코모도 SSL 멀티 도메인을 발급후 ssl.conf 설정

아래와 같이 두개의 도메인이 있다면
a.co.kr
b.co.kr

/usr/local/apach/conf/httpd.conf 구성
NameVirtualHost *:80
<VirtualHost *:80>
ServerAdmin webmaster@a.co.kr
DocumentRoot /home/a/public_html
ServerName a.co.kr
ServerAlias www.a.co.kr
ErrorLog logs/a.co.kr-error_log
CustomLog logs/a.co.kr-access_log common
</VirtualHost>

<VirtualHost *:80>
ServerAdmin webmaster@b.co.kr
DocumentRoot /home/b/public_html
ServerName b.co.kr
ServerAlias www.b.co.kr
ErrorLog logs/b.co.kr-error_log
CustomLog logs/b.co.kr-access_log common
</VirtualHost>


/usr/local/apache/conf/ssl.conf의 내용
NameVirtualHost *:443
<VirtualHost *:443>
DocumentRoot "/home/a/public_html/"
ServerName a.co.kr
ServerAlias www.a.co.kr
ServerAdmin webmaster@a.co.kr
ErrorLog /usr/local/apache/logs/a.co.kr-error_log
TransferLog /usr/local/apache/logs/a.co.kr-access_log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile 인증서 위치와 인증서 파일.crt
SSLCertificateKeyFile 비밀키 위치와 비밀키 파일.key
SSLCACertificateFile 루트인증서 위치와 파일.crt
SSLOptions +StdEnvVars
SSLOptions +StdEnvVars
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog /usr/local/apache/logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/home/b/public_html/"
ServerName b.co.kr
ServerAlias www.b.co.kr
ServerAdmin webmaster@b.co.kr
ErrorLog /usr/local/apache/logs/b.co.kr-error_log
TransferLog /usr/local/apache/logs/b.co.kr-access_log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile 인증서 위치와 인증서 파일.crt
SSLCertificateKeyFile 비밀키 위치와 비밀키 파일.key
SSLCACertificateFile 루트인증서 위치와 파일.crt
SSLOptions +StdEnvVars
SSLOptions +StdEnvVars
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog /usr/local/apache/logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

설정 변경후 아파치 재시작
[root@localhost~]# /etc/rc.d/init.d/apachectl stop
[root@localhost~]# /etc/rc.d/init.d/apachectl startssl

인증서 암호 입력후 아파치가 SSL 모드로 시작되었는지 확인 확인

[root@localhost~]# ps -ef | grep httpd
root     15239     1  0 Jul15 ?        00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
Posted by 암리타 :

rsync ssh를 이용한 서버 백업

원본서버 : original server
백업 서버 : backup server

기본 원리
ssh 방식으로 접속하기 위해서 백업 서버에서 키를 생성하고 생성된 키를 원본 서버에 복사를 한 다음 rsync를 ssh 방식으로 접속하여 백업을 받는 방법이다.

*주의 : 원본서버에서 키를 생성하는게 아니라 백업서버에서 키를 생성해야 한다.

백업 서버에서 일반계정이나 root로 로그인 후 키를 저장할 디렉토리를 생성한다.

[root@#backup server]# mkdir .ssh
[root@#backup server]# chmod 700 .ssh

백업 서버에서 디렉토리 생성후 키를 생성한다.

[root@#backup server]# ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

원본 서버에서 일반계정으로 로그인하여 백업서버에서 생성한 키를 저장하기 위해 디렉토리를 생성한다.

[xxxx@#original server]# mkdir .ssh
[xxxx@#original server]# chmod 700 .ssh

다시 백업서버로 이동해서 백업서버에서 생성한 키를 원본 서버에 저장한다.

[root@#backup server]# scp -p /root/.ssh/id_dsa.pub 원본서버의 계정명@원본서버의 IP:/home/원본서버계정명/.ssh/authorized_key2
xxxx@xxx.xxx.xxx.xxx password: 계정암호 입력

이제 준비는 끝났고 백업 서버에서 rsync를 ssh로 연결하여 백업하면 끝.

