WAF嵌入LNMP集群架构

前言：

之前想着每天都更新一篇文章，但是连续几天之后，发现有好多博客大佬，所以觉得还是不要献丑好一点，然后就学习一下关于安全防护的知识，毕竟安全意识强弱代表在互联网防护能力，类似ddos，xss,csrf等也是经常出现，比如一些基本的×××方式：SQL注入，web参数，cc。所以我就记录了下面全程的将WAF嵌入LNMP架构，应用于实战集群架构。附带lua语言写的防护模块。

实战：

服务器架构图如下：

一、web服务器集群高可用负载均衡

1.高可用使用：nginx+keepalived模式

master（web1） 192.168.0.230

slaver（web2） 192.168.0.211

VIP：192.168.0.100

2.两边安装keepalived

[root@web1 ~]# yum install -y keepalived

3.创建服务器监控脚本

[root@web1 ~]# mkdir -p /server/work

[root@web1 ~]# cd /server/work/

[root@web1 work]# vim check_ng.sh

#!/bin/bash

#write by leo

d=`date --date today +%Y%m%d_%H:%M:%S`

n=`ps -C nginx --no-heading|wc-l`

#如果进程为0，则启动nginx，并且再次检测nginx进程数量

#如果还为0，说明nginx无法启动，此时需要关闭keepalived

if[$n-eq"0"];then

            /etc/init.d/nginx start

            n2=`ps -C nginx --no-heading|wc-l`

            if[$n2-eq"0"];then

                            echo"$dnginx down,keepalived will stop">> /server/logs/nginx/check_ng.log

                            systemctl stop keepalived

            fi

fi

[root@web1 work]# mkdir -p /server/logs/nginx

[root@web1 work]# chmod +x check_ng.sh

4.修改master的keepalived配置文件

[root@web1 ~]# vim /etc/keepalived/keepalived.conf

! Configuration Fileforkeepalived

global_defs {

             notification_email {

                            boheng@buyercamp.com

}

notification_email_from root@web1

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id LVS_DEVEL

}

vrrp_script chk_nginx {

                script "/server/work/check_ng.sh"

                interval 3

}

vrrp_instance VI_1 {

                state MASTER

                interface ens33

                virtual_router_id 51

                priority 100

                advert_int 1

                authentication {

                                auth_type PASS

                                auth_pass 000000

                }

                virtual_ipaddress {

                                192.168.0.100

                }

                track_script {

                                chk_nginx

                }

}

[root@web1 ~]# systemctl stop nginx

[root@web1 ~]# systemctl status nginx

● nginx.service - LSB: starts the nginx web server Loaded: loaded (/etc/rc.d/init.d/nginx; bad; vendor preset: disabled) Active: inactive (dead) Docs: man:systemd-sysv-generator(8)

[root@web1 ~]# systemctl start keepalived

[root@web1 ~]# systemctl status keepalived

● keepalived.service - LVSandVRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor preset: disabled) Active: active (running) since Fri2018-07-1315:06:13CST;32s ago Process:14019ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)Main PID:14020(keepalived) CGroup: /system.slice/keepalived.service ├─14020/usr/sbin/keepalived -D ├─14021/usr/sbin/keepalived -D └─14022/usr/sbin/keepalived -DJul1315:06:15web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:15web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:15web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:15web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: VRRP_Instance(VI_1) Sendi...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Hint: Some lines were ellipsized, use -l to showinfull.

5.修改slaver的keepalived配置文件

[root@web2 ~]# vim /etc/keepalived/keepalived.conf

! Configuration Fileforkeepalivedglobal_defs {

            notification_email {

                            boheng@buyercamp.com

            }

            notification_email_from root@web2

            smtp_server 127.0.0.1

            smtp_connect_timeout 30

            router_id LVS_DEVEL

}

vrrp_script chk_nginx {

            script "/server/work/check_ng.sh"

            interval 3

}

vrrp_instance VI_1 {

            stateBACKUP

            interface ens33

            virtual_router_id 51

            priority 90

            advert_int1

            authentication {

                            auth_type PASS

                            auth_pass 000000

            }

            virtual_ipaddress {

                            192.168.0.100

            }

            track_script {

                            chk_nginx

            }

}

[root@web2 ~]# systemctl stop nginx

[root@web2 ~]# systemctl status nginx

● nginx.service - LSB: starts the nginx web server Loaded: loaded (/etc/rc.d/init.d/nginx; bad; vendor preset: disabled) Active: inactive (dead) Docs: man:systemd-sysv-generator(8)

