安装部署文档

RedHat 安装:
1. 安装要求:
lvm管理方式
分区方式:
1):/ 4000M
2):swap(MEM<4096) =MEM * 2
(MEM>4096) =MEM
3):/user 12000M
4):/home 10000M
5):/var 4000M
6):/app 剩余空间
配置SSH安全:
1) 关闭ssh底版本兼容
#Protocol 2,1 ---> Protocol 2
2) 禁止root远程登陆
#PermitRootLogin yes --> PermitRootLogin no
3) 重启sshd
Service sshd restart
操作系统保留服务:
1) auditd
2) crond
3) network
4) psacct
5) rsync
6) sshd
7) syslog
8) sysstat
9) xinetd

配置操作系统审计
1) 启动帐号空间审计
service auditd start
2) 启动命令审计
service psacct start
3) 启动系统日志
service syslog start

2. 操作系统安装组件


3. Apache 安全加固:(注意:修改配置文件前移动做好备份)
1) apache主目录: /app/apache/
2) 新建应用组
groupadd app
3) 新建apache帐号
useradd -g app -d /app/tomcat tomcat
chown -r tomcat.app /app/tomcat
4) 新建apache软件目录
su -tomcat;mkdir _backup
5) 安装apache
su -apache
cd _backup/
wget http://www.apache.org/httpd.xxx.tar.gz (建议安装apache最新版本)
./configure --prefix=/app/apache --enable-rewrite --enable-so --with-mpm=worker --with-threads=yes --enable-headers --enable

-deflate --enable-cache --enable-disk-cache --enable-mem-cache;make ;make install

6) 检查mod_rewrite.so模块支持
su -apache
cd ./bin/
./httpd -l | grep mod_rewrite
没有得话可以手工生成但是要有apache对应现有apache版本得源代码

7) 手工编译mod_rewrite.so文件
cd $http_xxx/modules/mappers/
/app/apache/bin/apxs -c mod_rewrite.c
gcc -shared -o mod_rewrite.so mod_rewrite.o
/app/apache/bin/apxs -i -A -n rewrite mod_rewrite.so

8) 增加防止跨网站攻击配置
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
9) 配置ServeName
ServerName xxx.xxx.xxx.xxx:80 //防火墙上对外IP
10) 关闭目录列表并支持include
Options Indexes FollowSymLinks
--> Options Includes FollowSymLinks
11) 删除或屏蔽maual相关小节
12) 删除或屏蔽cgi-bin相关小节
13) 禁止访问WEB-INF

AllowOverride None
Deny from all

14) 禁止其它机器访问logs目录

Options None
AllowOverride None
Deny from All
Allow from localhost

15) 删除或屏蔽cgi-bin相关小节

AllowOverride None
Deny from all

16) 关闭apache版本显示
ServerSignature Off
ServerTokens Prod

17) 关闭apache 413错误:
操作打开413
# ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
修改
ErrorDocument 413 "SYSTEM IS BUSY ... "

18) 静默方式启动apache(当前http保持以前配置,新得http请求用新得配置)
cd /app/apache/bin/
./apachectl -k graceful

19) apache非root帐号启动配置
vi /etc/sudoers
增加
tomcat ALL=(ALL) NOPASSWD: /app/apache/bin/apachectl start,/app/apache/bin/apachectl stop,/app/apache/bin/apachectl graceful
tomcat ALL=(ALL) NOPASSWD: /usr/bin/killall -9 monitor,/root/start.sh

4. Tomcat配置:
Tomcat主目录:/app/tomcat
字符集配置:
linux:
export LANG=zh_CN.GBK
AIX
LANG=zh_CN
export LANG
环境变量及启动参数:
JAVA_OPTS='-Xms2048m -Xmx2048m'
CATALINA_OPTS='-Djava.awt.headless=true'
或者
JAVA_OPTS='-Xms512m -Xmx512m -XX:PermSize=256M -XX:MaxPermSize=256m -Djava.awt.headless=true';export JAVA_OPTS

配置tomcat服务器参数
vi $TOMCAT_HOME/conf/server.xml
注意根据内存不同调整maxThreads大小
maxThreads="500" minSpareThreads="25" maxSpareThreads="75"
acceptCount="50" connectionTimeout="20000" disableUploadTimeout="true"
enableLookups="false" redirectPort="8443" debug="0"
protocol="AJP/1.3" />
成
maxThreads="1000" minSpareThreads="25" maxSpareThreads="75"
acceptCount="200" disableUploadTimeout="true"
enableLookups="false" redirectPort="8443" debug="0"
protocol="AJP/1.3" />

