测试系统：CentOS6.2 64BIT

mysql 更新为5.5.21

php等部分软件升级

一、同步系统时间

ntp.api.bz 是一组NTP服务器集群，目前有6台服务器，位于上海电信。这项服务是 api.bz 继 http://sms.api.bz 移动飞信免费短信发送接口之后的第二项免费 API 服务。

ntpdate ntp.api.bz

设置每小时同步一次时间

crontab -e

添加：

* */1 * * * ntpdate ntp.api.bz >> /var/log/ntpdate.log

二、配置网易YUM源(可选)

首先备份/etc/yum.repos.d/CentOS-Base.repo    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup

下载对应版本repo文件, 放入/etc/yum.repos.d/(操作前请做好相应备份)

运行yum makecache生成缓存

mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup

mkdir -p /data0/software

cp CentOS6-Base-163.repo /etc/yum.repos.d/

yum makecache

三、获取开源程序

sudo -s

LANG=C

yum -y install gcc gcc-c++ autoconf libjpeg libjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel bzip2 bzip2-devel ncurses ncurses-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5 krb5-devel libidn libidn-devel openssl openssl-devel openldap openldap-devel nss_ldap openldap-clients openldap-servers

软件存放目录

mkdir -p /data0/software

MYSQL

mysql5.5+需要使用cmake编译

安装cmake编译

tar zxvf cmake-2.8.7.tar.gz

cd cmake-2.8.7

./bootstrap

gmake

make

make install

cd..

安装mysql

tar zxvf mysql-5.5.21.tar.gz

cd mysql-5.5.21

cmake . -DCMAKE_INSTALL_PREFIX=/usr/local/webserver/mysql -DINSTALL_DATADIR=/data0/mysql/data -DDEFAULT_CHARSET=utf8 -DDEFAULT_COLLATION=utf8_general_ci -DEXTRA_CHARSETS=all -DWITH_SSL=system -DWITH_EMBEDDED_SERVER=1 -DENABLED_LOCAL_INFILE=1 -DWITH_MYISAM_STORAGE_ENGINE=1 -DMYSQL_USER=mysql

make

make install

编译选项说明：

-DCMAKE_INSTALL_PREFIX=/usr/local/webserver/mysql //安装目录

-DINSTALL_DATADIR=/data0/mysql/data //数据库存放目录

-DDEFAULT_CHARSET=utf8 //使用utf8字符

-DDEFAULT_COLLATION=utf8_general_ci  //校验字符

-DEXTRA_CHARSETS=all  //安装所有扩展字符集

-DWITH_SSL=system //使用SSL加密

-DWITH_EMBEDDED_SERVER=1 //编译成embedded mysql library

-DENABLED_LOCAL_INFILE=1 //允许从本地导入数据

-DWITH_MYISAM_STORAGE_ENGINE=1 //安装myisam引擎

配置mysql

mkdir -p /data0/mysql/data

groupadd mysql

useradd -g mysql mysql

chown -R mysql:mysql /data0/mysql/data

cp support-files/my-medium.cnf /etc/my.cnf

vi /etc/my.cnf

在my.cnf中增加用户名及数据目录

在[mysqld]下面增加:

user=mysql

datadir=/data0/mysql/data

开启事件调度(可选)

在 [mysqld] 的下面加入如下行

event_scheduler=1

安装mysql初使化系统表其数据

cd /usr/local/webserver/mysql

./scripts/mysql_install_db --user=mysql

配置mysqld服务，并使其开机自运行

cp support-files/mysql.server /etc/init.d/mysqld

chmod +x /etc/init.d/mysqld

chkconfig --add mysqld

chkconfig mysqld --level 3 on

修改/etc/init.d/mysqld相关配置

vi /etc/init.d/mysqld

将datadir指定为/data0/mysql/data

将basedir指定为/usr/local/webserver/mysql

basedir=/usr/local/webserver/mysql

datadir=/data0/mysql/data

mysqld_pid_file_path=/data/mysql/data/mysql.pid(可选)

启动mysql及指定mysql root密码

service mysqld start

./bin/mysqladmin -u root password 'admin'

