利用docker-compose安装lnmp(Nginx mariadb php7.0 )

对于Docker来说,最大的便利就是能快速的搭建起一个个的容器,容器之间可以通过网络和文件来进行通信。

之前我已经将自己的博客使用docker搭建起来了,这里简单记录一下docker-compose文件内容。

我的博客的架构为lnmp,依赖的容器有:

  • Nginx(Port:80)

  • mariadb(Port:3306)

  • wordpress+php7.0-fpm(Port:9000)

  • phpmyadmin(Port:8009)

docker-compose.yml文件内容如下

nginx:
    image: nginx:latest
    ports:
        - '80:80'
    volumes:
        - ./nginx:/etc/nginx/conf.d
        - ./logs/nginx:/var/log/nginx
        - ./jialeens:/var/www/html
    links:
        - wordpress
    restart: always

mysql:
    image: mariadb
    ports:
        - '3306:3306'
    volumes:
        - ./db-data:/var/lib/mysql
    environment:
        - MYSQL_ROOT_PASSWORD=******
    restart: always

wordpress:
    image: wordpress:4.8.0-php7.0-fpm
    ports:
        - '9000:9000'
    volumes:
        - ./jialeens:/var/www/html
    environment:
        - WORDPRESS_DB_NAME=***
        - WORDPRESS_TABLE_PREFIX=wp_
        - WORDPRESS_DB_HOST=mysql
        - WORDPRESS_DB_PASSWORD=*****
    links:
        - mysql
    restart: always
phpmyadmin:
  image: phpmyadmin/phpmyadmin
  links:
    - mysql
  environment:
    PMA_HOST: mysql
    PMA_PORT: 3306
  ports:
    - '8009:80'

Nginx配置文件:

jialeens.com.conf

server {
    listen 80;
    server_name jialeens.com www.jialeens.com;

    fastcgi_buffer_size 64k;
    fastcgi_buffers 4 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 128k;
    client_max_body_size 100m;
    root /var/www/html;
    index index.php;

    access_log /var/log/nginx/jialeens-access-http.log;
    error_log /var/log/nginx/jialeens-error-http.log;

    if ($host = 'jialeens.com') {
        return 301 http://www.jialeens.com$request_uri;
    }
    location ~* ^.+.(js|ico|gif|jpg|jpeg|png|html|htm)$ {
       log_not_found off;
       access_log off;
       expires 7d;
    }
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+.php)(/.+)$;
        fastcgi_pass wordpress:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PHP_VALUE "upload_max_filesize=128M n post_max_size=128M";
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }
}

因为流量不大,所以没做fastcgi的缓存,以后有空再弄吧。

Centos 6.5安装PDO PHP扩展

PHP 数据对象PDO扩展为PHP访问数据库定义了一个轻量级的一致接口。PDO 提供了一个数据访问抽象层,这意味着,不管使用哪种数据库,都可以用相同的函数(方法)来查询和获取数据。最近在我们的建站和OA系统交流群中,有对服务器运维不熟悉的朋友问到关于PHP的PDO扩展安装的问题。本文我们将和大家一起分享如何在服务器上安装PDO扩展。

环境

  • 服务器系统:Centos6.5 (虚拟机演示)

  • PHP软件包存放目录:/data/php-5.6.14/

  • PHP安装目录:/usr/local/php/
  • mysql安装目录:/usr/local/mysql/

操作流程

通过phpinfo()函数我们可以检查服务器是否安装了PDO扩展。如果没有找到PDO扩展信息,那我们通过如下步骤来进行安装:

找到你的PHP的安装包(我的放在/data/php-5.6.14/目录下),并进入PHP扩展的pdo_mysql目录,运行下面命令:

/usr/local/php/bin/phpize

(/usr/local/php/是我的PHP安装目录,大家根据实际情况修改即可)

未分类

执行完上面命令后,我们就会发现当前pdo_msyql目录下就出现了configure文件。

未分类

然之我们执行下面命令:

./configure --with-php-config=/usr/local/php/bin/php-config --with-pdo-mysql=/usr/local/mysql/

参数说明:

  • –with-php-config=/usr/local/php/bin/php-config 指定安装 PHP 的时候的配置
  • –with-pdo-MySQL=/usr/local/mysql/ 指定 MySQL 数据库的安装目录位置
    (这里具体PHP和msyql的安装目录大家根据自己实际情况而定)

继续编译安装:

make && make install

命令执行完毕,效果如下:

未分类

足以最后一行的那个目录,后面会用到,此时生成的pdo_mysql.so文件就在该目录下:

未分类

接下来我们修改PHP配置文件,打开的你的php.ini文件,并添加一行代码:

extension=/usr/local/php/lib/php/extensions/no-debug-non-zts-20131226/pdo_mysql.so

