1. 일단 스크립트 작성

#!/bin/sh
cd /var/www/html
sudo echo-service start


2. /etc/init.d에 복사


3. 권한 변경 및 등록

sudo update-rc.d echo.sh defaults
sudo chmod +x echo.sh

4. insserv 경고 대처 (무시해도 상관 없다)
   스크립트에 LSB Tags 넣기

#!/bin/sh

### BEGIN INIT INFO
# Provides:          turtlelab
# Required-Start:    $remote_fs
# Required-Stop:     $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start Echo daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO

cd /var/www/html
sudo echo-service start

 

How to LSBize an Init Script

status page for dependency based boot sequencing is available.

This is a short documentation about how to make an Init Script LSB (Linux Standard Base)-compliant based on the Chapter 20 of the LSB 3.1.

LSB-compliant init scripts need to:

and should also follow Debian Policy, chapter 9.4 Console messages from init.d scripts)

Full information on the actions (and return codes) that LSB scripts have to honor are available at LSB 3.1, Chapter 20.2. Init Script Actions. Maintainers should review that section and review / adjust their init.d scripts accordingly.

 

Run-time dependencies

Adding run-time dependencies was a release goal for Lenny, and dependency based boot sequencing is the default in Squeeze. There is a separate wiki page documenting that effort.

By documenting the run-time dependencies for init.d scripts, it becomes possible to verify the current boot order, order the boot using these dependencies, and run boot scripts in parallel to speed up the boot process.

Add a block like this in the init.d script:

### BEGIN INIT INFO
# Provides:          scriptname
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO

The block shown above has a special rigid format delimited by the lines

 

### BEGIN INIT INFO
### END INIT INFO

where all trailing spaces shall be ignored. On the other hand, all lines inside the block shall be of the form

# {keyword}: arg1 [arg2...]

and begin with a hash character '#' in the first column followed by one single space, except for the lines following the Description keyword. The following keywords are defined

Provides: boot_facility_1 [boot_facility_2...]

  • defines boot facilities provided by this init script such that when the script is run with the start argument, the specified boot facilities will be deemed present and hence other init scripts which require those boot facilities must be started at a later stage. Normally you should use the script name as boot facility (without .sh if the file name has such an ending) but one can in the exceptional case also use the name of the service(s) that the script replaces. Boot facilities provided by scripts must not start with '$'. (Virtual facility names listed below are defined outside the init.d scripts.) Facility names should be unique within the distribution, to avoid 'duplicate provides' errors when a package is installed.

Required-Start: boot_facility_1 [boot_facility_2...]

  • defines facilities that must be available to start the script. Consider using virtual facility names as described below if adequate. If no boot facility is specified it means that this script can be started just after the bootstrap without local filesystems mounted, nor system logger, etc.

Required-Stop: boot_facility_1 [boot_facility_2...]

  • defines facilities used by the service provided by the script. The facility provided by this script should stop before the listed facilities are stopped to avoid conflicts. Normally you would include here the same facilities as for the Required-Start keyword.

Should-Start: boot_facility_1 [boot_facility_2...]

  • defines the facilities that if present should start before the service provided by the script. Nevertheless, the script can still start if the listed facilities are missing. This allows for weak dependencies which do not cause the service to fail if a facility is not available. Consider using virtual facility names as described below if adequate.

Should-Stop: boot_facility_1 [boot_facility_2...]

  • defines the facilities that if present should be stopped after this service. Normally you would include here the same facilities as those used with the Should-Start keyword.

Default-Start: run_level_1 [run_level_2...]

Default-Stop: run_level_1 [run_level_2...]

  • defines the run levels where the script should be started (stopped) by default. For example, if a service should run in runlevels 3, 4, and 5 only, specify "Default-Start: 3 4 5" and "Default-Stop: 0 1 2 6".

Short-Description: short_description

  • provide a brief description of the actions of the init script. Limited to a single line of text.

Description: multiline_description

  • provide a more complete description of the actions of the init script. May span multiple lines. In a multiline description, each continuation line shall begin with a '#' followed by tab character or a '#' followed by at least two space characters. The multiline description is terminated by the first line that does not match this criteria.

X-Start-Before: boot_facility_1 [boot_facility_2...]

X-Stop-After: boot_facility_1 [boot_facility_2...]