将mysql相关命令加到用户PATH中去

vi ~/.bash_profile

将PATH改为：

PATH=$PATH:$HOME/bin:/usr/local/webserver/mysql/bin

使其生效：

. ~/.bash_profile

启动，停止和重启mysql命令

service mysqld start

service mysqld stop

service mysqld restart

登录到mysql

mysql -u root -p

php系列

安装PHP支持库

tar zxvf libiconv-1.14.tar.gz

cd libiconv-1.14/

./configure --prefix=/usr/local

make

make install

cd ../

tar zxvf libmcrypt-2.5.8.tar.gz

cd libmcrypt-2.5.8/

./configure

make

make install

/sbin/ldconfig

cd libltdl/

./configure --enable-ltdl-install

make

make install

cd http://www.cnblogs.com/

tar zxvf mhash-0.9.9.9.tar.gz

cd mhash-0.9.9.9/

./configure

make

make install

cd ../

ln -s /usr/local/lib/libmcrypt.la /usr/lib/libmcrypt.la

ln -s /usr/local/lib/libmcrypt.so /usr/lib/libmcrypt.so

ln -s /usr/local/lib/libmcrypt.so.4 /usr/lib/libmcrypt.so.4

ln -s /usr/local/lib/libmcrypt.so.4.4.8 /usr/lib/libmcrypt.so.4.4.8

ln -s /usr/local/lib/libmhash.a /usr/lib/libmhash.a

ln -s /usr/local/lib/libmhash.la /usr/lib/libmhash.la

ln -s /usr/local/lib/libmhash.so /usr/lib/libmhash.so

ln -s /usr/local/lib/libmhash.so.2 /usr/lib/libmhash.so.2

ln -s /usr/local/lib/libmhash.so.2.0.1 /usr/lib/libmhash.so.2.0.1

ln -s /usr/local/bin/libmcrypt-config /usr/bin/libmcrypt-config

tar zxvf mcrypt-2.6.8.tar.gz

cd mcrypt-2.6.8/

/sbin/ldconfig

./configure

make

make install

cd ../

编译安装PHP(FastCGI模式)

ln -s /usr/lib64/libjpeg.so /usr/lib/libjpeg.so

ln -s /usr/lib64/libpng.so /usr/lib/libpng.so

ln -s /usr/lib64/libldap.so /usr/lib/libldap.so

ln -s /usr/local/webserver/mysql/lib/libmysqlclient.so.18  /usr/lib64/

tar zxvf php-5.2.17.tar.gz

gzip -cd php-5.2.17-fpm-0.5.14.diff.gz | patch -d php-5.2.17 -p1

cd php-5.2.17/

./configure --prefix=/usr/local/webserver/php --with-config-file-path=/usr/local/webserver/php/etc --with-mysql=/usr/local/webserver/mysql --with-mysqli=/usr/local/webserver/mysql/bin/mysql_config --with-iconv-dir=/usr/local --with-freetype-dir --with-jpeg-dir --with-png-dir --with-zlib --with-libxml-dir=/usr/ --enable-xml --disable-rpath --enable-discard-path --enable-safe-mode --enable-bcmath --enable-shmop --enable-sysvsem --enable-inline-optimization --with-curl --with-curlwrappers --enable-mbregex --enable-fastcgi --enable-fpm --enable-force-cgi-redirect --enable-mbstring --with-mcrypt --with-gd --enable-gd-native-ttf --with-openssl --with-mhash --enable-pcntl --enable-sockets --with-ldap --with-ldap-sasl --with-xmlrpc --enable-zip --enable-soap

make ZEND_EXTRA_LIBS='-liconv'

make install

cp php.ini-dist /usr/local/webserver/php/etc/php.ini

cd ../

编译安装PHP5扩展模块

tar zxvf memcache-3.0.6.tgz

cd memcache-3.0.6

/usr/local/webserver/php/bin/phpize

./configure --with-php-config=/usr/local/webserver/php/bin/php-config

make

make install

cd ../

tar jxvf eaccelerator-0.9.6.1.tar.bz2

cd eaccelerator-0.9.6.1/

/usr/local/webserver/php/bin/phpize

./configure --enable-eaccelerator=shared --with-php-config=/usr/local/webserver/php/bin/php-config

make

make install

cd ../

tar zxvf PDO_MYSQL-1.0.2.tgz

cd PDO_MYSQL-1.0.2/

/usr/local/webserver/php/bin/phpize

./configure --with-php-config=/usr/local/webserver/php/bin/php-config --with-pdo-mysql=/usr/local/webserver/mysql

make

make install

cd ../

tar zxvf ImageMagick.tar.gz

cd ImageMagick-6.7.5-6/

./configure

make

make install

cd ../

tar zxvf imagick-2.3.0.tgcd imagick-2.3.0

/usr/local/webserver/php/bin/phpize

./configure --with-php-config=/usr/local/webserver/php/bin/php-config

make

make install

cd ../

5、修改php.ini文件

手工修改：查找/usr/local/webserver/php/etc/php.ini中的extension_dir = "./"

