apache2.4
RemoteIPHeader X-Real-IP RemoteIPTrustedProxy 127.0.0.1
apache2.2
Не требует никакой настройки, достаточно скомпилировать и установить. При необходимости можно изменить заголовок с X-Real-IP на желаемый.
# apxs -a -i -c mod_realip.c
#include "httpd.h" #include "http_config.h" #include "apr_strings.h" module AP_MODULE_DECLARE_DATA realip_module; static int change_remote_ip(request_rec *r) { const char *fwdvalue; char *val; if (fwdvalue = apr_table_get(r->headers_in, "X-Real-IP")) { apr_array_header_t *arr = apr_array_make(r->pool, 0, sizeof(char*)); while (*fwdvalue && (val = ap_get_token(r->pool, &fwdvalue, 1))) { *(char **)apr_array_push(arr) = apr_pstrdup(r->pool, val); if (*fwdvalue != '\0') ++fwdvalue; } r->connection->remote_ip = apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]); r->connection->remote_addr->sa.sin.sin_addr.s_addr = inet_addr(r->connection->remote_ip); } return DECLINED; } static void register_hooks(apr_pool_t *p) { ap_hook_post_read_request(change_remote_ip, NULL, NULL, APR_HOOK_FIRST); } module AP_MODULE_DECLARE_DATA realip_module = { STANDARD20_MODULE_STUFF, NULL, NULL, NULL, NULL, NULL, register_hooks, };
# sed 's/remote_ip/client_ip/g;s/remote_addr/client_addr/g' -i mod_realip.c
diff -Nru oops-1.5.23.orig/src/lib/rwlock/rwlock.c oops-1.5.23/src/lib/rwlock/rwlock.c --- oops-1.5.23.orig/src/lib/rwlock/rwlock.c 2000-11-29 19:03:35.000000000 +0200 +++ oops-1.5.23/src/lib/rwlock/rwlock.c 2006-09-06 00:30:36.000000000 +0300 @@ -53,6 +53,8 @@ #include <pthread.h> #include "rwlock.h" +#if defined(OOPS_IMPLEMENT_RWLOCK) + /* maximum number of times a read lock may be obtained */ #define MAX_READ_LOCKS (INT_MAX - 1) @@ -375,4 +377,6 @@ return(0); } +#endif /* defined(OOPS_IMPLEMENT_RWLOCK) */ + #endif /* _THREAD_SAFE || _PTHREADS || _REENTRANT */ diff -Nru oops-1.5.23.orig/src/lib/rwlock/rwlock.h oops-1.5.23/src/lib/rwlock/rwlock.h --- oops-1.5.23.orig/src/lib/rwlock/rwlock.h 2003-10-06 17:15:40.000000000 +0300 +++ oops-1.5.23/src/lib/rwlock/rwlock.h 2006-09-06 00:29:46.000000000 +0300 @@ -53,6 +53,7 @@ #if !defined(PTHREAD_RWLOCK_INITIALIZER) #define PTHREAD_RWLOCK_INITIALIZER NULL +#define OOPS_IMPLEMENT_RWLOCK 1 struct pthread_rwlock { pthread_mutex_t lock; /* monitor lock */
Переписать этот ужас.
Только Debian. Пользователь, которому принадлежат сайты, должен быть предварительно создан.