  • provide reverse dependencies, that appear as if the listed facilities had should-start and should-stop on the package with these headers.

X-Interactive: true

  • Indicates that this init script can interact with the user, requesting some input (for example, a password). This make sure the script run alone when the boot system starts scripts in parallell and have direct access to the tty.

For dependency tracking, the provides, required- and should- keywords are important, and the rest is unused. The default runlevels are used by a program to order the init scripts (e.g. 

insserv

) to keep track of which rc#.d directory to update when a service is added for the first time, and should reflect the intent of the service.

There are some "virtual" facility names, listed in the [LSB 3.1]. These are:

$local_fs all local filesystems are mounted. All scripts that write in /var/ need to depend on this, unless they already depend on $remote_fs.
$network low level networking (ethernet card; may imply PCMCIA running)
$named daemons which may provide hostname resolution (if present) are running. For example, daemons to query DNS, NIS+, or LDAP.
$portmap daemons providing ?SunRPC/ONCRPC portmapping service as defined in RFC 1833 (if present) are running all remote
$remote_fs all filesystems are mounted. In some LSB run-time environments, filesystems such as /usr may be remote. If the script need a mounted /usr/, it needs to depend on $remote_fs. Scripts depending on $remote_fs do not need to depend on $local_fs. During shutdown, scripts that need to run before sendsigs kills all processes should depend on $remote_fs.
$syslog system logger is operational
$time the system time has been set, for example by using a network-based time program such as ntp or rdate, or via the hardware Real Time Clock. Note that just depending on ntp will not result in an accurate time just after ntp started. It usually takes minutes until ntp actually adjusts the time. Also note that standard insserv.conf just lists hwclock as $time.
$all facility supported by 
insserv to start a script after all the scripts not depending on $all, at the end of the boot sequence. This only work for start ordering, not stop ordering. Depending on a script depending on $all will give incorrect ordering, as the script depending on $all will be started after the script depending on it.

Other (non-system) facilities may be defined by other applications. These facilities shall be named using the same conventions defined for naming init scripts. See the list of proposed Debian specific virtual facilities for more information on this.

Most of this section was originally based from a message by Petter Reinholdtsen on Debian-devel.

 

BTS reports related to LSB headers are usertagged.

 

'Web > Server' 카테고리의 다른 글

스크립트 포멧 오류가 날 때 확인  (0) 2018.02.20
웹서버 설정(apache2, php, mariadb)  (0) 2018.02.20
웹폴더 권한 설정  (0) 2018.02.20
Posted by jazzlife
,

The ^M is a carriage return character. Linux uses the line feed character to mark the end of a line, whereas Windows uses the two-character sequence CR LF. Your file has Windows line endings, which is confusing Linux.

Remove the spurious CR characters. You can do it with the following command:

sed -i -e 's/\r$//' custom_script.sh


'Web > Server' 카테고리의 다른 글

데몬 스크립트 작성 및 등록하기  (0) 2018.02.21
웹서버 설정(apache2, php, mariadb)  (0) 2018.02.20
웹폴더 권한 설정  (0) 2018.02.20
Posted by jazzlife
,


[아파치 설치]

apt-get install apache2

#a2enmod rewrite
#a2enmod headers
#a2enmod ssl
#a2dismod -f autoindex

vi /etc/apache2/apache2.conf

# deny (log file, binary, certificate, shell script, sql dump file) access.
<FilesMatch "\.(?i:log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$">
    Require all denied
</FilesMatch>
  
# deny access.
<FilesMatch "(?i:composer\.json|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$">
    Require all denied
</FilesMatch>
 
# Allow Lets Encrypt Domain Validation Program
<DirectoryMatch "\.well-known/acme-challenge/">
    Require all granted
</DirectoryMatch>



[PHP 설치]

apt-get install php
apt-get install libapache2-mod-php
apt-get install php-mcrypt
apt-get install php-mbstring
apt-get install php-gd
apt-get install php-curl php-xml
apt-get install php-mysql php-mongodb
apt-get install libapache2-mpm-itk

vi /etc/php/7.0/apache2/php.ini 에 아래 두줄 추가
extension=mongodb.so extension=mysqli.so

