RHCE实战单机部署HTTPS网站与DHCP服务的深度整合指南1. 环境准备与本地源配置在RHEL 8系统中同时部署HTTPS网站和DHCP服务前合理的本地源配置是基础保障。不同于独立实验环境综合服务部署需要更稳定的软件安装来源。创建本地源的关键步骤挂载系统ISO镜像mkdir -p /mnt/dvd mount /dev/sr0 /mnt/dvd配置双仓库源文件cat /etc/yum.repos.d/local.repo EOF [BaseOS] nameBaseOS baseurlfile:///mnt/dvd/BaseOS gpgcheck0 enabled1 [AppStream] nameAppStream baseurlfile:///mnt/dvd/AppStream gpgcheck0 enabled1 EOF验证源有效性yum clean all yum makecache yum repolist提示若使用虚拟机环境建议将ISO挂载设置为开机自动执行避免重启后服务依赖缺失。在/etc/fstab中添加/dev/sr0 /mnt/dvd iso9660 defaults,ro 0 0服务依赖安装清单httpdmod_ssldhcp-serveropensslfirewalld (如需)2. HTTPS网站高级配置2.1 证书生成与权限管理在综合环境中证书管理需要兼顾安全性与服务稳定性# 生成私钥带密码保护 openssl genrsa -aes256 -out /etc/pki/tls/private/zuoye.key 2048 # 创建证书签名请求 openssl req -new -key /etc/pki/tls/private/zuoye.key \ -out /etc/pki/tls/certs/zuoye.csr \ -subj /CCN/STBeijing/LBeijing/OExample/CNwww.zuoye.com # 生成自签名证书 openssl x509 -req -days 365 -in /etc/pki/tls/certs/zuoye.csr \ -signkey /etc/pki/tls/private/zuoye.key \ -out /etc/pki/tls/certs/zuoye.crt # 设置权限 chmod 600 /etc/pki/tls/private/zuoye.key chmod 644 /etc/pki/tls/certs/zuoye.crt2.2 虚拟主机与访问控制多服务共存时虚拟主机配置需要特别注意路径隔离VirtualHost *:22222 ServerName www.zuoye.com DocumentRoot /www/https SSLEngine on SSLCertificateFile /etc/pki/tls/certs/zuoye.crt SSLCertificateKeyFile /etc/pki/tls/private/zuoye.key Directory /www/secret AuthType Basic AuthName Restricted Content AuthUserFile /etc/httpd/conf/.htpasswd Require user xiaoming /Directory Alias /mimi /www/secret /VirtualHost密码文件创建htpasswd -c /etc/httpd/conf/.htpasswd xiaoming3. DHCP服务多子网配置3.1 主配置文件详解在/etc/dhcp/dhcpd.conf中实现双子网支持option domain-name zuoye.com; authoritative; default-lease-time 21600; max-lease-time 43200; subnet 192.168.168.0 netmask 255.255.255.0 { range 192.168.168.100 192.168.168.200; option routers 192.168.168.1; option domain-name-servers 8.8.8.8; option broadcast-address 192.168.168.255; } subnet 172.24.8.0 netmask 255.255.255.0 { range 172.24.8.100 172.24.8.200; option routers 172.24.8.1; option domain-name-servers 1.1.1.1; option broadcast-address 172.24.8.255; } host special-client { hardware ethernet 00:0c:29:12:34:56; fixed-address 192.168.168.168; }3.2 服务启动与排错服务管理命令systemctl enable --now dhcpd systemctl status dhcpd journalctl -xe -u dhcpd常见问题排查表现象可能原因解决方案服务启动失败配置文件语法错误dhcpd -t测试配置客户端获取不到IP防火墙阻止放行UDP 67端口地址冲突地址池范围重叠检查子网划分特定子网不响应接口未绑定修改/etc/sysconfig/dhcpd4. 