#!/bin/bash function read_domain { if [[ -z $domain ]]; then echo -n "Provide domain to add: " read domain fi } function read_user { if [[ -z $user ]]; then echo -n "Provide domain's owner login: " read user fi } function read_logs { if [[ -z $logs ]]; then echo -n "Enable access/error logs? [y/N]: " read logs fi case $logs in y*|Y*) LOGS=1 ;; *) unset $logs ;; esac } function init_vars { #### BASE SETTINGS #### CLIENTS_HOME="/home/clients" DOMAIN_DIR="/home/clients/$user/domains/$domain" DOCROOT="$DOMAIN_DIR/html" LOGSDIR="$DOMAIN_DIR/logs" TMPCONFDIR="/opt/scripts/www_configs" # can be set as IP='111.111.111.111' IP=`ip route get 8.8.8.8 | head -1 | awk '{print $NF}'` if [[ ! -d $TMPCONFDIR ]]; then mkdir -p $TMPCONFDIR fi if [[ -z `id $user` ]]; then echo "You need to create user '$user' first!" exit 1 fi if [[ ! -d $DOCROOT ]]; then mkdir -p $DOCROOT chown -R $user:$user $DOCROOT fi if [[ ! -d $LOGSDIR ]]; then mkdir -p $LOGSDIR fi } function generate_apache_vhost { if [[ $logs ]]; then local log_block="LogLevel warn ErrorLog $LOGSDIR/apache_error_log CustomLog $LOGSDIR/apache_access_log combined" fi if [[ $domain ]] && [[ $user ]]; then cat > $TMPCONFDIR/apache.$domain << EOF <VirtualHost 127.0.0.1:82> <IfModule mpm_itk_module> AssignUserId $user $user </IfModule> ServerName $domain ServerAlias www.$domain ServerAdmin $user@$domain DocumentRoot $DOCROOT <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory $DOCROOT> Options -Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all </Directory> ScriptAlias /cgi-bin/ $DOCROOT/cgi-bin/ <Directory "$DOCROOT/cgi-bin/"> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all </Directory> $log_block </VirtualHost> EOF fi } function generate_nginx_vhost { if [[ $logs ]]; then local log_block="access_log $LOGSDIR/nginx_access_log; error_log $LOGSDIR/nginx_error_log;" fi if [[ $domain ]] && [[ $user ]]; then cat > $TMPCONFDIR/nginx.$domain << EOF server { listen 80; server_name $domain www.$domain; root $DOCROOT; location / { proxy_pass http://127.0.0.1:82/; proxy_redirect off; proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_max_temp_file_size 0; client_max_body_size 10m; client_body_buffer_size 128k; proxy_connect_timeout 90; proxy_send_timeout 90; proxy_read_timeout 90; proxy_buffer_size 4k; proxy_buffers 4 32k; proxy_busy_buffers_size 64k; proxy_temp_file_write_size 64k; } location ~* ^.+.(jpg|gif|png|avi|mpg|zip|exe)$ { root $DOCROOT; } $log_block } EOF fi } function generate_named_vhost { serial=`/bin/date +"%Y%m%d%k"` cat >$TMPCONFDIR/named.$domain<< EOF \$TTL 10800 @ IN SOA ns1.$domain. root.$domain. ( $serial ; serial 10800 ; refresh 3600 ; retry 604800 ; expire 3600 ) ; minimum ; NS IN NS ns1.$domain. IN NS ns2.$domain. ; MX IN MX 10 mx1.$domain. ; records ns1 IN A $IP ns2 IN A $IP mx1 IN A $IP www IN A $IP $domain. IN A $IP EOF } function enable_apache_vhost { if [[ -f "/etc/apache2/sites-available/${domain}.conf" ]]; then echo "Domain $domain already exists in /etc/apache2/sites-available/${domain}.conf" exit 1 else cp $TMPCONFDIR/apache.$domain /etc/apache2/sites-available/${domain}.conf a2ensite $domain if [[ -z `apache2ctl configtest` ]]; then /etc/init.d/apache2 reload echo "$domain enabled!" else echo "Errors detected, please solve it manually!" exit 1 fi fi } function enable_nginx_vhost { if [[ -f "/etc/nginx/sites-available/$domain" ]]; then echo "Domain $domain already exists in /etc/nginx/sites-available/$domain" exit 1 else cp $TMPCONFDIR/nginx.$domain /etc/nginx/sites-available/$domain ln -s /etc/nginx/sites-available/$domain /etc/nginx/sites-enabled/$domain if [[ -z `nginx -t` ]]; then /etc/init.d/nginx reload echo "$domain enabled!" else echo "Errors detected, please solve it manually!" exit 1 fi fi } function enable_named_vhost { [[ -d "/etc/bind/zones" ]] || mkdir -p "/etc/bind/zones" if [[ -f "/etc/bind/zones/$domain.conf" ]]; then echo "Zone $domain already exists in /etc/bind/zones/$domain.conf" exit 1 else cp $TMPCONFDIR/named.