第八周作业-N67044-张铭扬
1. 完成ftp的mysql虚拟用户
数据库服务器：10.0.0.152
FTP服务器：10.0.0.156
#配置数据库服务器 [root@centos8 ~]# yum -y install mariadb-server [root@centos8 ~]# systemctl enable --now mariadb-service Failed to enable unit: Unit file mariadb-service.service does not exist. [root@centos8 ~]# systemctl enable --now mariadb.service Created symlink /etc/systemd/system/mysql.service → /usr/lib/systemd/system/mariadb.service. Created symlink /etc/systemd/system/mysqld.service → /usr/lib/systemd/system/mariadb.service. Created symlink /etc/systemd/system/multi-user.target.wants/mariadb.service → /usr/lib/systemd/system/mariadb.service. [root@centos8 ~]# mysql MariaDB [(none)]> create database vsftpd; Query OK, 1 row affected (0.000 sec) MariaDB [(none)]> use vsftpd; Database changed MariaDB [vsftpd]> create table users(id int AUTO_INCREMENT NOT NULL PRIMARY KEY,name CHAR(50) BINARY NOT NULL,password CHAR(48) BINARY NOT NULL); Query OK, 0 rows affected (0.004 sec) MariaDB [vsftpd]> insert into users(name,password) values('ftp_zhang',password('123456')); Query OK, 1 row affected (0.012 sec) MariaDB [vsftpd]> insert into users(name,password) values('ftp_linux',password('123456')); Query OK, 1 row affected (0.001 sec) MariaDB [vsftpd]> select * from users; +----+-----------+-------------------------------------------+ | id | name | password | +----+-----------+-------------------------------------------+ | 1 | ftp_zhang | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | | 2 | ftp_linux | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | +----+-----------+-------------------------------------------+ 2 rows in set (0.000 sec)
MariaDB [vsftpd]> grant select on vsftpd.* to vsftpd@'10.0.0.%' identified by '123456';
Query OK, 0 rows affected (0.001 sec)
MariaDB [vsftpd]> flush privileges;
Query OK, 0 rows affected (0.001 sec)
#布置FTP服务器 [root@centos7 ~]# yum -y install vsftpd [root@centos7 ~]# yum -y install gcc gcc-c++ make mariadb-devel pam-devel #下载pam-mysql源码进行编译 [root@centos7 ~]#wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql0.7RC1.tar.gz [root@centos7 ~]# tar xvf pam_mysql-0.7RC1.tar.gz [root@centos7 ~]# cd pam_mysql-0.7RC1 [root@centos7 pam_mysql-0.7RC1]# ./configure --with-pam-mods-dir=/lib64/security [root@centos7 pam_mysql-0.7RC1]# make install [root@centos7 ~]# vim /etc/pam.d/vsftpd.mysql [root@centos7 ~]# cat /etc/pam.d/vsftpd.mysql auth required pam_mysql.so user=vsftpd passwd=123456 host=10.0.0.152 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2 account required pam_mysql.so user=vsftpd passwd=123456 host=10.0.0.152 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2 #建立相应用户和修改vsftpd配置文件 [root@centos7 ~]# useradd -s /sbin/nologin -d /data/ftproot -r vuser [root@centos7 ~]# mkdir -pv /data/ftproot/upload mkdir: created directory ‘/data/ftproot’ mkdir: created directory ‘/data/ftproot/upload’ [root@centos7 ~]# setfacl -m u:vuser:rwx /data/ftproot/upload [root@centos7 ~]# vim /etc/vsftpd/vsftpd.conf #添加以下两行 guest_enable=YES guest_username=vuser #修改 pam_service_name=vsftpd.mysql [root@centos7 ~]# systemctl enable --now vsftpd Created symlink from /etc/systemd/system/multi-user.target.wants/vsftpd.service to /usr/lib/systemd/system/vsftpd.service.