[root@#backup server]# rsync -avz --delete --rsh="ssh -i /root/.ssh/id_dsa -l 원본서버계정명" 원본서버IP:원본서버의경로 백업서버의 경로
xxxx@xxx.xxx.xxx.xxx password: 원본 서버 계정 암호 입력



rsync 설명
rsync  version 2.6.8  protocol version 29
Copyright (C) 1996-2006 by Andrew Tridgell, Wayne Davison, and others.
<http://rsync.samba.org/>
Capabilities: 64-bit files, socketpairs, hard links, ACLs, xattrs, symlinks, batchfiles,
              inplace, IPv6, 64-bit system inums, 64-bit internal inums
rsync comes with ABSOLUTELY NO WARRANTY.  This is free software, and you
are welcome to redistribute it under certain conditions.  See the GNU
General Public Licence for details.

rsync is a file transfer program capable of efficient remote update
via a fast differencing algorithm.

Usage: rsync [OPTION]... SRC [SRC]... DEST
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST:DEST
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST::DEST
  or   rsync [OPTION]... SRC [SRC]... rsync://[USER@]HOST[:PORT]/DEST
  or   rsync [OPTION]... [USER@]HOST:SRC [DEST]
  or   rsync [OPTION]... [USER@]HOST::SRC [DEST]
  or   rsync [OPTION]... rsync://[USER@]HOST[:PORT]/SRC [DEST]
The ':' usages connect via remote shell, while '::' & 'rsync://' usages connect
to an rsync daemon, and require SRC or DEST to start with a module name.

Options
 -v, --verbose               increase verbosity
 -q, --quiet                 suppress non-error messages
 -c, --checksum              skip based on checksum, not mod-time & size
 -a, --archive               archive mode; same as -rlptgoD (no -H)
     --no-OPTION             turn off an implied OPTION (e.g. --no-D)
 -r, --recursive             recurse into directories
 -R, --relative              use relative path names
     --no-implied-dirs       don't send implied dirs with --relative
 -b, --backup                make backups (see --suffix & --backup-dir)
     --backup-dir=DIR        make backups into hierarchy based in DIR
     --suffix=SUFFIX         set backup suffix (default ~ w/o --backup-dir)
 -u, --update                skip files that are newer on the receiver
     --inplace               update destination files in-place (SEE MAN PAGE)
     --append                append data onto shorter files
 -d, --dirs                  transfer directories without recursing
 -l, --links                 copy symlinks as symlinks
 -L, --copy-links            transform symlink into referent file/dir
     --copy-unsafe-links     only "unsafe" symlinks are transformed
     --safe-links            ignore symlinks that point outside the source tree
 -k, --copy-dirlinks         transform symlink to a dir into referent dir
 -K, --keep-dirlinks         treat symlinked dir on receiver as dir
 -H, --hard-links            preserve hard links
 -p, --perms                 preserve permissions
 -E, --executability         preserve the file's executability
 -A, --acls                  preserve ACLs (implies --perms)
 -X, --xattrs                preserve extended attributes (implies --perms)
     --chmod=CHMOD           change destination permissions
 -o, --owner                 preserve owner (super-user only)
 -g, --group                 preserve group
     --devices               preserve device files (super-user only)
     --specials              preserve special files
 -D                          same as --devices --specials
 -t, --times                 preserve times
 -O, --omit-dir-times        omit directories when preserving times
     --super                 receiver attempts super-user activities
 -S, --sparse                handle sparse files efficiently
 -n, --dry-run               show what would have been transferred
 -W, --whole-file            copy files whole (without rsync algorithm)
 -x, --one-file-system       don't cross filesystem boundaries
 -B, --block-size=SIZE       force a fixed checksum block-size
 -e, --rsh=COMMAND           specify the remote shell to use
     --rsync-path=PROGRAM    specify the rsync to run on the remote machine
     --existing              ignore non-existing files on receiving side
     --ignore-existing       ignore files that already exist on receiving side
     --remove-sent-files     sent files/symlinks are removed from sending side
     --del                   an alias for --delete-during
     --delete                delete files that don't exist on the sending side
     --delete-before         receiver deletes before transfer (default)
     --delete-during         receiver deletes during transfer, not before
     --delete-after          receiver deletes after transfer, not before
     --delete-excluded       also delete excluded files on the receiving side
     --ignore-errors         delete even if there are I/O errors
     --force                 force deletion of directories even if not empty
     --max-delete=NUM        don't delete more than NUM files
     --max-size=SIZE         don't transfer any file larger than SIZE
     --min-size=SIZE         don't transfer any file smaller than SIZE
     --partial               keep partially transferred files
     --partial-dir=DIR       put a partially transferred file into DIR
     --delay-updates         put all updated files into place at transfer's end
 -m, --prune-empty-dirs      prune empty directory chains from the file-list
     --numeric-ids           don't map uid/gid values by user/group name
     --timeout=TIME          set I/O timeout in seconds
 -I, --ignore-times          don't skip files that match in size and mod-time
     --size-only             skip files that match in size
     --modify-window=NUM     compare mod-times with reduced accuracy
 -T, --temp-dir=DIR          create temporary files in directory DIR
 -y, --fuzzy                 find similar file for basis if no dest file
     --compare-dest=DIR      also compare destination files relative to DIR
     --copy-dest=DIR         ... and include copies of unchanged files
     --link-dest=DIR         hardlink to files in DIR when unchanged
 -z, --compress              compress file data during the transfer
     --compress-level=NUM    explicitly set compression level
 -C, --cvs-exclude           auto-ignore files the same way CVS does
 -f, --filter=RULE           add a file-filtering RULE
 -F                          same as --filter='dir-merge /.rsync-filter'
                             repeated: --filter='- .rsync-filter'
     --exclude=PATTERN       exclude files matching PATTERN
     --exclude-from=FILE     read exclude patterns from FILE
     --include=PATTERN       don't exclude files matching PATTERN
     --include-from=FILE     read include patterns from FILE
     --files-from=FILE       read list of source-file names from FILE
 -0, --from0                 all *-from/filter files are delimited by 0s
     --address=ADDRESS       bind address for outgoing socket to daemon
     --port=PORT             specify double-colon alternate port number
     --sockopts=OPTIONS      specify custom TCP options
     --blocking-io           use blocking I/O for the remote shell
     --stats                 give some file-transfer stats
 -8, --8-bit-output          leave high-bit chars unescaped in output
 -h, --human-readable        output numbers in a human-readable format
     --progress              show progress during transfer
 -P                          same as --partial --progress
 -i, --itemize-changes       output a change-summary for all updates
     --log-format=FORMAT     output filenames using the specified format
     --password-file=FILE    read password from FILE
     --list-only             list the files instead of copying them
     --bwlimit=KBPS          limit I/O bandwidth; KBytes per second
     --write-batch=FILE      write a batched update to FILE
     --only-write-batch=FILE like --write-batch but w/o updating destination
     --read-batch=FILE       read a batched update from FILE
     --protocol=NUM          force an older protocol version to be used
 -4, --ipv4                  prefer IPv4
 -6, --ipv6                  prefer IPv6
     --version               print version number
(-h) --help                  show this help (-h works with no other options)