修改为extension_dir = "/usr/local/webserver/php/lib/php/extensions/no-debug-non-zts-20060613/"

并在此行后增加以下几行，然后保存：

extension = "memcache.so"

extension = "pdo_mysql.so"

extension = "imagick.so"

再查找output_buffering = Off

修改为output_buffering = On

再查找; cgi.fix_pathinfo=0

修改为cgi.fix_pathinfo=0，防止Nginx文件类型错误解析漏洞。

自动修改：若嫌手工修改麻烦，可执行以下shell命令，自动完成对php.ini文件的修改：

sed -i 's#extension_dir = "./"#extension_dir = "/usr/local/webserver/php/lib/php/extensions/no-debug-non-zts-20060613/"\nextension = "memcache.so"\nextension = "pdo_mysql.so"\nextension = "imagick.so"\n#' /usr/local/webserver/php/etc/php.ini

sed -i 's#output_buffering = Off#output_buffering = On#' /usr/local/webserver/php/etc/php.ini

sed -i "s#; always_populate_raw_post_data = On#always_populate_raw_post_data = On#g" /usr/local/webserver/php/etc/php.ini

sed -i "s#; cgi.fix_pathinfo=0#cgi.fix_pathinfo=0#g" /usr/local/webserver/php/etc/php.ini

配置eAccelerator加速PHP：

mkdir -p /usr/local/webserver/eaccelerator_cache

vi /usr/local/webserver/php/etc/php.ini

[eaccelerator]

zend_extension="/usr/local/webserver/php/lib/php/extensions/no-debug-non-zts-20060613/eaccelerator.so"

eaccelerator.shm_size="64"

eaccelerator.cache_dir="/usr/local/webserver/eaccelerator_cache"

eaccelerator.enable="1"

eaccelerator.optimizer="1"

eaccelerator.check_mtime="1"

eaccelerator.debug="0"

eaccelerator.filter=""

eaccelerator.shm_max="0"

eaccelerator.shm_ttl="3600"

eaccelerator.shm_prune_period="3600"

eaccelerator.shm_only="0"

eaccelerator.compress="1"

eaccelerator.compress_level="9"

创建www用户和组，以及供虚拟主机使用的目录：

/usr/sbin/groupadd www

/usr/sbin/useradd -g www www

mkdir -p /data0/htdocs/www

chmod +w /data0/htdocs/www

chown -R www:www /data0/htdocs/www

创建php-fpm配置文件(php-fpm是为PHP打的一个FastCGI管理补丁，可以平滑变更php.ini配置而无需重启php-cgi)：

在/usr/local/webserver/php/etc/目录中创建php-fpm.conf文件：

rm -f /usr/local/webserver/php/etc/php-fpm.conf

vi /usr/local/webserver/php/etc/php-fpm.conf

输入以下内容(如果您安装 Nginx + PHP 用于程序调试，请将以下的0改为1，以便显示PHP错误信息，否则，Nginx 会报状态为500的空白错误页)：

All relative paths in this config are relative to php's install prefix

Pid file

/usr/local/webserver/php/logs/php-fpm.pid

Error log file

/usr/local/webserver/php/logs/php-fpm.log

Log level

notice

When this amount of php processes exited with SIGSEGV or SIGBUS ...

10

... in a less than this interval of time, a graceful restart will be initiated.

Useful to work around accidental curruptions in accelerator's shared memory.

1m

Time limit on waiting child's reaction on signals from master

5s

Set to 'no' to debug fpm

yes

Name of pool. Used in logs and stats.

default

Address to accept fastcgi requests on.

Valid syntax is 'ip.ad.re.ss:port' or just 'port' or '/path/to/unix/socket'

127.0.0.1:9000

Set listen(2) backlog

-1

Set permissions for unix socket, if one used.

In Linux read/write permissions must be set in order to allow connections from web server.

Many BSD-derrived systems allow connections regardless of permissions.