#在客户端登录 [root@centos8 ~]# ftp 10.0.0.156 Connected to 10.0.0.156 (10.0.0.156). 220 (vsFTPd 3.0.2) Name (10.0.0.156:root): ftp_zhang 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> pwd 257 "/" ftp> ls 227 Entering Passive Mode (10,0,0,156,75,17). 150 Here comes the directory listing. drwxrwxr-x 2 0 0 6 Sep 06 15:40 upload 226 Directory send OK. ftp> exit 221 Goodbye. [root@centos8 ~]# ftp 10.0.0.156 Connected to 10.0.0.156 (10.0.0.156). 220 (vsFTPd 3.0.2) Name (10.0.0.156:root): ftp_linux 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> pwd 257 "/"
#在FTP服务器上配置虚拟用户具有不同的访问权限 [root@centos7 ~]# vim /etc/vsftpd/vsftpd.conf user_config_dir=/etc/vsftpd/conf.d/ [root@centos7 ~]# mkdir /etc/vsftpd/conf.d/ [root@centos7 ~]# vim /etc/vsftpd/conf.d/ftp_zhang [root@centos7 ~]# cat /etc/vsftpd/conf.d/ftp_zhang non_upload_enable=YES anon_mkdir_write_enable=YES anon_other_write_enable=YES local_root=/data/ftproot1 [root@centos7 ~]# #mkdir -pv /data/ftproot/upload [root@centos7 ~]# mkdir -pv /data/ftproot1/upload mkdir: created directory ‘/data/ftproot1’ mkdir: created directory ‘/data/ftproot1/upload’ [root@centos7 ~]# chown vuser.vuser /data/ftproot1/upload/ [root@centos7 ~]# ll -d /data/ftproot1/upload/ drwxr-xr-x 2 vuser vuser 6 Sep 7 00:17 /data/ftproot1/upload/ [root@centos7 ~]# systemctl restart vsftpd
2. 完成rsyslog远程日志收集，及采集mysql日志。
rsyslog服务器：10.0.0.152
mariadb服务器：10.0.0.153
[root@rsyslog ~]# yum -y install rsyslog-mysql [root@rsyslog ~]# scp /usr/share/doc/rsyslog/mysql-createDB.sql 10.0.0.153:/data The authenticity of host '10.0.0.153 (10.0.0.153)' can't be established. ECDSA key fingerprint is SHA256:1ncw1W9JSRN6C3N37UgzhsUcubjSL2BG/AihY10VQ1k. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.0.0.153' (ECDSA) to the list of known hosts. root@10.0.0.153's password: mysql-createDB.sql [root@rsyslog ~]# vim /etc/rsyslog.conf ####MODULES#### module(load="ommysql") ####RULES#### #facility.priority :ommysql:DBHOST,DBNAME,DBUSER, PASSWORD *.info :ommysql:10.0.0.18,Syslog,rsyslog,magedu [root@rsyslog ~]# systemctl restart rsyslog.service
[root@mariadb ~]# yum -y install mariadb-server [root@mariadb ~]# systemctl start mariadb [root@mariadb data]# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 9 Server version: 10.3.28-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> source /data/mysql-createDB.sql Query OK, 1 row affected (0.000 sec) Database changed Query OK, 0 rows affected (0.014 sec) Query OK, 0 rows affected (0.003 sec) MariaDB [Syslog]> show databases; +--------------------+ | Database | +--------------------+ | Syslog | | information_schema | | mysql | | performance_schema | +--------------------+ 4 rows in set (0.000 sec) MariaDB [Syslog]> grant all on Syslog.* to rsyslog@'10.0.0.%' identified by '123456'; Query OK, 0 rows affected (0.000 sec)
测试
[root@rsyslog ~]# logger "this is a test log" #mariadb服务器 MariaDB [Syslog]> select * from SystemEvents\G; *************************** 9. row *************************** ID: 9 CustomerID: NULL ReceivedAt: 2022-09-10 13:20:03 DeviceReportedTime: 2022-09-10 13:20:03 Facility: 1 Priority: 5 FromHost: rsyslog Message: this is a test log NTSeverity: NULL Importance: NULL EventSource: NULL EventUser: NULL EventCategory: NULL EventID: NULL EventBinaryData: NULL MaxAvailable: NULL CurrUsage: NULL MinUsage: NULL MaxUsage: NULL InfoUnitID: 1 SysLogTag: root[1334]: EventLogType: NULL GenericFileName: NULL SystemID: NULL 9 rows in set (0.000 sec)
