因是 FreeBSD 新手, 若有不足或錯誤之處煩請補上, 多多指教謝謝!
1. CPU: Celeron 2.8 MHz, RAM: 4G DDR3, HD: SATA2 500 G, MB: Gigabyte, 網卡PCIE: re0 對內, re1 對外.
2. FreeBSD 10.2 - 4G 隨身碟啟動, 以 ZFS 資料結構的整顆硬碟 (2g 的 swap), 選 re1 網卡以 DHCP 連線啟動.
3. 選 lib32, ports, src 三項, 輸入 root 密碼, 新增一名使用者及密碼 (wheel).
4. 約 10 分安裝完成, 重啟動以 root 登入, # df -f 看到整顆硬碟用量 (與 UFS 不同, 不用重整磁區及 UPS, 停電也不怕!)
5. /boot.loaderconf 加入四行 zfs 相關 資料 :
vm.kmem.size="330M"
vm.kmem.size_amx="330M"
vfs.zfs.arc_max="40M"
vfs.zfs.vdev.cache_size="5M"
6. /etc/ppp/ppp.conf, 內容:
# /etc/ppp/ppp.conf
default:
set log Phase tun command
enable dns
hinet:
set device PPPoE:re1
set authname 7200xxxx@ip.hinet.net
set authkey xxxxxxxxxx
set dial
set login
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
add default HISADDR
7. /etc/rc.conf, 內容:
# /etc/rc.conf
# dmesg: /var/run/dmesg.boot
#
#linux_enable="YES"
sshd_enable="YES"
gateway_enable="YES"
zfs_enable="YES"
dumpdev="NONE"
# --INETD Settings--
inetd_enable="NO"
#inetd_flags="-1 -R 1024"
# --NIC Settings--
ifconfig_re1="inet 114.35.147.146 netmask 0xffffff00"
ifconfig_re0="inet 192.168.0.100 netmask 0xffffff00"
default_router="192.168.1.1"
hostname="alexk.full.com"
# --NATD Settings--
natd_enable="YES"
natd_interface="re0"
natd_flags="-f /etc/natd.conf"
# --DNS Settings--
named_enable="NO"
#named_flags="-c /etc/namedb/named.conf"
#named_program="/usr/local/sbin/named"
# --VPN Setting--
mpd_enable="NO"
#mpd_flags="-b"
# --DHCP Settings--
#dhcpd_enable="YES"
#dhcpd_ifaces="fxp1"
# --Time Settings--
ntpd_enable="YES"
# --PF Settings--
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
# --IPFW Setting--
#firewall_enable="YES"
#firewall_type="open"
#firewall_script="/etc/ipfw.conf"
#firewall_quiet="NO"
#firewall_logging="YES"
# --PPPoE Settings--
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="hinet"
# --PORTMAP Settings--
portmap_enable="NO"
nfs_server="NO"
nfs_client="NO"
# --MOTD Settings--
update_motd="NO"
# --MailScanner Stop Settings--
sendmail_enable="NONE"
#sendmail_submit_enable="NO"
#sendmail_outbound_enable="NO"
#sendmail_msp_queue_enable="NO"
#clamav_clamd_enable="YES"
#clamav_msp_queue_enable="NO"
# --SYSLOG Settings--
syslogd_enable="YES"
syslogd_flag="-ss"
# --ICMP Settings--
icmp_drop_redirect="YES"
icmp_log_redirect="YES"
# --SHARE Settings--
clear_tmp_enable="YES"
tcp_drop_synfin="YES"
log_in_vain="YES"
accounting_enable="YES"
# --KERNEL Settings: syscl -w kern.securelevel=2--
kern_securelevel_enable="YES"
kern_securelevel="-1"
# --NGINX Settings--
# --MYSQL Settings--
sh /etc/rc 重啟動 rc.conf
8. /etc/pf.conf, 內容:
# /etc/pf.conf Add by AlexK 2015-12-03
# --macros--
#int_if="re0"
ext_if="re1"
loop="lo0"
ports="{20,21,22,25,53,80,110}"
icmp_types="echoreq"
noroute="{127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.225.255/32}"
web="{127.0.0.1}"
comp1="192.168.0.100"
# --normalization--
scrub in all
# --filtering--
# pass loopback
pass in qucik on $loop all
pass out quick on $loop all
# block the ftp ssh bruteforce bastards
block drop in quick on $ext_if from <ssh-bruteforce>
