分类目录归档：Linux

HTTPS证书生成和一些基础知识

2016年5月14日 chen

HTTPS 区别于 HTTP，它多了加密(encryption)，认证(verification)，鉴定(identification)。它的安全源自非对称加密以及第三方的 CA 认证。

CA 数字证书认证中心

举个栗子

普通的介绍信

假设 A 公司的张三先生要到 B 公司去拜访，但是 B 公司的所有人都不认识他，他咋办捏？

常用的办法是带公司开的一张介绍信，在信中说：兹有张三先生前往贵公司办理业务，请给予接洽……云云。

然后在信上敲上A公司的公章。

张三先生到了 B 公司后，把介绍信递给 B 公司的前台李四小姐。李小姐一看介绍信上有 A 公司的公章，而且A公司是经常和 B 公司有业务往来的，这位李小姐就相信张先生不是歹人了。

引入中介机构的介绍信

好，回到刚才的话题。如果和 B 公司有业务往来的公司很多，每个公司的公章都不同，那前台就要懂得分辨各种公章，非常滴麻烦。

所以，有某个中介公司 C，发现了这个商机。C公司专门开设了一项“代理公章”的业务。

今后，A 公司的业务员去B公司，需要带2个介绍信：
　　介绍信1
　　含有 C 公司的公章及 A 公司的公章。并且特地注明：C 公司信任A公司。
　　
　　介绍信2
　　仅含有 A 公司的公章，然后写上：兹有张三先生前往贵公司办理业务，请给予接洽……云云。

这样不是增加麻烦了吗？有啥好处捏？

主要的好处在于，对于接待公司的前台，就不需要记住各个公司的公章分别是啥样子的；他/她只要记住中介公司 C 的公章即可。

当他/她拿到两份介绍信之后，先对“介绍信1”的 C 公章，验明正身；确认无误之后，再比对“介绍信1”和“介绍信2”的两个 A 公章是否一致。如果是一样的，那就可以证明“介绍信2”是可以信任的了。

在上面的栗子中，C公司就是 CA认证中心。介绍信就是CA认证。

CA 认证分为三类：

DV（Domain Validation），面向个体用户，安全体系相对较弱，验证方式就是向 whois 信息中的邮箱发送邮件，按照邮件内容进行验证即可通过；
OV（Organization Validation），面向企业用户，证书在 DV 证书验证的基础上，还需要公司的授权，CA 通过拨打信息库中公司的电话来确认；
EV（Extended Validation），打开 Github 的网页，你会看到 URL 地址栏展示了注册公司的信息，这会让用户产生更大的信任，这类证书的申请除了以上两个确认外，还需要公司提供金融机构的开户许可证，要求十分严格。

生成密钥、证书

具体操作前，还要先说一些基本概念：

.pem：这是一个集合格式。公钥和私钥都是这个格式。为了区分一般私钥用.key后缀，公钥用.pub后缀。
.csr：这个后缀的全称是Certificate Signing Request，即是证书签名请求文件。有一些应用可以通过向证书颁发机构certificate-authorities提交请求，来生成这个文件。这个文件实际的格式是 PKCS10 。它包括了证书请求的所有的相关细节信息，包括 subject ,orginataion,state,whatnot,以及证书的公钥，之后csr文件会被提交给ca，ca在其基础上进行数字签名，将签名之后的文件返回过来，这个返回过来的文件就是公钥文件（其中包含了public key不包含private key）。这个返回回来的文件也可以有多种格式。可以用如下的命令查看相关信息openssl req -text -noout -in yourcsrfile.csr。
.pkcs12 .pkx .p12最初被RSA定义在 Public-Key Cryptography Stantard 中，变量12表示这个是被Microsoft加强过的。这个格式同时包含公钥和私钥证书对，不同于.pem文件，这个格式的文件是被加密过的，Openssl可以把这个格式的文件转化成为同时包含公钥和私钥信息的文件：openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes
.crt .cer .cert 实质上是.pem（准确的说是.der）格式的文件的不同扩展。以这些后缀结尾的文件，会被windows的浏览器默认为是证书文件，而.pem不会被这样认出。
.der是另一种证书格式，它根据ASN1 DER 格式来存储，ASN1全称Abstract Syntax Notation One也是一种对于数据表示，编码以及传输的数据格式。.pem实际上是采用base64加密之后的.der文件。openssl也可以把.der文件转化成为.pem文件openssl x509 -inform der -in to-convert.der -out converted.pem

具体操作

第一部生成CA证书

# 生成 CA 私钥
openssl genrsa -out ca.key 2048

# X.509 Certificate Signing Request (CSR) Management.
openssl req -new -key ca.key -out ca.csr

# 会进行交互填写信息
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN # 国家
State or Province Name (full name) [Some-State]:Shanghai # 省
Locality Name (eg, city) []:Shanghai # 市
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCCA # 后面生成客户端和服务器端证书的时候也需要填写，不要写成一样的
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:localhost # 域名，如果是为了给网站生成证书，需要写成 xxxx.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:


# X.509 Certificate Data Management.
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt

# 生成 CA 私钥

openssl genrsa -out ca.key 2048

# X.509 Certificate Signing Request (CSR) Management.

openssl req -new -key ca.key -out ca.csr

# 会进行交互填写信息

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:CN # 国家

State or Province Name (full name) [Some-State]:Shanghai # 省

Locality Name (eg, city) []:Shanghai # 市

Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCCA # 后面生成客户端和服务器端证书的时候也需要填写，不要写成一样的

Organizational Unit Name (eg, section) []:

Common Name (e.g. server FQDN or YOUR name) []:localhost # 域名，如果是为了给网站生成证书，需要写成 xxxx.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

# X.509 Certificate Data Management.

openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt

现在目录里面会有三个文件，更具上面的基础知识的描述，可以知道这些什么是文件

root@chen-Ubuntu:/home/chen/test/openssl# ll
总用量 20
drwxr-xr-x  2 root root 4096 5月  14 17:25 ./
drwxrwxrwx 18 chen chen 4096 5月  12 21:03 ../
-rw-r--r--  1 root root 1155 5月  14 17:25 ca.crt # 证书文件
-rw-r--r--  1 root root  980 5月  14 17:22 ca.csr # 证书签名请求文件
-rw-r--r--  1 root root 1675 5月  14 17:13 ca.key # 私钥

root@chen-Ubuntu:/home/chen/test/openssl# ll

总用量 20

drwxr-xr-x 2 root root 4096 5月 14 17:25 ./

drwxrwxrwx 18 chen chen 4096 5月 12 21:03 ../

-rw-r--r-- 1 root root 1155 5月 14 17:25 ca.crt # 证书文件

-rw-r--r-- 1 root root 980 5月 14 17:22 ca.csr # 证书签名请求文件

-rw-r--r-- 1 root root 1675 5月 14 17:13 ca.key # 私钥

第一步，为服务器端准备公钥、私钥

# 生成服务器端私钥
openssl genrsa -out server.key 2048
# 生成服务器端公钥
openssl rsa -in server.key -pubout -out server.pub

# 生成服务器端私钥

openssl genrsa -out server.key 2048

# 生成服务器端公钥

openssl rsa -in server.key -pubout -out server.pub

目录里多了2个服务端的公钥和私钥

root@chen-Ubuntu:/home/chen/test/openssl# tree
.
├── ca.crt
├── ca.csr
├── ca.key
├── server.key # 私钥
└── server.pub # 公钥

root@chen-Ubuntu:/home/chen/test/openssl# tree

├── ca.crt

├── ca.csr

├── ca.key

├── server.key # 私钥

└── server.pub # 公钥

第三步，生成服务器端证书

# 服务器端需要向 CA 机构申请签名证书，在申请签名证书之前依然是创建自己的 CSR 文件
openssl req -new -key server.key -out server.csr

# 会进行交互
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shanghai
Locality Name (eg, city) []:Shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCSERVER
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:


# 向自己的 CA 机构申请证书，签名过程需要 CA 的证书和私钥参与，最终颁发一个带有 CA 签名的证书
openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt

# 服务器端需要向 CA 机构申请签名证书，在申请签名证书之前依然是创建自己的 CSR 文件

openssl req -new -key server.key -out server.csr

# 会进行交互

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:Shanghai

Locality Name (eg, city) []:Shanghai

Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCSERVER

Organizational Unit Name (eg, section) []:

Common Name (e.g. server FQDN or YOUR name) []:localhost

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

# 向自己的 CA 机构申请证书，签名过程需要 CA 的证书和私钥参与，最终颁发一个带有 CA 签名的证书

openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt

这次多了三个文件

├── ca.crt
├── ca.csr
├── ca.key
├── ca.srl
├── server.crt # 证书签名请求文件
├── server.csr # 服务端证书
├── server.key
└── server.pub

├── ca.crt

├── ca.csr

├── ca.key

├── ca.srl

├── server.crt # 证书签名请求文件

├── server.csr # 服务端证书

├── server.key

└── server.pub

另外多出来的ca.srl是什么文件呢？

是用来存储证书序列号文件的。

Nginx 部署

在nginx配置的server中加上如下配置：

listen 443 ssl;

ssl on;
ssl_certificate /home/chen/test/openssl/server.crt;
ssl_certificate_key /home/chen/test/openssl/server.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";

listen 443 ssl;

ssl on;

ssl_certificate /home/chen/test/openssl/server.crt;

ssl_certificate_key /home/chen/test/openssl/server.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";

重启后就可以正常访问了。但是很由于CA证书是我们自己签发的，浏览器并不认可，所以会进行警告。

双向认证

在项目中为了数据传输的安全性，我们就可以加上ssl认证。比如：移动端请求服务端的认证加密，以及内部服务的认证加密都可以使用。

第一步，既然是双向认证，那么我们同样需要为客户端生成一套密钥。

openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr

# 交互
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shanghai
Locality Name (eg, city) []:Shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCCLIENT
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in client.csr -out client.crt

openssl genrsa -out client.key 2048

openssl req -new -key client.key -out client.csr

# 交互

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:Shanghai

Locality Name (eg, city) []:Shanghai

Organization Name (eg, company) [Internet Widgits Pty Ltd]:CCCLIENT

Organizational Unit Name (eg, section) []:

Common Name (e.g. server FQDN or YOUR name) []:localhost

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in client.csr -out client.crt

第二步，nginx启用双向认证。

listen 443 ssl;

ssl on;
ssl_certificate /home/chen/test/openssl/server.crt;
ssl_certificate_key /home/chen/test/openssl/server.key;
ssl_client_certificate /home/chen/test/openssl/ca.crt; # ca证书
ssl_verify_client on; # 启用验证客户端
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";
# Add perfect forward secrecy
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

listen 443 ssl;

ssl on;

ssl_certificate /home/chen/test/openssl/server.crt;

ssl_certificate_key /home/chen/test/openssl/server.key;

ssl_client_certificate /home/chen/test/openssl/ca.crt; # ca证书

ssl_verify_client on; # 启用验证客户端

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

# Add perfect forward secrecy

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

第三步，客户端。

function curl_ssl($url, $vars, $second=30,$aHeader=array())
{
    $ch = curl_init();
    //curl_setopt($ch,CURLOPT_VERBOSE,'1');
    curl_setopt($ch,CURLOPT_TIMEOUT,$second);
    curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_PORT,443);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($ch, CURLOPT_CAINFO,  '/home/chen/test/openssl/ca.crt');
    curl_setopt($ch, CURLOPT_SSLCERTTYPE, 'PEM');
    curl_setopt($ch, CURLOPT_SSLCERT, '/home/chen/test/openssl/client.crt');
    curl_setopt($ch,CURLOPT_SSLKEYTYPE,'PEM');
    curl_setopt($ch,CURLOPT_SSLKEY,'/home/chen/test/openssl/client.key');

    if( count($aHeader) >= 1 ){
            curl_setopt($ch, CURLOPT_HTTPHEADER, $aHeader);
    }


    $data = curl_exec($ch);
    curl_close($ch);
    if($data)
            return $data;
    else   
            return false;
}

var_dump(curl_ssl('https://localhost', []));

function curl_ssl($url, $vars, $second=30,$aHeader=array())

{

$ch = curl_init();

//curl_setopt($ch,CURLOPT_VERBOSE,'1');

curl_setopt($ch,CURLOPT_TIMEOUT,$second);

curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch,CURLOPT_URL,$url);

curl_setopt($ch,CURLOPT_PORT,443);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

curl_setopt($ch, CURLOPT_CAINFO, '/home/chen/test/openssl/ca.crt');

curl_setopt($ch, CURLOPT_SSLCERTTYPE, 'PEM');

curl_setopt($ch, CURLOPT_SSLCERT, '/home/chen/test/openssl/client.crt');

curl_setopt($ch,CURLOPT_SSLKEYTYPE,'PEM');

curl_setopt($ch,CURLOPT_SSLKEY,'/home/chen/test/openssl/client.key');

if( count($aHeader) >= 1 ){

curl_setopt($ch, CURLOPT_HTTPHEADER, $aHeader);

}

$data = curl_exec($ch);

curl_close($ch);

if($data)

return $data;

else

return false;

}

var_dump(curl_ssl('https://localhost', []));

执行

php client.php 
# 结果 hello world
string(12) "hello world
"

php client.php

# 结果 hello world

string(12) "hello world

但是这个时候用浏览器访问就会400错误。

这是我们可以为浏览器生成一个证书。然后让浏览器导入就可以访问了。

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
Enter Export Password:
Verifying - Enter Export Password:

# 会进行密码设置

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

Enter Export Password:

Verifying - Enter Export Password:

# 会进行密码设置

导入流程见下方

输入刚刚这只的密码即可

点击确认完成

刷新后，选择证书。

之后正常访问。

参考以及引用自：

http://wangzhezhe.github.io/blog/2015/08/05/httpsandgolang/
http://www.cnblogs.com/freespider/p/3622830.html
http://www.barretlee.com/blog/2015/10/05/how-to-build-a-https-server/
http://blog.csdn.net/jiangwlee/article/details/7724274

Linux

搭建HTTPS服务器

2016年1月1日 chen

一、申请https证书

StartSSL可以免费申请https证书，但是免费证书只能使用在一个域名中。

1、登录或注册账号

有账号就登录，没账号就注册。

选择地区、填写邮件，等待确认验证码。

安装浏览器证书

安装完成，点击选择证书，登录。

2、域名验证

选择Validations Wizard -> Domian Validation 域名验证

填写域名

等待获取域名信息，选择验证方式，输入验证码，确认验证，完毕。

3、申请证书

选择 Certificates -> Web Server SSL/TLS Certificate 网页服务器SSL认证

输入域名，以及密钥，点击提交。

系统会根据刚刚输入的密钥生成一个私钥，我们需要将其保存下来。

之后StartSSL就会通过我们的申请。我们只需要将其下载下来上传到服务器即可。

二、服务器配置

[root@root www.iter-cc.com]# ll
total 16
# startsl 为我们生成的私钥
-rw-r--r-- 1 root root  1838 Jan  1 18:57 my-private-encrypted.key
# startssl 通过审核的证书
-rw-r--r-- 1 root root 11673 Jan  1 18:56 www.iter-cc.com.zip