[root@web2 ~]# systemctl start keepalived

[root@web2 ~]# systemctl status keepalived

● keepalived.service - LVSandVRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor preset: disabled)

Active: active (running) since Fri 2018-07-13 15:07:20 CST; 43s ago

Process: 13279 ExecStart=/usr/sbin/keepalived$KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)Main PID:13280(keepalived) CGroup:/system.slice/keepalived.service ├─13280/usr/sbin/keepalived -D ├─13281/usr/sbin/keepalived -D └─13282/usr/sbin/keepalived -DJul1315:07:20web2 Keepalived_vrrp[13282]: Registering Kernel netlin...Jul1315:07:20web2 Keepalived_vrrp[13282]: Registering gratuitous AR...Jul1315:07:20web2 Keepalived_vrrp[13282]: Opening file'/etc/keepal...

Jul 13 15:07:20 web2 Keepalived_vrrp[13282]: WARNING - default user 'k...Jul1315:07:20web2 Keepalived_vrrp[13282]: SECURITY VIOLATION - scri...Jul1315:07:20web2 Keepalived_vrrp[13282]: VRRP_Instance(VI_1) remov...Jul1315:07:20web2 Keepalived_vrrp[13282]: Using LinkWatch kernel ne...Jul1315:07:20web2 Keepalived_vrrp[13282]: VRRP_Instance(VI_1) Enter...Jul1315:07:20web2 Keepalived_vrrp[13282]: VRRP sockpool: [ifindex(2...Jul1315:07:20web2 Keepalived_vrrp[13282]: VRRP_Script(chk_nginx) su...Hint: Some lines were ellipsized,use-l to show in full.

6.在master上查看IP地址

[root@web1 ~]# ip a1: lo: mtu65536qdisc noqueue state UNKNOWN groupdefaultqlen1000link/loopback00:00:00:00:00:00brd00:00:00:00:00:00inet127.0.0.1/8scope host lo valid_lft forever preferred_lft forever inet6 ::1/128scope host valid_lft forever preferred_lft forever2: ens33: mtu1500qdisc pfifo_fast state UP groupdefaultqlen1000link/ether00:0c:29:c5:33:97brd ff:ff:ff:ff:ff:ff inet192.168.0.230/24brd192.168.0.255scopeglobalnoprefixroute dynamic ens33 valid_lft6103sec preferred_lft6103sec inet192.168.0.100/32scopeglobalens33 valid_lft forever preferred_lft forever

7.在slaver上查看IP地址

[root@web2 ~]# ip a

1: lo: mtu65536qdisc noqueuestateUNKNOWN group default qlen1000link/loopback00:00:00:00:00:00brd00:00:00:00:00:00inet127.0.0.1/8scope host lo valid_lft forever preferred_lft forever inet6 ::1/128scope host valid_lft forever preferred_lft forever2: ens33: mtu1500qdisc pfifo_faststateUP group default qlen1000link/ether00:0c:29:d7:df:dc brd ff:ff:ff:ff:ff:ff inet192.168.0.211/24brd192.168.0.255scope global noprefixroute dynamic ens33 valid_lft6107sec preferred_lft6107sec inet6 fe80::20c:29ff:fed7:dfdc/64scopelinkvalid_lft forever preferred_lft forever