$domain /etc/bind/zones/$domain.conf cat >>/etc/bind/named.conf.local<< EOF zone "$domain" { type master; file "/etc/bind/zones/$domain.conf"; }; EOF if [[ -z `/usr/sbin/named-checkconf` && -z `/usr/sbin/named-checkzone -q $domain /etc/bind/zones/$domain.conf` ]] ; then /usr/sbin/rndc reload echo "bind9: $domain enabled" else echo "Errors detected, please solve it manually!" exit 1 fi fi } function enable_logrotate { if [[ ! -d "/etc/logrotate.d/vhosts" ]]; then mkdir -p /etc/logrotate.d/vhosts fi cat > $TMPCONFDIR/logrotate.$domain << EOF $LOGSDIR/*_log { daily missingok rotate 52 compress delaycompress notifempty create 0644 root root sharedscripts prerotate if [ -d /etc/logrotate.d/httpd-prerotate ]; then \\ run-parts /etc/logrotate.d/httpd-prerotate; \\ fi; \\ endscript postrotate /etc/init.d/apache2 reload > /dev/null [ ! -f /var/run/nginx.pid ] || kill -USR1 `cat /var/run/nginx.pid` endscript } EOF if [[ $logs ]]; then # install logrotate if [[ -f "/etc/logrotate.d/vhosts/$domain" ]]; then echo "Domain $domain already exists in /etc/logrotate.d/vhosts/$domain" exit 1 else cp $TMPCONFDIR/logrotate.$domain /etc/logrotate.d/vhosts/$domain fi fi } read_domain read_user read_logs init_vars generate_apache_vhost generate_nginx_vhost generate_named_vhost enable_apache_vhost enable_nginx_vhost enable_named_vhost enable_logrotate
Необходимо предварительно создать пользователя http
#!/bin/bash echo -n "Введите имя сайта: " read domain # СОЗДАНИЕ ДИРЕКТОРИИ mkdir -p /home/http/domains/$domain/html/cgi-bin chown -R http:http /home/http/domains/$domain/html # СОЗДАНИЕ КОНФИГА ВИРТХОСТА ДЛЯ АПАЧА cat >/etc/apache2/sites-available/$domain << EOF <VirtualHost *:80> ServerName $domain ServerAlias www.$domain DocumentRoot /home/http/domains/$domain/html ErrorLog /dev/null ScriptAlias /cgi-bin/ "/home/http/domains/$domain/html/cgi-bin/" <Directory "/cgi-bin/"> AllowOverride None Options None +FollowSymLinks ExecCGI DirectoryIndex index.pl </Directory> <Directory /> Options All -Indexes AllowOverride All </Directory> </VirtualHost> EOF # ВКЛЮЧЕНИЕ ВИРТХОСТА /usr/sbin/a2ensite $domain /etc/init.d/apache2 reload # СОЗДАНИЕ ФАЙЛА ДНС-ЗОНЫ serial=`/bin/date +"%Y%m%d%k"` cat >/etc/bind/zones/$domain<< EOF \$TTL 10800 @ IN SOA ns1.$domain. root.$domain. ( $serial ; serial 10800 ; refresh 3600 ; retry 604800 ; expire 3600 ) ; minimum ; NS IN NS ns1.$domain. IN NS ns2.$domain. ; MX IN MX 10 mx1.$domain. ; records ns1 IN A 95.169.190.217 ns2 IN A 95.169.191.217 www IN A 95.169.191.217 $domain. IN A 95.169.191.217 EOF # СОЗДАНИЕ ЗАПИСИ О ДНС-ЗОНЕ cat >>/etc/bind/named.conf.local<< EOF zone "$domain" { type master; file "/etc/bind/zones/$domain"; }; EOF # ВКЛЮЧЕНИЕ ЗОНЫ /usr/sbin/rndc reload
Костыль проверяет количество чайлдов апача, если это количество меньше значения директивы MinSpareServers, то прибивает все процессы вебсервера через kill -9, чистит семафоры и стартует апач. Добавить в крон на каждую минуту.
* * * * * /opt/scripts/apache/apache_checker.sh check
# mkdir /opt/scripts/apache
#!/bin/sh ALERTEMAIL="[email protected]" APACHECTL=/usr/sbin/apache2ctl SCRIPT_DIR=/opt/scripts/apache RUNNING_PROCESSES=`ps auxww | grep -c bin/apache`; APACHEUSER="www-data" MinSpareServers="24" ######## [DO NOT MODIFY] ### LOG_FILE=${SCRIPT_DIR}/status.log DATE=`date '+%Y-%m-%d %T'` apache_start() { $APACHECTL start; } apache_stop() { $APACHECTL stop; sleep 1; killall -9 apache httpd apache2 >/dev/null 2>&1; } apache_restart() { apache_stop; sleep 1; apache_semclear; apache_start; } # if not running - start apache_check() { if [[ ${RUNNING_PROCESSES} -le $MinSpareServers ]]; then apache_restart; echo "${DATE} ALERT: `hostname -f` - apache was restarted" >> ${LOG_FILE}; echo "${DATE} ALERT: `hostname -f` - apache was restarted" | /usr/sbin/sendmail $ALERTEMAIL; fi } # clear semaphores apache_semclear() { for i in `ipcs | grep $APACHEUSER | awk -F ' ' '{ print $2}'` do ipcrm -s $i; done } case $1 in start) apache_start; ;; stop) apache_stop; ;; restart) apache_restart; ;; check) apache_check; ;; semclear) apache_semclear; ;; *) echo "Script usage: $0 start | stop | restart | check | semclear"; esac
Работает под debian.