[root@root www.iter-cc.com]# ll

total 16

# startsl 为我们生成的私钥

-rw-r--r-- 1 root root 1838 Jan 1 18:57 my-private-encrypted.key

# startssl 通过审核的证书

-rw-r--r-- 1 root root 11673 Jan 1 18:56 www.iter-cc.com.zip

将www.iter-cc.com.zip解压后得到不同版本服务器的证书，我需要使用的是Nginx Server.zip

[root@root www.iter-cc.com]# unzip www.iter-cc.com.zip 
Archive:  www.iter-cc.com.zip
  inflating: IIS Server.zip          
  inflating: Apache Server.zip       
  inflating: Nginx Server.zip        
  inflating: Other Server.zip        
[root@root www.iter-cc.com]# ll
total 32
-rw-r--r-- 1 root root  2960 Jan  1 18:54 Apache Server.zip
-rw-r--r-- 1 root root  2962 Jan  1 18:54 IIS Server.zip
-rw-r--r-- 1 root root  1838 Jan  1 18:57 my-private-encrypted.key
-rw-r--r-- 1 root root  2529 Jan  1 18:54 Nginx Server.zip
-rw-r--r-- 1 root root  2962 Jan  1 18:54 Other Server.zip
-rw-r--r-- 1 root root 11673 Jan  1 18:56 www.iter-cc.com.zip

[root@root www.iter-cc.com]# unzip www.iter-cc.com.zip

Archive: www.iter-cc.com.zip

inflating: IIS Server.zip

inflating: Apache Server.zip

inflating: Nginx Server.zip

inflating: Other Server.zip

[root@root www.iter-cc.com]# ll

total 32

-rw-r--r-- 1 root root 2960 Jan 1 18:54 Apache Server.zip

-rw-r--r-- 1 root root 2962 Jan 1 18:54 IIS Server.zip

-rw-r--r-- 1 root root 1838 Jan 1 18:57 my-private-encrypted.key

-rw-r--r-- 1 root root 2529 Jan 1 18:54 Nginx Server.zip

-rw-r--r-- 1 root root 2962 Jan 1 18:54 Other Server.zip

-rw-r--r-- 1 root root 11673 Jan 1 18:56 www.iter-cc.com.zip

解压Nginx Server.zip

[root@root www.iter-cc.com]# unzip Nginx\ Server.zip 
Archive:  Nginx Server.zip
  inflating: 1_www.iter-cc.com_bundle.crt  
[root@root www.iter-cc.com]# ll
total 36
-rw-r--r-- 1 root root  3864 Jan  1 18:54 1_www.iter-cc.com_bundle.crt
-rw-r--r-- 1 root root  2960 Jan  1 18:54 Apache Server.zip
-rw-r--r-- 1 root root  2962 Jan  1 18:54 IIS Server.zip
# 得到my-private-encrypted.key 我们需要用的证书
-rw-r--r-- 1 root root  1838 Jan  1 18:57 my-private-encrypted.key
-rw-r--r-- 1 root root  2529 Jan  1 18:54 Nginx Server.zip
-rw-r--r-- 1 root root  2962 Jan  1 18:54 Other Server.zip
-rw-r--r-- 1 root root 11673 Jan  1 18:56 www.iter-cc.com.zip

[root@root www.iter-cc.com]# unzip Nginx\ Server.zip

Archive: Nginx Server.zip

inflating: 1_www.iter-cc.com_bundle.crt

[root@root www.iter-cc.com]# ll

total 36

-rw-r--r-- 1 root root 3864 Jan 1 18:54 1_www.iter-cc.com_bundle.crt

-rw-r--r-- 1 root root 2960 Jan 1 18:54 Apache Server.zip

-rw-r--r-- 1 root root 2962 Jan 1 18:54 IIS Server.zip

# 得到my-private-encrypted.key 我们需要用的证书

-rw-r--r-- 1 root root 1838 Jan 1 18:57 my-private-encrypted.key

-rw-r--r-- 1 root root 2529 Jan 1 18:54 Nginx Server.zip

-rw-r--r-- 1 root root 2962 Jan 1 18:54 Other Server.zip

-rw-r--r-- 1 root root 11673 Jan 1 18:56 www.iter-cc.com.zip

服务器配置

编辑nginx配置

server {
    listen 80;
    server_name www.iter-cc.com;
    return 301 https://$host$request_uri;
}

server
        {
                listen       443 ssl;
                server_name www.iter-cc.com iter-cc.com;

                ssl_certificate /path/to/ssl/1_www.iter-cc.com_bundle.crt;
                ssl_certificate_key /path/to/ssl/my-private-encrypted.key;
                # ...
                # ...

server {

listen 80;

server_name www.iter-cc.com;

return 301 https://$host$request_uri;

}

server

{

listen 443 ssl;

server_name www.iter-cc.com iter-cc.com;

ssl_certificate /path/to/ssl/1_www.iter-cc.com_bundle.crt;

ssl_certificate_key /path/to/ssl/my-private-encrypted.key;

# ...

当我们重启服务器的时候，系统会让我们输入刚刚生成密钥的命令

[root@root vhost]# /etc/init.d/nginx restart
Restarting nginx daemon: nginxEnter PEM pass phrase:

[root@root vhost]# /etc/init.d/nginx restart

Restarting nginx daemon: nginxEnter PEM pass phrase:

输入确认后即可完成。

访问网站，OK！

如果嫌每次重启服务器的时候需要输入密码比较烦，我们可以解密私钥。然后将nginx的路径指向解密后的密钥即可。

[root@root www.iter-cc.com]# openssl rsa -in my-private-encrypted.key -out my-private-decrypted.key
Enter pass phrase for my-private-encrypted.key:
writing RSA key

[root@root www.iter-cc.com]# openssl rsa -in my-private-encrypted.key -out my-private-decrypted.key

Enter pass phrase for my-private-encrypted.key:

writing RSA key

编辑服务器配置

server {
    listen 80;
    server_name www.iter-cc.com;
    return 301 https://$host$request_uri;
}

server
        {
                listen       443 ssl;
                server_name www.iter-cc.com iter-cc.com;

                ssl_certificate /path/to/ssl/1_www.iter-cc.com_bundle.crt;
                ssl_certificate_key /path/to/ssl/my-private-decrypted.key; # 修改这里
                # ...
                # ...

server {

listen 80;

server_name www.iter-cc.com;

return 301 https://$host$request_uri;

}

server

{

listen 443 ssl;

server_name www.iter-cc.com iter-cc.com;

ssl_certificate /path/to/ssl/1_www.iter-cc.com_bundle.crt;

ssl_certificate_key /path/to/ssl/my-private-decrypted.key; # 修改这里

# ...

之后重启服务器就可以无需密码。

[root@AY131115200127957482Z vhost]# /etc/init.d/nginx restart
Restarting nginx daemon: nginx.

[root@AY131115200127957482Z vhost]# /etc/init.d/nginx restart

Restarting nginx daemon: nginx.

访问网站确认ok！！！

Linux

搭建自己的邮件服务器

2016年1月1日 chen

一、配置域名解析

确认主域名有A记录指向服务器IP
添加一个邮件二级域名比如 mail.iter-cc.com 指向服务器ip
主域名下添加一则MX记录指向邮件二级域名 比如 mail.iter-cc.com。如果你作为邮件服务器的域名没有多个，那么MX优先级可以随便写，最高1，最低50，当优先级高的解析无效时，就会去解析低的。
添加一则txt记录作为SPF(Sender Policy Framework)。关于SPF的格式可以去http://www.openspf.org/SPF_Record_Syntax 查看。比如我设置的是

v=spf1 a mx ~all
# 就是除了我的A记录和MX记录外，如果有其他域发出邮件的话，那都是伪造的。

v=spf1 a mx ~all

# 就是除了我的A记录和MX记录外，如果有其他域发出邮件的话，那都是伪造的。

一下为我的域名解析

二、安装Postfix

yum -y install postfix
yum remove sendmail

yum -y install postfix

yum remove sendmail

安装完毕后进行配置

vim /etc/postfix/main.cf

1 2	vim /etc/postfix/main.cf

# 75行: 取消注释，设置hostname
myhostname = mail.iter-cc.com
# 83行: 取消注释，设置域名
mydomain = iter-cc.com
# 99行: 取消注释
myorigin = $mydomain
# 116行: 修改
inet_interfaces = all
# 119行: 推荐ipv4，如果支持ipv6，则可以为all
inet_protocols = ipv4
# 164行: 添加
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
# 264行: 取消注释，指定内网和本地的IP地址范围
mynetworks = 127.0.0.0/8, 10.0.0.0/24
# 419行: 取消注释，邮件保存目录
home_mailbox = Maildir/
# 571行: 添加
smtpd_banner = $myhostname ESMTP