3. 解析ftp主动和被动模式工作原理。
主动模式：户端向服务器的FTP端口发送连接请求，服务器接受连接，建立一条命令链路。当需要传送数据时，客户端在命令链路上用PORT命令告诉服务器：“我打开了XXXX端口，你过来连接我”。于是服务器向客户端的XXXX端口发送连接请求，建立一条数据链路来传送数据。
被动模式：客户端向服务器的FTP端口发送连接请求，服务器接受连接，建立一条命令链路。当需要传送数据时，服务器在命令链路上用PASV命令告诉客户端：“我打开了XXXX端口，你过来连接我”。于是客户端向服务器的XXXX端口发送连接请求，建立一条数据链路来传送数据。
4. 利用sesync, inotify分别实现数据备份
基于rsync daemon 实现 sersync
#备份服务器 [root@backup-server ~]# yum -y install rsync-deamon [root@backup-server ~]# vim /etc/rsyncd.conf uid = root gid = root max connections = 0 ignore errors exclude = lost+found/ log file = /var/log/rsyncd.log pid file = /var/run/rsyncd.pid lock file = /var/run/rsyncd.lock reverse lookup = no [backup] path = /data/backup/ comment = backup dir read only = no auth users = rsyncuser secrets file = /etc/rsync.pas [root@backup-server ~]# mkdir /data/backup/ [root@backup-server ~]# echo "rsyncuser:zhang" > /etc/rsync.pas [root@backup-server ~]# chmod 600 /etc/rsync.pas [root@backup-server ~]# systemctl start rsyncd
#数据服务器 [root@data-server ~]# yum -y install rsync [root@data-server ~]# rsync rsync://10.0.0.153 backup backup dir [root@data-server ~]# rsync rsync://rsyncuser@10.0.0.153/backup Password: drwxr-xr-x 6 2022/09/16 23:37:16 [root@data-server ~]# tar xf sersync2.5.4_64bit_binary_stable_final.tar.gz [root@data-server ~]# ls anaconda-ks.cfg GNU-Linux-x86 reset_centos.sh sersync2.5.4_64bit_binary_stable_final.tar.gz [root@data-server ~]# cd GNU-Linux-x86/ [root@data-server GNU-Linux-x86]# ls confxml.xml sersync2 [root@data-server GNU-Linux-x86]# cd [root@data-server ~]# mv GNU-Linux-x86/ /usr/local/sersync [root@data-server ~]# ln /usr/local/sersync/sersync2 /usr/bin/ [root@data-server sersync]# vim confxml.xml <attrib start="true"/> <sersync> <localpath watch="/data/www"> <remote ip="10.0.0.153" name="backup"/> <auth start="true" users="rsyncuser" passwordfile="/etc/rsync.pas"/>
[root@data-server www]# sersync2 -dro /usr/local/sersync/confxml.xml
set the system param
execute：echo 50000000 > /proc/sys/fs/inotify/max_user_watches
execute：echo 327679 > /proc/sys/fs/inotify/max_queued_events
parse the command param
option: -d run as a daemon
option: -r rsync all the local files to the remote servers before the sersync work
option: -o config xml name： /usr/local/sersync/confxml.xml
daemon thread num: 10
parse xml config file
host ip : localhost host port: 8008
daemon start，sersync run behind the console
use rsync password-file :
user is rsyncuser
passwordfile is /etc/rsync.pas
config xml parse success
please set /etc/rsyncd.conf max connections=0 Manually
sersync working thread 12 = 1(primary thread) + 1(fail retry thread) + 10(daemon sub threads)
Max threads numbers is: 22 = 12(Thread pool nums) + 10(Sub threads)
please according your cpu ，use -n param to adjust the cpu rate
------------------------------------------
rsync the directory recursivly to the remote servers once
working please wait...
execute command: cd /data/www && rsync -artuz -R --delete ./ rsyncuser@10.0.0.153::backup --password-file=/etc/rsync.pas >/dev/null 2>&1
run the sersync:
watch path is: /data/www
数据服务器：10.0.0.152
备份服务器：10.0.0.153