0666

Additional php.ini defines, specific to this pool of workers.

/usr/sbin/sendmail -t -i

0

Unix user of processes

www

Unix group of processes

www

Process manager settings

Sets style of controling worker process count.

Valid values are 'static' and 'apache-like'

static

Sets the limit on the number of simultaneous requests that will be served.

Equivalent to Apache MaxClients directive.

Equivalent to PHP_FCGI_CHILDREN environment in original php.fcgi Used with any pm_style.

128

Settings group for 'apache-like' pm style

Sets the number of server processes created on startup.

Used only when 'apache-like' pm_style is selected

20

Sets the desired minimum number of idle server processes.

Used only when 'apache-like' pm_style is selected

5

Sets the desired maximum number of idle server processes.

Used only when 'apache-like' pm_style is selected

35

The timeout (in seconds) for serving a single request after which the worker process will be terminated

Should be used when 'max_execution_time' ini option does not stop script execution for some reason

'0s' means 'off'

0s

The timeout (in seconds) for serving of single request after which a php backtrace will be dumped to slow.log file

'0s' means 'off'

0s

The log file for slow requests

logs/slow.log

Set open file desc rlimit

65535

Set max core size rlimit

0

Chroot to this directory at the start, absolute path

Chdir to this directory at the start, absolute path

Redirect workers' stdout and stderr into main error log.

If not set, they will be redirected to /dev/null, according to FastCGI specs

yes

How much requests each process should execute before respawn.

Useful to work around memory leaks in 3rd party libraries.

For endless request processing please specify 0

Equivalent to PHP_FCGI_MAX_REQUESTS

1024

Comma separated list of ipv4 addresses of FastCGI clients that allowed to connect.

Equivalent to FCGI_WEB_SERVER_ADDRS environment in original php.fcgi (5.2.2+)

Makes sense only with AF_INET listening socket.

127.0.0.1

Pass environment variables like LD_LIBRARY_PATH

All $VARIABLEs are taken from current environment

$HOSTNAME

/usr/local/bin:/usr/bin:/bin

/tmp

/tmp

/tmp

$OSTYPE

$MACHTYPE

2

启动php-cgi进程，监听127.0.0.1的9000端口，进程数为128(如果服务器内存小于3GB，可以只开启64个进程)，用户为www：

ulimit -SHn 65535

/usr/local/webserver/php/sbin/php-fpm start

注：/usr/local/webserver/php/sbin/php-fpm还有其他参数，包括：start|stop|quit|restart|reload|logrotate，修改php.ini后不重启php-cgi，重新加载配置文件使用reload。

nginx包

安装Nginx所需的pcre库：

tar zxvf pcre-8.10.tar.gz

cd pcre-8.10/

./configure

make && make install

cd ../

安装Nginx

tar zxvf nginx-1.0.12.tar.gz

cd nginx-1.0.12/

./configure --user=www --group=www --prefix=/usr/local/webserver/nginx --with-http_stub_status_module --with-http_ssl_module

make && make install

cd ../

创建Nginx日志目录

mkdir -p /data1/logs

chmod +w /data1/logs

chown -R www:www /data1/logs

在/usr/local/webserver/nginx/conf/目录中创建nginx.conf文件：

rm -f /usr/local/webserver/nginx/conf/nginx.conf

vi /usr/local/webserver/nginx/conf/nginx.conf

user www www;

worker_processes 8;

error_log /data1/logs/nginx_error.log crit;

pid /usr/local/webserver/nginx/nginx.pid;

#Specifies the value for maximum file descriptors that can be opened by this process.

worker_rlimit_nofile 65535;

events

{

use epoll;

worker_connections 65535;

}

http

{

include mime.types;

default_type application/octet-stream;

#charset gb2312;

server_names_hash_bucket_size 128;

client_header_buffer_size 32k;

large_client_header_buffers 4 32k;

client_max_body_size 8m;

sendfile on;

tcp_nopush on;

keepalive_timeout 60;

tcp_nodelay on;

fastcgi_connect_timeout 300;

fastcgi_send_timeout 300;

fastcgi_read_timeout 300;

fastcgi_buffer_size 64k;

fastcgi_buffers 4 64k;

fastcgi_busy_buffers_size 128k;

fastcgi_temp_file_write_size 128k;

gzip on;

gzip_min_length 1k;

gzip_buffers 4 16k;

gzip_http_version 1.0;

gzip_comp_level 2;

gzip_types text/plain application/x-javascript text/css application/xml;

gzip_vary on;

log_format default '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" $http_x_forwarded_for';