# pass ping
pass in quick on $ext_if proto icmp all
# special rule for FTP / SSh
pass in quick on $ext_if proto tcp from any to ($ext_if) port { ftp ssh } flags\
S/SA keep state (max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)
# block the ssh burteforce bastards
block drop in quick on $ext_if from <ssh-bruteforce>
# pass FTP
pass in quick on $ext_if proto tcp from any to $ext_if port > 49151 keep state
# pass in service DNS HTTP
pass in quick on $ext_if proto { tcp, udp } from any to $ext_if port $ports keep state
# pass localhost to any
pass out quick on $ext_if all keep state
# block another all
block return-rst in quick on $ext_if proto tcp all
block return-icmp(net-unr) in quick on $ext_if proto udp all
block in quick on $ext_if all
9. # ee /etc/make.conf, 內容: 略
# portsnap fetch
# portsnap extract (第二次 # portsnap fetch update)
# cd /usr/ports/ftp/axel, # make -DBATCH install clean, # rehash
# cd /usr/ports/ports-mgmt/jailaudit, # make -DBATCH install clean, # rehash
10. # mkdir /root/kernels
# cd /usr/src/sys/amd64/conf
# cp GENERIC /root/kernels/KERN_FW
# ln -s /root/kernels/KERN_FW
# ee /root/kernels/KERN_FW, 內容:#
# GENERIC -- Generic kernel configuration file for FreeBSD/amd64
#
# For more information on this file, please read the config(5) manual page,
# and/or the handbook section on Kernel Configuration Files:
#
# http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-config.html
#
# The handbook is also available locally in /usr/share/doc/handbook
# if you've installed the doc distribution, otherwise always see the
# FreeBSD World Wide Web server (http://www.FreeBSD.org/) for the
# latest information.
#
# An exhaustive list of options and more detailed explanations of the
# device lines is also present in the ../../conf/NOTES and NOTES files.
# If you are in doubt as to the purpose or necessity of a line, check first
# in NOTES.
#
# $FreeBSD: releng/10.2/sys/amd64/conf/GENERIC 286135 2015-07-31 16:44:57Z gjb $
# /root/kernels/KERN_FW
cpu HAMMER
ident KERN_FW
makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
makeoptions WITH_CTF=1 # Run ctfconvert(1) for DTrace support
options SCHED_ULE # ULE scheduler
…..
options RACCT_DEFAULT_TO_DISABLED # Set kern.racct.enable=0 by default
options RCTL # Resource limits
# PF-Firewall
device pf
device pflog
device pfsync
# IPFW-Firewall
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT
options DUMMYNET //use pipe to limit brand限制連線頻寬用
# Debugging support. Always need this:
options KDB # Enable kernel debugger support.
options KDB_TRACE # Print a stack trace for a panic.
# Make an SMP-capable kernel by default
options SMP # Symmetric MultiProcessor Kernel
# CPU frequency control
device cpufreq
# Bus support.
device acpi
options ACPI_DMAR
device pci
# Floppy drives
device fdc
# ATA controllers
device ahci # AHCI-compatible SATA controllers
device ata # Legacy ATA/SATA controllers
options ATA_STATIC_ID # Static device numbering
device mvs # Marvell 88SX50XX/88SX60XX/88SX70XX/SoC SATA
device siis # SiliconImage SiI3124/SiI3132/SiI3531 SATA
…..
