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fa1f77f6000)

PHP가 제대로 연동이 되어 있는지 확인해보겠습니다.
ldd /usr/local/php/bin/php

좀 더 확실하게 연동이 되어 있는지 확인 명령어입니다.
ldd /usr/local/php/bin/php | grep local

그림과 같이 libssl, libcrypto, libcurl = openssl, curl이 소스설치연동된것으로 보입니다.
또한 pcre2, libgd, libzip 또한 소스설치한곳으로 연동이 되었습니다.

설치된 버전 확인명령어입니다.
/usr/local/apache/bin/httpd -V
/usr/local/mysql/bin/mysql -V
/usr/local/php/bin/php -v

php에 연동된 모듈 확인 명령어입니다.
/usr/local/php/bin/php -m
[PHP Modules]
bcmath
bz2
calendar
Core
ctype
curl
date
dba
dom
enchant
exif
FFI
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
imagick
imap
intl
json
ldap
libxml
mbstring
mcrypt
mysql
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
pspell
readline
Reflection
session
shmop
SimpleXML
snmp
soap
sockets
SPL
sqlite3
standard
sysvmsg
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

openssl, curl 버전 다시 확인
openssl version
curl -V

======================================= 끝 ========================================

안녕하세요. 현재 모든 웹브라우저 보안정책은 TLSv1.2, TLSv1.3 만 지원이 가능합니다.

최신 브라우저에서는 TLSv1.0, TLSv1.1은 로 운영되고 있는 보안 사이트들은 접속조차 불가능합니다.

웹브라우저단에서 차단하고 있습니다.

리눅스에서 TLSv1.2를 지원 못하는 CentOS 버전은 CentOS 5 (TLSv1.0 ~ TLSv1.1 만 지원), Ubuntu 12.04 (TLSv1.0 ~ TLSv1.1 만 지원) 버전입니다.

TLSv1.2는 지원이 가능하지만, EoS (End of Service) OS는 CentOS 6(2020-11-30), Ubuntu 14.04 (2019-04), Ubuntu 16.04(2021-04) 입니다.

TLS 버전을 담당하는 프로그램은 openssl로 해당 버전에 따라 지원이 가능합니다. 

각 OS 버전의 openssl 관련 버전입니다.

Redhat

CentOS 5 = openssl 0.9.8e (TLSv1.0 ~ TLSv1.1 지원)

CentOS 6 = openssl 1.0.1g (TLSv1.0 ~ TLSv1.2, SSLv3 지원)

CentOS 7 = openssl 1.0.2k (TLSv1.0 ~ TLSv1.2, SSLv3 지원)

CentOS 8(Rocky Linux 8) = openssl 1.1.1g (TLSv1.0 ~ TLSv1.3 지원)

Debian

Ubuntu 14.04 = openssl 1.0.1f (TLSv1.0 ~ TLSv1.2 지원)

Ubuntu 16.04 = openssl 1.0.2g (TLSv1.0 ~ TLSv1.2 지원)

Ubuntu 18.04 = openssl 1.1.1 (TLSv1.0 ~ TLSv1.3 지원)

Ubuntu 20.04 = openssl 1.1.1f (TLSv1.0 ~ TLSv1.3 지원)

Ubuntu 22.04 = openssl 3.0.2 (TLSv1.2 ~ TLSv1.3,  SSLv3지원)

마이크로소프트사 TLS 관련 문서링크

https://docs.microsoft.com/ko-kr/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

TLS v1.2 최소 요구 사항

- OpenSSL 1.0.1 이상
- httpd 2.2.22 이상
- JAVA 7 이상
- Windows Server 2008 SP2 이상

TLS v1.3 최소 요구 사항

-OpenSSL version 1.1.1 버전이상
-Apache 2.4.37 버전 이상
-Nginx 1.13 버전이상
-Windows Server 2022 버전이상
-Windows 11 버전이상

보통 openssl 버전을 이용하여 통신하는 프로세스가 있는데 curl 입니다.

curl 통신으로 ftp, http 통신등 다양한 통신을 합니다. 또한 tls버전도 확인하여 통신하게 됩니다.