#备份服务器 [root@centos8 ~]# yum -y install rsync [root@centos8 ~]# touch /etc/rsyncd.conf [root@centos8 ~]# rsync --daemon [root@centos8 ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 5 0.0.0.0:873 0.0.0.0:* LISTEN 0 128 0.0.0.0:111 0.0.0.0:* LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 5 [::]:873 [::]:* LISTEN 0 128 [::]:111 [::]:* LISTEN 0 128 [::]:22 [::]:* [root@centos8 ~]# vim /etc/rsyncd.conf [root@centos8 ~]# mkdir /data/backup [root@centos8 ~]# cat /etc/rsyncd.conf [backup] path = /data/backup/ read only = no [root@centos8 ~]# rsync --daemon #数据服务器 [root@centos8 ~]# yum -y install rsync [root@centos8 ~]# rsync rsync://10.0.0.153 backup
#备份服务器 [root@centos8 ~]# setfacl -m u:nobody:rwx /data/backup/ #数据服务器 [root@centos8 ~]# rsync /etc/networks root@10.0.0.153::backup #备份服务器 [root@centos8 ~]# ll /data/backup/ total 4 -rw-r--r--. 1 nobody nobody 58 Sep 12 23:17 networks
[root@data-server etc]# vim inotify_rsync.sh [root@data-server etc]# cat inotify_rsync.sh #!/bin/bash SRC='/data/www' DEST='rsyncuser@10.0.0.153::backup' inotifywait -mrp --exclude=".*\.swp" --timefmt '%Y-%m-%d %H:%M:%S' --format '%T %W %F' -e create,delete,moved_to,close_write,attrib ${SRC} | while read DATE TIME DIR FILE ; do FILEPATH=${DIR}${FILE} rsync -az -delete --password-file==/etc/rsync.pas $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log done [root@data-server etc]# bash inotify_rsync.sh [root@backup-server backup]# watch -n0.5 ls -l /data/backup/
5. 解析LVS调度算法及几种工作模式原理，实现LVS+DR高可用nginx。
LVS集群的工作模式
lvs-nat：修改请求报文的目标IP,多目标IP的DNAT
lvs-dr：操纵封装新的MAC地址
lvs-tun：在原请求IP报文之外新加一个IP首部
lvs-fullnat：修改请求报文的源和目标IP
LVS的NAT模式
lvs-nat：本质是多目标IP的DNAT，通过将请求报文中的目标地址和目标端口修改为某挑出的RS的RIP和 PORT实现转发
（1）RIP和DIP应在同一个IP网络，且应使用私网地址；RS的网关要指向DIP
（2）请求报文和响应报文都必须经由Director转发，Director易于成为系统瓶颈
（3）支持端口映射，可修改请求报文的目标PORT
（4）VS必须是Linux系统，RS可以是任意O
LVS的DR模式
LVS-DR：Direct Routing，直接路由，LVS默认模式,应用最广泛,通过为请求报文重新封装一个MAC首部 进行转发，源MAC是DIP所在的接口的MAC，目标MAC是某挑选出的RS的RIP所在接口的MAC地址；源 IP/PORT，以及目标IP/PORT均保持不变
1. Director和各RS都配置有VIP
2. 确保前端路由器将目标IP为VIP的请求报文发往Director
在前端网关做静态绑定VIP和Director的MAC地址
在RS上使用arptables工具
在RS上修改内核参数以限制arp通告及应答级别
3. RS的RIP可以使用私网地址，也可以是公网地址；RIP与DIP在同一IP网络；RIP的网关不能指向 DIP，以确保响应报文不会经由Director
4. RS和Director要在同一个物理网络
5. 请求报文要经由Director，但响应报文不经由Director，而由RS直接发往Client
6. 不支持端口映射（端口不能修改）
7. 无需开启 ip_forward 8. RS可使用大多数OS系统
LVS的TUN模式
转发方式：不修改请求报文的IP首部（源IP为CIP，目标IP为VIP），而在原IP报文之外再封装一个IP首部 （源IP是DIP，目标IP是RIP），将报文发往挑选出的目标RS；RS直接响应给客户端（源IP是VIP，目标IP 是CIP）
TUN模式特点：
1. RIP和DIP可以不处于同一物理网络中，RS的网关一般不能指向DIP,且RIP可以和公网通信。也就是 说集群节点可以跨互联网实现。DIP, VIP, RIP可以是公网地址
2. RealServer的tun接口上需要配置VIP地址，以便接收director转发过来的数据包，以及作为响应的 报文源IP
3. Director转发给RealServer时需要借助隧道，隧道外层的IP头部的源IP是DIP，目标IP是RIP，而 RealServer响应给客户端的IP头部是根据隧道内层的IP头分析得到的，源IP是VIP，目标IP是CIP
4. 请求报文要经由Director，但响应不经由Director,响应由RealServer自己完成
5. 不支持端口映射
6. RS的OS须支持隧道功能
LVS工作模式总结和比较
LVS 调试算法
ipvs scheduler：根据其调度时是否考虑各RS当前的负载状态分为两种：静态方法和动态方法
1.静态方法
1、RR：roundrobin，轮询,较常用
2、WRR：Weighted RR，加权轮询,较常用
3、SH：Source Hashing，实现session sticky，源IP地址hash；将来自于同一个IP地址的请求始终发往 第一次挑中的RS，从而实现会话绑定
4、DH：Destination Hashing；目标地址哈希，第一次轮询调度至RS，后续将发往同一个目标地址的 请求始终转发至第一次挑中的RS，典型使用场景是正向代理缓存场景中的负载均衡,如: Web缓存
2. 动态方法
1、LC：least connections 适用于长连接应用
Overhead=activeconns*256+inactiveconns
2、WLC：Weighted LC，默认调度方法,较常用
Overhead=(activeconns*256+inactiveconns)/weight
3、SED：Shortest Expection Delay，初始连接高权重优先,只检查活动连接,而不考虑非活动连接
Overhead=(activeconns+1)*256/weight
4、NQ：Never Queue，第一轮均匀分配，后续SED
5、LBLC：Locality-Based LC，动态的DH算法，使用场景：根据负载状态实现正向代理,实现Web Cache等
