안녕하세요 이전글에서 tlsv1.3 기반의 APM을 설치를 진행했습니다. 이번에는 실제 tlsv1.3이 인증서에서 적용이 되었는지 확인하기 위해서 무료 인증서 letsencrypt를 이용해서 설치를 진행하겠습니다. 기존 letsencrypt는 90일 기간이지만 무료인증서중 180일 보장하는 buypass 인증서가 있어 이것으로 인증서를 설치하겠습니다.
간단한 웹페이지를 만들겠습니다. 디렉토리도 만들겠습니다.
도메인이름은 test.co.kr 으로 하겠습니다.
mkdir -p /home/test.co.kr/public_html echo "TEST test.co.kr index Page" >> /home/test.co.kr/public_html/index.html
# vi /usr/local/apache/conf/extra/httpd-vhosts.conf
apache 설정파일 적용및 실행 # /etc/init.d/apachectl graceful
SSL 관련 모듈 확인 # apachectl -l Compiled in modules: core.c mod_so.c -> 동적 방식 (DSO)로 설치되어있다. 만약 정적방식일 경우 mod_ssl.c로 설치가 되어있습니다. http_core.c prefork.c
mod_ssl.so 모듈이 실제 있는지 확인 ll /usr/local/apache/modules/ | grep ssl -rwxr-xr-x 1 root root 615936 Jul 26 06:26 mod_ssl.so
# vi /usr/local/apache/conf/httpd.conf LoadModule socache_shmcb_module modules/mod_socache_shmcb.so LoadModule socache_dbm_module modules/mod_socache_dbm.so LoadModule socache_memcache_module modules/mod_socache_memcache.so LoadModule ssl_module modules/mod_ssl.so Include conf/extra/httpd-ssl.conf -> 해당 부분 주석처리 해제 후 저장
2번째 링크에서 해당 도메인을 TLS 검사를 해봤을때 TLS 1.3 1.2는 enable로 나와있습니다. 그러나 TLS1.1, TLS1.0도 enable로 되어 있디만 앞에 deprecated, 즉 권장하지 않는다고 나와 있습니다. 그렇기 때문에 이것을 변경하고자 합니다. TLSv1.2, TLSv1.3 을 제외한 나머지를 disabled로 변경해봅니다.
ssl.conf 에서 TLSv1.2, TLSv1.3 을 제외한 나머지를 disabled로 변경하기위해 아래 설정을 변경합니다. # vi /usr/local/apache/conf/extra/httpd-ssl.conf SSLProtocol all +TLSv1.2 +TLSv1.3 -> 이 설정은 all 때문에 모두 포함됩니다. 아래와 같이 변경해줍니다. SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
변경 후 apachectl -t 문법검사 후 통과가 된다면 세션때문에 재시작을 해줍니다. /etc/init.d/apachectl restart
# openssl s_client -connect test.co.kr:443 -tls1_3 참고로 저 명령어는 애초에 서버에 설치되어 있는 openssl 버전 기반으로 하기 때문에 순정 CentOS 에서는 불가능합니다. 그래서 openssl 소스업그레이드를 한 CentOS7버전에서 저 명령어를 입력해야합니다.
만약 간단하게 소스업그레이드를 안하고 확인하고 싶다면 # yum install -y openssl11* # openssl11 s_client -connect test.co.kr:443 -tls1_3
이상입니다. ========================================== 끝 ===============================================
안녕하세요. 이전 글에서 CentOS 7 에서 TLSv1.3을 설치 및 연동하기위해서 openssl, curl를 설치진행 했습니다. 이것들을 이용하여 APM또한 TLSv1.3을 연동설치 진행을 해보겠습니다. 모든 APM은 최신버전으로 설치하겠습니다.