Ubuntu는 실질적으로 EoS 기간전인 OS가 18.04이며, tls 1.3을 지원하기 때문에 EoS 23.04이 되기 전에 tls 1.3 서버를 구축해놓는다면 문제가 없습니다.

CentOS 7은 지원기간이 대략 10년이며, EoS 2024-06-30 입니다.

아직 1년 11개월 정도 남았으나, 출시한 년도가 CentOS 7 2014년이기 때문에 openssl 1.1.1은 2018년에 출시되었기 때문에 서버에서 기본이 아니므로 openssl 1.1.1이 없습니다.

패키지로 관련 라이브러리는 다운로드 및 설치는 가능하나 아래 그림과 같이 openssl은 여전히 이전것으로 되어 있습니다.

# yum install openssl11*

그렇기 때문에 실질적으론 설치만 됩니다. 

아래에 curl 기본설치와 city-fan repo를 참조하여 업그레이드 한 이후 버전및 참조하는 라이브러리를 확인한 내용입니다.

# cat /etc/yum.repos.d/city-fan.repo     // curl 패키지 업그레이드 repo, 각 OS 별로 가능합니다. (CentOS 5~7, Rocky Linux 8)

[CityFan]
name=City Fan Repo
baseurl=http://www.city-fan.org/ftp/contrib/yum-repo/rhel$releasever/$basearch/
enabled=1
gpgcheck=0

curl를 최신버전으로 업그레이드 하여도, 똑같이 이전 라이브러리를 참조하기 때문에 tls 1.3으로 APM이나 curl 통신은 할 수 없습니다.

그렇기 때문에 CentOS 7는 패키지로 구조상으로 힘들며, 결국 openssl, curl 소스설치를 진행을 해야합니다.

openssl 과 curl은 OS의 근간이 되므로 만약 기존에 소스로 APM이 설치되어 있는 상태에서 openssl, curl를 업그레이드 한다면 APM을 다시 설치해야합니다.

이부분은 참고하셔야합니다.

이번에는 Openssl과 Curl만 업그레이드하여 tls 1.3통신을 할 수 있게 구성하겠습니다.

기본적인 devel 설치

# yum install -y libdb-devel enchant-devel libxslt libxslt-devel net-snmp-devel readline-devel readline aspell-devel unixODBC unixODBC-devel libicu-devel icu libicu libc-client libc-client-devel libc-client-2007f freetype-devel freetype* freetype libXpm libXpm-devel libpng-devel libpng* libvpx-devel libvpx libcurl libcurl-devel curl* curl-devel curl tcp_wrappers-devel libzip environment-modules uw-imap-utils uw-imap-devel uw-imap uw-imap-static pam-devel libldb-devel openldap-devel cyrus-sasl-devel bzip2-devel bzip2 bzip2-libs ncurses-devel ncurses mysql-devel libjpeg-devel libjpeg* libjpeg-devel openssl-devel openssl* openssl-libs libxml* libxml2 libxml2-devel libmcrypt libmcrypt-devel libmcrypt* mcrypt mhash* mhash mhash-devel libmhash libmhash-devel expat-devel expat expat* gmp* gmp gmp-devel krb5* krb5-devel db4 db4-devel wget make cmake libtool* pcre* gdbm* gdbm gdbm-devel libtiff* libtiff libtiff-devel flex zlib* zlib-devel zlib gd* gd gd-devel patch t1lib t1lib-devel readline libedit-devel libtidy libtidy-devel gcc* gcc gcc-c++ libtermcap-devel dialog sqlite-devel oniguruma oniguruma-devel libzip5 mod_ssl postgresql-devel lcov systemtap-sdt-devel mod_ldap elfutils-devel libwebp-devel libwebp git gzip libnghttp2-devel valgrind* mod_proxy* editline editline-devel patchelf systemd-devel ImageMagick-devel libzstd-devel libffi libffi-devel libraqm-devel libraqm libsodium libsodium-devel brotli* libssh2* c-ares*