# VMware support
device vmx # VMware VMXNET3 Ethernet
# cd /usr/src
# make builderkernel KERNCONF=KERN_FW (約 25 分)
# make installkernel KERNCONF=KERN_FW (約 2 分)
# shutdown -r now (重新啟動)
----- 後續 -----
我的 FreeBSD 10.2 ZFS 架 WEB 網站手扎 (alexk1107@gmail.com)
因是 FreeBSD 新手, 若有不足或錯誤之處煩請補上, 多多指教謝謝!
1. CPU: Celeron 2.7 GHz, RAM: 4G DDR3, HD: SATA2 500 G, MB: Gigabyte, 網卡PCIE: re0 對內, re1 對外.
2. FreeBSD 10.2 - 4G 隨身碟啟動, 以 ZFS 資料結構的整顆硬碟 (2g 的 swap), 選 re1 網卡以 DHCP 連線啟動.
3. 選 lib32, ports, src 三項, 輸入 root 密碼, 新增一名使用者及密碼 (wheel, tcsh).
4. 約 10 分安裝完成, 重啟動以 root 登入, # df -f 看到整顆硬碟用量 (與 UFS 不同, 不用重整磁區及 UPS, 停電也不怕!)
4.1 設定開機進入 single mode 時, 需要輸入 密碼, 在 console none unknow off secure 改為 insecure
4.2 login: 禁止以 root 登入, 修改 /etc/ttys 檔案, 將 ttyv0 ~ ttyv8 中的 secure 改為 insecure
4.3 更新 FreeBSD, # freebsd-update fetch 及 # freebsd-update install 後重新啟動 # shutdown -r now
以 user 登入後 # su -取得 root最高權限.
編輯 /etc/resolv.conf, 內容:
nameserver 127.0.0.1
nameserver 168.95.192.1
nameserver 168.95.1.1
domain full.com
5. 編輯 /boot/loader.conf 加入四行 zfs 相關 資料 :
vm.kmem.size="330M"
vm.kmem.size_amx="330M"
vfs.zfs.arc_max="40M"
vfs.zfs.vdev.cache_size="5M"
(或插隨身碟 # mkdir /mnt/usb, # mount_msdosfs /dev/da0s1 /mnt/usb, # cp /mnt/usb/loader.conf /boot/.)
6. 編輯 /etc/ppp/ppp.conf, 內容 (# cp /mnt/usb/ppp.conf /etc/ppp/.):
# /etc/ppp/ppp.conf
default:
set log Phase tun command
enable dns
hinet:
set device PPPoE:re1
set authname 7200xxxx@ip.hinet.net
set authkey xxxxxxxxxx
set dial
set login
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
add default HISADDR
7. /etc/rc.conf, 內容 (# cp /mnt/usb/rc.conf /etc/.):
# /etc/rc.conf
# dmesg: /var/run/dmesg.boot
#
#linux_enable="YES"
sshd_enable="NO" # service sshd onestatus 查看遠端管理是否開啟
gateway_enable="YES"
zfs_enable="YES"
dumpdev="NONE"
# --INETD Settings--
inetd_enable="NO"
#inetd_flags="-1 -R 1024"
# --NIC Settings--
ifconfig_re1="inet 114.35.147.146 netmask 0xffffff00"
ifconfig_re0="inet 192.168.0.100 netmask 0xffffff00"
default_router="192.168.1.1"
hostname="alexk.full.com"
# --NATD Settings--
natd_enable="YES"
natd_interface="re0"
natd_flags="-f /etc/natd.conf"
# --DNS Settings--
named_enable="NO"
#named_flags="-c /etc/namedb/named.conf"
#named_program="/usr/local/sbin/named"
# --VPN Setting--
#mpd_enable="NO"
#mpd_flags="-b"
# --DHCP Settings--
#dhcpd_enable="YES"
#dhcpd_ifaces="fxp1"
# --Time Settings--
ntpd_enable="YES"
# --PF Settings--
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
# --IPFW Setting--
firewall_enable="NO"
#firewall_type="open"
#firewall_script="/etc/ipfw.conf"
#firewall_quiet="NO"
#firewall_logging="YES"
# --PPPoE Settings--
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="hinet"