설치할 버전들 apr-1.7.0 apr-iconv-1.2.2 apr-util-1.6.1 pcre-8.45 apache-2.4.54 mod_url-apache2-1.25 cmake-3.23.1 mariadb-10.6.8 pcre2-10.37 libgd-2.3.2 libzip-1.8.0 php-8.0.21 mcrypt-1.0.4 imagick-3.7.0 mysql php모듈 - git 버전
설치 순서는 다음과 같습니다. 기본적인 패키지devel 및 gcc 와 심볼릭링크 설정 -> apr -> apr-iconv -> apr-util -> pcre -> apache -> mod_url -> cmake -> mariadb -> pcre2, libgd, libzip -> php -> php 추가모듈 Opcache, mcrypt, imagick, mysql
APM_Setup 디렉토리 만들기 mkdir -p /usr/local/src/APM_Setup
apr 설치 cd /usr/local/src/APM_Setup wget https://archive.apache.org/dist/apr/apr-1.7.0.tar.gz tar zxvf apr-1.7.0.tar.gz cd /usr/local/src/APM_Setup/apr-1.7.0 ./configure --prefix=/usr/local/apr && make -j && make install
apr-iconv 설치 cd /usr/local/src/APM_Setup wget https://archive.apache.org/dist/apr/apr-iconv-1.2.2.tar.gz tar zxvf apr-iconv-1.2.2.tar.gz cd /usr/local/src/APM_Setup/apr-iconv-1.2.2 ./configure --prefix=/usr/local/apr --with-apr=/usr/local/apr/bin/apr-1-config && make -j && make install
apr-util 설치 cd /usr/local/src/APM_Setup wget https://archive.apache.org/dist/apr/apr-util-1.6.1.tar.gz tar zxvf apr-util-1.6.1.tar.gz cd /usr/local/src/APM_Setup/apr-util-1.6.1 ./configure --prefix=/usr/local/apr --with-apr=/usr/local/apr/bin/apr-1-config --with-apr-iconv=/usr/local/apr/bin/apriconv --with-crypto --with-openssl=/usr/local --with-nss --with-lber --with-ldap --with-ldap-include=/usr/include --with-ldap-lib=/usr/lib64/ && make -j && make install
-> 여기서 암호화 모듈과 업그레이드한 openssl 연동 --with-openssl=/usr/local 입니다.
pcre 1 설치 cd /usr/local/src/APM_Setup wget https://ftp.exim.org/pub/pcre/pcre-8.45.tar.gz tar zxvf pcre-8.45.tar.gz cd /usr/local/src/APM_Setup/pcre-8.45 ./configure --prefix=/usr/local/pcre --enable-pcre8 --enable-pcre16 --enable-pcre32 --enable-jit --enable-utf8 --enable-pcregrep-libz --enable-pcregrep-libbz2 --enable-pcretest-libreadline --enable-valgrind make -j16 && make install
httpd 설치 cd /usr/local/src/APM_Setup wget https://archive.apache.org/dist/httpd/httpd-2.4.54.tar.gz tar zxvf httpd-2.4.54.tar.gz cd /usr/local/src/APM_Setup/httpd-2.4.54
## 소스 설치시 httpd 동시 접속자 수 기본 default 값에서 늘려주기.(최소 4코어 8쓰레드, 16GB 이상) 원래값 256의 8배 -> 2048 sed -i "s/#define DEFAULT_SERVER_LIMIT 256/#define DEFAULT_SERVER_LIMIT 2048/g" ./server/mpm/prefork/prefork.c sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 64/g" ./server/mpm/worker/worker.c sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 64/g" ./server/mpm/event/event.c
## 소스 설치시 httpd 동시 접속자 수 기본 default 값에서 늘려주기.(최소 8코어 16쓰레드, 32GB 이상) sed -i "s/#define DEFAULT_SERVER_LIMIT 256/#define DEFAULT_SERVER_LIMIT 4096/g" ./server/mpm/prefork/prefork.c sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 128/g" ./server/mpm/worker/worker.c sed -i "s/#define DEFAULT_SERVER_LIMIT 16/#define DEFAULT_SERVER_LIMIT 128/g" ./server/mpm/event/event.c
openssl, curl를 소스설치 했기 때문에 기본적으로 configure를 소스설치한곳을 먼저 바라보게 하는 설정
LDFLAGS 이부분이 지금 보시면 /usr/local/lib -> /usr/local/lib64 -> /usr/lib64 -> /usr/lib -> /usr/local/lib 이렇게 바라보고 있는겁니다. 그렇기 때문에 소스 설치한 라이브러리를 먼저 보고 그다음 패키지가 저장되는 라이브러리를 확인하는 구조입니다.