Openssl 최신버전 설치

# mkdir /usr/local/src/OS_Update

# cd /usr/local/src/OS_Update

# wget https://www.openssl.org/source/openssl-1.1.1q.tar.gz

# tar zxvf openssl-1.1.1q.tar.gz

# cd openssl-1.1.1q

# ./config -fPIC shared --prefix=/usr/local

# make -j8 && make install

# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/root/bin

# echo $PATH

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/root/bin

CURL 최신버전 설치

# cd /usr/local/src/OS_Update

# wget https://curl.se/download/curl-7.84.0.tar.gz

# tar zxvf curl-7.84.0.tar.gz

# cd curl-7.84.0

# ./configure --prefix=/usr/local --enable-maintainer-mode --enable-silent-rules --enable-debug --enable-optimize --enable-curldebug --enable-symbol-hiding --enable-ares --enable-code-coverage --enable-dependency-tracking --enable-fast-install --enable-http --enable-ftp --enable-file --enable-ldap --enable-ldaps --enable-rtsp --enable-proxy --enable-dict --enable-telnet --enable-tftp --enable-pop3 --enable-imap --enable-smb --enable-smtp --enable-gopher --enable-mqtt --enable-manual --enable-libcurl-option --enable-libgcc --enable-openssl-auto-load-config --enable-versioned-symbols --enable-threaded-resolver --enable-pthreads --enable-verbose --enable-sspi --enable-crypto-auth --enable-ntlm --enable-ntlm-wb --enable-tls-srp --enable-unix-sockets --enable-cookies --enable-socketpair --enable-http-auth --enable-doh --enable-mime --enable-dateparse --enable-netrc --enable-progress-meter --enable-dnsshuffle --enable-get-easy-options --enable-alt-svc --enable-headers-api --enable-hsts --with-schannel --with-secure-transport --with-amissl --with-libssh2 --with-libssh --with-wolfssh --with-winidn --with-schannel --with-secure-transport --with-amissl --with-ssl=/usr/local/lib64/pkgconfig --with-openssl=/usr/local --with-gnutls --with-mbedtls --with-wolfssl --with-bearssl --with-nss-deprecated --with-nss --with-pic --with-aix-soname=both --with-gnu-ld --with-sysroot --with-zlib --with-brotli --with-zstd --with-libssh2 --with-libssh --with-wolfssh --with-winidn --with-libidn2 --with-nghttp2 --with-ngtcp2 --with-nghttp3 --with-quiche --with-msh3

// 컴파일옵션은 최대한 호환성 연동을 위하여 enable, with 옵션들을 추가하였다.

# make -j8 && make install

빨간색 네모박스로 되어 있는 부분이 openssl를 연동한 부분인데, 보통 패키지라면 /usr/lib64 또는 /usr/lib를 참조하지만 소스설치를 openssl를 /usr/local로 했기 때문에 /usr/local/lib64로 라이브러리를 참조하고 있습니다.

OS에서 openssl 와 curl를 최신버전으로 업그레이드 하였습니다.

혹시나 이전 버전의 openssl을 인식을 못하기 위해서 기존 openssl와 curl를 변경해줍니다.

# mv /usr/bin/openssl /usr/bin/openssl_1.0.2k

# ln -s /usr/local/bin/openssl /usr/bin/openssl

# mv /usr/bin/curl /usr/bin/curl_7.29.0

# ln -s /usr/local/bin/curl /usr/bin/curl

실제로 openssl이 지원하는 tls 버전들을 확인해보겠습니다. 아래 명령어는 지원하는 버전들을 알 수 있습니다.

# /usr/local/bin/openssl ciphers -v | awk '{print $2}' | sort | uniq             // openssl 1.1.1q
SSLv3
TLSv1
TLSv1.2
TLSv1.3

# /usr/bin/openssl_1.0.2k ciphers -v | awk '{print $2}' | sort | uniq          // openssl 1.0.2k
SSLv3
TLSv1.2

이렇게 tls 1.3을 지원하고 있는지 확인할 수 있습니다.

다음 게시글은 업그레이드한 CentOS 7에서 openssl, curl로 APM 설치를 진행하겠습니다. 감사합니다.