# mkdir -p /opt/scripts/monitoring/active_alerts
Скрипт ложить в /opt/scripts/monitoring/checker.sh
#!/bin/bash SCRIPT_DIR=/opt/scripts/monitoring LOG_FILE=${SCRIPT_DIR}/status.log PHONES="80501234567 80507654321" CURDATE=`/bin/date +"%s"`; function alert { for i in $PHONES; do echo "$1 $2 $3" | /usr/sbin/sendmail -fmonitoring@monitoring ${i}@sms.mysmsgate.com; done } function check { cat $SCRIPT_DIR/targets | while read ip server; do /usr/bin/wget -T 5 --tries=3 -q -O - http://${ip}/.do_not_remove.php | grep SUCCESS >/dev/null; if [[ $? == 0 ]]; then if [[ -e $SCRIPT_DIR/active_alerts/$server ]]; then cat $SCRIPT_DIR/active_alerts/$server | while read startdate; do DATE=`/bin/date +"%F %T"`; let "i = $CURDATE - $startdate"; lenght=`/bin/date -u +"%T" --date=@${i}`; alert "$DATE" $server "is UP, downtime is $lenght"; echo "$DATE" $server "is UP, downtime is $lenght" > $LOG_FILE rm -f $SCRIPT_DIR/active_alerts/$server done fi else if [[ -e $SCRIPT_DIR/active_alerts/$server ]]; then MINUTE=`/bin/date +"%M"` if [[ $MINUTE == 00 ]]; then cat $SCRIPT_DIR/active_alerts/$server | while read startdate; do DATE=`/bin/date +"%F %T"`; let "i = $CURDATE - $startdate"; lenght=`/bin/date -u +"%T" --date=@${i}`; alert "$DATE" $server "down for $lenght"; done fi else echo $CURDATE > $SCRIPT_DIR/active_alerts/$server; DATE=`/bin/date +"%F %T"`; alert "$DATE" $server "is DOWN"; echo "$DATE" $server "is UP, downtime is $lenght" > $LOG_FILE fi fi done } check
local <HOST IP> port 1194 proto tcp dev tun ca /usr/local/etc/openvpn/ca.crt cert /usr/local/etc/openvpn/server.crt key /usr/local/etc/openvpn/server.key dh /usr/local/etc/openvpn/dh1024.pem server 192.168.78.0 255.255.255.0 ifconfig-pool-persist /usr/local/etc/openvpn/ips push "redirect-gateway" auth-user-pass-verify /usr/local/etc/openvpn/auth.pl via-env client-cert-not-required username-as-common-name keepalive 100 120 comp-lzo client-config-dir /usr/local/etc/openvpn/ccd max-clients 250 persist-key persist-tun status /usr/local/etc/openvpn/openvpn-status.log verb 3
#!/usr/bin/perl use strict; my $passwdfile = "/usr/local/etc/openvpn/users"; my $isValidUser = 0; my $username; my $password; my $thisUsername = $ENV{'username'}; my $thisPassword = $ENV{'password'}; open (PASSWORDS,"$passwdfile") or die "can't find file: $passwdfile : $!\n"; while (<PASSWORDS>) { ($username,$password)= split (/:/, $_); chomp $username; chomp $password; if ($username eq $thisUsername && $password eq $thisPassword) { $isValidUser = 1; last; } } close PASSWORDS; if ($isValidUser == 1) { print "ERR\n"; exit 1; } else { print "OK\n"; exit 0; }
client dev tun proto tcp remote <HOST IP> 1194 resolv-retry infinite nobind persist-key persist-tun pull auth-user-pass ca ca.crt comp-lzo verb 3
login:password
Имя файла должно полностью совпадать с login. Для нормальной работы openvpn-клиента под windows - IP шлюза и серый IP клиента должны быть из одной /30 подсети. Под linux/BSD таких ограничений нет.
ifconfig-push 192.168.78.CIENT_IP 192.168.78.VPN_GATEWAY