注意在hn项目里面AIX操作系统中jvm虚拟机中加"-XX:PermSize=256M -XX:MaxPermSize=256m" 参数报错

1)禁止tomcat目录列表
su - tomcat
cd conf/
vi web.xml

listings
true

成

listings
false

重起tomcat
2) 修改tomat默认首页
修改或删除webapps/ROOT/WEB-INF/web.xml文件

3) apache桥接tomcat时,用$APACHE_HOME/htdocs做apache访问得静态路径,tomcat默认根路径$TOMCAT_HOME/webapps/ROOT删除
写同步程序同步tomcat得默认根路径到 $APACHE_HOME/htdocs
/etc/rsyncd.conf<uid = tomcat
gid = app
max connections = 50
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
log file = /var/log/rsyncd.log

[app]
path = /app/apache/htdocs
comment = html, jpg, swf
read only = no
EOF

配置rsyncd服务端
vi /etc/xinetd.d/rsync
disable = no
成
disable = yes

启动rsyncd服务
service xinetd reload
可以使用命令行或写成脚本同步程序到$APACHE_HOME/htdocs
rsync -azv $TOMCAT_HOME/webapps/ROOT/ $APACHE_HOME/htdocs/ --exclude WEB-INF --exclude *.jsp
--exclude *.tar --exclude *.gz --exclude *.sh --exclude logs

5. weblogic安装配置

6. websphere安装
启用websphere的认证机制要用root帐号启动websphere程序

7. oracle安装
export LD_ASSUME_KERNEL=2.4.20
export ORACLE_BASE=/export/home/oracle
export ORACLE_HOME=$ORACLE_BASE/9i
export ORACLE_SID=ECOM
export ORACLE_TERM=xterm
export ORA_NLS33=$ORACLE_HOME/ocommon/nls/admin/data
export LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib:/usr/openwin/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/td/lib:/usr/ucblib:/usr/local/lib
export PATH=$PATH:$ORACLE_HOME/bin
export CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib
export CLASSPATH=$CLASSPATH:$ORACLE_HOME/network/jlib
export LANG=zh_CN
export NLS_LANG="SIMPLIFIED CHINESE_CHINA.ZHS16GBK" ; export NLS_LANG
export PATH=$PATH:$ORACLE_BASE/9i/bin

==========================
用户的home目录生成login.sql <set pages 40
set lines 160
col username for a20
col DEFAULT_TABLESPACE for a20
col TEMPORARY_TABLESPACE for a10
col file_name for a60
set timing on
EOF
=========================
数据库监控脚本
#!/bin/sh
sqlplus $1/$2@$3 <set feed off
set lines 130
set pagesize 999
col TS_name format a13
col TS_place format a48
spool $4.txt
select b.file_id ID,b.FILE_NAME TS_place,b.tablespace_name TS_name,b.bytes BYTES,b.MAXBYTES,
(b.bytes-sum(nvl(a.bytes,0))) USED,sum(nvl(a.bytes,0)) surplus,
sum(nvl(a.bytes,0))/(b.bytes)*100 surplus_pre
from dba_free_space a,dba_data_files b
where a.file_id=b.file_id
group by b.tablespace_name,b.file_id,b.bytes,b.FILE_NAME,b.MAXBYTES
order by b.file_id;
prompt FSFI
rem fsfi value compute
rem fsfi.sql
column fsfi format 999,99
select tablespace_name,sqrt(max(blocks)/sum(blocks))*
(100/sqrt(sqrt(count(blocks)))) fsfi
from dba_free_space
group by tablespace_name order by 1;
rem spool fsfi.rep;
rem /
rem spool off;
spool off
exit
EOF
===========================
系统性能监控(linux)
#!/bin/sh
#/var/log/system_monitor
#/var/log/root.cron
#0,5,10,15,20,25,30,35,40,45,50,55 * * * * /var/log/system/system_monitor&
day=`date +%m%d%Y`
file="/var/log/system/sysinfo$day"
if [ -f $file ]; then
echo "ok">/dev/null
else
echo " date cpu mem load average sessions">>$file
echo " user system idle free 1 5 15">>$file
echo "">>$file
fi
time=`date '+%m%d %H:%M:%S '`
load=`uptime |grep load|sed s/,/ /g | sed s/:/ /g | awk '{printf "%10s %6s %6s",$13,$14,$15}'`
cpu=`vmstat 1 2 | sed -n '$p' |awk '{printf "%8s %6s %9s", $13,$14,$15}'`
real=`free | grep buffers | tail +2 | awk '{print $4}'`
httpd_number=`ps -ef|grep httpd|grep -v grep|wc -l|awk '{printf "%9d",$1}'`
app_number=`ps -ef H|grep "java"|grep -v grep | wc -l`
oracle_number=`ps -ef|grep "LOCAL=NO"|grep -v grep|wc -l|awk '{printf "%9d",$1}'`
echo "$time $cpu $real$load$httpd_number+$app_number+$oracle_number" >>$file
=============================