Centos7 nginx(with ssl let's Encrypt) + php + mysql 環境構築

萩原賢二のコーディングストック > サーバー環境 > Centos7 nginx(with ssl let’s Encrypt) + php + mysql 環境構築備忘録

2018.07.8

Centos7 nginx(with ssl let’s Encrypt) + php + mysql 環境構築備忘録

さくらインターネットのVPSでCentos7上で nginxの環境構築をしてみました。
その時のの記録です。
また、今後のWebサーバーには必須とも言える「SSL通信」を、無料SSL証明書で有名な「Let’s Encrypt」も導入してみました。サクラネットの初期導入スクリプトには「Let’s EncryptにてSSL証明書を取得して nginxをインストールしWebサーバーを構築する」スクリプトが用意されていますが、今回はマニュアルでインストールしてみました。

ファイアーオールの無効化
SELinux 無効化
iptables インストール,設定
iptables 設定確認
ssh KEY認証
システムアップデート、名変更
リポジトリ導入、更新
Nginx をインストール
Nginx : バーチャルホストの設定
Nginx : UserDirを利用する
Nginx : SSL の設定
PHP-FPM と Nginx の設定
MySQL5.7のインストール

ファイアーオールの無効化

# systemctl status firewalld
# systemctl stop firewalld 
# systemctl disable firewalld

# systemctl status firewalld

# systemctl stop firewalld

# systemctl disable firewalld

SELinux 無効化

# getenforce
# vi /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

# getenforce

# vi /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of three two values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

iptables インストール,設定

# yum -y install iptables-services
# cd /etc/sysconfig
# vi iptables
# systemtl restart iptables
# systemctl restart iptables
# iptables --list

# yum -y install iptables-services

# cd /etc/sysconfig

# vi iptables

# systemtl restart iptables

# systemctl restart iptables

# iptables --list

iptables 設定確認

# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

# iptables --list

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT icmp -- anywhere anywhere

ACCEPT all -- anywhere anywhere

ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

ACCEPT tcp -- anywhere anywhere tcp dpt:http

ACCEPT tcp -- anywhere anywhere tcp dpt:https

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target prot opt source destination

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

ssh KEY認証

# mkdir .ssh
# cd .ssh
# ssh-keygen -t rsa                       # ペアキーを作成
# vi authorized_keys　　　　               # 必要なsshパブリックキーを入力
# 　cat id_rsa.pub >> authorized_keys     # 作成したペアキーをアペンド
# cat authorized_keys                    # 内容確認
ssh 鍵方式のみログインを許可
# vi /etc/ssh/sshd_config
    PermitRootLogin yes　                 # ←　rootでのログインを許可  
    PasswordAuthentication no            #　←鍵方式のみログインを許可
</div>

# mkdir .ssh

# cd .ssh

# ssh-keygen -t rsa # ペアキーを作成

# vi authorized_keys　　　　 # 必要なsshパブリックキーを入力

# 　cat id_rsa.pub >> authorized_keys # 作成したペアキーをアペンド

# cat authorized_keys # 内容確認

ssh 鍵方式のみログインを許可

# vi /etc/ssh/sshd_config

PermitRootLogin yes　 # ←　rootでのログインを許可

PasswordAuthentication no #　←鍵方式のみログインを許可

</div>

システムアップデート、ホスト名変更

# yum -y update
# cat /etc/centos-release        # バージョン確認
CentOS Linux release 7.5.1804 (Core)
# hostnamectl sakura2.fal.jp     # ホスト名変更
# hostnamectl set-hostname hostname.sampledomain.jp
# reboot
# hostname

# yum -y update

# cat /etc/centos-release # バージョン確認

CentOS Linux release 7.5.1804 (Core)

# hostnamectl sakura2.fal.jp # ホスト名変更

# hostnamectl set-hostname hostname.sampledomain.jp

# reboot

# hostname

EPELリポジトリ

# yum install epel-release -y
# yum -y update epel-release

1 2	# yum install epel-release -y # yum -y update epel-release

Remiリポジトリ

# rpm -Uvh http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
# yum -y update remi-release

1 2	# rpm -Uvh http://rpms.famillecollet.com/enterprise/remi-release-7.rpm # yum -y update remi-release

Nginx をインストール

# yum --enablerepo=epel -y install nginx # nginx -v nginx version: nginx/1.12.2

1
2
3

# yum --enablerepo=epel -y install nginx
# nginx -v
nginx version: nginx/1.12.2

Nginx : バーチャルホストの設定

# vi /etc/nginx/conf.d/virtual.host.conf

1	# vi /etc/nginx/conf.d/virtual.host.conf

server {
    listen       80;
    server_name  sakura.codingstock.jp;

    location / {
        root   /usr/share/nginx/virtual.host;
        index  index.html index.htm;
    }
#    location ~ \.php$ {
#        fastcgi_pass   127.0.0.1:9000;
#        fastcgi_param  SCRIPT_FILENAME /usr/share/nginx/virtual.host/$fastcgi_script_name;
#        fastcgi_param  PATH_INFO $fastcgi_path_info;
#        include        fastcgi_params;
#    }
}

server {

listen 80;

server_name sakura.codingstock.jp;

location / {

root /usr/share/nginx/virtual.host;

index index.html index.htm;