# 添加到最后
# 规定邮件最大尺寸为10M
message_size_limit = 10485760
# 规定收件箱最大容量为1G
mailbox_size_limit = 1073741824

# 75行: 取消注释，设置hostname

myhostname = mail.iter-cc.com

# 83行: 取消注释，设置域名

mydomain = iter-cc.com

# 99行: 取消注释

myorigin = $mydomain

# 116行: 修改

inet_interfaces = all

# 119行: 推荐ipv4，如果支持ipv6，则可以为all

inet_protocols = ipv4

# 164行: 添加

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

# 264行: 取消注释，指定内网和本地的IP地址范围

mynetworks = 127.0.0.0/8, 10.0.0.0/24

# 419行: 取消注释，邮件保存目录

home_mailbox = Maildir/

# 571行: 添加

smtpd_banner = $myhostname ESMTP

# 添加到最后

# 规定邮件最大尺寸为10M

message_size_limit = 10485760

# 规定收件箱最大容量为1G

mailbox_size_limit = 1073741824

三、安装Dovecot

yum -y install dovecot

1 2	yum -y install dovecot

安装完毕后进行配置

vim /etc/dovecot/dovecot.conf

1 2	vim /etc/dovecot/dovecot.conf

# 26行: 如果不使用IPv6，请修改为*
listen = *

# 26行: 如果不使用IPv6，请修改为*

listen = *

vim /etc/dovecot/conf.d/10-auth.conf

1 2	vim /etc/dovecot/conf.d/10-auth.conf

# 9行: 取消注释并修改
disable_plaintext_auth = no
# 97行: 添加
auth_mechanisms = plain login

# 9行: 取消注释并修改

disable_plaintext_auth = no

# 97行: 添加

auth_mechanisms = plain login

vim /etc/dovecot/conf.d/10-mail.conf

1 2	vim /etc/dovecot/conf.d/10-mail.conf

# 30行: 取消注释并添加
mail_location = maildir:~/Maildir

# 30行: 取消注释并添加

mail_location = maildir:~/Maildir

vim /etc/dovecot/conf.d/10-master.conf

1 2	vim /etc/dovecot/conf.d/10-master.conf

# 88-90行: 取消注释并添加
# Postfix smtp验证
unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
}

# 88-90行: 取消注释并添加

# Postfix smtp验证

unix_listener /var/spool/postfix/private/auth {

mode = 0666

user = postfix

group = postfix

}

最后返回编辑Postfix配置

vim /etc/postfix/main.cf

1 2	vim /etc/postfix/main.cf

# 添加到最后
# SMTP认证
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject

# 添加到最后

# SMTP认证

smtpd_sasl_type = dovecot

smtpd_sasl_path = private/auth

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain = $myhostname

smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject

注意：
postfix与dovecot的分工作用为：
postfix管邮件收发
dovecot负责邮件管理，上传，下载，删除等。

最后记得启动或者重启postfix以及dovecot。

# 启动
/etc/init.d/postfix start
/etc/init.d/dovecot start

# 开机启动
chkconfig postfix on
chkconfig dovecot on

# 启动

/etc/init.d/postfix start

/etc/init.d/dovecot start

# 开机启动

chkconfig postfix on

chkconfig dovecot on

最后创建用户，收发邮件

useradd cc # 创建用户
passwd cc # 设置密码

useradd cc # 创建用户

passwd cc # 设置密码

设置foxmail账号，

发送邮件

接收邮件

centos、Java、Linux、ubuntu

linux下安装最新版本Java

2015年10月11日 chen

Ubuntu

1、 Installing default JRE/JDK

sudo apt-get update
sudo apt-get install default-jre
sudo apt-get install default-jdk

sudo apt-get update

sudo apt-get install default-jre

sudo apt-get install default-jdk

2、 Installing Oracle JDK

sudo apt-get install python-software-properties
sudo add-apt-repository ppa:webupd8team/java
sudo apt-get update

# Oracle JDK 6
sudo apt-get install oracle-java6-installer
# Oracle JDK 7
sudo apt-get install oracle-java7-installer
# Oracle JDK 8
sudo apt-get install oracle-java8-installer

sudo apt-get install python-software-properties

sudo add-apt-repository ppa:webupd8team/java

sudo apt-get update

# Oracle JDK 6

sudo apt-get install oracle-java6-installer

# Oracle JDK 7

sudo apt-get install oracle-java7-installer

# Oracle JDK 8

sudo apt-get install oracle-java8-installer

3、 Managing Java

# 有 2 个候选项可用于替换 java (提供 /usr/bin/java)。
sudo update-alternatives --config java

# 有 2 个候选项可用于替换 java (提供 /usr/bin/java)。

sudo update-alternatives --config java

4、 Setting the “JAVA_HOME” environment variable

# 根据设置时所选项来确定path
sudo update-alternatives --config java

sudo vim /etc/environment
# 在文件最后添加上：
JAVA_HOME="/usr/lib/jvm/java-8-oracle"
# 保存退出

# 重新加载源
source /etc/environment

java -version
/*
java version "1.8.0_60"
Java(TM) SE Runtime Environment (build 1.8.0_60-b27)
Java HotSpot(TM) 64-Bit Server VM (build 25.60-b23, mixed mode)
*/

# 根据设置时所选项来确定path

sudo update-alternatives --config java

sudo vim /etc/environment

# 在文件最后添加上：

JAVA_HOME="/usr/lib/jvm/java-8-oracle"

# 保存退出

# 重新加载源

source /etc/environment

java -version

java version "1.8.0_60"

Java(TM) SE Runtime Environment (build 1.8.0_60-b27)

Java HotSpot(TM) 64-Bit Server VM (build 25.60-b23, mixed mode)

如果你因为防火墙或者其他原因,导致installer 下载速度很慢,可以中断操作.然后下载好相应jdk的tar.gz 包,放在:

   /var/cache/oracle-jdk7-installer             (jdk7) 

   /var/cache/oracle-jdk8-installer              (jdk8)

/var/cache/oracle-jdk7-installer (jdk7)

/var/cache/oracle-jdk8-installer (jdk8)

下面,然后安装一次installer. installer 则会默认使用你下载的tar.gz包

vagrant

vagrant 搭建自己的开发环境（三）—— 多主机配置

2014年10月25日 chen

有时候项目不仅仅只有一台服务器，可能会有多台服务器，比如说主从同步，负载均衡，冗余等等。
vagrant也可以配置多台服务器，每台主机都可以拥有自己的配置。

  # 这样可以定义2个主机，或者更多
  config.vm.define "master" do |master|
  end

  config.vm.define "slave" do |slave|
  end

# 这样可以定义2个主机，或者更多

config.vm.define "master" do |master|

end

config.vm.define "slave" do |slave|

end

当启动时候，或者ssh链接时候，可以使用 vagrant up 主机名 或 vagrant ssh 主机名 命令针对某一台虚拟机进行操作。

根据单主机的配置，我们可以推算出多主机的配置大致相同。

config.vm.define "master" do |master|
    master.vm.network "private_network", ip: "192.168.33.11"
    master.vm.network "public_network"
    master.vm.hostname = "cc-master"
    master.vm.synced_folder "../cc-master", "/cc-master", 
        create: true, owner: "root", group: "root"
  end

config.vm.define "master" do |master|

master.vm.network "private_network", ip: "192.168.33.11"

master.vm.network "public_network"

master.vm.hostname = "cc-master"

master.vm.synced_folder "../cc-master", "/cc-master",

create: true, owner: "root", group: "root"

end

vagrant

vagrant 搭建自己的开发环境（二）—— 配置及打包

2014年10月22日 chen

在vagrant init xxx初始化后，会生成一个名字叫Vagrantfile的配置文件。大概它，我们就可以对vagrant进行配置。

一、共享目录

vagrant初始化后的目录其实已经和虚拟机共享了。如果还想配置其他共享目录可以进行以下配置。

  config.vm.synced_folder "../vagrant_data", "/vagrant_data",
    create: true, owner: "root", group: "root"
  # 意思就是将本机下，vagarnt工作目录上一级下的vagrant_data目录，与虚拟机中的根目录下的vagrant_data目录进行共享。
  # create: true 表示  如果 不存在目录时，主动创建
  # owner: "root"  表示 创建时所属者为 root
  # group: "root"  表示 创建时所属组为 root

config.vm.synced_folder "../vagrant_data", "/vagrant_data",

create: true, owner: "root", group: "root"

