centos 7 에서 ftp, nginx, php, mariadb 설치

리눅스 버전 확인 -
[root@localhost ~]# cat /etc/redhat-release

 

 

 

네트워크 설정-

[root@localhost ~]# hostname -I // 아이피 확인

[root@localhost ~]# ip addr show // 아이피 확인
[root@localhost ~]# ping google.com
ping : unknown host google.com
[root@localhost ~]# vi /etc/sysconfig/network-scripts/ifcfg-enp0s3

ONBOOT=yes

 

 

에러가 난다면 -

centos7 지원 안해서 여러가지 에러가 날 수 있음. (mirrorlist 서버가 내려가 있음)

그래서 repogitory 를 바꿔야함.

 

yum install epel-release
이걸 치면

Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=7&arch=x86_64&repo=os&infra=stock error was...

 

[root@localhost ~]#  cd /etc/yum.repos.d/
[root@localhost ~]#  mkdir backup
[root@localhost ~]#  mv *.repo backup/

[root@localhost ~]# cd /etc/yum.repos.d/ (다시 이동)

[root@localhost ~]# vi CentOS-Base.repo

 

-----------------------------

[base]
name=CentOS-7 - Base
baseurl=http://vault.centos.org/7.9.2009/os/x86_64/
enabled=1
gpgcheck=0

[updates]
name=CentOS-7 - Updates
baseurl=http://vault.centos.org/7.9.2009/updates/x86_64/
enabled=1
gpgcheck=0

[extras]
name=CentOS-7 - Extras
baseurl=http://vault.centos.org/7.9.2009/extras/x86_64/
enabled=1
gpgcheck=0

--------------------------

 

[root@localhost ~]# yum clean all

[root@localhost ~]# yum makecache ->

Metadata Cache Created

 

 

기본 설치-
[root@localhost ~]# yum install epel-release
[root@localhost ~]# yum install wget

[root@localhost ~]# yum update

 

 

 

방화벽 및 sshd -
[root@localhost ~]#vi /etc/ssh/sshd_config

Port 변경할 포트 PermitRootLogin no // root ssh 접근 제한 yes 로 되어있고 주석 처리 되어있음. MaxAuthTries 6 // 주석 처리 되었고 sshd 접근 6회 초과시 블럭

Port 변경할 포트 PermitRootLogin no // root ssh 접근 제한 yes 로 되어있고 주석 처리 되어있음. MaxAuthTries 3 // 주석 처리 되었고 sshd 접근 6회 초과시 블럭 MaxSessions 1

 

[root@localhost ~]# yum install policycoreutils-python

[root@localhost ~]# semanage port -a -t ssh_port_t -p tcp 포트

[root@localhost ~]# semanage port -l|grep ssh

ssh_port_t                                      tcp   변경한포트, 22 번 말고 다른거

[root@localhost ~]# systemctl start firewalld

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=포트번호/tcp

[root@localhost ~]# firewall-cmd --reload

[root@localhost ~]# firewall-cmd --list-all

 

 

포트 확인 -

[root@localhost ~]# yum install net-tools
[root@localhost ~]# netstat -tulpn | grep LISTEN

[root@localhost ~]# netstat -atun

[root@localhost ~]# reboot

 

 

ftp 설치-
[root@localhost ~]# yum install vsftpd
[root@localhost ~]# vi /etc/vsftpd/vsftpd.conf

anonymous_enable=NO local_enable=YES write_enable=YES local_umask=002 file_open_mode=0755 dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES ftp_data_port=20 xferlog_file=/var/log/xferlog xferlog_std_format=YES # (default follows) chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot_list listen=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES pasv_enable=NO (응답:    425 Failed to establish connection.) log_ftp_protocol=YES dual_log_enable=YES vsftpd_log_file=/var/log/vsftpd.log // 이거 없으면 fail2ban 사용 안됨

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=21/tcp // 21 말고 다른거

[root@localhost ~]# firewall-cmd --reload

[root@localhost ~]# firewall-cmd --list-all

[root@localhost ~]# systemctl start firewalld

[root@localhost ~]# vi /etc/vsftpd/user_list

[root@localhost ~]# vi /etc/vsftpd/ftpusers

#root

root

... 아이디 생성 및 비밀번호 생성 ...

