CentOS6 yum方式安裝lnmp

本文打造易於複製粘貼的lnmp安裝方法。

相比較其餘編譯安裝的教程，本文解除了軟件版本鎖定，理論上，永遠安裝的是最新穩定版且支持軟件升級。

編譯教程在寫做時每每使用當時的最新穩定版軟件，可是稍過期日，新的漏洞出來，很快會將讀者帶入危險，由於軟件已通過時了。嚴重不建議新手使用編譯方法安裝lnmp。

環境CentOS 6.5 x64

安裝第三方軟件源(epel、nginx、remi)

rpm -ivh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh http://nginx.org/packages/centos/6/noarch/RPMS/nginx-release-centos-6-0.el6.ngx.noarch.rpm
rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm

yum一鍵安裝lnmp

yum install nginx mysql mysql-server php-fpm php-mysql php-cli php-gd  php-xml  php-mbstring php-mcrypt  php-zendopcache --enablerepo=epel,nginx,remi

php參數配置

sed -i '/expose_php/{s/On/Off/g}' /etc/php.ini
sed -i '/display_errors/{s/On/Off/g}' /etc/php.ini
sed -i '/php_errors.log/{s/;//g}' /etc/php.ini
sed -i '/file_uploads/{s/On/Off/g}' /etc/php.ini
sed -i '/allow_url_fopen/{s/On/Off/g}' /etc/php.ini
sed -i '/allow_url_include/{s/On/Off/g}' /etc/php.ini
sed -i '/;date.timezone/{s/;//g;s/=/= Asia\/Shanghai/g}' /etc/php.ini
sed -i '/cgi.fix_pathinfo\=/{s/;//g;s/1/0/g}' /etc/php.ini
sed -i '/memory_limit/{s/128/64/g}' /etc/php.ini
sed -i '/safe_mode/{s/Off/On/g}' /etc/php.ini

php-fpm配置

sed -i 's/apache/nginx/g' /etc/php-fpm.d/www.conf
sed -i '/request_terminate_timeout/{s/;//g;s/0/30/g}' /etc/php-fpm.d/www.conf

內核優化

echo "net.ipv6.conf.all.disable_ipv6 = 1"       >> /etc/sysctl.conf
echo "vm.swappiness = 25"           >> /etc/sysctl.conf
echo "net.ipv4.route.max_size = 524288 "        >> /etc/sysctl.conf
echo "net.core.somaxconn = 10240"           >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_syn_backlog = 204800"    >> /etc/sysctl.conf
echo "net.core.netdev_max_backlog =  204800"    >> /etc/sysctl.conf
echo "net.ipv4.ip_local_port_range = 1024   65535"   >> /etc/sysctl.conf

echo "ulimit -SHn 65535" >> /etc/profile
cat >> /etc/security/limits.conf <<EOF
nginx               soft    nofile  65535
nginx               hard    nofile  65535
EOF

nginx基本優化

sed -i '/worker_processes/{s/1/4/g}' /etc/nginx/nginx.conf
sed -i '/worker_processes/a\ worker_rlimit_nofile 65535;' /etc/nginx/nginx.conf
sed -i '/worker_connections/{s/1024/10240/g}' /etc/nginx/nginx.conf
sed -i '/sendfile/a\ server_tokens off;' /etc/nginx/nginx.conf
sed -i '/version/{s/\/\$nginx_version//g}' /etc/nginx/fastcgi_params
sed -i '/events/a\    use epoll;' /etc/nginx/nginx.conf

nginx的fpm基本配置，找到FASTCGI選項，去掉註釋，修改下面這樣

location ~ \.php$ {
    root  /var/www/html;
    fastcgi_pass  127.0.0.1:9000;
    #fastcgi_pass  unix:/tmp/php-fpm.sock;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    include  fastcgi_params;
}

nginx頁面設置

mkdir -p /var/www/html
sed -i 's#/usr/share/nginx/html#/var/www/html#g' /etc/nginx/conf.d/default.conf
sed -i 's/index.html/& index.php/' /etc/nginx/nginx.conf
echo "<?php phpinfo();phpinfo(INFO_MODULES);?>" >/var/www/html/index.php

mysql配置

有條件的話，給mysql單獨分個區做爲datadir

[mysqld]

datadir=/data

其餘參數能夠參考/usr/share/mysql下的示例文件

mysql基本加固，（設置密碼，限制訪問等）

mysql_secure_installation

iptables防火牆，須要根據本身設置，下面僅僅是個示例

cat >/root/firewall.sh <<EOF
#!/usr/bin/env bash
modprobe ip_tables
modprobe iptable_filter
modprobe ipt_REJECT
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24  --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp -s 192.168.1.0/24  --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 10 --name ssh --rsource -j ACCEPT
iptables -P INPUT DROP
iptables -A OUTPUT -s 224.0.0.0/8 -j DROP
iptables -A OUTPUT -d 224.0.0.0/8 -j DROP
iptables -A OUTPUT -s 255.255.255.255/32 -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
/etc/init.d/iptables save
/etc/init.d/iptables restart
EOF

啓動服務

chkconfig nginx on
chkconfig php-fpm on
chkconfig mysqld on
/etc/init.d/php-fpm start
/etc/init.d/mysqld start
/etc/init.d/nginx start

經過瀏覽器訪問系統IP應該就已經可以看到php信息了。

--last update 2014-1-1