# 意思就是将本机下，vagarnt工作目录上一级下的vagrant_data目录，与虚拟机中的根目录下的vagrant_data目录进行共享。

# create: true 表示如果不存在目录时，主动创建

# owner: "root" 表示创建时所属者为 root

# group: "root" 表示创建时所属组为 root

二、网络配置

公有网络 —— 局域网下都能访问到

config.vm.network "public_network"

1 2	config.vm.network "public_network"

私有网络 —— 只有本机才能访问

config.vm.network "private_network", ip: "192.168.33.10"
# 注意 私有网络 ip网段不能和现有局域网ip网段有冲突

config.vm.network "private_network", ip: "192.168.33.10"

# 注意私有网络 ip网段不能和现有局域网ip网段有冲突

三、重新打包

重新打包前，需要删除一个文件

 sudo rm -rf /etc/udev/rules.d/70-persistent-net.rules

1 2	sudo rm -rf /etc/udev/rules.d/70-persistent-net.rules

不删除的话，重新打包后，再次安装会出现网络异常的问题。

然后就可以打包了，打包命令

vagrant package
==> default: Attempting graceful shutdown of VM...
==> default: Clearing any previously set forwarded ports...
==> default: Exporting VM...
==> default: Compressing package to: d:/vagrant/package.box

vagrant package

==> default: Attempting graceful shutdown of VM...

==> default: Clearing any previously set forwarded ports...

==> default: Exporting VM...

==> default: Compressing package to: d:/vagrant/package.box

打包成功后，会在当前目录下，生成一个名叫package.box的box。然后以后就可以使用此镜像进行安装虚拟机。

vagrant

vagrant 搭建自己的开发环境（一） —— 安装、初始化、启动

2014年10月19日 chen

一、安装VirtualBox

上官网下载，并安装。不做过多描述。

二、安装vagrant

上官网下载，并安装。不做过多描述。

三、添加box

box是指某种操作系统的操作镜像文件。我们可以上vagrantcloud下载自己想要的box。

1、创建工作目录

C:\Users\Administrator>cd d:\
C:\Users\Administrator>d:
d:\>mkdir vagrant
d:\>cd vagrant

C:\Users\Administrator>cd d:\

C:\Users\Administrator>d:

d:\>mkdir vagrant

d:\>cd vagrant

2、下载/添加box

# 注意 chef/centos-6.5 是一个box的名称。我们可以通过vagrant box add box名称 来添加box
d:\vagrant>vagrant box add chef/centos-6.5
==> box: Loading metadata for box 'chef/centos-6.5'
    box: URL: https://vagrantcloud.com/chef/centos-6.5
This box can work with multiple providers! The providers that it
can work with are listed below. Please review the list and choose
the provider you will be working with.

1) virtualbox
2) vmware_desktop
# 注意 这里我们因为安装的virtulbox，所以选择1
Enter your choice: 1
# 然后就开始下载，并安装
==> box: Adding box 'chef/centos-6.5' (v1.0.0) for provider: virtualbox
    box: Downloading: https://vagrantcloud.com/chef/boxes/centos-6.5/versions/1/
providers/virtualbox.box
==> box: Box download is resuming from prior download progress
    box: Progress: 0% (Rate: 26964/s, Estimated time remaining: 9:50:55))

# 注意 chef/centos-6.5 是一个box的名称。我们可以通过vagrant box add box名称来添加box

d:\vagrant>vagrant box add chef/centos-6.5

==> box: Loading metadata for box 'chef/centos-6.5'

box: URL: https://vagrantcloud.com/chef/centos-6.5

This box can work with multiple providers! The providers that it

can work with are listed below. Please review the list and choose

the provider you will be working with.

1) virtualbox

2) vmware_desktop

# 注意这里我们因为安装的virtulbox，所以选择1

Enter your choice: 1

# 然后就开始下载，并安装

==> box: Adding box 'chef/centos-6.5' (v1.0.0) for provider: virtualbox

box: Downloading: https://vagrantcloud.com/chef/boxes/centos-6.5/versions/1/

providers/virtualbox.box

==> box: Box download is resuming from prior download progress

box: Progress: 0% (Rate: 26964/s, Estimated time remaining: 9:50:55))

由于网络原因使用命令行下载太慢，我们可以是用迅雷下载完后，使用命令行添加本地box

d:\vagrant>vagrant box add "chef_centos" "d:\box\chefcentos-6.5-virtualbox.box"
==> box: Adding box 'chef_centos' (v0) for provider:
    box: Downloading: file://d:/box/chefcentos-6.5-virtualbox.box
    box: Progress: 100% (Rate: 564M/s, Estimated time remaining: --:--:--)
The box you're attempting to add already exists. Remove it before
adding it again or add it with the `--force` flag.

Name: chef_centos
Provider: virtualbox
Version: 0

d:\vagrant>vagrant box add "chef_centos" "d:\box\chefcentos-6.5-virtualbox.box"

==> box: Adding box 'chef_centos' (v0) for provider:

box: Downloading: file://d:/box/chefcentos-6.5-virtualbox.box

box: Progress: 100% (Rate: 564M/s, Estimated time remaining: --:--:--)

The box you're attempting to add already exists. Remove it before

adding it again or add it with the `--force` flag.

Name: chef_centos

Provider: virtualbox

Version: 0

安装完成后，我们进行初始化，就是启动，然后使用ssh链接到虚拟机。

3、初始化

d:\vagrant>vagrant init chef_centos
A `Vagrantfile` has been placed in this directory. You are now
ready to `vagrant up` your first virtual environment! Please read
the comments in the Vagrantfile as well as documentation on
`vagrantup.com` for more information on using Vagrant.

d:\vagrant>vagrant init chef_centos

A `Vagrantfile` has been placed in this directory. You are now

ready to `vagrant up` your first virtual environment! Please read

the comments in the Vagrantfile as well as documentation on

`vagrantup.com` for more information on using Vagrant.

4、启动

d:\vagrant>vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'chef_centos'...
==> default: Matching MAC address for NAT networking...
==> default: Setting the name of the VM: vagrant_default_1413711491988_22350
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 => 2222 (adapter 1)
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Connection timeout. Retrying...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
==> default: Mounting shared folders...
    default: /vagrant => D:/vagrant

d:\vagrant>vagrant up

Bringing machine 'default' up with 'virtualbox' provider...

==> default: Importing base box 'chef_centos'...

==> default: Matching MAC address for NAT networking...

==> default: Setting the name of the VM: vagrant_default_1413711491988_22350

==> default: Clearing any previously set network interfaces...

==> default: Preparing network interfaces based on configuration...

default: Adapter 1: nat

==> default: Forwarding ports...

default: 22 => 2222 (adapter 1)

==> default: Booting VM...