8.在master上关闭keepalived服务（模拟master宕机或者脑裂情况）

[root@web1 ~]# systemctl stop keepalived

[root@web1 ~]# systemctl status keepalived

● keepalived.service - LVSandVRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor preset: disabled) Active: inactive (dead)Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:06:20web1 Keepalived_vrrp[14022]: Sending gratuitous ARPon...Jul1315:11:20web1 systemd[1]: Stopping LVSandVRRP High Availabil....Jul1315:11:20web1 Keepalived[14020]: StoppingJul1315:11:20web1 Keepalived_vrrp[14022]: VRRP_Instance(VI_1) sent ...Jul1315:11:20web1 Keepalived_vrrp[14022]: VRRP_Instance(VI_1) remov...Jul1315:11:21web1 Keepalived_vrrp[14022]: StoppedJul1315:11:21web1 Keepalived[14020]: Stopped Keepalived v1.3.5(03...2Jul1315:11:21web1 systemd[1]: Stopped LVSandVRRP High Availabili....Hint: Some lines were ellipsized, use -l to showinfull.

9.在slaver上查看状态

[root@web2 ~]# ip a

1: lo: mtu65536qdisc noqueue state UNKNOWN groupdefaultqlen1000link/loopback00:00:00:00:00:00brd00:00:00:00:00:00inet127.0.0.1/8scope host lo valid_lft forever preferred_lft forever inet6 ::1/128scope host valid_lft forever preferred_lft forever2: ens33: mtu1500qdisc pfifo_fast state UP groupdefaultqlen1000link/ether00:0c:29:d7:df:dc brd ff:ff:ff:ff:ff:ff inet192.168.0.211/24brd192.168.0.255scopeglobalnoprefixroute dynamic ens33 valid_lft5895sec preferred_lft5895sec inet192.168.0.100/32scopeglobalens33 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fed7:dfdc/64scope link valid_lft forever preferred_lft forever

[root@web2 ~]# systemctl status keepalived

● keepalived.service - LVSandVRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor preset: disabled) Active: active (running) since Fri2018-07-1315:07:20CST;7min ago Process:13279ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)Main PID:13280(keepalived) CGroup: /system.slice/keepalived.service ├─13280/usr/sbin/keepalived -D ├─13281/usr/sbin/keepalived -D └─13282/usr/sbin/keepalived -DJul1315:12:22web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:22web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:22web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:22web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:27web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:27web2 Keepalived_vrrp[13282]: VRRP_Instance(VI_1) Sendi...Jul1315:12:27web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:27web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:27web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Jul1315:12:27web2 Keepalived_vrrp[13282]: Sending gratuitous ARPon...Hint: Some lines were ellipsized, use -l to showinfull.

10.查看丢包情况

在windows上模拟持续性访问，使用ping查看丢包情况

二、建立共享存储服务器

1.安装NFS方式，master 服务端

[root@web1 web]# yum install -y rpcbind nfs-utils

2.slaver 客户端

[root@web2 web]# yum install -y nfs-utils

3.master服务端启动共享存储服务

[root@web1 web]# cat /etc/exports

/server/web192.168.0.0/24(rw,sync,no_root_squash)

[root@web1 web]# systemctl start nfs

4.slaver客户端查看共享存储

[root@web2 web]# showmount -e 192.168.0.230

Export listfor192.168.0.230:/server/web192.168.0.0/24

[root@web2 web]# mount -t nfs 192.168.0.230:/server/web /server/web -o proto=tcp -o nolock

[root@web2 web]# ls

[root@web2 web]# df -h

Filesystem Size Used Avail Use% Mountedon/dev/mapper/centos-root 50G 4.2G 46G 9% /devtmpfs899M0899M0% /devtmpfs911M0911M0% /dev/shmtmpfs911M9.6M902M2% /runtmpfs911M0911M0% /sys/fs/cgroup/dev/sda11014M142M873M14% /boot/dev/mapper/centos-home47G74M47G1% /hometmpfs183M0183M0% /run/user/0192.168.0.230:/server/web50G4.2G46G9% /server/web

[root@web2 web]#

5.修改nginx配置文件（两边配置一致）

[root@web1 ~]# cd /usr/local/nginx/conf/vhost/

[root@web1 vhost]# vim zt.conf

server {
            listen80;

            #listen [::]:80 default_server ipv6only=on;

            server_name zt.linuxview.com ;

            index index.html index.htm index.php;

            root /server/web/test;