(这里是我演示的pdo_mysql.so目录,大家设置时根据自己的实际目录添加)

未分类

最后保存推出,并重启服务。然后使用phpinfo()函数检查一下PDO扩展安装是否成功,结果如下,说明PDO扩展安装成功。

未分类

本文我们和大家一起分享了如何在linux系统中,安装PHP的PDO扩展,如果大家在实际操作中有什么问题,欢迎一起交流讨论,我们共同学习,共同进步。

CentOS 7.0安装LAMP服务器(PHP+MariaDB+Apache)

1、关闭firewall:

systemctl stop firew
alld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动

2、安装iptables防火墙(#可不安装)

yum install iptables-services #安装
vi /etc/sysconfig/iptables #编辑防火墙配置文件
//配置文件:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
//:wq! #保存退出

关闭 SELINUX

vi /etc/selinux/config
#SELINUX=enforcing #注释掉
#SELINUXTYPE=targeted #注释掉
SELINUX=disabled #增加
:wq! #保存退出
setenforce 0 #使配置立即生效

一、Apache安装

yum install httpd #根据提示,输入Y安装即可成功安装
systemctl start httpd.service #启动apache
systemctl stop httpd.service #停止apache
systemctl restart httpd.service #重启apache
systemctl enable httpd.service #设置apache开机启动

二、安装MariaDB

yum install mariadb mariadb-server 
//#询问是否要安装,输入Y即可自动安装,直到安装完成
systemctl start mariadb.service #启动MariaDB
systemctl stop mariadb.service #停止MariaDB
systemctl restart mariadb.service #重启MariaDB
systemctl enable mariadb.service #设置开机启动
cp /usr/share/mysql/my-huge.cnf /etc/my.cnf 
//拷贝配置文件(注意:如果/etc目录下面默认有一个my.cnf,直接覆盖即可)

设置密码

mysql_secure_installation
systemctl restart mariadb.service

三、安装PHP

//主程序
yum install php
//安装模块
yum install php-mysql php-gd libjpeg* php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-bcmath php-mhash
systemctl restart mariadb.service #重启MariaDB
systemctl restart httpd.service #重启apache

四、安装phpMyAdmin

//主程序
sudo yum install phpmyadmin php-mcrypt
//修改配置文件
vi /etc/httpd/conf.d/phpMyAdmin.conf 

<Directory /usr/share/phpMyAdmin/>
  AddDefaultCharset UTF-8

  <IfModule mod_authz_core.c>
   # Apache 2.4
   <RequireAny>
    #Require ip 127.0.0.1
    #Require ip ::1
    Require all granted
   </RequireAny>
  </IfModule>
  <IfModule !mod_authz_core.c>
   Order Deny,Allow
   Deny from All
   Allow from 127.0.0.1
   Allow from ::1
  </IfModule>
</Directory>

<Directory /usr/share/phpMyAdmin/setup/>
  <IfModule mod_authz_core.c>
   # Apache 2.4
   <RequireAny>
    #Require ip 127.0.0.1
    #Require ip ::1
    Require all granted
   </RequireAny>
  </IfModule>
  <IfModule !mod_authz_core.c>
   Order Deny,Allow
   Deny from All
   Allow from 127.0.0.1
   Allow from ::1
  </IfModule>
</Directory>

systemctl restart httpd #重启httpd

Ubuntu 16.04 apt安装Nginx PHP5.6 MySQL5.6

在Ubuntu 16.04中使用源安装Nginx+PHP5.6+MySQL5.6的方法。

安装Nginx

1、首先添加nginx_signing.key(必须,否则出错)

$ wget http://nginx.org/keys/nginx_signing.key

$ sudo apt-key add nginx_signing.key

2、添加]Nginx](http://nginx.org/)官方提供的源

$ echo "deb http://nginx.org/packages/ubuntu/ trusty nginx" >> /etc/apt/sources.list

$ echo "deb-src http://nginx.org/packages/ubuntu/ trusty nginx" >> /etc/apt/sources.list

3、更新源并安装Nginx

$ sudo apt-get update

$ sudo apt-get install nginx

4、安装Nginx完成后可查看版本号,输入

$ /usr/sbin/nginx -v

安装PHP5.6

1、添加PPA

$ sudo apt-get install python-software-properties software-properties-common

$ sudo add-apt-repository ppa:ondrej/php

$ sudo apt-get update

2、安装PHP5.6以及所需的一些扩展

$ sudo apt-get install php5.6-fpm php5.6-mysql php5.6-common php5.6-curl php5.6-cli php5.6-mcrypt php5.6-mbstring php5.6-dom

3、配置PHP5.6

打开php.ini配置文件:

$ sudo vim /etc/php/5.6/fpm/php.ini

找到cgi.fix_pathinfo选项,去掉注释;,然后将值设置为0:

cgi.fix_pathinfo = 0;
display_errors  =  On

location ~ .php$ {
          # include snippets/fastcgi-php.conf;
        #
          # # With php7.0-cgi alone:
        # fastcgi_pass 127.0.0.1:9000;
        # # With php7.0-fpm:
                fastcgi_param SCRIPT_FILENAME     documentroot fastcgi_script_name;
                  fastcgi_pass unix:/run/php/php5.6-fpm.sock;
                  fastcgi_index index.php;
                  include fastcgi_params;
}

安装MySQL

$ sudo apt-get install mysql-server-5.6 mysql-client-5.6

途中会提示设置MySQL的密码,安装好后:

$ mysql -uroot -p

然后输入刚刚设置的密码,能成功进入即成功安装。

Zabbix 3.2.1运行在PHP 7.1.7出现的问题解决

安装完成用admin账号登陆后,出现红色的框框显示这个:

A non well formed numeric value encountered [zabbix.php:21 → require_once() → ZBase->run() → ZBase->processRequest() → CView->getOutput() → include() → make_status_of_zbx() → CFrontendSetup->checkRequirements() → CFrontendSetup->checkPhpMemoryLimit() → str2mem() in include/func.inc.php:410]
A non well formed numeric value encountered [zabbix.php:21 → require_once() → ZBase->run() → ZBase->processRequest() → CView->getOutput() → include() → make_status_of_zbx() → CFrontendSetup->checkRequirements() → CFrontendSetup->checkPhpPostMaxSize() → str2mem() in include/func.inc.php:410]
A non well formed numeric value encountered [zabbix.php:21 → require_once() → ZBase->run() → ZBase->processRequest() → CView->getOutput() → include() → make_status_of_zbx() → CFrontendSetup->checkRequirements() → CFrontendSetup->checkPhpUploadMaxFilesize() → str2mem() in include/func.inc.php:410]

网上查了一下,这是因为PHP 7.1.7类型强化,处理方法是找到Zabbix WEB目录下include/func.inc.php文件,修改它

sed -i '/$last = strtolower(substr($val, -1));/a$val = substr($val,0,-1);' func.inc.php

问题依然未能解决,后来查看了一下func.inc.php代码,跳转到报错的位置#410,通过网上的解决方法分析,应该是val这个变量类型问题,在403行后添加一行$val = substr($val,0,-1); 保存修改后的文件,重新访问zabbix web界面即可。

openssl undefined reference to `SSLv2_client_method’

今天在Ubuntu 11.10编译php-5.2.17的时候出现如下的错误:

  1. php-5.2.17/ext/openssl/xp_ssl.c:357: undefined reference to `SSLv2_server_method’
  2. php-5.2.17/ext/openssl/xp_ssl.c:337: undefined reference to `SSLv2_client_method’
  3. collect2: ld returned 1 exit status
  4. make: *** [sapi/cgi/php-cgi] 错误 1

这个需要一个补丁禁用openssl的SSLv2_client_method,方法如下:

  1. cd php-5.2.17/
  2. wget http://devops.webres.wang/wp-content/uploads/2012/06/debian_patches_disable_SSLv2_for_openssl_1_0_0.patch
  3. patch -p1 < debian_patches_disable_SSLv2_for_openssl_1_0_0.patch

然后再重新编译php

  1. make clean
  2. make && make install

配置PHP与Oracle数据库连接

首先确认你已经安装有oracle 11g,下面是在装有oracle 11g的centos-6 64位配置php与oracle连接的事例。

安装oracle即时客户端

到这里http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html下载oracle-instantclient11.2-basic,oracle-instantclient11.2-devel,oracle-instantclient11.2-sqlplus文件,开始安装:

  1. rpm -ivh oracle-instantclient11.2-basic-11.2.0.3.0-1.x86_64.rpm  oracle-instantclient11.2-devel-11.2.0.3.0-1.x86_64.rpm  oracle-instantclient11.2-sqlplus-11.2.0.3.0-1.x86_64.rpm
  1. vi /etc/ld.so.conf.d/oracle-lib.conf

加入:

  1. /usr/lib/oracle/11.2/client64/lib/
  1. ldconfig

安装OCI8 PHP扩展

  1. cd /tmp
  2. wget http://pecl.php.net/get/oci8-1.4.7.tgz
  3. tar xzf oci8-1.4.7.tgz
  4. cd oci8-1.4.7
  5. phpize
  6. ./configure –with-oci8=shared,instantclient,/usr/lib/oracle/11.2/client64/lib/
  7. make && make install

在/etc/php.ini中加入:

  1. extension = "oci8.so"