[root@localhost ~]# useradd id

[root@localhost ~]# passwd id

... 아이디 생성 및 비밀번호 생성 ...

[root@localhost ~]#vi /etc/vsftpd/chroot_list

[root@localhost ~]# systemctl restart vsftpd

[root@localhost ~]# vi /etc/sysconfig/selinux

#This file controls the state of SELinux on the system. #SELINUX= can take on of thes three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are proteced, # mls - Multi Level Security protection. SELINUXTYPE=targeted

#This file controls the state of SELinux on the system. #SELINUX= can take on of thes three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=permissive # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are proteced, # mls - Multi Level Security protection. SELINUXTYPE=targeted

 

[root@localhost ~]# getsebool -a | grep ftp

[root@localhost ~]# setsebool allow_ftpd_full_access on

[root@localhost ~]# systemctl restart vsftpd

[root@localhost ~]# systemctl enable vsftpd

[root@localhost ~]# reboot

 

 

nginx 확인 -

[root@localhost ~]# vi /etc/yum.repos.d/nginx.repo

[nginx] name=nginx repo baseurl=http://nginx.org/packages/centos/7/$basearch/ gpgcheck=0 enabled=1

[root@localhost ~]# yum install nginx

[root@localhost ~]# vi /etc/nginx/conf.d/default.conf

location ~ \.php$ -> location ~ \.(php|html|htm)${  root /usr/share/nginx/html;  fastcgi_pass unix:/run/php-fpm/php-fpm.sock; // php-fpm.mid 파일  fastcgi_index index.php;  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;  include fastcgi_params; }

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=80/tcp

[root@localhost ~]# firewall-cmd --reload

[root@localhost ~]# systemctl start nginx

[root@localhost ~]# systemctl enable nginx

 

 

php 확인 -

[root@localhost ~]# rpm -qa|grep php

[root@localhost ~]# rpm -qa|grep remi-release

[root@localhost ~]# rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-7.rpm

[root@localhost ~]# rpm -qa|grep remi-release

remi-release-7.8-1.el7.remi.noarch

[root@localhost ~]# ll /etc/yum.repos.d/remi.repo

-rw-r--r-- l root root 2605 8월 17 19:29 /etc/yum.repos.d/remi.repo

[root@localhost ~]# yum --enablerepo=remi-php73 install php php-fpm php-pdo php-mcrypt php-mstring php-pecl-zip php-xml php-pecl-jsonc php-mysqlnd php-mbstring php-gd

[root@localhost ~]# vi /etc/php-fpm.d/www.conf

listen = /run/php-fpm/php-fpm.sock listen.allowed_clients = 127.0.0.1 listen.owner = nginx listen.group = nginx listen.mode = 0666 user = nginx group = nginx pm = dynamic pm.max_children = 50 pm.start_servers = 5 pm.min_spare_servers = 5 pm.max_spare_servers = 35 slowlog = /var/log/php-fpm/www-slow.log security.limit_extensions = .php .html .htm php_admin_value[error_log] = /var/log/php-fpm/www-error.log php_admin_flag[log_errors] = on php_value[session.save_handler] = files php_value[session.save_path] = /var/lib/php/session

[root@localhost ~]# ls -la /var/lib/php/session

-rw------- 1 apache apache 13842 2020-11-12 06:14 sess_2hp....

[root@localhost ~]# chown -R nginx:nginx /var/lib/php/session

[root@localhost ~]# chmod 0777 /var/lib/php/session

[root@localhost ~]# systemctl enable php-fpm

[root@localhost ~]# systemctl restart php-fpm

 

 

컴포저 설치 (locally) -

[root@localhost ~]# cd /(설치 디렉토리 이동)/

[root@localhost ~]# curl -sS https://getcomposer.org/installer | php

[root@localhost ~]# vi composer.json

{ "require": { "facebook/graph-sdk": "5.6.0", "google/apiclient" : "^2.0", "phpmailer/phpmailer": "~6.1" } }

[root@localhost ~]# php composer.phar install

 

 

mariadb 확인 -

[root@localhost ~]# vi /etc/yum.repos.d/MariaDB.repo

[mariadb] name=MariaDB baseurl=http://yum.mariadb.org/10.4.17/centos7-amd64 gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB gpgcheck=1