            #error_page 404 /404.html;error_page404404/404.html;

            include enable-php.conf;

            location /nginx_status {

                        stub_statuson;

                        access_logoff;

            }

            location ~* ^/data/(attachment|avatar)/.*\.(php|php5)$ {

                        deny all;

            }

            location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {

                        expires30d;

            }

            location ~ .*\.(js|css)?$ {

                        expires12h;

            }

            location ~ /\. {

                        deny all;

            }

            access_log /server/logs/nginx/zuitu/access.log ;

            error_log /server/logs/nginx/zuitu/error.log ;

}

6.访问网页

7.master上设置反向代理

[root@web1 vhost]# vim xs.conf

server {

        listen80;

        server_name xs.linuxview.com ;

        location / {

                    proxy_pass http://192.168.0.211:80;

                    proxy_set_header Host xs.linuxview.com;

                    proxy_redirect off;

                    proxy_set_header X-Real-IP192.168.0.211;

                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                    proxy_connect_timeout60;

                    proxy_read_timeout600;

                    proxy_send_timeout600;

        }

        access_log /server/logs/nginx/zuitu/access.log ;

        error_log /server/logs/nginx/zuitu/error.log ;

}

[root@web1 vhost]# /usr/local/nginx/sbin/nginx -s reload

8.slaver上设置nginx的配置文件

[root@web2 vhost]# vim xs.conf

server {

            listen80;

            #listen [::]:80 default_server ipv6only=on;

            server_name xs.linuxview.com ;

            index index.html index.htm index.php;

            root /server/web/test3;#error_page 404 /404.html;error_page404404/404.html;

            include enable-php.conf;

            location /nginx_status {

                        stub_statuson;

                        access_logoff;

            }

            location ~* ^/data/(attachment|avatar)/.*\.(php|php5)$ {

                        deny all;

            }

            location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {

                        expires30d;

            }

            location ~ .*\.(js|css)?$ {

                        expires12h;

            }

            location ~ /\. {

                        deny all;

            }

            access_log /server/logs/nginx/zuitu/access.log ;

            error_log /server/logs/nginx/zuitu/error.log ;

}

[root@web2 vhost]# /usr/local/nginx/sbin/nginx -s reload

9.访问网页测试

三、WAF镶嵌lnmp架构

1.安装依赖包

[root@waf ~]# yum install -y readline-devel pcre-devel openssl-devel gcc* git* libxml2*

2.下载2.0.5版本的luajit，编译安装

[root@waf ~]# mkdir -p /server/source

[root@waf ~]# cd /server/source/

[root@waf source]# wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz

[root@waf source]# tar -xf LuaJIT-2.0.5.tar.gz

[root@waf source]# cd LuaJIT-2.0.5

[root@waf LuaJIT-2.0.5]# export LUAJIT_LIB=/user/local/lib

[root@waf LuaJIT-2.0.5]# export LUAJIT_INC=/usr/local/include/luajit-2.0

[root@waf LuaJIT-2.0.5]# make && make install && ln -s /usr/local/lib/libluajit-5.1.so.2 /lib64/libluajit-5.1.so.2

成功安装标志：

3.下载并编译安装openresty

[root@waf source]# wget https://openresty.org/download/openresty-1.11.2.2.tar.gz

[root@waf source]# tar -xf openresty-1.11.2.2.tar.gz

[root@waf source]# cd openresty-1.11.2.2

[root@waf openresty-1.11.2.2]# ./configure --prefix=/usr/local/openresty --user=www --group=www --with-luajit --with-http_v2_module --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-ipv6 --with-http_sub_module --with-pcre --with-pcre-jit --with-file-aio --with-http_dav_module