==> default: Waiting for machine to boot. This may take a few minutes...

default: SSH address: 127.0.0.1:2222

default: SSH username: vagrant

default: SSH auth method: private key

default: Warning: Connection timeout. Retrying...

==> default: Machine booted and ready!

==> default: Checking for guest additions in VM...

==> default: Mounting shared folders...

default: /vagrant => D:/vagrant

4、ssh 链接

如果windows上还没有安装openssl，可以先google一下，如何安装配置。

如果已经安装好了，可以直接使用 vagrant ssh 命令，链接到虚拟机并且操作。

d:\vagrant>vagrant ssh
cygwin warning:
  MS-DOS style path detected: C:/Users/Administrator/.vagrant.d/insecure_private
_key
  Preferred POSIX equivalent is: /cygdrive/c/Users/Administrator/.vagrant.d/inse
cure_private_key
  CYGWIN environment variable option "nodosfilewarning" turns off this warning.
  Consult the user's guide for more details about POSIX paths:
    http://cygwin.com/cygwin-ug-net/using.html#using-pathnames
Last login: Fri Mar  7 16:57:20 2014 from 10.0.2.2
[vagrant@localhost ~]$ pwd
/home/vagrant

d:\vagrant>vagrant ssh

cygwin warning:

MS-DOS style path detected: C:/Users/Administrator/.vagrant.d/insecure_private

_key

Preferred POSIX equivalent is: /cygdrive/c/Users/Administrator/.vagrant.d/inse

cure_private_key

CYGWIN environment variable option "nodosfilewarning" turns off this warning.

Consult the user's guide for more details about POSIX paths:

http://cygwin.com/cygwin-ug-net/using.html#using-pathnames

Last login: Fri Mar 7 16:57:20 2014 from 10.0.2.2

[vagrant@localhost ~]$ pwd

/home/vagrant

Linux

ffmpeg转换视频格式

2014年5月17日 chen

一、安装

1、centos使用yum安装

[root@chen Desktop]# rpm --import http://packages.atrpms.net/RPM-GPG-KEY.atrpms

#添加yum源
[root@chen Desktop]# vim /etc/yum.repos.d/atrpms.repo

[atrpms]
name=Fedora Core $releasever - $basearch - ATrpms
baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/stable
gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms
gpgcheck=1
enabled=0

[atrpms-testing]
name=Fedora Core $releasever - $basearch - ATrpms
baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/testing
gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms
gpgcheck=1
enabled=0

# 使用yum安装
[root@chen Desktop]# yum --enablerepo=atrpms* install ffmpeg

[root@chen Desktop]# rpm --import http://packages.atrpms.net/RPM-GPG-KEY.atrpms

#添加yum源

[root@chen Desktop]# vim /etc/yum.repos.d/atrpms.repo

[atrpms]

name=Fedora Core $releasever - $basearch - ATrpms

baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/stable

gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms

gpgcheck=1

enabled=0

[atrpms-testing]

name=Fedora Core $releasever - $basearch - ATrpms

baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/testing

gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms

gpgcheck=1

enabled=0

# 使用yum安装

[root@chen Desktop]# yum --enablerepo=atrpms* install ffmpeg

Linux

在线预览word，excel，pdf

2014年5月11日 chen

大致思路：word/excel 转换成 pdf，然后pdf转换成swf，在各个浏览器兼容显示。

一、安装环境

1、准备工作

安装开发者工具
yum groupinstall "Development Tools"
安装java开发环境
yum groupinstall "Java Platform"

安装开发者工具

yum groupinstall "Development Tools"

安装java开发环境

yum groupinstall "Java Platform"

2、安装openoffice

下载 软件包
http://www.openoffice.org/

[root@chen Downloads]# wget http://superb-dca2.dl.sourceforge.net/project/openofficeorg.mirror/4.1.0/binaries/zh-CN/Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz

[root@chen Downloads]# tar zxvf Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz 
[root@chen Downloads]# ls
Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz  zh-CN
[root@chen Downloads]# cd zh-CN/RPMS/

# 安装RPMS下所有安装包
[root@chen RPMS]# rpm -ivh *.rpm

#运行 openoffice
[root@chen RPMS]# soffice --headless --accept="socket,host=127.0.0.1,port=8100;urp;" --nofirststartwizard &

下载软件包

http://www.openoffice.org/

[root@chen Downloads]# wget http://superb-dca2.dl.sourceforge.net/project/openofficeorg.mirror/4.1.0/binaries/zh-CN/Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz

[root@chen Downloads]# tar zxvf Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz

[root@chen Downloads]# ls

Apache_OpenOffice_4.1.0_Linux_x86_install-rpm_zh-CN.tar.gz zh-CN

[root@chen Downloads]# cd zh-CN/RPMS/

# 安装RPMS下所有安装包

[root@chen RPMS]# rpm -ivh *.rpm

#运行 openoffice

[root@chen RPMS]# soffice --headless --accept="socket,host=127.0.0.1,port=8100;urp;" --nofirststartwizard &

2、安装 jodconverter

[root@chen Downloads]# wget http://iweb.dl.sourceforge.net/project/jodconverter/JODConverter/2.2.2/jodconverter-2.2.2.zip
[root@chen Downloads]# unzip jodconverter-2.2.2.zip

1 2	[root@chen Downloads]# wget http://iweb.dl.sourceforge.net/project/jodconverter/JODConverter/2.2.2/jodconverter-2.2.2.zip [root@chen Downloads]# unzip jodconverter-2.2.2.zip

3、转换成pdf

# 将Download下的docx转换成pdf
# 语法： java -jar jodconverter路径/lib/jodconverter-cli-2.2.2.jar 1.docx 1.pdf
[root@chen Downloads]# java -jar jodconverter-2.2.2/lib/jodconverter-cli-2.2.2.jar 1.docx 1.pdf
May 10, 2014 10:00:01 PM com.artofsolving.jodconverter.openoffice.connection.AbstractOpenOfficeConnection connect
INFO: connected
May 10, 2014 10:00:04 PM com.artofsolving.jodconverter.openoffice.connection.AbstractOpenOfficeConnection disposing
INFO: disconnected

# 将Download下的docx转换成pdf

# 语法： java -jar jodconverter路径/lib/jodconverter-cli-2.2.2.jar 1.docx 1.pdf

[root@chen Downloads]# java -jar jodconverter-2.2.2/lib/jodconverter-cli-2.2.2.jar 1.docx 1.pdf

May 10, 2014 10:00:01 PM com.artofsolving.jodconverter.openoffice.connection.AbstractOpenOfficeConnection connect

INFO: connected

May 10, 2014 10:00:04 PM com.artofsolving.jodconverter.openoffice.connection.AbstractOpenOfficeConnection disposing

INFO: disconnected

转换成功如下。

其实如果只考虑现代浏览器（chrome、firefox等），已经可以在线预览了。

但是为了兼容低版本的IE，需要将PDF转化成SWF进行兼容。

ps:如果存在乱码问题解决方法如下

转换后如有乱码问题
http://ericyuen.blogbus.com/logs/7650496.html
1. 将Windows下的字体C:\Windows\Fonts\simsun.ttc

拷贝到 /opt/openoffice4/share/fonts/truetype/simsun.ttc

转换后如有乱码问题

http://ericyuen.blogbus.com/logs/7650496.html

1. 将Windows下的字体C:\Windows\Fonts\simsun.ttc

拷贝到 /opt/openoffice4/share/fonts/truetype/simsun.ttc

4、安装 swftools

# 安装所需的库和组件
[root@chen Downloads]# yum install gcc* automake zlib-devel libjpeg-devel giflib-devel freetype-devel

# 下载swftools 
# http://www.swftools.org/download.html
[root@chen Downloads]# wget http://www.swftools.org/swftools-0.9.2.tar.gz
[root@chen Downloads]# tar -zxvf swftools-0.9.2.tar.gz 
[root@chen Downloads]# cd swftools-0.9.2
[root@chen swftools-0.9.2]# ./configure --prefix=/usr/local/swftools
[root@chen swftools-0.9.2]# make && make install