接着使用php -m查看模块是否已经被加载

PHP环境安全性能检查

PHP在Linux环境下安全配置是一个复杂的过程,其中涉及到很多的细节设置,在这里发出来一个脚本,通过这个脚本来检测你的PHP环境是否存在安全隐患,从而针对这些对你的PHP环境进行加固。
功能:

  • 1.检测PHP环境安全配置
  • 2.应禁用的功能。
  • 3.危险的设置,可能会导致本地或远程文件包含。
  • 4.错误处理。
  • 5.在编译时定义的常量。
  • 安装PHP环境后,将此三个文件脚本放在网站web目录下(audit.php php.xml style.css )进行浏览器查看,他将在你配置的基础中通过XML文件中匹配规则检测出可能存在的配置错误,存在问题的选项它会用红色突出的颜色显示。当然还有一些东西可以根据你的要求更改。
    效果如下:
    服务器安全
    audit.php

    1. <?php
    2. /**
    3.  * PHP Security Auditor
    4.  */
    5. class Audit {
    6.  
    7. static private $rules;
    8. static private $constants;
    9. static private $phpVer;
    10.  
    11. static public $report;
    12.  
    13. /**
    14. * Converts settings such as 1M 1G 1K to their byte equivilent values
    15. *
    16. * @param string $n
    17. * @return string
    18. */
    19. static private function convertToBytes($n) {
    20.  
    21. // If n is -1 then there is no limit
    22.      if ($n == -1)
    23.      return PHP_INT_MAX;
    24.  
    25.      switch (substr($n, -1)) {
    26.                     case "B": return substr($n,0,-1);
    27.       case "K": return substr($n,0,-1) * 1024;
    28.                     case "M": return substr($n,0,-1) * 1024 * 1024;
    29.                     case "G": return substr($n,0,-1) * 1024 * 1024 * 1024;
    30.             }
    31.             return $n;
    32.      }
    33.  
    34. static private function MakeReport($type, $title) {
    35.  
    36. ksort(self::$report[$type]);
    37.  
    38.      $html = ‘<h1>’ . $title . ‘</h1><table><tr class="h"><th>Setting</th><th>Current</th><th>Recomended</th><th>Description</th></tr>’;
    39.     foreach(self::$report[$type] as $key => $values)
    40.     {
    41.     if ($values[‘p’] == 1) $class="r";
    42.     else $class="v";
    43.  
    44. $html .= ‘<tr><td class="e">’ . htmlentities($key) . ‘</td>’ .
    45. ‘<td class="’. $class .’">’ . htmlentities($values[‘c’]) . ‘</td>’ .
    46. ‘<td class="’. $class .’">’ . htmlentities($values[‘r’]) . ‘</td>’ .
    47. ‘<td class="’. $class .’">’ . htmlentities($values[‘d’]) . ‘</td></tr>’;
    48.     }
    49.     $html .= ‘</table>’;
    50.  
    51. return $html;
    52. }
    53.  
    54.  
    55.     static public function HTMLReport()
    56.      {
    57.      $class = "";
    58.  
    59.      $html = ‘<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">’ .
    60. ‘<html><head>’ .
    61.      ‘<link rel="stylesheet" type="text/css" media="all" href="style.css"/>’ .
    62.      ‘</head><body>’;
    63.  
    64.      $html .= self::MakeReport("ini", "PHP INI");
    65.      $html .= self::MakeReport("disabled", "PHP Disabled Functions");
    66.      $html .= self::MakeReport("const", "PHP CONST");
    67.  
    68.     $html .= ‘</html>’;
    69.  
    70.     echo($html . "n");
    71. }
    72.  
    73.    /**
    74.    * Adds an item to the reporting array.
    75.    *
    76.    * @param string $type – the type (ini or const)
    77.    * @param string $key – the name of the variable
    78.    * @param string $currentValue – the current ini or const value
    79.    * @param string $recomended – the recomended value
    80.    * @param string $desc – a description of the issue
    81.    * @param boolean $problem – true if not complaint, false if compliant
    82.    */
    83. static private function Report($type, $key, $currentValue, $recomended, $desc, $problem)
    84. {
    85. if (isset(self::$report[$type][$key]))
    86. if ((self::$report[$type][$key][‘r’] < $recomended)
    87. && (self::$report[$type][$key[‘p’]] == 1))
    88. return;
    89.  
    90. self::$report[$type][$key] = array(
    91. "c" => $currentValue,
    92. "r" => $recomended,
    93. "d" => $desc,
    94. "p" => $problem
    95. );
    96. }
    97.  
    98. /**
    99. * Loads the rules from an XML file
    100. *
    101. * @param string $file
    102. */
    103. static public function LoadRules($file = "php.xml")
    104. {
    105.  
    106. if (!defined(‘PHP_VERSION_ID’))
    107. {
    108. $version = explode(".", PHP_VERSION);
    109. self::$phpVer =  ($version[0] * 10000 + $version[1] * 100 + $version[2]);