[root@waf openresty-1.11.2.2]# gmake && gmake install

4.修改最大文件打开数量

[root@waf openresty-1.11.2.2]# vim /proc/sys/fs/file-max100000

[root@waf openresty-1.11.2.2]# ulimit -l64

5.修改openresty内置的nginx配置文件（--prefix指定的是安装目录，所以配置文件就在安装目录里面，编译完成之后，就不用在源码包界面了）

[root@waf openresty]# mkdir /server/conf

[root@waf openresty]# pwd/usr/local/openresty

[root@waf openresty]# cd /server/conf/

[root@waf conf]# ls

[root@waf conf]# ln -s /usr/local/openresty /server/conf/openresty

[root@waf conf]# lsopenresty

[root@waf conf]# ln -s /usr/local/openresty/nginx /server/conf/nginx

[root@waf conf]# ll

total 0

lrwxrwxrwx1root root26Jul1009:25nginx ->/usr/local/openresty/nginx

lrwxrwxrwx1root root20Jul1009:23openresty ->/usr/local/openresty

[root@waf conf]#vim nginx.conf

（修改user为www ,在最后一行的括号上新增include vhost/*.conf;）

[root@waf conf]# useradd www -M -s /sbin/nologin

[root@waf conf]# mkdir vhost

[root@waf conf]# cd vhost/

##编写测试网页

[root@waf vhost]# vim waf.conf

server {

        listen80;

        server_name waf.linuxview.com ;

        indexindex.html index.php index.htm ;

        root /server/web/waf ;

        error_log /server/logs/nginx/waf/error.log;

        access_log /server/logs/nginx/waf/access.log;

}

[root@waf vhost]# mkdir -p /server/web/waf && cd /server/web/waf

##创建测试网页

[root@waf waf]# cat index.html

Welcome to Linuxview!!!

##重加载nginx

[root@waf waf]# /usr/local/openresty/nginx/sbin/nginx -s reload

6.访问测试网页

7.安装waf防护模块

[root@waf waf]# cd /server/source/

#这个目录用来存源码或软件包等

[root@waf source]# git clone https://github.com/leoheng/lua.git

#这些全是lua语言写的防护模块，复制到nginx的conf配置文件目录

[root@waf waf]# cp -a ./waf /server/conf/nginx/conf/

[root@waf waf]# cd /server/conf/nginx/conf/

[root@waf conf]# ls

fastcgi.conf koi-win scgi_params waffastcgi.conf.defaultmime.types scgi_params.defaultwin-utffastcgi_params mime.types.defaultuwsgi_paramsfastcgi_params.defaultnginx.conf uwsgi_params.defaultkoi-utf nginx.conf.defaultvhost

[root@waf conf]# cd waf/

[root@waf waf]# ls

access.lua config.lua init.lua lib.lua rule-config

[root@waf waf]#cd ..

##在http字段下添加lua模块

[root@waf conf]# vim nginx.conf

            lua_shared_dict limit50m; ##CC,50M

            lua_package_path/server/conf/nginx/conf/waf/?.lua ;

            init_by_lua_file /server/conf/nginx/conf/waf/init.lua ;

            access_by_lua_file /server/conf/nginx/conf/waf/access.lua ;

##检查配置文件并重加载服务

[root@waf conf]# /usr/local/openresty/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntaxisoknginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf testissuccessful

[root@waf conf]# /usr/local/openresty/nginx/sbin/nginx -s reload

8.配置waf防护

[root@waf waf]# cat config.lua

--WAF config file,enable ="on",disable ="off"        ##WAF功能选项

--waf status

config_waf_enable ="on"        ##是否启动waf防护

--log dirconfig_log_dir ="/server/logs/waf_logs"        ##waf的日志

--rule settingconfig_rule_dir ="/usr/local/openresty/nginx/conf/waf/rule-config"        ##waf的防护规则配置文件

--enable/disable white urlconfig_white_url_check ="on"        ##配置白名单url检查

--enable/disable white ip

config_white_ip_check ="on"        ##配置白名单IP检查

--enable/disable block ipconfig_black_ip_check ="on"        ##配置黑名单IP检查

--enable/disable url filteringconfig_url_check ="on"        ##配置url检查过滤

--enalbe/disable url args filteringconfig_url_args_check ="on"        ##配置url参数检查

--enable/disable user agent filteringconfig_user_agent_check ="on"        ##配置用户代理检查

--enable/disable cookie deny filteringconfig_cookie_check ="on"        ##配置cookie过滤检查