Use "rsync --daemon --help" to see the daemon-mode command-line options.
Please see the rsync(1) and rsyncd.conf(5) man pages for full documentation.
See http://rsync.samba.org/ for updates, bug reports, and answers

Posted by 암리타 :

텔넷 접속에서 한글이 깨져 보일 경우가 있다.
리눅스에서 한글이 깨질 경우가 있다면 아래와 같이 하면 된다.

아래와 같이 ls -al 을 해 보았을때 합계 부분이 깨져 보인다면

[root@localhost~]# ls -al
?⑷퀎 9792
drwxr-x---  4 root root  4096  6월 28 16:47 .
------------- 이하 생략 ----------

/etc/profile 파일에
export LANG="ko_KR.eucKR" 를 추가하면 됨.

[root@localhost ~]# ls -al
합계 156
drwxr-x---  4 root root  4096  6월 28 16:47 .
------------- 이하 생략 ----------


참고로 /etc/profile 은 시스템 로그인후 제일 먼저 적용되는 파일이며, 시스템에 적용되는 $PATH, $USER, $LOGNAME, HOSTNAME, $MAIL, $HISTSIZE, $INPUTRCE 등의 환경변수들을 설정 할수 있다.

재부팅 없이 실시간으로 변경을 할 경우에는 아래와 같이 한다.

shell> export LANG=ko_KR.eucKR


 

Posted by 암리타 :