SaaSes の VPS の Osukini サーバー + CentOS の初期設定からチューニングまとめ

ssh info@192.168.0.1 -p 22

su -

rpm -qa | grep centos-release

centos-release-5-7.el5.centos

yum upgrade

/usr/sbin/visudo

info ALL=(ALL) ALL

yum -y install vim-enhanced

vim ~/.bashrc

alias vi='vim'
alias ls="ls -G"
alias ll="ls -alF"
alias la="ls -A"
alias l="ls -CF"

source .bashrc

vim /etc/ssh/sshd_config

Port 10022

sudo /etc/init.d/sshd restart

ssh info@192.168.0.1 -p 10022

ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/hoge/.ssh/id_rsa): // ファイル作成場所
Enter passphrase (empty for no passphrase): // パスフレーズを入力する
Enter same passphrase again: // パスフレーズをもう一度入力する

-rw-------   1 hoge  staff  1743  5 14 16:29 id_rsa
-rw-r--r--   1 hoge  staff   402  5 14 16:29 id_rsa.pub
-rw-r--r--@  1 hoge  staff  3911  5 11 02:28 known_hosts

cd ~
mkdir .ssh

scp -P 10022 ~/.ssh/id_rsa.pub info@192.168.0.1:~/.ssh/authorized_keys

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

sudo vi /etc/ssh/sshd_config

PermitRootLogin no

PasswordAuthentication no

PermitEmptyPasswords no

sudo /etc/init.d/sshd restart

ssh info@192.168.0.1 -p 10022

sudo vi /etc/sysconfig/iptables

*filter
:INPUT   ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT  ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
 
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# SSH, HTTP, FTP1, FTP2, MySQL
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 10022 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80    -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 20    -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21    -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306  -j ACCEPT
 
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
 
COMMIT

sudo /etc/rc.d/init.d/iptables restart

sudo /sbin/chkconfig auditd off
sudo /sbin/chkconfig autofs off
sudo /sbin/chkconfig avahi-daemon off
sudo /sbin/chkconfig bluetooth off
sudo /sbin/chkconfig cups off
sudo /sbin/chkconfig firstboot off
sudo /sbin/chkconfig gpm off
sudo /sbin/chkconfig haldaemon off
sudo /sbin/chkconfig hidd off
sudo /sbin/chkconfig isdn off
sudo /sbin/chkconfig kudzu off
sudo /sbin/chkconfig lvm2-monitor off
sudo /sbin/chkconfig mcstrans off
sudo /sbin/chkconfig mdmonitor off
sudo /sbin/chkconfig messagebus off
sudo /sbin/chkconfig netfs off
sudo /sbin/chkconfig nfslock off
sudo /sbin/chkconfig pcscd off
sudo /sbin/chkconfig portmap off
sudo /sbin/chkconfig rawdevices off
sudo /sbin/chkconfig restorecond off
sudo /sbin/chkconfig rpcgssd off
sudo /sbin/chkconfig rpcidmapd off
sudo /sbin/chkconfig smartd off
sudo /sbin/chkconfig xfs off
sudo /sbin/chkconfig yum-updatesd off

wget http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
wget http://rpms.famillecollet.com/el5.x86_64/remi-release-5-8.el5.remi.noarch.rpm
wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm

sudo rpm -Uvh epel-release-5-4.noarch.rpm remi-release-5-8.el5.remi.noarch.rpm rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm

sudo vi /etc/yum.repos.d/epel.repo

[epel]
name=Extra Packages for Enterprise Linux 5 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/5/$basearch
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch
failovermethod=priority
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL

sudo vi /etc/yum.repos.d/rpmforge.repo

[rpmforge]
name = RHEL $releasever - RPMforge.net - dag
baseurl = http://apt.sw.be/redhat/el5/en/$basearch/rpmforge
mirrorlist = http://apt.sw.be/redhat/el5/en/mirrors-rpmforge
#mirrorlist = file:///etc/yum.repos.d/mirrors-rpmforge
enabled = 0
protect = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rpmforge-dag
gpgcheck = 1

sudo yum --enablerepo=remi,epel,rpmforge install httpd-devel php-devel php-mysql php-pear mysql-server