**아래는 설정하지 않고 한 컴파일 결과값입니다.** ( export LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/ -L/usr/lib64/ -L/usr/lib/" )
LDFLAGS 이 /usr/local/lib를 먼저 바라보지만 curl은 /usr/local/lib 에 라이브러리들이 있지만, openssl은 /usr/local/lib64에 있습니다.
httpd 컴파일 후 소스설치 make -j && make install
mod_url 설치 (한글 파일 언어 인식 패치) cd /usr/local/src/APM_Setup wget https://kldp.net/modurl/release/2188-mod_url-apache2-1.25.tar.bz2 tar xvf 2188-mod_url-apache2-1.25.tar.bz2 cd /usr/local/src/APM_Setup/mod_url-apache2-1.25/ /usr/local/apache/bin/apxs -iac mod_url.c
최신 DB 설치를 위한 패키지 설치 yum install -y libtermcap-devel gdbm-devel zlib* libxml* freetype* libpng* libjpeg* iconv flex gmp ncurses-devel make gcc* cmake expat* bzip2 openssl-* lz4* msgpack* libxml2* java-1.8.0* zeromq zeromq-devel jemalloc* boost boost-devel bzip2-devel zstd snappy snappy-devel Judy Judy-devel libzstd* perl-Judy bison bison* libcurl* curl* git libpmem*
cmake 최신버전 업그레이드 설치 CentOS 7 cmake 기본버전이 2.8.12 입니다. 그렇기 때문에 cmake 안정화 최신버전을 설치해줍니다. 버전 3.23.2
cd /usr/local/src/APM_Setup wget https://github.com/Kitware/CMake/releases/download/v3.23.2/cmake-3.23.2.tar.gz tar zxvf cmake-3.23.2.tar.gz cd cmake-3.23.2 ./bootstrap --prefix=/usr/local make -j && make install
mariadb-10.6 LTS설치 / mysql-8.0.29 버전은 너무 무겁기 때문에 보다 가벼운 mariadb 안정화 최신버전을 설치합니다.
DB 관련 소유자, 소유그룹 만들어주기 groupadd -g 400 mysql useradd -u400 -g400 -d /usr/local/mysql -s /bin/false mysql
DB 설치 cd /usr/local/src/APM_Setup wget https://dlm.mariadb.com/2298160/MariaDB/mariadb-10.6.8/source/mariadb-10.6.8.tar.gz tar zxvf mariadb-10.6.8.tar.gz mkdir /usr/local/src/APM_Setup/mariadb-10.6.8/build cd /usr/local/src/APM_Setup/mariadb-10.6.8/build
-> 보통 컴파일 옵션에서 mysql.sock 파일은 /tmp/mysql.sock 가 default 이지만 혹시나 모를 패키지가 또 설치되어 있을 수 있기 때문에 /usr/local/mysql/tmp/mysql.sock 으로 변경해줍니다.
make -j && make install
mysql 설정파일 my.cnf 변경 및 실행 파일 스크립트파일 만들기 mv -f /etc/my.cnf /etc/my.cnf_source_before cp -arp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld chkconfig --add mysqld chkconfig mysqld on
# back_log is the number of connections the operating system can keep in # the listen queue, before the MariaDB connection manager thread has # processed them. If you have a very high connection rate and experience # "connection refused" errors, you might need to increase this value. # Check your OS documentation for the maximum value of this parameter. # Attempting to set back_log higher than your operating system limit # will have no effect. back_log = 50
# Don't listen on a TCP/IP port at all. This can be a security # enhancement, if all processes that need to connect to mysqld run # on the same host. All interaction with mysqld must be made via Unix # sockets or named pipes. # Note that using this option without enabling named pipes on Windows # (via the "enable-named-pipe" option) will render mysqld useless! #skip-networking
# Enable external file level locking. Enabled file locking will have a # negative impact on performance, so only use it in case you have # multiple database instances running on the same files (note some # restrictions still apply!) or if you use other software relying on # locking MyISAM tables on file level. #external-locking
# *** INNODB Specific options *** # Use this option if you have a MariaDB server with InnoDB support enabled # but you do not plan to use it. This will save memory and disk space # and speed up some things. #skip-innodb
# Additional memory pool that is used by InnoDB to store metadata # information. If InnoDB requires more memory for this purpose it will # start to allocate it from the OS. As this is fast enough on most # recent operating systems, you normally do not need to change this # value. SHOW INNODB STATUS will display the current amount used.