# 设置swftools环境变量，使pdf2swf成为一个可执行命令
vim /etc/profile
export PATH=$PATH:/usr/local/swftools/bin/

# 转换命令
[root@chen swftools-0.9.2]# pdf2swf "input.pdf" "output.swf"

# 安装所需的库和组件

[root@chen Downloads]# yum install gcc* automake zlib-devel libjpeg-devel giflib-devel freetype-devel

# 下载swftools

# http://www.swftools.org/download.html

[root@chen Downloads]# wget http://www.swftools.org/swftools-0.9.2.tar.gz

[root@chen Downloads]# tar -zxvf swftools-0.9.2.tar.gz

[root@chen Downloads]# cd swftools-0.9.2

[root@chen swftools-0.9.2]# ./configure --prefix=/usr/local/swftools

[root@chen swftools-0.9.2]# make && make install

# 设置swftools环境变量，使pdf2swf成为一个可执行命令

vim /etc/profile

export PATH=$PATH:/usr/local/swftools/bin/

# 转换命令

[root@chen swftools-0.9.2]# pdf2swf "input.pdf" "output.swf"

5、FlexPaper浏览swf

下载插件
http://flexpaper.devaldi.com/

1 2	下载插件 http://flexpaper.devaldi.com/

<!doctype html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>FlexPager</title>
    <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
    <link rel="stylesheet" type="text/css" href="css/flexpaper.css" />
    <script type="text/javascript" src="js/jquery.min.js"></script>
    <script type="text/javascript" src="js/flexpaper.js"></script>
    <script type="text/javascript" src="js/flexpaper_handlers.js"></script>
    <style>
    html, body, div {
        width: 100%;
        height: 100%;
    }
    </style>
</head>
<body>
    <div id="documentViewer" class="flexpaper_viewer"></div>
    <script type="text/javascript">
        function getDocumentUrl(document){
            return "php/services/view.php?doc={doc}&format={format}&page={page}".replace("{doc}",document);
        }

        var startDocument = "Paper";

        $('#documentViewer').FlexPaperViewer(
                { config : {

                    SWFFile : '1.swf',

                    Scale : 0.6,
                    ZoomTransition : 'easeOut',
                    ZoomTime : 0.5,
                    ZoomInterval : 0.2,
                    FitPageOnLoad : true,
                    FitWidthOnLoad : false,
                    FullScreenAsMaxWindow : false,
                    ProgressiveLoading : false,
                    MinZoomSize : 0.2,
                    MaxZoomSize : 5,
                    SearchMatchAll : false,
                    InitViewMode : 'Portrait',
                    RenderingOrder : 'flash',
                    StartAtPage : '',

                    ViewModeToolsVisible : true,
                    ZoomToolsVisible : true,
                    NavToolsVisible : true,
                    CursorToolsVisible : true,
                    SearchToolsVisible : true,
                    WMode : 'window',
                    localeChain: 'en_US'
                }}
        );
    </script>
</body>
</html>

<!doctype html>

<head>

<title>FlexPager</title>

<style>

html, body, div {

width: 100%;

height: 100%;

}

</style>

</head>

<body>

function getDocumentUrl(document){

return "php/services/view.php?doc={doc}&format={format}&page={page}".replace("{doc}",document);

}

var startDocument = "Paper";

$('#documentViewer').FlexPaperViewer(

{ config : {

SWFFile : '1.swf',

Scale : 0.6,

ZoomTransition : 'easeOut',

ZoomTime : 0.5,

ZoomInterval : 0.2,

FitPageOnLoad : true,

FitWidthOnLoad : false,

FullScreenAsMaxWindow : false,

ProgressiveLoading : false,

MinZoomSize : 0.2,

MaxZoomSize : 5,

SearchMatchAll : false,

InitViewMode : 'Portrait',

RenderingOrder : 'flash',

StartAtPage : '',

ViewModeToolsVisible : true,

ZoomToolsVisible : true,

NavToolsVisible : true,

CursorToolsVisible : true,

SearchToolsVisible : true,

WMode : 'window',

localeChain: 'en_US'

}}

);

</script>

</body>

</html>

测试连接：http://test.iter-cc.com/FlexPaper/1.html

Linux

Centos安装SVN

2014年2月9日 chen

1、通过yum安装svn，当然一般centos都会默认安装。

[root@master Desktop]# yum -y install subversion
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: mirrors.163.com
 * extras: mirrors.163.com
 * updates: mirrors.163.com
base                                                                                                  | 3.7 kB     00:00     
extras                                                                                                | 3.4 kB     00:00     
updates                                                                                               | 3.4 kB     00:00     
updates/primary_db                                                                                    | 1.4 MB     00:00     
Setting up Install Process
Package subversion-1.6.11-9.el6_4.i686 already installed and latest version
Nothing to do

[root@master Desktop]# yum -y install subversion

Loaded plugins: fastestmirror, refresh-packagekit, security

Loading mirror speeds from cached hostfile

* base: mirrors.163.com

* extras: mirrors.163.com

* updates: mirrors.163.com

base | 3.7 kB 00:00

extras | 3.4 kB 00:00

updates | 3.4 kB 00:00

updates/primary_db | 1.4 MB 00:00

Setting up Install Process

Package subversion-1.6.11-9.el6_4.i686 already installed and latest version

Nothing to do

2、建立SVN库

[root@master opt]# mkdir -p /opt/svn/repos
[root@master opt]# svnadmin create /opt/svn/repos/          
[root@master opt]# cd /opt/svn/repos/
[root@master repos]# ls
conf  db  format  hooks  locks  README.txt

# mkdir -p /opt/svn/repos  创建svn库文件夹
# svnadmin create /opt/svn/repos/  创建库
# 然后repos文件夹下就多出了 conf  db  format  hooks  locks  README.txt 这些文件及文件夹

[root@master opt]# mkdir -p /opt/svn/repos

[root@master opt]# svnadmin create /opt/svn/repos/

[root@master opt]# cd /opt/svn/repos/

[root@master repos]# ls

conf db format hooks locks README.txt

# mkdir -p /opt/svn/repos 创建svn库文件夹

# svnadmin create /opt/svn/repos/ 创建库

# 然后repos文件夹下就多出了 conf db format hooks locks README.txt 这些文件及文件夹

3、配置

# 编辑 conf/passwd， 配置用户及密码
[root@master repos]# vim conf/passwd 

# 文件内容
### This file is an example password file for svnserve.
### Its format is similar to that of svnserve.conf. As shown in the
### example below it contains one section labelled [users].
### The name and password for each user follow, one account per line.

[users]
# harry = harryssecret
# sally = sallyssecret
#

username = password
laochen = nihao

#这样就创建了 用户 laochen 密码为 nihao 的帐号

# 编辑 conf/passwd，配置用户及密码

[root@master repos]# vim conf/passwd

# 文件内容

### This file is an example password file for svnserve.

### Its format is similar to that of svnserve.conf. As shown in the

### example below it contains one section labelled [users].

### The name and password for each user follow, one account per line.

[users]

# harry = harryssecret

# sally = sallyssecret

username = password

laochen = nihao

#这样就创建了用户 laochen 密码为 nihao 的帐号

# 编辑 conf/zuthz, 配置权限

[root@master repos]# vim conf/authz 

### This file is an example authorization file for svnserve.
### Its format is identical to that of mod_authz_svn authorization
### files.
### As shown below each section defines authorizations for the path and
### (optional) repository specified by the section name.
### The authorizations follow. An authorization line can refer to:
###  - a single user,
###  - a group of users defined in a special [groups] section,
###  - an alias defined in a special [aliases] section,
###  - all authenticated users, using the '$authenticated' token,
###  - only anonymous users, using the '$anonymous' token,
###  - anyone, using the '*' wildcard.
###
### A match can be inverted by prefixing the rule with '~'. Rules can
### grant read ('r') access, read-write ('rw') access, or no access
### ('').