    110. } else
    111. self::$phpVer = PHP_VERSION_ID;
    112.  
    113. self::$constants = get_defined_constants();
    114. self::$rules = simplexml_load_file($file);
    115. }
    116.  
    117. /**
    118. * Processes the XML ruleset against const and ini values found in PHP
    119. *
    120. */
    121. static public function ProcessXML() {
    122.  
    123. foreach(self::$rules as $null => $entry) {
    124. $ruleID = $entry->attributes()->id;
    125.  
    126. // Check the version of PHP the rule applies to
    127.  
    128. $version = (string)$entry->version;
    129.  
    130. if ($version != "") {
    131.  
    132. $op = (string)$entry->version->attributes()->op;
    133.  
    134. switch ($op) {
    135. case ‘before’:
    136. if ($version < self::$phpVer)
    137. continue 2;
    138. break;
    139. }
    140. }
    141.  
    142. // Evaluate the rule as we are sure it applys to the version of PHP running
    143.  
    144. switch((string)$entry->type)
    145. {
    146. // Look at CONST values in PHP
    147. case "const":
    148.  
    149. $key = (string)$entry->key; // e.g LIBXML_NOENT
    150. $cValue = self::$constants[$key]; // The current value
    151. $rValue = (string)$entry->value; // The recomended value
    152. $desc = (string)$entry->description; // Description
    153.  
    154. switch((string)$entry->value->attributes()->op)
    155. {
    156. case "eq":
    157. self::Report("const", $key, $cValue, $rValue, $desc, ($cValue == $rValue) ? 0 : 1);
    158. break;
    159. }
    160.  
    161. break;
    162.  
    163. // Check the list of functions that should be restricted
    164.  
    165. case "disable_functions":
    166.  
    167. $disabled = ini_get("disable_functions");
    168. $list = explode(",", $disabled);
    169.  
    170. $xmlList = (array)($entry->list);
    171. $xmlList = $xmlList[‘function’];
    172.  
    173. foreach($xmlList as $null => $function) {
    174. $de = array_search($function, $list);
    175. self::Report("disabled", $function, (($de == 0) ? "enabled" : "disabled"), "disabled", "", (($de == 0) ? 1 : 0));
    176. }
    177.  
    178. break;
    179.  
    180. // Look at values defined within the INI files
    181.  
    182. case "ini":
    183.  
    184. $key = (string)$entry->key; // e.g. display_errors
    185. $cValue = trim(self::convertToBytes(ini_get($key))); // Current value
    186. $rValue = (string)$entry->value; // Recomended value
    187. $desc = (string)$entry->description; // Description
    188.  
    189. if (is_numeric($rValue) && $cValue == "") $cValue = "0";
    190.  
    191. // Deals with where one value should be compared to another
    192.  
    193. if ((string)$entry->value->attributes()->type == "key")
    194. $rValue = self::convertToBytes(ini_get((string)$entry->value));
    195.  
    196. switch((string)$entry->value->attributes()->op)
    197. {
    198. // Equal to
    199. case "eq":
    200. self::Report("ini", $key, $cValue, $rValue, $desc, ($cValue == $rValue) ? 0 : 1);
    201. break;
    202.  
    203. // Less than or equal to
    204. case "lt":
    205. self::Report("ini", $key, $cValue, "< $rValue", $desc, ($cValue <= $rValue) ? 0 : 1);
    206. break;
    207.  
    208. // Greater than or equal to
    209. case "gt":
    210. self::Report("ini", $key, $cValue, "> $rValue", $desc, ($cValue >= $rValue) ? 0 : 1);
    211. break;
    212.  
    213. // Not equal to
    214. case "ne":
    215. $neValue  = (string)$entry->value->attributes()->net;
    216. $notBlank = (string)$entry->value->attributes()->notblank;
    217.  
    218.  
    219. if ($notBlank == "true") {
    220. self::Report("ini", $key, $cValue, $rValue, $desc, ($cValue != "") ? 0 : 1);
    221. break;
    222. }
    223.  
    224. self::Report("ini", $key, $cValue, $rValue, $desc, ($cValue != $neValue) ? 0 : 1);
    225. break;
    226.  
    227. }
    228.  
    229. break;
    230. }
    231.  
    232. }
    233.  
    234. }
    235.  
    236.  
    237. }
    238.  
    239. Audit::LoadRules();
    240. Audit::ProcessXML();
    241. Audit::HTMLReport();

    php.xml代码如下:

    1. <?xml version="1.0" encoding="UTF-8"?>
    2. <rules>
    3. <entry id="1">
    4. <type>ini</type>
    5. <key>upload_max_filesize</key>
    6. <value op="lt">4194304</value>
    7. <description>Sets the maximum size of an uploaded file. Reduce this to mitigate the risk of DOS attacks.</description>
    8. </entry>
    9. <entry id="29">
    10. <type>ini</type>
    11. <key>upload_max_filesize</key>
    12. <value op="lt" type="key">memory_limit</value>
    13. <description>The maximum size of an uploaded file should be able to fit within the avaliable memory limit.</description>
    14. </entry>
    15. <entry id="30">
    16. <type>ini</type>
    17. <key>post_max_size</key>
    18. <value op="lt" type="key">memory_limit</value>
    19. <description>The maximum post size of data posted to the server should be within the avaliable memory limit.</description>
    20. </entry>
    21. <entry id="32">
    22. <type>ini</type>
    23. <key>always_populate_raw_post_data</key>
    24. <value op="eq">0</value>
    25. <description>This does not need to be used. The preferred method for accessing the raw POST data is php://input.</description>
    26. </entry>
    27. <entry id="33">
    28. <type>ini</type>
    29. <key>magic_quotes_gpc</key>
    30. <value op="eq">0</value>
    31. <description>Sets magic_quotes state for GPC (GET PUT COOKIE) data.  Relying on this feature is highly discouraged.</description>
    32. <version op="before">50300</version>
    33. <url>http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-gpc</url>
    34. </entry>
    35. <entry id="34">
    36. <type>ini</type>
    37. <key>magic_quotes_runtime</key>
    38. <value op="eq">0</value>
    39. <description>Sets magic_quotes state for data from external sources.  Relying on this feature is highly discouraged.</description>
    40. <version op="before">50300</version>
    41. <url>http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-runtime</url>
    42. </entry>
    43. <entry id="35">
    44. <type>ini</type>
    45. <key>safe_mode</key>
    46. <value op="eq">0</value>
    47. <description>This feature has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.</description>
    48. <version op="before">50300</version>
    49. </entry>
    50. <entry id="36">
    51. <type>ini</type>
    52. <key>memory_limit</key>
    53. <value op="lt">16777216</value>
    54. <description>The maximum memory limit for each script should be 16M or less.</description>
    55. </entry>
    56. <entry id="5">
    57. <type>ini</type>
    58. <key>upload_max_filesize</key>
    59. <value op="lt" type="key">post_max_size</value>
    60. <description>The maximum upload file size should be less than or equal to the maximum post size.</description>
    61. </entry>
    62. <entry id="2">
    63. <type>ini</type>
    64. <key>max_file_uploads</key>
    65. <value op="lt">10</value>
    66. <description>The maximum mumber of files that can be uploaded in 1 go.</description>
    67. </entry>
    68. <entry id="3">
    69. <type>ini</type>
    70. <key>file_uploads</key>
    71. <value op="eq">0</value>
    72. <description>This may be impractical but if not needed file uploading should be disabled.</description>
    73. </entry>
    74. <entry id="4">
    75. <type>ini</type>
    76. <key>post_max_size</key>
    77. <value op="lt">4194304</value>
    78. <description>The maximum post size should as small as reasonably possible to mitigate the risk of DOS attacks.</description>
    79. </entry>
    80. <entry id="6">
    81. <type>ini</type>
    82. <key>register_long_arrays</key>
    83. <value op="eq">0</value>
    84. <description>Populates HTTP_*_VARS which should no longer be used.</description>
    85. <version op="before">50300</version>
    86. </entry>
    87. <entry id="7">
    88. <type>ini</type>
    89. <key>register_globals</key>
    90. <value op="eq">0</value>
    91. <description>Highly dangerous feature enabling variables to be defined in scripts from the GPC paramaters. This should be always be turned off.</description>
    92. <version op="before">50300</version>
    93. </entry>
    94. <entry id="8">
    95. <type>ini</type>
    96. <key>session.hash_function</key>
    97. <value op="eq">1</value>
    98. <description>MD5 should be replaced with SHA-160 as it is a more complex and secure hashing algorithm.</description>
    99. <version op="after">50000</version>
    100. </entry>
    101. <entry id="9">
    102. <type>ini</type>
    103. <key>session.hash_bits_per_character</key>
    104. <value op="gt">5</value>
    105. <description>The number of bits encoded per character of the session key.</description>
    106. <version op="after">50000</version>
    107. </entry>
    108. <entry id="10">
    109. <type>ini</type>
    110. <key>session.entropy_file</key>
    111. <value op="ne" net="">/dev/random</value>
    112. <description>Provides a random seed for generating the session.</description>
    113. </entry>
    114. <entry id="11">
    115. <type>ini</type>
    116. <key>session.entropy_length</key>
    117. <value op="gt">32</value>
    118. <description>The number of bytes to read for gathering entropy for session generation.</description>
    119. </entry>
    120. <entry id="12">
    121. <type>ini</type>
    122. <key>session.name</key>
    123. <value op="ne" net="PHPSESSID">Custom String</value>
    124. <description>The name given to the PHP Session. It is recomended this be changed from the default.</description>
    125. </entry>
    126. <entry id="14">
    127. <type>ini</type>
    128. <key>session.save_path</key>
    129. <value op="ne" net="/tmp" notblank="true">/custom/location</value>
    130. <description>The save path for the session should be changed from the default /tmp.</description>
    131. </entry>
    132. <entry id="15">
    133. <type>ini</type>
    134. <key>session.use_trans_sid</key>
    135. <value op="eq">0</value>
    136. <description>Sessions should not be allowed in GET paramaters.</description>
    137. </entry>
    138. <entry id="18">
    139. <type>ini</type>
    140. <key>display_errors</key>
    141. <value op="eq">0</value>
    142. <description>Error messages should be suppressed</description>
    143. </entry>
    144. <entry id="19">
    145. <type>ini</type>
    146. <key>allow_url_fopen</key>
    147. <value op="eq">0</value>