--enable/disable cc filteringconfig_cc_check ="on"        ##配置CC×××检查过滤

--cc rate the xxx of xxx secondsconfig_cc_rate ="10/60"        ##CC×××速率访问网页每60秒访问10次

--enable/disable post filteringconfig_post_check ="on"        ##配置post检查过滤

--config waf output redirect/htmlconfig_waf_output ="html"        ##配置匹配成功重定向或者输出警告页面

--if config_waf_output ,setting urlconfig_waf_redirect_url ="https://www.baidu.com"        ##重定向到百度首页##输出HTML格式的警告信息[[ html警告内容 ]]

config_output_html=[[ WAF-TEST

WAF-TEST

// TODO SOMTHING HTML

]]

9.访问匹配模块

规则：检测白名单-》黑名单-》UA×××检测-》CC×××检测-》cookie检测-》URL检测-》URL×××检测-》URL参数检测-》post检测

[root@waf waf]# cat access.lua

require'init'    ##先请求init.lua文件进行匹配，然后进行检查功能匹配

##配置检查顺序

function waf_main()

        if white_ip_check() then

        elseif black_ip_check() then

        elseif user_agent_attack_check() then

        elseif cc_attack_check() then

        elseif cookie_attack_check() then

        elseif white_url_check() then

        elseif url_attack_check() then

        elseif url_args_attack_check() then

        --elseif post_attack_check() then

        else

                return

        end

end

waf_main()

[root@waf waf]#

10.防护规则大概流程图：

11.url参数测试

12.模拟CC×××测试

[root@waf waf]# ab -c 100 -t 100 http://waf.linuxview.com/

13.查看日志记录：×××方式，客户端地址，被×××的服务器时间等等

14.SQL测试

15.安装httpguard再升级CC防护

下载压缩包，复制lua配置到waf下

[root@waf waf]# cd /server/source/

[root@waf source]# wget --no-check-certificate https://github.com/centos-bz/HttpGuard/archive/master.zip

[root@waf source]# unzip master.zip

[root@waf source]# cd HttpGuard-master/

[root@waf HttpGuard-master]# cp guard.lua /server/conf/nginx/conf/waf/

[root@waf HttpGuard-master]# cp runtime.lua /server/conf/nginx/conf/waf/

四、MySQL5.7集群（双主多从模式）

当只有两台数据库的时候，使用双主模式（互为主从）

1.修改master的mysql配置文件

[root@web1 ~]# vim /etc/my.cnf

#在mysqld下新增一下配置

[mysqld]

log-bin=mysql-bin

binlog_format=mixed

server-id = 1

sync_binlog = 1

binlog_checksum = none

binlog_format = mixed

auto-increment-increment = 2

auto-increment-offset = 1

slave-skip-errors = all

[root@web1 ~]# systemctl restart mysql

[root@web1 ~]# systemctl status mysql

● mysql.service - LSB: start and stop MySQL Loaded: loaded (/etc/rc.d/init.d/mysql; bad; vendor preset: disabled) Active: active (exited) since Fri 2018-07-13 17:18:39 CST; 6s ago Docs: man:systemd-sysv-generator(8) Process: 37255 ExecStart=/etc/rc.d/init.d/mysql start (code=exited, status=0/SUCCESS)Jul 13 17:18:39 web1 systemd[1]: Starting LSB: start and stop MySQL...Jul 13 17:18:39 web1 mysql[37255]: Starting MySQL SUCCESS!Jul 13 17:18:39 web1 systemd[1]: Started LSB: start and stop MySQL.Jul 13 17:18:40 web1 mysql[37255]: 2018-07-13T09:18:40.050893Z mysqld_safe A mys...tsHint: Some lines were ellipsized, use -l to show in full.