[aliases]
# joe = /C=XZ/ST=Dessert/L=Snake City/O=Snake Oil, Ltd./OU=Research Institute/CN=Joe Average

[groups]
# harry_and_sally = harry,sally
# harry_sally_and_joe = harry,sally,&joe

# [/foo/bar]
# harry = rw
# &joe = r
# * =

# [repository:/baz/fuz]
# @harry_and_sally = rw
# * = r
#

[/]
nihao = rw

# [/] 设置根目录权限
# nihao = rw 着你 用户 nihao 具有 读写权限
# r 为 读， w 为 写

# 编辑 conf/zuthz, 配置权限

[root@master repos]# vim conf/authz

### This file is an example authorization file for svnserve.

### Its format is identical to that of mod_authz_svn authorization

### files.

### As shown below each section defines authorizations for the path and

### (optional) repository specified by the section name.

### The authorizations follow. An authorization line can refer to:

### - a single user,

### - a group of users defined in a special [groups] section,

### - an alias defined in a special [aliases] section,

### - all authenticated users, using the '$authenticated' token,

### - only anonymous users, using the '$anonymous' token,

### - anyone, using the '*' wildcard.

###

### A match can be inverted by prefixing the rule with '~'. Rules can

### grant read ('r') access, read-write ('rw') access, or no access

### ('').

[aliases]

# joe = /C=XZ/ST=Dessert/L=Snake City/O=Snake Oil, Ltd./OU=Research Institute/CN=Joe Average

[groups]

# harry_and_sally = harry,sally

# harry_sally_and_joe = harry,sally,&joe

# [/foo/bar]

# harry = rw

# &joe = r

# * =

# [repository:/baz/fuz]

# @harry_and_sally = rw

# * = r

[/]

nihao = rw

# [/] 设置根目录权限

# nihao = rw 着你用户 nihao 具有读写权限

# r 为读， w 为写

#编辑conf/svnserve.conf 配置svn默认选项

[root@master repos]# vim conf/svnserve.conf 

### This file controls the configuration of the svnserve daemon, if you
### use it to allow access to this repository.  (If you only allow
### access through http: and/or file: URLs, then this file is
### irrelevant.)

### Visit http://subversion.tigris.org/ for more information.

[general]
### These options control access to the repository for unauthenticated
### and authenticated users.  Valid values are "write", "read",
### and "none".  The sample settings below are the defaults.
anon-access = none
auth-access = write
### The password-db option controls the location of the password
### database file.  Unless you specify a path starting with a /,
### the file's location is relative to the directory containing
### this configuration file.
### If SASL is enabled (see below), this file will NOT be used.
### Uncomment the line below to use the default password file.
password-db = passwd
### The authz-db option controls the location of the authorization
### rules for path-based access control.  Unless you specify a path
### starting with a /, the file's location is relative to the the
### directory containing this file.  If you don't specify an
### authz-db, no path-based access control is done.
### Uncomment the line below to use the default authorization file.
authz-db = authz
### This option specifies the authentication realm of the repository.
### If two repositories have the same authentication realm, they should
### have the same password database, and vice versa.  The default realm
### is repository's uuid.
realm = /opt/svn/repos

[sasl]
### This option specifies whether you want to use the Cyrus SASL
### library for authentication. Default is false.
### This section will be ignored if svnserve is not built with Cyrus
### SASL support; to check, run 'svnserve --version' and look for a line
### reading 'Cyrus SASL authentication is available.'
# use-sasl = true
### These options specify the desired strength of the security layer
### that you want SASL to provide. 0 means no encryption, 1 means
### integrity-checking only, values larger than 1 are correlated
### to the effective key length for encryption (e.g. 128 means 128-bit
### encryption). The values below are the defaults.
# min-encryption = 0
# max-encryption = 256

#anon-access = none 匿名用户，没有任务权限
#auth-access = write 认证用户可以写入
#password-db = passwd 用户名密码配置文件名
#authz-db = authz 权限配置文件名
#realm = /opt/svn/repos 库文件路径

#编辑conf/svnserve.conf 配置svn默认选项

[root@master repos]# vim conf/svnserve.conf

### This file controls the configuration of the svnserve daemon, if you

### use it to allow access to this repository. (If you only allow

### access through http: and/or file: URLs, then this file is

### irrelevant.)

### Visit http://subversion.tigris.org/ for more information.

[general]

### These options control access to the repository for unauthenticated

### and authenticated users. Valid values are "write", "read",

### and "none". The sample settings below are the defaults.

anon-access = none

auth-access = write

### The password-db option controls the location of the password

### database file. Unless you specify a path starting with a /,

### the file's location is relative to the directory containing

### this configuration file.

### If SASL is enabled (see below), this file will NOT be used.

### Uncomment the line below to use the default password file.

password-db = passwd

### The authz-db option controls the location of the authorization

### rules for path-based access control. Unless you specify a path

### starting with a /, the file's location is relative to the the

### directory containing this file. If you don't specify an

### authz-db, no path-based access control is done.

### Uncomment the line below to use the default authorization file.

authz-db = authz

### This option specifies the authentication realm of the repository.

### If two repositories have the same authentication realm, they should

### have the same password database, and vice versa. The default realm

### is repository's uuid.

realm = /opt/svn/repos

[sasl]

### This option specifies whether you want to use the Cyrus SASL

### library for authentication. Default is false.

### This section will be ignored if svnserve is not built with Cyrus

### SASL support; to check, run 'svnserve --version' and look for a line

### reading 'Cyrus SASL authentication is available.'

# use-sasl = true

### These options specify the desired strength of the security layer

### that you want SASL to provide. 0 means no encryption, 1 means

### integrity-checking only, values larger than 1 are correlated

### to the effective key length for encryption (e.g. 128 means 128-bit

### encryption). The values below are the defaults.

# min-encryption = 0

# max-encryption = 256

#anon-access = none 匿名用户，没有任务权限

#auth-access = write 认证用户可以写入

#password-db = passwd 用户名密码配置文件名

#authz-db = authz 权限配置文件名

#realm = /opt/svn/repos 库文件路径

4、启用svn服务

[root@master repos]# svnserve -d -r /opt/svn/repos/

# 如果已有其他svn开启，获取不想使用默认端口，可以如下
# svnserve -d -r /opt/svn/repos --listen-port 3391

[root@master repos]# svnserve -d -r /opt/svn/repos/

# 如果已有其他svn开启，获取不想使用默认端口，可以如下

# svnserve -d -r /opt/svn/repos --listen-port 3391

5、客户端连接

连接地址

输入用户名密码

成功登录

6、svn文件结构目录

Subversion有一个很标准的目录结构，是这样的。

project为项目名称，trunk为主开发目录，branches为分支开发目录，tags为tag存档目录（不允许修改）。

详细可参考：点击这里

7、为SVN开启防火墙规则。点击这里

CA 数字证书认证中心

生成密钥、证书

Nginx 部署

双向认证

一、申请https证书

二、服务器配置

一、配置域名解析

二、安装Postfix

三、安装Dovecot

最后创建用户，收发邮件

Ubuntu

1、 Installing default JRE/JDK

2、 Installing Oracle JDK

3、 Managing Java

4、 Setting the “JAVA_HOME” environment variable

一、共享目录

二、网络配置

三、重新打包

一、安装VirtualBox

二、安装vagrant

三、添加box

1、创建工作目录

2、下载/添加box

3、初始化

4、启动

4、ssh 链接

一、安装

1、centos使用yum安装

一、安装环境

1、准备工作

2、安装openoffice

2、安装 jodconverter

3、转换成pdf

4、安装 swftools

5、FlexPaper浏览swf

For The Dream