服务整合与系统调优4.1 SELinux与防火墙策略多服务环境下安全策略需要精细调整# HTTP相关策略 setsebool -P httpd_can_network_connect on semanage port -a -t http_port_t -p tcp 22222 # DHCP相关策略 setsebool -P dhcpd_use_journal on # 防火墙规则 firewall-cmd --permanent --add-servicehttp firewall-cmd --permanent --add-servicehttps firewall-cmd --permanent --add-port22222/tcp firewall-cmd --permanent --add-servicedhcp firewall-cmd --reload4.2 资源限制与启动顺序调整服务依赖关系# 确保网络就绪后启动服务 systemctl edit dhcpd [Unit] Afternetwork-online.target Wantsnetwork-online.target内存优化配置在/etc/httpd/conf.modules.d/00-mpm.conf中调整IfModule mpm_prefork_module StartServers 5 MinSpareServers 5 MaxSpareServers 10 MaxRequestWorkers 50 MaxConnectionsPerChild 1000 /IfModule5. 客户端测试与验证5.1 HTTPS网站验证方法curl测试命令curl -vk https://www.zuoye.com:22222 \ --resolve www.zuoye.com:22222:192.168.168.100浏览器测试要点在客户端hosts文件添加192.168.168.100 www.zuoye.com访问时需添加端口号https://www.zuoye.com:22222忽略证书警告自签名证书5.2 DHCP客户端测试Linux客户端dhclient -v eth0 ip a show eth0Windows客户端ipconfig /release ipconfig /renew ipconfig /all保留地址验证arp -an | grep 192.168.168.168 ping -c 4 192.168.168.1686. 排错工具箱6.1 服务日志分析HTTPD错误定位tail -f /var/log/httpd/error_log sslscan www.zuoye.com:22222DHCP租约查看cat /var/lib/dhcpd/dhcpd.leases dhcpd-pools -f /etc/dhcp/dhcpd.conf6.2 网络诊断命令命令用途ss -tulnp查看端口占用tcpdump -i eth0 port 67抓取DHCP报文openssl s_client -connect www.zuoye.com:22222SSL握手测试nmcli con show检查网络连接在实际RHCE考试环境中这种多服务整合场景非常常见。记得在实验完成后将关键配置备份到/root目录下包括/etc/httpd/conf.d/vhost.conf/etc/dhcp/dhcpd.conf/etc/pki/tls/certs/zuoye.crt/etc/pki/tls/private/zuoye.key
RHCE实验环境搭建：1台主机同时配置HTTPS网站与DHCP服务器的3个关键点
RHCE实战单机部署HTTPS网站与DHCP服务的深度整合指南1. 环境准备与本地源配置在RHEL 8系统中同时部署HTTPS网站和DHCP服务前合理的本地源配置是基础保障。不同于独立实验环境综合服务部署需要更稳定的软件安装来源。创建本地源的关键步骤挂载系统ISO镜像mkdir -p /mnt/dvd mount /dev/sr0 /mnt/dvd配置双仓库源文件cat /etc/yum.repos.d/local.repo EOF [BaseOS] nameBaseOS baseurlfile:///mnt/dvd/BaseOS gpgcheck0 enabled1 [AppStream] nameAppStream baseurlfile:///mnt/dvd/AppStream gpgcheck0 enabled1 EOF验证源有效性yum clean all yum makecache yum repolist提示若使用虚拟机环境建议将ISO挂载设置为开机自动执行避免重启后服务依赖缺失。在/etc/fstab中添加/dev/sr0 /mnt/dvd iso9660 defaults,ro 0 0服务依赖安装清单httpdmod_ssldhcp-serveropensslfirewalld (如需)2. HTTPS网站高级配置2.1 证书生成与权限管理在综合环境中证书管理需要兼顾安全性与服务稳定性# 生成私钥带密码保护 openssl genrsa -aes256 -out /etc/pki/tls/private/zuoye.key 2048 # 创建证书签名请求 openssl req -new -key /etc/pki/tls/private/zuoye.key \ -out /etc/pki/tls/certs/zuoye.csr \ -subj /CCN/STBeijing/LBeijing/OExample/CNwww.zuoye.com # 生成自签名证书 openssl x509 -req -days 365 -in /etc/pki/tls/certs/zuoye.csr \ -signkey /etc/pki/tls/private/zuoye.key \ -out /etc/pki/tls/certs/zuoye.crt # 设置权限 chmod 600 /etc/pki/tls/private/zuoye.key chmod 644 /etc/pki/tls/certs/zuoye.crt2.2 虚拟主机与访问控制多服务共存时虚拟主机配置需要特别注意路径隔离VirtualHost *:22222 ServerName www.zuoye.com DocumentRoot /www/https SSLEngine on SSLCertificateFile /etc/pki/tls/certs/zuoye.crt SSLCertificateKeyFile /etc/pki/tls/private/zuoye.key Directory /www/secret AuthType Basic AuthName Restricted Content AuthUserFile /etc/httpd/conf/.htpasswd Require user xiaoming /Directory Alias /mimi /www/secret /VirtualHost密码文件创建htpasswd -c /etc/httpd/conf/.htpasswd xiaoming3. DHCP服务多子网配置3.1 主配置文件详解在/etc/dhcp/dhcpd.conf中实现双子网支持option domain-name zuoye.com; authoritative; default-lease-time 21600; max-lease-time 43200; subnet 192.168.168.0 netmask 255.255.255.0 { range 192.168.168.100 192.168.168.200; option routers 192.168.168.1; option domain-name-servers 8.8.8.8; option broadcast-address 192.168.168.255; } subnet 172.24.8.0 netmask 255.255.255.0 { range 172.24.8.100 172.24.8.200; option routers 172.24.8.1; option domain-name-servers 1.1.1.1; option broadcast-address 172.24.8.255; } host special-client { hardware ethernet 00:0c:29:12:34:56; fixed-address 192.168.168.168; }3.2 服务启动与排错服务管理命令systemctl enable --now dhcpd systemctl status dhcpd journalctl -xe -u dhcpd常见问题排查表现象可能原因解决方案服务启动失败配置文件语法错误dhcpd -t测试配置客户端获取不到IP防火墙阻止放行UDP 67端口地址冲突地址池范围重叠检查子网划分特定子网不响应接口未绑定修改/etc/sysconfig/dhcpd4. 服务整合与系统调优4.1 SELinux与防火墙策略多服务环境下安全策略需要精细调整# HTTP相关策略 setsebool -P httpd_can_network_connect on semanage port -a -t http_port_t -p tcp 22222 # DHCP相关策略 setsebool -P dhcpd_use_journal on # 防火墙规则 firewall-cmd --permanent --add-servicehttp firewall-cmd --permanent --add-servicehttps firewall-cmd --permanent --add-port22222/tcp firewall-cmd --permanent --add-servicedhcp firewall-cmd --reload4.2 资源限制与启动顺序调整服务依赖关系# 确保网络就绪后启动服务 systemctl edit dhcpd [Unit] Afternetwork-online.target Wantsnetwork-online.target内存优化配置在/etc/httpd/conf.modules.d/00-mpm.conf中调整IfModule mpm_prefork_module StartServers 5 MinSpareServers 5 MaxSpareServers 10 MaxRequestWorkers 50 MaxConnectionsPerChild 1000 /IfModule5. 客户端测试与验证5.1 HTTPS网站验证方法curl测试命令curl -vk https://www.zuoye.com:22222 \ --resolve www.zuoye.com:22222:192.168.168.100浏览器测试要点在客户端hosts文件添加192.168.168.100 www.zuoye.com访问时需添加端口号https://www.zuoye.com:22222忽略证书警告自签名证书5.2 DHCP客户端测试Linux客户端dhclient -v eth0 ip a show eth0Windows客户端ipconfig /release ipconfig /renew ipconfig /all保留地址验证arp -an | grep 192.168.168.168 ping -c 4 192.168.168.1686. 排错工具箱6.1 服务日志分析HTTPD错误定位tail -f /var/log/httpd/error_log sslscan www.zuoye.com:22222DHCP租约查看cat /var/lib/dhcpd/dhcpd.leases dhcpd-pools -f /etc/dhcp/dhcpd.conf6.2 网络诊断命令命令用途ss -tulnp查看端口占用tcpdump -i eth0 port 67抓取DHCP报文openssl s_client -connect www.zuoye.com:22222SSL握手测试nmcli con show检查网络连接在实际RHCE考试环境中这种多服务整合场景非常常见。记得在实验完成后将关键配置备份到/root目录下包括/etc/httpd/conf.d/vhost.conf/etc/dhcp/dhcpd.conf/etc/pki/tls/certs/zuoye.crt/etc/pki/tls/private/zuoye.key