    148. <description>Remote files should not be accessable using fopen.</description>
    149. </entry>
    150. <entry id="20">
    151. <type>ini</type>
    152. <key>allow_url_include</key>
    153. <value op="eq">0</value>
    154. <description>You should not be able to include remote scripts using include.</description>
    155. </entry>
    156. <entry id="31">
    157. <type>ini</type>
    158. <key>session.cookie_httponly</key>
    159. <value op="eq">1</value>
    160. <description>Cookies must be httponly by default</description>
    161. <version op="after">50200</version>
    162. </entry>
    163. <entry id="20">
    164. <type>ini</type>
    165. <key>open_basedir</key>
    166. <value op="ne" net="/" notblank="true">/the/webroot</value>
    167. <description>Limit the files that can be opened by PHP to the webroot.</description>
    168. </entry>
    169. <entry id="32">
    170. <type>ini</type>
    171. <key>upload_tmp_dir</key>
    172. <value op="ne" net="/tmp" notblank="true">/custom/location</value>
    173. <description>Change the location of where files are initally uploaded to</description>
    174. </entry>
    175. <entry id="21">
    176. <type>ini</type>
    177. <key>max_execution_time</key>
    178. <value op="lt">20</value>
    179. <description>Execution time should be limited to 20 seconds or less.</description>
    180. </entry>
    181. <entry id="22">
    182. <type>ini</type>
    183. <key>max_input_nesting_level</key>
    184. <value op="lt">32</value>
    185. <description>Maximum level of nesting of objects 32 is sufficent.</description>
    186. </entry>
    187. <entry id="23">
    188. <type>ini</type>
    189. <key>enable_dl</key>
    190. <value op="eq">0</value>
    191. <description>Disable loading of dynamic extensions.</description>
    192. </entry>
    193. <entry id="24">
    194. <type>ini</type>
    195. <key>display_startup_errors</key>
    196. <value op="eq">0</value>
    197. <description>Startup errors should be suppressed.</description>
    198. </entry>
    199. <entry id="25">
    200. <type>ini</type>
    201. <key>log_errors</key>
    202. <value op="eq">1</value>
    203. <description>All errors generated by PHP should be logged to a file.</description>
    204. </entry>
    205. <entry id="26">
    206. <type>ini</type>
    207. <key>log_errors_max_len</key>
    208. <value op="gt">2048</value>
    209. <description>At least 2048 characters of the error message should be stored in the error log.</description>
    210. </entry>
    211. <entry id="27">
    212. <type>ini</type>
    213. <key>error_log</key>
    214. <value op="ne" net="">/custom/location</value>
    215. <description>Should be set to the location of the php error log.</description>
    216. </entry>
    217. <entry id="28">
    218. <type>const</type>
    219. <key>LIBXML_NOENT</key>
    220. <value op="eq">0</value>
    221. <description>External entities should be disabled for XML parsing</description>
    222. </entry>
    223. <entry id="37">
    224. <type>ini</type>
    225. <key>session.use_only_cookies</key>
    226. <value op="eq">1</value>
    227. <description>Session variables should only be passed in cookies.</description>
    228. </entry>
    229. <entry id="29">
    230. <type>const</type>
    231. <key>LIBXML_NONET</key>
    232. <value op="eq">0</value>
    233. <description>Network access for XML parsers should be disabled.</description>
    234. </entry>
    235. <entry id="38">
    236. <type>disable_functions</type>
    237. <list>
    238. <function>fsocket_open</function>
    239. <function>pack</function>
    240. <function>escapeshellarg</function>
    241. <function>escapeshellcmd</function>
    242. <function>exec</function>
    243. <function>passthru</function>
    244. <function>proc_close</function>
    245. <function>php_uname</function>
    246. <function>getmyuid</function>
    247. <function>getmypid</function>
    248. <function>passthru</function>
    249. <function>leak</function>
    250. <function>listen</function>
    251. <function>diskfreespace</function>
    252. <function>tmpfile</function>
    253. <function>link</function>
    254. <function>ignore_user_abort</function>
    255. <function>set_time_limit</function>
    256. <function>limit</function>
    257. <function>exec</function>
    258. <function>highlight_file</function>
    259. <function>show_source</function>
    260. <function>fpaththru</function>
    261. <function>virtual</function>
    262. <function>posix_ctermid</function>
    263. <function>posix_getcwd</function>
    264. <function>posix_getegid</function>
    265. <function>posix_geteuid</function>
    266. <function>posix_getgid</function>
    267. <function>posix_getgrgid</function>
    268. <function>posix_getgrnam</function>
    269. <function>posix_getgroups</function>
    270. <function>posix_getlogin</function>
    271. <function>posix_getpgid</function>
    272. <function>posix_getpgrp</function>
    273. <function>posix_getpid</function>
    274. <function>posix</function>
    275. <function>posix_getpwnam</function>
    276. <function>posix_getpwuid</function>
    277. <function>posix_getrlimit</function>
    278. <function>posix_getsid</function>
    279. <function>posix_getuid</function>
    280. <function>posix_isatty</function>
    281. <function>posix_kill</function>
    282. <function>posix_mkfifo</function>
    283. <function>posix_setegid</function>
    284. <function>posix_seteuid</function>
    285. <function>posix_setgid</function>
    286. <function>posix_setpgid</function>
    287. <function>posix_setsid</function>
    288. <function>posix_setuid</function>
    289. <function>posix_times</function>
    290. <function>posix_ttyname</function>
    291. <function>posix_uname</function>
    292. <function>proc_open</function>
    293. <function>proc_close</function>
    294. <function>proc_get_status</function>
    295. <function>proc_nice</function>
    296. <function>proc_terminate</function>
    297. <function>phpinfo</function>
    298. <function>proc_open</function>
    299. <function>shell_exec</function>
    300. <function>system</function>
    301. <function>set_time_limit</function>
    302. <function>ini_alter</function>
    303. <function>dl</function>
    304. <function>popen</function>
    305. <function>parse_ini_file</function>
    306. </list>
    307. </entry>
    308. </rules>