sudo vi /etc/httpd/conf/httpd.conf

#LoadModule auth_basic_module modules/mod_auth_basic.so
#LoadModule auth_digest_module modules/mod_auth_digest.so
#LoadModule authn_file_module modules/mod_authn_file.so
#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authn_dbm_module modules/mod_authn_dbm.so
#LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
#LoadModule authz_user_module modules/mod_authz_user.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so
#LoadModule authz_default_module modules/mod_authz_default.so
#LoadModule ldap_module modules/mod_ldap.so
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
#LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
#LoadModule logio_module modules/mod_logio.so
#LoadModule env_module modules/mod_env.so
#LoadModule ext_filter_module modules/mod_ext_filter.so
#LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
#LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
#LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
#LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
#LoadModule autoindex_module modules/mod_autoindex.so
#LoadModule info_module modules/mod_info.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
#LoadModule actions_module modules/mod_actions.so
#LoadModule speling_module modules/mod_speling.so
#LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
#LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule cache_module modules/mod_cache.so
#LoadModule suexec_module modules/mod_suexec.so
#LoadModule disk_cache_module modules/mod_disk_cache.so
#LoadModule file_cache_module modules/mod_file_cache.so
#LoadModule mem_cache_module modules/mod_mem_cache.so
#LoadModule cgi_module modules/mod_cgi.so
#LoadModule version_module modules/mod_version.so

<IfModule mod_autoindex.c>
        IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable
        #
        # AddIcon* directives tell the server which icon to show for different
        # files or filename extensions.  These are only displayed for
        # FancyIndexed directories.
        #
        AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
 
        AddIconByType (TXT,/icons/text.gif) text/*
        AddIconByType (IMG,/icons/image2.gif) image/*
        AddIconByType (SND,/icons/sound2.gif) audio/*
        AddIconByType (VID,/icons/movie.gif) video/*
 
        AddIcon /icons/binary.gif .bin .exe
        AddIcon /icons/binhex.gif .hqx
        AddIcon /icons/tar.gif .tar
        AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
        AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
        AddIcon /icons/a.gif .ps .ai .eps
        AddIcon /icons/layout.gif .html .shtml .htm .pdf
        AddIcon /icons/text.gif .txt
        AddIcon /icons/c.gif .c
        AddIcon /icons/p.gif .pl .py
        AddIcon /icons/f.gif .for
        AddIcon /icons/dvi.gif .dvi
        AddIcon /icons/uuencoded.gif .uu
        AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
        AddIcon /icons/tex.gif .tex
        AddIcon /icons/bomb.gif core
 
        AddIcon /icons/back.gif ..
        AddIcon /icons/hand.right.gif README
        AddIcon /icons/folder.gif ^^DIRECTORY^^
        AddIcon /icons/blank.gif ^^BLANKICON^^
 
        #
        # DefaultIcon is which icon to show for files which do not have an icon
        # explicitly set.
        #
        DefaultIcon /icons/unknown.gif
 
        #
        # AddDescription allows you to place a short description after a file in
        # server-generated indexes.  These are only displayed for FancyIndexed
        # directories.
        # Format: AddDescription "description" filename
        #
        #AddDescription "GZIP compressed document" .gz
        #AddDescription "tar archive" .tar
        #AddDescription "GZIP compressed tar archive" .tgz
 
        #
        # ReadmeName is the name of the README file the server will look for by
        # default, and append to directory listings.
        #
        # HeaderName is the name of a file which should be prepended to
        # directory indexes. 
        ReadmeName README.html
        HeaderName HEADER.html
 
        #
        # IndexIgnore is a set of filenames which directory indexing should ignore
        # and not include in the listing.  Shell-style wildcarding is permitted.
        #
        IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
</IfModule>

sudo mv /etc/httpd/conf.d/proxy_ajp.conf /etc/httpd/conf.d/proxy_ajp.conf.stop

sudo vi /etc/my.cnf

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
user=mysql
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1
 
# character-set
character-set-server=utf8
skip-character-set-client-handshake
 
# Disabling symbolic-links is recommended to prevent assorted security risks;
# to do so, uncomment this line:
# symbolic-links=0
 
[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid
 
[client]
default-character-set=utf8
 
[mysql]
default-character-set=utf8
 
[mysqldump]
default-character-set=utf8

sudo /sbin/chkconfig mysqld on

sudo /etc/rc.d/init.d/mysqld start

sudo mysqladmin -u root password 'パスワード'

sudo pecl install APC

Build process completed successfully
Installing ‘/usr/lib64/php/modules/apc.so’
Installing ‘/usr/include/php/ext/apc/apc_serializer.h’
install ok: channel://pecl.php.net/APC-3.1.9
configuration option “php_ini” is not set to php.ini location
You should add “extension=apc.so” to php.ini

sudo vi /etc/php.ini

extension=apc.so

sudo vi /etc/httpd/conf/httpd.conf

NameVirtualHost *:80

<VirtualHost *:80>
    DocumentRoot "/var/www/vhosts/example.com/web"
    ServerName example.com
    <Directory "/var/www/vhosts/example.com/web">
        order deny,allow
        allow from All
        Options FollowSymLinks
        AllowOverride All
    </Directory>
</VirtualHost>

sudo mkdir /var/www/vhosts
sudo chown info /var/www/vhosts