本文打造易于复制粘贴的lnmp安装方法。
相比较其他编译安装的教程，本文解除了软件版本锁定，理论上，永远安装的是最新稳定版且支持软件升级。
编译教程在写作时往往使用当时的最新稳定版软件，但是稍过时日，新的漏洞出来，很快会将读者带入危险，因为软件已经过时了。严重不建议新手使用编译方法安装lnmp。
环境CentOS 6.5 x64
安装第三方软件源(epel、nginx、remi)
|
1
2
3
|
rpm -ivh http:
//download
.fedora.redhat.com
/pub/epel/6/x86_64/epel-release-6-8
.noarch.rpm
rpm -ivh http:
//nginx
.org
/packages/centos/6/noarch/RPMS/nginx-release-centos-6-0
.el6.ngx.noarch.rpm
rpm -ivh http:
//rpms
.famillecollet.com
/enterprise/remi-release-6
.rpm
|
yum一键安装lnmp
|
1
|
yum
install
nginx mysql mysql-server php-fpm php-mysql php-cli php-gd php-xml php-mbstring php-mcrypt php-zendopcache --enablerepo=epel,nginx,remi
|
php参数配置
|
1
2
3
4
5
6
7
8
9
10
|
sed
-i
'/expose_php/{s/On/Off/g}'
/etc/php
.ini
sed
-i
'/display_errors/{s/On/Off/g}'
/etc/php
.ini
sed
-i
'/php_errors.log/{s/;//g}'
/etc/php
.ini
sed
-i
'/file_uploads/{s/On/Off/g}'
/etc/php
.ini
sed
-i
'/allow_url_fopen/{s/On/Off/g}'
/etc/php
.ini
sed
-i
'/allow_url_include/{s/On/Off/g}'
/etc/php
.ini
sed
-i
'/;date.timezone/{s/;//g;s/=/= Asia\/Shanghai/g}'
/etc/php
.ini
sed
-i
'/cgi.fix_pathinfo\=/{s/;//g;s/1/0/g}'
/etc/php
.ini
sed
-i
'/memory_limit/{s/128/64/g}'
/etc/php
.ini
sed
-i
'/safe_mode/{s/Off/On/g}'
/etc/php
.ini
|
php-fpm配置
|
1
2
|
sed
-i
's/apache/nginx/g'
/etc/php-fpm
.d
/www
.conf
sed
-i
'/request_terminate_timeout/{s/;//g;s/0/30/g}'
/etc/php-fpm
.d
/www
.conf
|
内核优化
|
1
2
3
4
5
6
7
|
echo
"net.ipv6.conf.all.disable_ipv6 = 1"
>>
/etc/sysctl
.conf
echo
"vm.swappiness = 25"
>>
/etc/sysctl
.conf
echo
"net.ipv4.route.max_size = 524288 "
>>
/etc/sysctl
.conf
echo
"net.core.somaxconn = 10240"
>>
/etc/sysctl
.conf
echo
"net.ipv4.tcp_max_syn_backlog = 204800"
>>
/etc/sysctl
.conf
echo
"net.core.netdev_max_backlog = 204800"
>>
/etc/sysctl
.conf
echo
"net.ipv4.ip_local_port_range = 1024 65535"
>>
/etc/sysctl
.conf
|
|
1
2
3
4
5
|
echo
"ulimit -SHn 65535"
>>
/etc/profile
cat
>>
/etc/security/limits
.conf <<EOF
nginx soft nofile 65535
nginx hard nofile 65535
EOF
|
nginx基本优化
|
1
2
3
4
5
6
|
sed
-i
'/worker_processes/{s/1/4/g}'
/etc/nginx/nginx
.conf
sed
-i
'/worker_processes/a\ worker_rlimit_nofile 65535;'
/etc/nginx/nginx
.conf
sed
-i
'/worker_connections/{s/1024/10240/g}'
/etc/nginx/nginx
.conf
sed
-i
'/sendfile/a\ server_tokens off;'
/etc/nginx/nginx
.conf
sed
-i
'/version/{s/\/\$nginx_version//g}'
/etc/nginx/fastcgi_params
sed
-i
'/events/a\ use epoll;'
/etc/nginx/nginx
.conf
|
nginx的fpm基本配置，找到FASTCGI选项，去掉注释，修改下面这样
|
1
2
3
4
5
6
7
8
|
location ~ \.php$ {
root
/var/www/html
;
fastcgi_pass 127.0.0.1:9000;
#fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
|
nginx页面设置
|
1
2
3
4
|
mkdir
-p
/var/www/html
sed
-i
's#/usr/share/nginx/html#/var/www/html#g'
/etc/nginx/conf
.d
/default
.conf
sed
-i
's/index.html/& index.php/'
/etc/nginx/nginx
.conf
echo
"<?php phpinfo();phpinfo(INFO_MODULES);?>"
>
/var/www/html/index
.php
|
mysql配置
有条件的话，给mysql单独分个区作为datadir
[mysqld]
datadir=/data
其他参数可以参考/usr/share/mysql下的示例文件
mysql基本加固，（设置密码，限制访问等）
|
1
|
mysql_secure_installation
|
iptables防火墙，需要根据自己设置，下面仅仅是个示例
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
cat
>
/root/firewall
.sh <<EOF
#!/usr/bin/env bash
modprobe ip_tables
modprobe iptable_filter
modprobe ipt_REJECT
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-
type
8 -m limit --limit 1
/sec
-j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0
/24
--dport 22 -m recent --
set
--name
ssh
--rsource
iptables -A INPUT -p tcp -s 192.168.1.0
/24
--dport 22 -m recent ! --rcheck --seconds 60 --hitcount 10 --name
ssh
--rsource -j ACCEPT
iptables -P INPUT DROP
iptables -A OUTPUT -s 224.0.0.0
/8
-j DROP
iptables -A OUTPUT -d 224.0.0.0
/8
-j DROP
iptables -A OUTPUT -s 255.255.255.255
/32
-j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
/etc/init
.d
/iptables
save
/etc/init
.d
/iptables
restart
EOF
|
启动服务
|
1
2
3
4
5
6
|
chkconfig nginx on
chkconfig php-fpm on
chkconfig mysqld on
/etc/init
.d
/php-fpm
start
/etc/init
.d
/mysqld
start
/etc/init
.d
/nginx
start
|
通过浏览器访问系统IP应该就已经能够看到php信息了。
本文转自 紫色葡萄 51CTO博客，原文链接：http://blog.51cto.com/purplegrape/936692，如需转载请自行联系原作者