# InnoDB, unlike MyISAM, uses a buffer pool to cache both indexes and # row data. The bigger you set this the less disk I/O is needed to # access data in tables. On a dedicated database server you may set this # parameter up to 80% of the machine physical memory size. Do not set it # too large, though, because competition of the physical memory may # cause paging in the operating system. Note that on 32bit systems you # might be limited to 2-3.5G of user level memory per process, so do not # set it too high. innodb_buffer_pool_size = 2G
# InnoDB stores data in one or more data files forming the tablespace. # If you have a single logical drive for your data, a single # autoextending file would be good enough. In other cases, a single file # per device is often a good choice. You can configure InnoDB to use raw # disk partitions as well - please refer to the manual for more info # about this. innodb_data_file_path = ibdata1:10M:autoextend
# Set this option if you would like the InnoDB tablespace files to be # stored in another location. By default this is the MariaDB datadir. innodb_data_home_dir = /usr/local/mysql/data
# Number of IO threads to use for async IO operations. This value is # hardcoded to 8 on Unix, but on Windows disk I/O may benefit from a # larger number. innodb_write_io_threads = 8 innodb_read_io_threads = 8
# If you run into InnoDB tablespace corruption, setting this to a nonzero # value will likely help you to dump your tables. Start from value 1 and # increase it until you're able to dump the table successfully. #innodb_force_recovery=1
# Number of threads allowed inside the InnoDB kernel. The optimal value # depends highly on the application, hardware as well as the OS # scheduler properties. A too high value may lead to thread thrashing. ### warning option ##innodb_thread_concurrency = 16 # If set to 1, InnoDB will flush (fsync) the transaction logs to the # disk at each commit, which offers full ACID behavior. If you are # willing to compromise this safety, and you are running small # transactions, you may set this to 0 or 2 to reduce disk I/O to the # logs. Value 0 means that the log is only written to the log file and # the log file flushed to disk approximately once per second. Value 2 # means the log is written to the log file at each commit, but the log # file is only flushed to disk approximately once per second. innodb_flush_log_at_trx_commit = 1
# Speed up InnoDB shutdown. This will disable InnoDB to do a full purge # and insert buffer merge on shutdown. It may increase shutdown time a # lot, but InnoDB will have to do it on the next startup instead. #innodb_fast_shutdown
# The size of the buffer InnoDB uses for buffering log data. As soon as # it is full, InnoDB will have to flush it to disk. As it is flushed # once per second anyway, it does not make sense to have it very large # (even with long transactions). innodb_log_buffer_size = 8M
# Size of each log file in a log group. You should set the combined size # of log files to about 25%-100% of your buffer pool size to avoid # unneeded buffer pool flush activity on log file overwrite. However, # note that a larger logfile size will increase the time needed for the # recovery process. innodb_log_file_size = 256M
# Total number of files in the log group. A value of 2-3 is usually good # enough. #### waring option #innodb_log_files_in_group = 3
# Location of the InnoDB log files. Default is the MariaDB datadir. You # may wish to point it to a dedicated hard drive or a RAID1 volume for # improved performance #innodb_log_group_home_dir
# Maximum allowed percentage of dirty pages in the InnoDB buffer pool. # If it is reached, InnoDB will start flushing