- 설정
vi /etc/apache2/mods-available/php7.0.conf

<FilesMatch ".+\.ph(p3|p4|p5|p7|t|tml)$">
    Require all denied
</FilesMatch>

vi /etc/php/7.0/apache2/php.ini
vi /etc/php/7.0/cli/php.ini

date.timezone = Asia/Seoul


/etc/init.d/apache2 restart


[MariaDB 설치]

apt-get install mariadb-server
/usr/bin/mysql_secure_installation

mysql
use mysql;
update user set plugin='' where User='root';
flush privileges;
exit;

비밀번호가 틀렸다면

use mysql;

SET PASSWORD FOR 'root'@'localhost'=PASSWORD('비밀번호');

exit;

SET PASSWORD FOR 'root'@'localhost'=PASSWORD('turtle123');
-언어설정 추가 (중요)

vi /etc/mysql/mariadb.conf.d/50-server.cnf

character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci


/etc/init.d/mysql restart



이거 안했다고 route가 제대로 안되네...


/etc/apache2/sites-available/yoursite.conf

<VirtualHost *:80>
    ServerAdmin youremail@yahoo.com
    ServerName yoursite.com
    ServerAlias www.yoursite.com
    DocumentRoot "/var/www/yoursite.com/public"
    <Directory /var/www/yoursite.com/public>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>
</VirtualHost>



SSL 설정


웹사이트 Apache 환경설정파일 작성

#16.12.20 설정 가이드가 추가됨

환경설정을 쉽게하도록 도와주는, 환경설정 생성기가 추가되었습니다.

https://blog.lael.be/demo-generator/apache/my-example-site.com.php

다음의 내용을 작성한다.
아래 예제에서는 사이트 환경설정파일명을 lael.be 로 가정하고 진행한다.
당신의 도메인, 사용자 아이디, 별도의 구분단어로 설정해서 사용하도록 하자.

#vi /etc/apache2/sites-available/lael.be.conf

/etc/apache2/sites-available/lael.be.conf 에 저장한다.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<VirtualHost *:80>
    #main domain
    ServerName lael.be
 
    #additional domain
    ServerAlias www.lael.be
    ServerAlias my-anotherdomain.com
 
    #document Root
    DocumentRoot /home/myuser1/www/
 
    #additional setting
    <Directory /home/myuser1/www/>
        Options FollowSymLinks MultiViews
        AllowOverride All
        require all granted
    </Directory>
 
    AssignUserID myuser1 myuser1
 
    ErrorLog ${APACHE_LOG_DIR}/lael.be-error.log
    CustomLog ${APACHE_LOG_DIR}/lael.be-access.log combined
</VirtualHost>

ServerAlias 는 사용안하면 빼도 되는 줄이다.

#15.09.16 추가

당신이 만약 SSL(https) 를 적용하고자 한다면 lael.be.conf 파일 하단에 다음의 코드를 추가하세요. 즉 VirtualHost 영역을 하나 더 추가.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
<VirtualHost *:443>
    #main domain
    ServerName lael.be
 
    #additional domain
    ServerAlias www.lael.be
    ServerAlias my-anotherdomain.com
 
    #document Root
    DocumentRoot /home/myuser1/www/
 
    #additional setting
    <Directory /home/myuser1/www/>
        Options FollowSymLinks MultiViews
        AllowOverride All
        require all granted
    </Directory>
 
    AssignUserID myuser1 myuser1
 
    ErrorLog ${APACHE_LOG_DIR}/lael.be-error.log
    CustomLog ${APACHE_LOG_DIR}/lael.be-access.log combined
 
    Header always set Strict-Transport-Security "max-age=31536000"
 
    SSLEngine on
 
    SSLProtocol all -SSLv2 -SSLv3
 
    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
    SSLHonorCipherOrder on
 
    SSLCertificateFile "/home/myuser1/ssl/mysite_ssl.crt"
    SSLCertificateKeyFile "/home/myuser1/ssl/mysite_ssl.key"
    SSLCertificateChainFile "/home/myuser1/ssl/mysite_ssl.certchain.crt"
 
</VirtualHost>

https://www.sslshopper.com/ssl-checker.html#hostname=blog.lael.be  (SSL Chain test - 인증서가 올바르게 설치되어 있는지)

https://www.ssllabs.com/ssltest/analyze.html?d=blog.lael.be (SSL Algorithm test - 안전한 암호화 통신이 설정되어 있는지)

Chain test 는 모두 Valid 이어야하고, SSL Algorithm test 는 A 이상이면 정상적인 운영이 가능하다.