6、LBLCR：LBLC with Replication，带复制功能的LBLC，解决LBLC负载不均衡问题，从负载重的复制 到负载轻的RS,,实现Web Cache等
内核版本 4.15 版本后新增调度算法：FO和OVF
FO（Weighted Fail Over）调度算法,在此FO算法中，遍历虚拟服务所关联的真实服务器链表，找到还未 过载（未设置IP_VS_DEST_F_OVERLOAD标志）的且权重最高的真实服务器，进行调度,属于静态算法
OVF（Overflow-connection）调度算法，基于真实服务器的活动连接数量和权重值实现。将新连接调度 到权重值最高的真实服务器，直到其活动连接数量超过权重值，之后调度到下一个权重值最高的真实服 务器,在此OVF算法中，遍历虚拟服务相关联的真实服务器链表，找到权重值最高的可用真实服务器。属于动态算法
一个可用的真实服务器需要同时满足以下条件：
未过载（未设置IP_VS_DEST_F_OVERLOAD标志）
真实服务器当前的活动连接数量小于其权重值
其权重值不为零
实现LVS+DR高可用nginx
环境：五台主机 一台：客户端 eth0:仅主机 192.168.10.6/24 GW:192.168.10.200 一台：ROUTER eth0 :NAT 10.0.0.200/24 eth1: 仅主机 192.168.10.200/24 启用 IP_FORWARD 一台：LVS eth0:NAT:DIP:10.0.0.154/24 GW:10.0.0.200 两台RS： RS1：eth0:NAT:10.0.0.156/24 GW：10.0.0.200 RS2：eth0:NAT:10.0.0.157/24 GW：10.0.0.200
#客户端网络配置 root@ubuntu18:~# cat /etc/netplan/eth0.yaml # This file describes the network interfaces available on your system # For more information, see netplan(5). network: version: 2 renderer: networkd ethernets: eth0: addresses: [192.168.10.6/24] gateway4: 192.168.10.200 root@ubuntu18:~# netplan apply root@ubuntu18:~# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.10.200 0.0.0.0 UG 0 0 0 eth0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
#Router网络配置 [root@router ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE=eth0 NAME=eth0 BOOTPROTO=none ONBOOT=yes IPADDR=10.0.0.200 PREFIX=24 [root@router ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth1 DEVICE=eth1 NAME=eth1 BOOTPROTO=none ONBOOT=yes IPADDR=192.168.10.200 PREFIX=24 [root@router ~]# nmcli connection reload [root@router ~]# nmcli connection up eth0 [root@router ~]# nmcli connection NAME UUID TYPE DEVICE eth0 5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03 ethernet eth0 eth1 9c92fad9-6ecb-3e6c-eb4d-8a47c6f50c04 ethernet eth1 #测试能否连接成功 [root@router ~]# ping 192.168.10.6 PING 192.168.10.6 (192.168.10.6) 56(84) bytes of data. 64 bytes from 192.168.10.6: icmp_seq=1 ttl=64 time=0.372 ms [root@router ~]# ping 10.0.0.156 PING 10.0.0.156 (10.0.0.156) 56(84) bytes of data. 64 bytes from 10.0.0.156: icmp_seq=1 ttl=64 time=0.404 ms [root@router ~]# ping 10.0.0.157 PING 10.0.0.157 (10.0.0.157) 56(84) bytes of data. 64 bytes from 10.0.0.157: icmp_seq=1 ttl=64 time=0.357 ms
#LVS网络配置 [root@centos8 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE=eth0 NAME=eth0 BOOTPROTO=none ONBOOT=yes IPADDR=10.0.0.154 PREFIX=24 GATEWAY=10.0.0.200 [root@centos8 ~]# nmcli connection reload [root@centos8 ~]# nmcli connection up eth0 Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4) [root@centos8 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.200 0.0.0.0 UG 100 0 0 eth0 10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@lvs ~]# ifconfig lo:1 10.0.0.100/32
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet 10.0.0.100/0 scope global lo:1
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:8e:f0:82 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.154/24 brd 10.0.0.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe8e:f082/64 scope link
valid_lft forever preferred_lft forever