2.进入数据库，赋权给web2用户，让它连接主数据库同步数据

[root@web1 ~]# mysql -uroot -p000000

mysql:[Warning] Using a password on the command line interface can be insecure.Welcome to the MySQL monitor. Commandsendwith ;or\g.Your MySQL connection id is3Serverversion:5.7.18-log Source distributionCopyright (c)2000,2017, Oracleand/orits affiliates. All rights reserved.Oracle is a registered trademark of Oracle Corporationand/oritsaffiliates. Other names may be trademarks of their respectiveowners.Type'help;'or'\h'forhelp. Type'\c'to clear the current input statement.

mysql> grant replication slave,replication client on *.* to web2@'192.168.0.%'identified by"000000";

Query OK,0rows affected,1warning (0.13sec)

mysql> flush privileges;

Query OK,0rows affected (0.03sec)

###查看log bin日志和post值位置

mysql> show master status;

+------------------+----------+--------------+------------------+-------------------+| File |Position| Binlog_Do_DB |Binlog_Ignore_DB| Executed_Gtid_Set |+------------------+----------+--------------+------------------+-------------------+| mysql-bin.000006 |620| || |+------------------+----------+--------------+------------------+-------------------+1 row in set (0.01sec)

mysql>

3.在slaver上修改MySQL配置文件

[root@web2 ~]# vim /etc/my.cnf

[mysqld]

server-id =2

log-bin = mysql-bin

sync_binlog =1

binlog_checksum = none

binlog_format = mixed

auto-increment-increment =2

auto-increment-offset =2

slave-skip-errors = all

[root@web2 ~]# systemctl restart mysql

[root@web2 ~]# systemctl status mysql

● mysql.service - LSB: startandstop MySQL Loaded: loaded (/etc/rc.d/init.d/mysql; bad; vendor preset: disabled) Active: active (running) since Fri2018-07-1317:29:56CST;20s ago Docs: man:systemd-sysv-generator(8) Process:31883ExecStart=/etc/rc.d/init.d/mysql start (code=exited, status=0/SUCCESS) CGroup: /system.slice/mysql.service ├─31891/bin/sh /usr/local/mysql/bin/mysqld_safe --datadir=/usr/local/m... └─32461/usr/local/mysql/bin/mysqld --basedir=/usr/local/mysql --datadi...Jul1317:29:38web2 systemd[1]: Starting LSB: startandstop MySQL...Jul1317:29:56web2 mysql[31883]: Starting MySQL................. SUCCESS!Jul1317:29:56web2 systemd[1]: Started LSB: startandstop MySQL.

4.创建数据库用户用于数据库同步数据

[root@web2 ~]# mysql -uroot -p000000

mysql: [Warning] Using a passwordonthe command line interface can be insecure.Welcome to the MySQL monitor. Commands end with ;or\g.Your MySQL connection idis3Server version:5.7.18-log Source distributionCopyright (c)2000,2017, Oracleand/orits affiliates. All rights reserved.Oracleisa registered trademarkofOracle Corporationand/oritsaffiliates. Other names may be trademarksoftheir respectiveowners.Type'help;'or'\h'forhelp. Type'\c'to clear the current input statement.

mysql> grant replication slave,replication clienton*.* to web2@'192.168.0.%'identifiedby"000000";

ERROR1064(42000): You have an errorinyour SQL syntax; check the manual that corresponds to your MySQL server versionforthe right syntax to use near'identiified by "000000"'at line1

mysql> grant replication slave,replication clienton*.* to web2@'192.168.0..%'identifiedby"000000";

Query OK,0rows affected,1warning (0.18sec)

mysql> flush privileges;

Query OK,0rows affected (0.00sec)

mysql> show master status;

5.在master上同步数据库到slaver上

mysql> stop slave;

Query OK, 0 rows affected, 1 warning (0.02 sec)

mysql>change master to master_host='192.168.0.211',master_user='web2',master_password='000000',master_log_file='mysql-bin.000006',master_log_pos=620;

Query OK, 0 rows affected, 2 warnings (0.03 sec)

mysql> start slave;

Query OK, 0 rows affected (0.00 sec)

mysql> show slave status \G;