라엘이가 여러 설정 값에 대해서 테스트를 해 보았고, 최적의 권장설정 값을 위와 같이 적어두었으니 그대로 쓰면 된다.

위의 설정값으로 SSL을 설치하면 A+등급을 받을 수 있을 것이다.

 

pv106

.

인증서 적용 테스트는 위의 사이트를 이용하여라.

인증서 체인 파일이란 “인증서에 대한 인증서” 파일이다.

mac-ssl

< 그림 : 이 블로그는 위의 단계를 거쳐 인증된다. 이것을 체인 인증 이라고 한다. >

대통령이 당신을 인증할 때 직권으로 인증하는 것이 아니라, 대통령 -> 서울시장 -> 강남구청장 -> 삼성동장 -> 당신 의 단계를 거친다. 검증하려면 모든 단계의 보증 증서를 제공해야 하는 것이다.

인증서 파일에는 삼성동장 -> 당신  의 정보가 들어있고, (암호화 통신시 공개됨)

인증서 키 파일에는 암호화 통신을 위한 정보가 들어있고 (은행 보안카드 로 비유. 외부에 공개되지 않음.)

인증서 체인 파일에는 대통령 -> 서울시장, 서울시장 -> 강남구청장, 강남구청장 -> 삼성동장 의 정보가 들어있다. (체인 인증이라고 한다. 연결고리 인증)

인증서 체인을 올바르게 작성하지 않으면 Firefox 브라우저와 Android Chrome 브라우저에서 “인증서 정보부족” 오류가 발생하게 된다.

 

14) 사이트 활성화 및 적용

명령어는
#a2ensite 사이트환경설정파일명
입니다.

#a2ensite lael.be

(참고로 사이트 비활성화는

#a2dissite lael.be

입니다.)

- 아파치 설정 다시 불러오기(적용을 위해)

#service apache2 reload


참조: https://blog.lael.be/post/73

'Web > Server' 카테고리의 다른 글

데몬 스크립트 작성 및 등록하기  (0) 2018.02.21
스크립트 포멧 오류가 날 때 확인  (0) 2018.02.20
웹폴더 권한 설정  (0) 2018.02.20
Posted by jazzlife
,

웹폴더 권한 설정

Web/Server 2018. 2. 20. 15:31

폴더 권한 때문에 웹페이지를 제대로 띄우지 못하는 경우가 있다.

권한을 제대로 설정해야한다.

웹서비스의 홈디렉토리의 소유자를 www-data:www-data 로 변경하는 방법이 있다.

BASH
sudo chown -R www-data:www-data /home/unclepapa/public_html

위와 같은 방식은 www-data의 권한을 탈취당해도 www-data가 가진 권한이 매우 적기에 보안상 추천되고 있다. 하지만 이는 FTP 접속에 제한이 될 수 밖에 없는데 계정사용자가 홈디렉토리에 접속해도 소유권이 모두 www-data 이기에 업로드/수정이 불가능하게 된다.

FTP 사용에 편의를 위해서는 어떻게든 디렉토리와 파일의 소유권이 계정사용자를 포함해야 하는데, Owner 값은 id 값으로 중복될 수 없기때문에 www-data 값을 변경할 수는 없다.

Group 값은 중복될 수 있기때문에 www-data의 group에 FTP 계정을 사용할 사용자를 추가할 수 있다.

BASH
sudo usermod -a -G www-data unclepapa

이 경우 기본적인 리눅스 umask 값에 의해 디렉토리 퍼미션이 755이기에 umask 값을 002로 변경하여 생성하는 디렉토리나 파일들이 775 / 664의 값을 갖도록 해야 파일의 업로드/수정이 가능해진다.

BASH
sudo chmod -R 775 /home/unclepapa/public_html

혹은 umask 값을 수정( 특정사용자의 umask 값을 변경하려면 ~/.bashrc 에 값을 적용)

BASH
sudo vi /etc/profile

  umask 002



출처: http://webdir.tistory.com/231 [WEBDIR]

'Web > Server' 카테고리의 다른 글

데몬 스크립트 작성 및 등록하기  (0) 2018.02.21
스크립트 포멧 오류가 날 때 확인  (0) 2018.02.20
웹서버 설정(apache2, php, mariadb)  (0) 2018.02.20
Posted by jazzlife
,