# --PORTMAP Settings--
nfs_server="NO"
nfs_client="NO"
portmap_enable="NO"
# --MOTD Settings--
update_motd="NO"
# --MailScanner Stop Settings--
sendmail_enable="NONE"
#sendmail_submit_enable="NO"
#sendmail_outbound_enable="NO"
#sendmail_msp_queue_enable="NO"
#clamav_clamd_enable="YES"
#clamav_msp_queue_enable="NO"
# --SYSLOG Settings--
syslogd_enable="YES"
syslogd_flag="-ss"
# --ICMP Settings--
tcp_drop_synfin="YES"
icmp_drop_redirect="YES"
icmp_log_redirect="YES"
# --PUBLIC Settings--
log_in_vain="YES"
accounting_enable="YES"
clear_tmp_enable="YES"
# --KERNEL Settings: syscl -w kern.securelevel=2
kern_securelevel_enable="YES"
kern_securelevel="-1"
# --WEB Settings--
# nginx_enable="YES"
# php_fpm_enable="YES"
# mysql_enable="YES"
# --The END--
sh /etc/rc 重啟動 rc.conf
8. # mkdir /root/kernels
# cd /usr/src/sys/amd64/conf
# cp GENERIC /root/kernels/KERN_FW
# ln -s /root/kernels/KERN_FW
# ee /root/kernels/KERN_FW, 內容:#
# GENERIC -- Generic kernel configuration file for FreeBSD/amd64
#
# For more information on this file, please read the config(5) manual page,
# and/or the handbook section on Kernel Configuration Files:
# .....
# in NOTES.
#
# $FreeBSD: releng/10.2/sys/amd64/conf/GENERIC 286135 2015-07-31 16:44:57Z gjb $
# /root/kernels/KERN_FW
cpu HAMMER
ident KERN_FW
makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
makeoptions WITH_CTF=1 # Run ctfconvert(1) for DTrace support
options SCHED_ULE # ULE scheduler
…..
options RACCT_DEFAULT_TO_DISABLED # Set kern.racct.enable=0 by default
options RCTL # Resource limits
# PF-Firewall
device pf
device pflog
device pfsync
options ALTQ
options ALTQ_CBQ
# IPFW-Firewall
options IPFIREWALL
options IPFIREWALL_VERBOSE
#options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT
options DUMMYNET //use pipe to limit brand限制連線頻寬用
# Debugging support. Always need this:
options KDB # Enable kernel debugger support.
options KDB_TRACE # Print a stack trace for a panic.
# Make an SMP-capable kernel by default
options SMP # Symmetric MultiProcessor Kernel
# CPU frequency control
device cpufreq
# Bus support.
device acpi
options ACPI_DMAR
device pci
# Floppy drives
device fdc
# ATA controllers
device ahci # AHCI-compatible SATA controllers
device ata # Legacy ATA/SATA controllers
options ATA_STATIC_ID # Static device numbering
device mvs # Marvell 88SX50XX/88SX60XX/88SX70XX/SoC SATA
device siis # SiliconImage SiI3124/SiI3132/SiI3531 SATA
…..
# VMware support
device vmx # VMware VMXNET3 Ethernet
# cd /usr/src
# make builderkernel KERNCONF=KERN_FW (約 25 分)
# make installkernel KERNCONF=KERN_FW (約 2 分)
# shutdown -r now (重新啟動)
# 重新啟動後 uname -rs, 看到了freebsd 10.2-RELEASE-p8 (10.2 版本已補上 P8 了)
9. /etc/pf.conf, 內容:
# In this PF, re1 is connected to the Internet and re0 is connected to the internal interface.
# /etc/pf.conf
# 1.Macro:
ext_if="re1" # macro for external interface - use tun0 for PPPoE
int_if="re0" # macro for internal interface
#tcp_services="{ssh, smtp, domain, www, pop3, auth, pop3s}"
tcp_services="{22 113}"
udp_services="{domain ntp}"
private_addrs="{127.0.0.0/8, 192.168.0.0/16,172.16.0.0/12, 10.0.0.0/8}"
icmp_types="echoreq"
loop="lo0"
web="{127.0.0.1}"
comp3="192.168.0.3"
# 2.Tables:
table <ssh-bruteforce> persist
# 3.Optios:
set skip on $loop
set block-policy return
# 4.Traffic Normalization:
scrub in all
# 5.Queueing:
# 6.Translation:
# 7.Packet Filtering:
# --Pass LoopBack--
pass in quick on $loop all
pass out quick on $loop all
# --Block the ftp ssh bruteforce bastards
block drop in quick on $ext_if from <ssh-bruteforce>
# --Pass Ping--
pass in quick on $ext_if proto icmp all
# --Special rule for FTP/SSH--
pass in quick on $ext_if proto tcp from any to ($ext_if) port { ftp ssh } flags S/SA keep state (max-src-conn-rate 3/30 overload <ssh-bruteforce> flush global)
# --Pass FTP--
pass in quick on $ext_if proto tcp from any to $ext_if port > 49151 keep state
# --Pass in Service DNS HTTP--
pass in quick on $ext_if proto { tcp,udp } from any to $ext_if port $tcp_services keep state
# --Pass Localhost to any--
#pass out quick on $ext_if all keep state
# --Block Internet Private Address to Me--
block in quick on $ext_if from private_addrs to any
# --Block Another all--
block return-rst in quick on $ext_if proto tcp all
block return-icmp(net-unr) in quick on $ext_if proto udp all
block in quick on $ext_if all
# --The End--
# pfctl -e;pfctl -f /etc/pf.conf 啟動 PF, # pfctl -d 停止; 編譯核心要停止 PF 且刪檔, # service pf start, # service pflog start
# /etc/rc.d/pf start | stop | restart | reload
10. # ee /etc/make.conf, 內容: (略)
# portsnap fetch
# portsnap extract (第二次 # portsnap fetch update)
# cd /usr/ports/ftp/axel, # make -DBATCH install clean, # rehash
# cd /usr/ports/ports-mgmt/jailaudit, # make -DBATCH install clean, # rehash
搜索網路補上 FreeBSD 一些安全設定, ..…
http://article.denniswave.com/5174
http://tw.dragonsoft.com/doc/bsd-sec-1.php
http://www.jquerycn.cn/a_8205
請經常查閱系統日誌檔, /var/log/messages, security, auth.log, maillog, pflog, ipfw.log, …..
# last | more 是否有異常登入情形
Nginx + PHP + PHP-FPM + MySQL + eAccelerator + Memcached
Nginx 安裝配置:
# cd /usr/ports/www/nginx
# make install clean
***Option for Nginx: (選七個)
1. IPv6, 2. HTTP, 3. HTTP_CHCHE, 4. HTTP_REWRITE, 5. HTTP_SSL, 6. HTTP_STATUS, 7. WWW
其餘取預設值,..…, 至安裝完成, 相關資料如下:
Nginx 設置檔案: /usr/local/etc/nginx/nginx.conf
Nginx 執行檔案: /usr/local/sbin/nginx
Nginx 網站首頁: /usr/local/www/nginx/index.html
# cat >> /etc/rc.conf <<EOF nginx_enable="YES" EOF, 在 /etc/rc.conf 檔案中加入 nginx_enable="YES".
啟動 Nginx, 並查看啟動情形:
# cd /usr/local/sbin
# service nginx start
# ps -aux | grep nginx
正常啟動 Nginx, 在瀏覽器 URL 輸入: 114.35.127.146/index.html, 即可立見 Welcome to Nginx! 歡迎畫面.