*************************** 1. row *************************** Slave_IO_State: Waiting for master to send event Master_Host: 192.168.0.211 Master_User: web2 Master_Port: 3306 Connect_Retry: 60 Master_Log_File: mysql-bin.000008 Read_Master_Log_Pos: 1110 Relay_Log_File: web1-relay-bin.000002 Relay_Log_Pos: 312 Relay_Master_Log_File: mysql-bin.000008 Slave_IO_Running: Yes Slave_SQL_Running: Yes Replicate_Do_DB: Replicate_Ignore_DB: Replicate_Do_Table: Replicate_Ignore_Table: Replicate_Wild_Do_Table: Replicate_Wild_Ignore_Table: Last_Errno: 0 Last_Error: Skip_Counter: 0 Exec_Master_Log_Pos: 1110 Relay_Log_Space: 510 Until_Condition: None Until_Log_File: Until_Log_Pos: 0 Master_SSL_Allowed: No Master_SSL_CA_File: Master_SSL_CA_Path: Master_SSL_Cert: Master_SSL_Cipher: Master_SSL_Key: Seconds_Behind_Master: 0Master_SSL_Verify_Server_Cert: No Last_IO_Errno: 0 Last_IO_Error: Last_SQL_Errno: 0 Last_SQL_Error: Replicate_Ignore_Server_Ids: Master_Server_Id: 2 Master_UUID: ed87ba4b-8653-11e8-94fe-000c29d7dfdc Master_Info_File: /usr/local/mysql/var/master.info SQL_Delay: 0 SQL_Remaining_Delay: NULL Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates Master_Retry_Count: 86400 Master_Bind: Last_IO_Error_Timestamp: Last_SQL_Error_Timestamp: Master_SSL_Crl: Master_SSL_Crlpath: Retrieved_Gtid_Set: Executed_Gtid_Set: Auto_Position: 0 Replicate_Rewrite_DB: Channel_Name: Master_TLS_Version:1 row in set (0.00 sec)

6.在slaver上同步master的数据库

mysql> stop slave;

Query OK, 0 rows affected, 1 warning (0.02 sec)

mysql>change master to master_host='192.168.0.230',master_user='web2',master_password='000000',master_log_file='mysql-bin.000006',master_log_pos=620;

Query OK, 0 rows affected, 2 warnings (0.03 sec)

mysql> start slave;

Query OK, 0 rows affected (0.00 sec)

mysql> show slave status \G;

*************************** 1. row *************************** Slave_IO_State: Connecting to master Master_Host: 192.168.0.230 Master_User: web1 Master_Port: 3306 Connect_Retry: 60 Master_Log_File: mysql-bin.000010 Read_Master_Log_Pos: 1110 Relay_Log_File: web2-relay-bin.000001 Relay_Log_Pos: 4 Relay_Master_Log_File: mysql-bin.000010 Slave_IO_Running: Yes Slave_SQL_Running: Yes

7.在master的数据库上创建数据库和表

mysql> create database leotest;

Query OK, 1 row affected (0.00 sec)

mysql> use leotest;

Database changed

mysql>create tabletest(id int(4),name varchar(10));

Query OK, 0 rows affected (0.04 sec)

mysql> show tables ;

+-------------------+| Tables_in_leotest |+-------------------+| test |+-------------------+1 row in set (0.00 sec)

mysql>

8.在slaver上查看同步的数据

mysql> show databases;

+--------------------+| Database |+--------------------+| information_schema || leotest || mysql || performance_schema || sys |+--------------------+5rowsinset (0.00sec)

mysql>

至此，MySQL集群已完成，而waf嵌入LNMP集群架构也完成了。

（原文来自：http://blog.51cto.com/leoheng/2148772）

最后编辑于：2018.07.24 16:30:07

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 203,547评论 6赞 477
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 85,399评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 150,428评论 0赞 337
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 54,599评论 1赞 274
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 63,612评论 5赞 365
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,577评论 1赞 281
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 37,941评论 3赞 395
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,603评论 0赞 258
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 40,852评论 1赞 297
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,605评论 2赞 321
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,693评论 1赞 329
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,375评论 4赞 318
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 38,955评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,936评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,172评论 1赞 259
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 43,970评论 2赞 349
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,414评论 2赞 342

WAF嵌入LNMP集群架构

前言：

实战：

推荐阅读更多精彩内容