#limit_zone crawler $binary_remote_addr 10m;

server

{

listen 80;

server_name 127.0.0.1;

index index.html index.htm index.php;

root /data0/htdocs/blog;

#limit_conn crawler 20;

location ~ .*\.(php|php5)?$

{

#fastcgi_pass unix:/tmp/php-cgi.sock;

fastcgi_pass 127.0.0.1:9000;

fastcgi_index index.php;

include fcgi.conf;

}

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|ico)$

{

expires 365d;

}

location ~ .*\.(js|css)?$

{

expires 365d;

}

access_log /data1/logs/access.log default;

}

}

在/usr/local/webserver/nginx/conf/目录中创建fcgi.conf文件：

vi /usr/local/webserver/nginx/conf/fcgi.conf

fastcgi_param GATEWAY_INTERFACE CGI/1.1;

fastcgi_param SERVER_SOFTWARE nginx;

fastcgi_param QUERY_STRING $query_string;

fastcgi_param REQUEST_METHOD $request_method;

fastcgi_param CONTENT_TYPE $content_type;

fastcgi_param CONTENT_LENGTH $content_length;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param SCRIPT_NAME $fastcgi_script_name;

fastcgi_param REQUEST_URI $request_uri;

fastcgi_param DOCUMENT_URI $document_uri;

fastcgi_param DOCUMENT_ROOT $document_root;

fastcgi_param SERVER_PROTOCOL $server_protocol;

fastcgi_param REMOTE_ADDR $remote_addr;

fastcgi_param REMOTE_PORT $remote_port;

fastcgi_param SERVER_ADDR $server_addr;

fastcgi_param SERVER_PORT $server_port;

fastcgi_param SERVER_NAME $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect

fastcgi_param REDIRECT_STATUS 200;

启动Nginx

ulimit -SHn 65535

/usr/local/webserver/nginx/sbin/nginx

vi /etc/rc.local

ulimit -SHn 65535

/usr/local/webserver/php/sbin/php-fpm start

/usr/local/webserver/nginx/sbin/nginx

优化Linux内核参数

vi /etc/sysctl.conf

# Add

net.ipv4.tcp_max_syn_backlog = 65536

net.core.netdev_max_backlog = 32768

net.core.somaxconn = 32768

net.core.wmem_default = 8388608

net.core.rmem_default = 8388608

net.core.rmem_max = 16777216

net.core.wmem_max = 16777216

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_synack_retries = 2

net.ipv4.tcp_syn_retries = 2

net.ipv4.tcp_tw_recycle = 1

#net.ipv4.tcp_tw_len = 1

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_mem = 94500000 915000000 927000000

net.ipv4.tcp_max_orphans = 3276800

#net.ipv4.tcp_fin_timeout = 30

#net.ipv4.tcp_keepalive_time = 120

net.ipv4.ip_local_port_range = 1024 65535

使配置立即生效

/sbin/sysctl -p

在不停止Nginx服务的情况下平滑变更Nginx配置

/usr/local/webserver/nginx/sbin/nginx -t

/usr/local/webserver/nginx/sbin/nginx -s reload

编写每天定时切割Nginx日志的脚本

创建脚本/usr/local/webserver/nginx/sbin/cut_nginx_log.sh

vi /usr/local/webserver/nginx/sbin/cut_nginx_log.sh

#!/bin/bash

# This script run at 00:00

# The Nginx logs path

logs_path="/usr/local/webserver/nginx/logs/"

mkdir -p ${logs_path}$(date -d "yesterday" +"%Y")/$(date -d "yesterday" +"%m")/

mv ${logs_path}access.log ${logs_path}$(date -d "yesterday" +"%Y")/$(date -d "yesterday" +"%m")/access_$(date -d "yesterday" +"%Y%m%d").log

kill -USR1 `cat /usr/local/webserver/nginx/nginx.pid`

设置crontab，每天凌晨00:00切割nginx访问日志

crontab -e

00 00 * * * /bin/bash  /usr/local/webserver/nginx/sbin/cut_nginx_log.sh

开启防火墙80端口

vi /etc/sysconfig/iptables

添加

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

重启防火墙

service iptables restart

PS: 如有问题请指正