}

# location ~ \.php$ {

# fastcgi_pass 127.0.0.1:9000;

# fastcgi_param SCRIPT_FILENAME /usr/share/nginx/virtual.host/$fastcgi_script_name;

# fastcgi_param PATH_INFO $fastcgi_path_info;

# include fastcgi_params;

# }

}

Nginx : UserDirを利用する

vi /etc/nginx/nginx.conf

1	vi /etc/nginx/nginx.conf

# server セクション内に追記
         location ~ ^/~(.+?)(/.*)?$ {
            alias /home/$1/public_html$2;
            index  index.html index.htm;
            autoindex on;
        }

# server セクション内に追記

location ~ ^/~(.+?)(/.*)?$ {

alias /home/$1/public_html$2;

index index.html index.htm;

autoindex on;

}

Nginx : SSL の設定

Certbot クライアントのインストール

# yum install certbot python-certbot-apache

1	# yum install certbot python-certbot-apache

Let’s Encrypt より証明書取得

# certbot -n certonly --webroot -w /usr/share/nginx/html \
-d ssl.natts.jp -m khagiwara@fal.jp --agree-tos \ 
--server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for ssl.natts.jp
Using the webroot path /usr/share/nginx/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/ssl.natts.jp/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/ssl.natts.jp/privkey.pem
   Your cert will expire on 2018-10-05. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

# certbot -n certonly --webroot -w /usr/share/nginx/html \

-d ssl.natts.jp -m khagiwara@fal.jp --agree-tos \

--server https://acme-v02.api.letsencrypt.org/directory

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator webroot, Installer None

Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

Obtaining a new certificate

Performing the following challenges:

http-01 challenge for ssl.natts.jp

Using the webroot path /usr/share/nginx/html for all unmatched domains.

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/ssl.natts.jp/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/ssl.natts.jp/privkey.pem

Your cert will expire on 2018-10-05. To obtain a new or tweaked

version of this certificate in the future, simply run certbot

again. To non-interactively renew *all* of your certificates, run

"certbot renew"

- Your account credentials have been saved in your Certbot

configuration directory at /etc/letsencrypt. You should make a

secure backup of this folder now. This configuration directory will

also contain certificates and private keys obtained by Certbot so

making regular backups of this folder is ideal.

- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

NginxにSSLインストール

# vi /etc/nginx/nginx.conf

    server {
        listen       443 ssl http2 default_server;
        listen       [::]:443 ssl http2 default_server;
        server_name  ssl.natts.jp;
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/letsencrypt/live/ssl.natts.jp/fullchain.pem";
        ssl_certificate_key "/etc/letsencrypt/live/ssl.natts.jp/privkey.pem";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

server {

listen 443 ssl http2 default_server;

listen [::]:443 ssl http2 default_server;

server_name ssl.natts.jp;

root /usr/share/nginx/html;

ssl_certificate "/etc/letsencrypt/live/ssl.natts.jp/fullchain.pem";

ssl_certificate_key "/etc/letsencrypt/live/ssl.natts.jp/privkey.pem";

ssl_session_cache shared:SSL:1m;

ssl_session_timeout 10m;

ssl_ciphers HIGH:!aNULL:!MD5;

ssl_prefer_server_ciphers on;

# Load configuration files for the default server block.

include /etc/nginx/default.d/*.conf;

location / {

}

error_page 404 /404.html;

location = /40x.html {

}

error_page 500 502 503 504 /50x.html;

location = /50x.html {

}

発行された証明書

PHP-FPM と Nginx の設定

# yum -y --enablerepo=remi-php70,epel install php-fpm php-gd php-gmp\
php-mbstring php-mcrypt php-opcache php-pdo \
php-pear-MDB2-Driver-mysqli php-pecl-memcached \
php-pecl-msgpack php-xml php-devel php-gd
<!-- ------------------------------------------------- -->
#php -v
PHP 7.0.30 (cli) (built: Apr 24 2018 21:28:23) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies
    with Zend OPcache v7.0.30, Copyright (c) 1999-2017, by Zend Technologies

# yum -y --enablerepo=remi-php70,epel install php-fpm php-gd php-gmp\

php-mbstring php-mcrypt php-opcache php-pdo \

php-pear-MDB2-Driver-mysqli php-pecl-memcached \

php-pecl-msgpack php-xml php-devel php-gd

#php -v

PHP 7.0.30 (cli) (built: Apr 24 2018 21:28:23) ( NTS )

MySQL5.7のインストール

# rpm -ivh http://dev.mysql.com/get/mysql57-community-release-el7-7.noarch.rpm
# yum install -y mysql-community-server
# mysql -V
mysql  Ver 14.14 Distrib 5.7.22, for Linux (x86_64) using  EditLine wrapper

# rpm -ivh http://dev.mysql.com/get/mysql57-community-release-el7-7.noarch.rpm

# yum install -y mysql-community-server

# mysql -V