them out agressively to # not run out of clean pages at all. This is a soft limit, not # guaranteed to be held. innodb_max_dirty_pages_pct = 90
# The flush method InnoDB will use for Log. The tablespace always uses # doublewrite flush logic. The default value is "fdatasync", another
# option is "O_DSYNC". #innodb_flush_method=O_DSYNC
# How long an InnoDB transaction should wait for a lock to be granted # before being rolled back. InnoDB automatically detects transaction # deadlocks in its own lock table and rolls back the transaction. If you # use the LOCK TABLES command, or other transaction-safe storage engines # than InnoDB in the same transaction, then a deadlock may arise which # InnoDB cannot notice. In cases like this the timeout is useful to # resolve the situation. innodb_lock_wait_timeout = 120
DB 초기화 기본 생성 /usr/local/mysql/scripts/mysql_install_db --user=mysql --basedir=/usr/local/mysql --datadir=/usr/local/mysql/data ========== DB 설치 끝. ==========
최신버전 pcre 2 설치 cd /usr/local/src/APM_Setup wget https://ftp.exim.org/pub/pcre/pcre2-10.37.tar.gz tar zxvf pcre2-10.37.tar.gz cd /usr/local/src/APM_Setup/pcre2-10.37 ./configure --prefix=/usr/local/pcre2 --enable-pcre2-8 --enable-pcre2-16 --enable-pcre2-32 --enable-jit --enable-jit-sealloc --enable-pcre2grep-jit --enable-pcre2grep-callout --enable-pcre2grep-callout-fork --enable-unicode --enable-pcre2grep-libz --enable-pcre2grep-libbz2 --enable-pcre2test-libreadline --enable-valgrind --enable-fuzz-support --enable-percent-zt --with-gnu-ld --with-pcre2grep-bufsize=20480 --with-pcre2grep-max-bufsize=1048576 --with-link-size=2 --with-parens-nest-limit=250 --with-heap-limit=20000000 --with-match-limit-depth=MATCH_LIMIT make -j && make install
최신버전 libgd 설치 libgd-2.3.3 버전이 나왔지만 실제 설치하면 연동이 안되는 것 같습니다. 이부분에 대해 아시는분 있다면 댓글로 남겨주시길 바랍니다.
cd /usr/local/src/APM_Setup wget https://github.com/libgd/libgd/releases/download/gd-2.3.2/libgd-2.3.2.tar.gz tar zxvf libgd-2.3.2.tar.gz cd /usr/local/src/APM_Setup/libgd-2.3.2 ./configure --prefix=/usr/local --with-pic --with-aix-soname=both --with-x --with-gnu-ld --with-libiconv-prefix --with-zlib --with-png --with-freetype --with-raqm --with-fontconfig --with-jpeg --with-xpm --with-tiff --with-webp make -j && make install
최신버전 libzip 설치 cd /usr/local/src/APM_Setup wget https://libzip.org/download/libzip-1.8.0.tar.gz tar zxvf libzip-1.8.0.tar.gz mkdir /usr/local/src/APM_Setup/libzip-1.8.0/build cd /usr/local/src/APM_Setup/libzip-1.8.0/build cmake ../ \ -DCMAKE_INSTALL_PREFIX=/usr/local \ -DENABLE_BZIP2=1 \ -DENABLE_COMMONCRYPTO=1 \ -DENABLE_GNUTLS=1 \ -DENABLE_LZMA=1 \ -DENABLE_MBEDTLS=1 \ -DENABLE_OPENSSL=1 \ -DENABLE_ZSTD=1 \ -DLIBZIP_DO_INSTALL=1 \ -DSHARED_LIB_VERSIONNING=1 make -j && make install
기존에 선언했던 PKG_CONFIG_PATH 재설정 (pcre2 라이브러리를 인식하기 위해서) sed -i "s/export PKG_CONFIG_PATH=\/usr\/local\/lib\/pkgconfig:\/usr\/local\/lib64\/pkgconfig:\/usr\/lib64\/pkgconfig:\/usr\/lib\/pkgconfig/export PKG_CONFIG_PATH=\/usr\/local\/pcre2\/lib\/pkgconfig:\/usr\/local\/lib\/pkgconfig:\/usr\/local\/lib64\/pkgconfig:\/usr\/lib64\/pkgconfig:\/usr\/lib\/pkgconfig/g" /etc/profile source /etc/profile
PHP 8 최신버전 설치 cd /usr/local/src/APM_Setup wget https://www.php.net/distributions/php-8.0.21.tar.gz tar zxvf php-8.0.21.tar.gz cd /usr/local/src/APM_Setup/php-8.0.21
sed -i 's/-lcrypto -lcrypt/-lcrypto -lcrypt -llber/g' /usr/local/src/APM_Setup/php-8.0.21/Makefile make -j && make install
PHP 설정파일 생성 및 설정 cp -arp /usr/local/src/APM_Setup/php-8.0.21/php.ini-development /usr/local/apache/conf/php.ini