    style.css代码如下:

    1. @CHARSET "UTF-8";
    2.  
    3. body {background-color: #ffffff; color: #000000;}
    4. body, td, th, h1, h2 {font-family: sans-serif;}
    5. pre {margin: 0px; font-family: monospace;}
    6. table {border-collapse: collapse;}
    7. td, th { border: 1px solid #000000; font-size: 75%; vertical-align: baseline;  padding-left:5px; padding-right:5px;}
    8. h1 {font-size: 150%;}
    9. h2 {font-size: 125%;}
    10. .p {text-align: left;}
    11. .e {background-color: #ccccff; font-weight: bold; color: #000000;}
    12. .h {background-color: #9999cc; font-weight: bold; color: #000000;}
    13. .v {background-color: #cccccc; color: #000000; padding-left:5px;}
    14. .r {background-color: #c50000; color: #000000;  padding-left:5px;}

    三个文件已经打包:php-security-check.zip
    转自:http://lanlan611.sinaapp.com/?p=112

    php sockets扩展安装

    今天安装cacti发现需要php sockets扩展,而现在的lnmp没有安装,于是想到了phpize工具安装扩展,安装方法如下:

    1. cd php-5.3.8/ext/sockets/
    2. /usr/local/php/bin/phpize
    3. ./configure –enable-sockets –with-php-config=/usr/local/php/bin/php-config
    4. make
    5. make install

    接着在/etc/php.ini添加加载扩展代码:

    1. extension=sockets.so

    service php-fpm reload或service httpd reload

    undefined reference to `libiconv_open’ collect2: ld returned 1 exit status错误

    今天有一网友反映使用lnmp一键安装包无法安装php,叫他发错误文件给我看,发现提示这样的错误:

    1. undefined reference to `libiconv_open’
    2. collect2: ld returned 1 exit status

    这个错误的原因可能php找不到iconv库文件,所以我们需要下载安装它。

    1. #wget http://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.14.tar.gz
    2. #tar -zxvf libiconv-1.14.tar.gz
    3. #cd libiconv-1.14
    4. # ./configure –prefix=/usr/local/libiconv
    5. # make
    6. # make install

    完成之后在编译php的./configure命令加上–with-iconv=/usr/local/libiconv指向iconv位置。
    这样应该能解决这个问题。