[root@localhost ~]# yum install MariaDB

[root@localhost ~]# rpm -qa | grep MariaDB

[root@localhost ~]# systemctl start mariadb

[root@localhost ~]# /usr/bin/mysqladmin -u root password 비밀번호

[root@localhost ~]# netstat -anp | grep 3306 // 3306 말고 다른거

[root@localhost ~]# mysql -u root -p

Enter password: 비밀번호 . . . quit

[root@localhost ~]# semanage port -a -t mysqld_port_t -p tcp 3306 // 3306 말고 다른거

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=3306/tcp // 3306 말고 다른거

mysql> alter user ‘유저명’ identified by ‘비밀번호’; or mysql> update user set password=password('비밀번호') where user='root'; Query OK, 0 rows affected (0.00 sec) mysql> flush privileges; // 리셋 부터 mysql> create user 'root'@'%' identified by '비밀번호'; mysql> grant all privileges on *.* to 'root'@'%' identified by '비밀번호' with grant option; Query OK, 0 rows affected (0.00 sec) mysql> flush privileges; Query OK, 0 rows affected (0.00 sec)

mysql -u 유저 -p (엔터) SELECT user, host FROM mysql.user WHERE user='root'; +------+-----------+ | user | host      | +------+-----------+ | root | localhost | | root | 127.0.0.1 | | root | %         | +------+-----------+ DELETE FROM mysql.user WHERE user='root' AND host='%'; FLUSH PRIVILEGES; CREATE USER '유저'@'localhost' IDENTIFIED BY '강력한비밀번호'; GRANT ALL PRIVILEGES ON *.* TO '유저'@'localhost' WITH GRANT OPTION; FLUSH PRIVILEGES;

[root@localhost ~]# firewall-cmd --reload

[root@localhost ~]# systemctl enable mariadb

 

 

 

새로운 버전 (root 계정 삭제 전용) -

 

root 계정 버리고 특정 계정 (user) 들에게 권한 분배 하기

 

sudo visudo
(결과) user ALL=(ALL) ALL // root 밑에

sudo usermod -aG wheel user

sudo visudo
(결과) #%wheel  ALL=(ALL)       ALL // # 제거

sudo groups user
(결과) user : user wheel


vi /etc/vsftpd/chroot_list (root 제거)
vi /etc/vsftpd/ftpusers (root 포함/주석 되어 있으면 주석 제거)
vi /etc/vsftpd/user_list (root 포함/주석 되어 있으면 주석 제거)


vi /etc/sysconfig/selinux
SELINUX=disabled -> SELINUX=permissive


vi /etc/ssh/sshd_config
PermitRootLogin no
MaxAuthTries 3

MaxSession1 1

 

 

Fail2Ban 설치

아래의 명령어로 Fail2Ban을 설치한다.

yum install fail2ban

 

아래의 명령어로 Fail2Ban이 CentOS가 기동하면 자동으로 실행되도록 설정한다.

systemctl enable fail2ban

 

systemctl start fail2ban

 

systemctl status fail2ban

 

 

[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = -1
findtime = 600
maxretry = 3
banaction = firewallcmd-rich-rules

[sshd]
enabled = true
port = 포트번호
logpath = /var/log/secure

[vsftpd]
enabled = true
port = 포트번호
logpath = /var/log/vsftpd.log


cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

파일 복사 보다

vi /etc/fail2ban/jail.local

로 파일 생성한뒤 위에 설정 추가


fail2ban 상태 체크 -
fail2ban-client status

fail2ban-client status
fail2ban-client status sshd

밴 리스트 -
firewall-cmd --list-rich-rules

 

참고 포스트 -

saksin.tistory.com/1364

CentOS 7 방화벽 설정

fishpoint.tistory.com/1406

에러해결 : Host 'HOST이름' is not allowed to connect to this MySQL server

kithub.tistory.com/entry/MariaDB-%EC%99%B8%EB%B6%80%EC%A0%91%EC%86%8D-%EC%8B%9C%EB%8F%84%EC%8B%9C

[ MariaDB ] 외부접속 문제 " Access denied for user "

https://engineeringcode.tistory.com/entry/CentOS7-Fail2Ban-%EC%84%A4%EC%B9%98

[CentOS 7] Fail2Ban 설치