sed -i 's/;upload_tmp_dir =/upload_tmp_dir = \/tmp/g' /usr/local/apache/conf/php.ini sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 100M/g' /usr/local/apache/conf/php.ini sed -i 's/post_max_size = 8M/post_max_size = 100M/g' /usr/local/apache/conf/php.ini sed -i 's/memory_limit = 128M/memory_limit = 256M/g' /usr/local/apache/conf/php.ini sed -i 's/allow_url_fopen = On/allow_url_fopen = Off/g' /usr/local/apache/conf/php.ini sed -i 's/expose_php = On/expose_php = Off/g' /usr/local/apache/conf/php.ini sed -i 's/display_errors = Off/display_errors = On/g' /usr/local/apache/conf/php.ini sed -i 's/log_errors = Off/log_errors = On/g' /usr/local/apache/conf/php.ini sed -i 's/;error_log = syslog/error_log = syslog/g' /usr/local/apache/conf/php.ini sed -i 's/short_open_tag = Off/short_open_tag = On/g' /usr/local/apache/conf/php.ini sed -i 's/;date.timezone =/date.timezone = "Asia\/Seoul"/g' /usr/local/apache/conf/php.ini sed -i 's/session.gc_maxlifetime = 1440 /session.gc_maxlifetime = "3600"/g' /usr/local/apache/conf/php.ini
PHP-FPM 설정파일 생성 및 수정 cp -arp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf cp -arp /usr/local/src/APM_Setup/php-8.0.21/sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm cp -arp /usr/local/php/etc/php-fpm.d/www.conf.default /usr/local/php/etc/php-fpm.d/www.conf cp -arp /usr/local/src/APM_Setup/php-8.0.21/sapi/fpm/php-fpm.service /lib/systemd/system/ chmod +x /etc/init.d/php-fpm chkconfig --add php-fpm chkconfig php-fpm off /etc/init.d/php-fpm stop
sed -i 's/;pid = run\/php-fpm.pid/pid = \/usr\/local\/php\/var\/run\/php-fpm.pid/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;error_log = log\/php-fpm.log/error_log = \/usr\/local\/php\/var\/log\/php-fpm.log/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;syslog.facility = daemon/syslog.facility = daemon/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;syslog.ident = php-fpm/syslog.ident = php-fpm/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;log_level = notice/log_level = warning/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;log_limit = 4096/log_limit = 4096/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;log_buffering = no/log_buffering = yes/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;emergency_restart_threshold = 0/emergency_restart_threshold = 5/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;emergency_restart_interval = 0/emergency_restart_interval = 30s/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;process_control_timeout = 0/process_control_timeout = 20/g' /usr/local/php/etc/php-fpm.conf sed -i 's/; process.max = 128/process.max = 1024/g' /usr/local/php/etc/php-fpm.conf sed -i 's/; process.priority = -19/process.priority = -19/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;daemonize = yes/daemonize = yes/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;systemd_interval = 10/systemd_interval = 10/g' /usr/local/php/etc/php-fpm.conf sed -i 's/;listen.backlog = 511/listen.backlog = 65535/g' /usr/local/php/etc/php-fpm.d/www.conf echo "net.core.somaxconn=65535" >> /etc/sysctl.conf sysctl -p sed -i 's/;listen.owner = nobody/listen.owner = nobody/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;listen.group = nobody/listen.group = nobody/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;listen.mode = 0660/listen.mode = 0660/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/; process.dumpable = yes/process.dumpable = yes/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/pm = dynamic/pm = ondemand/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/pm = static/pm = ondemand/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/pm.max_children = 5/pm.max_children = 50/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;pm.process_idle_timeout/pm.process_idle_timeout/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;access.log = log/access.log = \/usr\/local\/php\/var\/log/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;access.format/access.format/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;slowlog/slowlog/g' /usr/local/php/etc/php-fpm.d/www.conf sed -i 's/;request_slowlog_timeout = 0/;request_slowlog_timeout = 30/g' /usr/local/php/etc/php-fpm.d/www.conf