請參考: http://www.ahlinux.com/nginx/4929.html
Howto Install and Configure FEMP Stack (FreeBSD 10.2, Nginx, MariaDB, PHP)
http://linoxide.com/linux-how-to/install-configure-femp-stack/
How To Install an Nginx, MySQL, and PHP (FEMP) Stack on FreeBSD 10.1
https://www.digitalocean.com/community/tutorials/how-to-install-an-nginx-mysql-and-php-femp-stack-on-freebsd-10-1
PHP - php-fpm - mysql安裝配置:
# cd /usr/ports/lang/php56
# make install clean; rehash
全部取預設值直至安裝完成.
# cd /usr/ports/lang/php56-extensions
# make install clean; rehash
***Option: (選五個)
1. FTP, 2. IMAP, 3. MYSQL, 4. PDO_MYSQL, 5. ZLIB
其餘全部取預設值直至安裝完成.
# cd /usr/ports/databases/mysql56-server
# pkg install mysql56-server
安裝完成, 在 /etc/rc.conf 檔案中加入 mysql_enable="YES" 及 php_fpm_enable="YES", 配置相關資料如下:
PHP 設置檔案: /usr/local/etc/*.conf 下,
PHP-FPM 執行檔案: /usr/local/sbin/pfp-fpm
修改 php-fpm.conf 設置檔案:
# ee /usr/local/etc/php-fpm.conf
1. 將 listen = 127.0.0.1:9000 註解加*號, 改為 listen = /var/run/php-fpm.sock
2. 將 3 行的;號去掉, listen.owner = www; listen.group = www; listen.mode = 0660
拷貝及修改 php.ini 初始檔案:
1. # cd /usr/local/etc, # cp php.ini-production php.ini
2. # ee php.ini, 內容修改如下:
cgi.fix_pathinfo=1, 將 1 → 0 後儲存離開.
# service php-fpm start, 啟動 php-fpm 看到 Starting php-fpm,
# service mysql-server start, 啟動 mysql-server 看到 Starting mysql
# mysql_secure_installation
Set root password? y , 輸入密碼再確認後再 y, y, y, y 即可見到 Thanks for using MySQL!
# service mysql-server restart, 可看到 Stopping mysql. 及 Starting mysql. , # ps -aux | grep mysql
# service nginx start, 可見到 Starting nginx. , # ps -aux | grep nginx
# sysctl hw.ncpu, 可見到 hw.ncpu: 8
# ee /usr/local/etc/nginx/nginx.conf
# user nobady; 改為 user www;
worker_prosesses 8;
在 server { 下找到 servername x.x.x.x, 改為 servername 114.25.147.146, 再看一下 server 及 php 設置的相關資訊, 儲存離開.
# nginx -t, 做一下 nginx.conf 修改過後的測試, nginx.conf test is successful
# /usr/local/etc/nginx/ #>ls /var/www, 若為空則 # mkdir /var/www, # cd /var/www, # ee phpinfo.php, 內容如下:
<?php phpinfo(); ?> (儲存離開), # ls -alh .
# chown -R www:www .
# ls -alh
# service nginx restart, 可見到 nginx.conf test is successful
# ls -al, 可看到兩個檔案 index.html 及 phpinfo.php, ps -aux | grep nginx
# cd ..
/var # mkdir -p /var/www
/var # chown -R www:www www/
/var # cd www/
/var/www # ls, 可看到兩個檔案 index.html 及 phpinfo.php
/var/www # ls -alh
/var/www # cat phpinfo.php, 內容: <? php phpinfo(); ?>
/var/www # cat index.html, 內容: <h1> Hi, Welcome to www.full123.com </h1>
開啟瀏覽器 URL 輸入: 114.35.147.146/phpinfo.php, 可看到 PHP 畫面, 若輸入: 114.35.147.146 , 可看到主網頁的首頁Hi, .....的畫面.
請參考: https://www.youtube.com/watch?v=Yb0KaTIVJWo 及 https://www.youtube.com/watch?v=fPIXN_APawI
# cd /usr/ports/databases/mysql56-server
# make WITH_CHARSET=utf8 WITH_XCHARSET=all BUILD_OPTIMIZED=yes Install clean
# 約 40 分鐘完成
Home
SmbFTPD
Forum