#服务器1 [root@centos7 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore [root@centos7 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce [root@centos7 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore [root@centos7 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce [root@centos7 ~]# ifconfig lo:1 10.0.0.100/32 [root@centos7 ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet 10.0.0.100/0 scope global lo:1 valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:a9:52:80 brd ff:ff:ff:ff:ff:ff inet 10.0.0.156/24 brd 10.0.0.255 scope global noprefixroute eth0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fea9:5280/64 scope link valid_lft forever preferred_lft forever #服务器2相同步骤
#LVS配置 [root@lvs ~]# ipvsadm -Ln IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn TCP 10.0.0.100:80 rr -> 10.0.0.156:80 Route 1 0 0 -> 10.0.0.157:80 Route 1 0 0
root@ubuntu18:~# curl 10.0.0.100 10.0.0.156 10.0.0.157
6. 完成nginx编译安装及平滑升级
[root@centos7 ~]# useradd -s /sbin/nologin ngi
[root@centos7 ~]# cd /usr/local/src/
[root@centos7 src]# rz -E rz waiting to receive. [root@centos7 src]# ls nginx-1.18.0.tar.gz [root@centos7 src]# tar xf nginx-1.18.0.tar.gz [root@centos7 src]# cd nginx-1.18.0 [root@centos7 nginx-1.18.0]# ./configure --prefix=/apps/nginx \ > --user=nginx \ > --group=nginx \ > --with-http_ssl_module \ > --with-http_v2_module \ > --with-http_realip_module \ > --with-http_stub_status_module \ > --with-http_gzip_static_module \ > --with-pcre \ > --with-stream \ > --with-stream_ssl_module \ > --with-stream_realip_module [root@centos7 nginx-1.18.0]# make && make install [root@centos7 nginx-1.18.0]# ln -s /apps/nginx/sbin/nginx /usr/sbin/ [root@centos7 nginx-1.18.0]# chown -R nginx.nginx /apps/nginx [root@centos7 nginx-1.18.0]# nginx -V nginx version: nginx/1.18.0 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module
--with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
平滑升级
wget http://nginx.org/download/nginx-1.22.0.tar.gz -P /usr/local/src [root@centos7 src]# cd /usr/local/src/ [root@centos7 src]# ls nginx-1.18.0 nginx-1.18.0.tar.gz nginx-1.22.0.tar.gz [root@centos7 src]# tar xvf nginx-1.22.0.tar.gz [root@centos7 src]# cd nginx-1.22.0 [root@centos7 nginx-1.22.0]# ls auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src [root@centos7 nginx-1.22.0]# nginx -V nginx version: nginx/1.18.0 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module ./configure --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module root@centos7 nginx-1.22.0]# make root@centos7 ~]# mv /apps/nginx/sbin/nginx{,.bak} [root@centos7 ~]# cd - /usr/local/src/nginx-1.22.0 [root@centos7 nginx-1.22.0]# cp objs/nginx /apps/nginx/sbin/ [root@centos7 nginx-1.22.0]# ls /apps/nginx/sbin/ nginx nginx.bak [root@centos7 nginx-1.22.0]# /apps/nginx/sbin/nginx -t nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok nginx: configuration file /apps/nginx/conf/nginx.conf test is successful [root@centos7 nginx-1.22.0]# kill -USR2 `cat /apps/nginx/logs/nginx.pid` [root@centos7 nginx-1.22.0]# ps auxf |grep nginx root 7945 0.0 0.0 112812 980 pts/1 S+ 22:24 0:00 \_ grep --color=auto nginx root 4541 0.0 0.1 46348 2044 ? Ss 21:57 0:00 nginx: master process nginx nginx 4560 0.0 0.1 46772 2032 ? S 22:02 0:00 \_ nginx: worker process nginx 4561 0.0 0.1 46772 2032 ? S 22:02 0:00 \_ nginx: worker process root 7834 0.0 0.3 42448 5512 ? S 22:27 0:00 \_ nginx: master process /apps/nginx/sbin/nginx -c /apps/nginx/conf/nginx.conf nginx 7835 0.0 0.2 77192 4904 ? S 22:30 0:00 \_ nginx: worker process nginx 7836 0.0 0.2 77192 4908 ? S 22:30 0:00 \_ nginx: worker process