Opcache 추가모듈 설치 및 설정 cd /usr/local/src/APM_Setup/php-8.0.21/ext/opcache /usr/local/php/bin/phpize ./configure --with-php-config=/usr/local/php/bin/php-config make -j && make install
php.ini 설정파일에 opcache 설정 수정 echo "zend_extension=opcache.so" >> /usr/local/apache/conf/php.ini echo "zend_extension_ts=opcache.so" >> /usr/local/apache/conf/php.ini echo " " >> /usr/local/apache/conf/php.ini sed -i 's/;opcache.enable=1/opcache.enable=1/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.enable_cli=0/opcache.enable_cli=1/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.memory_consumption=128/opcache.memory_consumption=128/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.interned_strings_buffer=8/opcache.interned_strings_buffer=8/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=10000/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.max_wasted_percentage=5/opcache.max_wasted_percentage=5/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.use_cwd=1/opcache.use_cwd=1/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.validate_timestamps=1/opcache.validate_timestamps=1/g' /usr/local/apache/conf/php.ini sed -i 's/;opcache.revalidate_freq=2/opcache.revalidate_freq=10/g' /usr/local/apache/conf/php.ini
mcrypt 모듈 설치 및 php연동 (암호화모듈) cd /usr/local/src/APM_Setup wget https://pecl.php.net/get/mcrypt-1.0.4.tgz tar zxvf mcrypt-1.0.4.tgz cd /usr/local/src/APM_Setup/mcrypt-1.0.4 /usr/local/php/bin/phpize && ./configure --with-php-config=/usr/local/php/bin/php-config && make -j && make install echo "[mcrypt]" >> /usr/local/apache/conf/php.ini echo "extension=mcrypt.so" >> /usr/local/apache/conf/php.ini echo " " >> /usr/local/apache/conf/php.ini
imagick 이미지 모듈 설치 및 php연동 cd /usr/local/src/APM_Setup wget https://pecl.php.net/get/imagick-3.7.0.tgz tar zxvf imagick-3.7.0.tgz cd /usr/local/src/APM_Setup/imagick-3.7.0/ /usr/local/php/bin/phpize ./configure --with-php-config=/usr/local/php/bin/php-config make -j && make install echo "[imagick]" >> /usr/local/apache/conf/php.ini echo "extension=imagick.so" >> /usr/local/apache/conf/php.ini echo " " >> /usr/local/apache/conf/php.ini
mysql 구 모듈 php 연동 cd /usr/local/src/APM_Setup/php-8.0.21/ext/ git clone https://github.com/php/pecl-database-mysql mysql --recursive cd /usr/local/src/APM_Setup/php-8.0.21/ext/mysql /usr/local/php/bin/phpize ./configure --with-php-config=/usr/local/php/bin/php-config --with-mysql=/usr/local/mysql --with-mysql-sock=/usr/local/mysql/tmp/mysql.sock
php_mysql.c 현재 서버의 설정에 맞게 변경 sed -i 's/PHP_MYSQL_TYPE/PHP_MIME_TYPE/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c sed -i 's/PHP_MYSQL_INCLUDE/"PHP_MYSQL_H"/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c sed -i 's/PHP_MYSQL_LIBS/"PHP_MYSQL_H"/g' /usr/local/src/APM_Setup/php-8.0.21/ext/mysql/php_mysql.c make -j && make install
DB가 아래 2개 부분이 위그림과 같이 초록색으로 소스설치한곳으로 연동이 되어 있습니다. libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fa1f7ce1000) libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fa1f77f6000)
PHP가 제대로 연동이 되어 있는지 확인해보겠습니다. ldd /usr/local/php/bin/php
좀 더 확실하게 연동이 되어 있는지 확인 명령어입니다. ldd /usr/local/php/bin/php | grep local
ㅡ
그림과 같이 libssl, libcrypto, libcurl = openssl, curl이 소스설치연동된것으로 보입니다. 또한 pcre2, libgd, libzip 또한 소스설치한곳으로 연동이 되었습니다.
설치된 버전 확인명령어입니다. /usr/local/apache/bin/httpd -V /usr/local/mysql/bin/mysql -V /usr/local/php/bin/php -v
