create account

Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk) by oflyhigh

View this thread on: hive.blogpeakd.comecency.com
· @oflyhigh ·
$49.79
Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)
在昨天的帖子中介绍了[如何在Ubuntu 18.04下安装Apache2、PHP7.2、MYSQL](https://steemit.com/linux/@oflyhigh/ubuntu-18-04-apache2-php7-2-mysql),完成安全后,我们略作设置并绑定域名就可以跑起网站啦。

![](https://cdn.steemitimages.com/DQmQZB76VdWfP5ciCSthhWEsSPs5D158T9cCAJKrvimFVSo/image.png)
(图源 :[pexels.com]( https://www.pexels.com/))

# 默认配置

但是默认情况下,网站的目录配置为:
>`DocumentRoot /var/www/html`

而Apache2的用户和用户组为
>`export APACHE_RUN_USER=www-data`
`export APACHE_RUN_GROUP=www-data`
>`User ${APACHE_RUN_USER}`
`Group ${APACHE_RUN_GROUP}`

也就是说,如果我们想运行多个站点,站点的用户和组都是`www-data`,这样有个风险就是,一旦一个站点被黑,那么上载恶意脚本后很容易黑掉其它站点。

# mpm-itk 模块

那么有没有办法已不同的用户运行虚拟主机呢?比如说a用户的虚拟主机程序用户和用户组都是a,而b用户的虚拟主机程序用户和用户组都是b,答案是使用mpm-itk 模块。

老一点的版本可能会使用以下指令安装模块:
>`sudo apt-get install apache2-mpm-itk`

在Ubuntu 18.04下,上述指令无法安装mpm-itk,正确的指令为:
>`sudo apt-get install libapache2-mpm-itk`

安装完成时会自动使能这个模块。
>Setting up libapache2-mpm-itk (2.4.7-04-1) ...
apache2_invoke: Enable module mpm_itk

如果需要手动使能相关模块,可以使用如下指令:
>`sudo a2enmod mpm_itk`

提示信息如下:
>Considering dependency mpm_prefork for mpm_itk:
Considering conflict mpm_event for mpm_prefork:
Considering conflict mpm_worker for mpm_prefork:
Module mpm_prefork already enabled
Module mpm_itk already enabled

# 创建站点

安装好这个mpm_itk模块后,我们创建个新站点(可以从默认站点配置文件来修改)

>`cd /etc/apache2/sites-available`
`sudo cp 000-default.conf mysite.conf`
`sudo vi mysite.conf`

然后主要修改如下:
>`        ServerName mysite.com`
`        <ifmodule mpm_itk_module>`
`                AssignUserID mysite mysite`
`        </ifmodule>`
`        DocumentRoot /home/mysite/www`
`        ErrorLog /home/mysite/logs/error.log`
`        CustomLog /home/mysite/logs/access.log combined`


然后使用adduser添加用户:
>`sudo adduser mysite`

登陆上述用户,创建对应目录和站点文件。

然后执行如下指令启动站点:
>` sudo a2ensite mysite.conf`
`sudo systemctl reload apache2`

# 权限错误

按上述操作配置后,访问站点会提示 403 Forbidden 错误:
![](https://cdn.steemitimages.com/DQmP7LqieSY24TvHjP44WhBnRQxUxqZfN4KsGwESBfLb1Xx/image.png)

查看错误日志发现类似如下错误:

>`[Tue Jul 17 00:46:08.773031 2018] [authz_core:error] [pid 12821] [client xxxxx:54251] AH01630: client denied by server configuration: /home/mysite/www/`
`[Tue Jul 17 00:46:11.360338 2018] [authz_core:error] [pid 12821] [client xxxx:54251] AH01630: client denied by server configuration: /home/mysite/www/`

我一直以为是我libapache2-mpm-itk模块没有配置好,经过一整天的反复测试和调查后,才发现在apche2.conf中设置了如下访问限制。

```
<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>
```

也就是说除了` /var/www/`以及`/usr/share`以外的目录都是禁止访问的。知道了这点就很好解决啦,在我们的mysite.conf中运行访问我们的目录就可以啦。

```
        <Directory /home/mysite/www>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
        </Directory>
```

再来测试一下,耶,一切正常。

# 总结


现在我们就可以已独立的用户运行虚拟主机啦,这样做安全性更高,也更便于管理。是不是很简单?

# 相关链接

* [Ubuntu 18.04 安装Apache2、PHP7.2、MYSQL](https://steemit.com/linux/@oflyhigh/ubuntu-18-04-apache2-php7-2-mysql)
* [The Apache 2 ITK MPM](http://mpm-itk.sesse.net/)
👍  , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , and 76 others
👎  
properties (23)
authoroflyhigh
permlinkubuntu-18-04-mpm-itk
categorylinux
json_metadata{"tags":["linux","apache","mpm-itk","security","cn"],"image":["https://cdn.steemitimages.com/DQmQZB76VdWfP5ciCSthhWEsSPs5D158T9cCAJKrvimFVSo/image.png","https://cdn.steemitimages.com/DQmP7LqieSY24TvHjP44WhBnRQxUxqZfN4KsGwESBfLb1Xx/image.png"],"links":["https://steemit.com/linux/@oflyhigh/ubuntu-18-04-apache2-php7-2-mysql","https://www.pexels.com/","http://mpm-itk.sesse.net/"],"app":"steemit/0.1","format":"markdown"}
created2018-07-17 05:38:27
last_update2018-07-17 05:38:27
depth0
children10
last_payout2018-07-24 05:38:27
cashout_time1969-12-31 23:59:59
total_payout_value42.301 HBD
curator_payout_value7.489 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length3,129
author_reputation6,302,438,912,882,690
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,951,893
net_rshares23,909,119,755,564
author_curate_reward""
vote details (141)
@alex00 ·
wow,,what a post..hope that everyone learn from here...
properties (22)
authoralex00
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180717t055148280z
categorylinux
json_metadata{"tags":["linux"],"app":"steemit/0.1"}
created2018-07-17 05:52:06
last_update2018-07-17 05:52:06
depth1
children0
last_payout2018-07-24 05:52:06
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length55
author_reputation73,467,785
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,952,867
net_rshares0
@antone ·
$0.07
提到虚拟主机,又让我这个技术小白想起上半年为自己搭梯子,买虚拟主机什么的,熬了几夜 花了好长时间都没搞好的惨痛经历
👍  
properties (23)
authorantone
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180717t061009332z
categorylinux
json_metadata{"community":"busy","app":"busy/2.5.2","format":"markdown","tags":["linux"],"users":[],"links":[],"image":[]}
created2018-07-17 06:10:09
last_update2018-07-17 06:10:09
depth1
children0
last_payout2018-07-24 06:10:09
cashout_time1969-12-31 23:59:59
total_payout_value0.050 HBD
curator_payout_value0.015 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length57
author_reputation1,083,737,624,439
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,954,202
net_rshares31,931,638,564
author_curate_reward""
vote details (1)
@catwomanteresa · (edited)
$0.07
請收下我崇拜的眼光,每次看到O哥的技術文,只能默默的鼓掌,然後默默的飄走
![passby02.gif](https://cdn.steemitimages.com/DQmWTB5iKtorBRxJ3BPGYUYtUcwSJBFt9VXYSiiqNx1frDN/passby02.gif)
👍  
properties (23)
authorcatwomanteresa
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180717t080933846z
categorylinux
json_metadata{"tags":["linux"],"app":"steemit/0.1","image":["https://cdn.steemitimages.com/DQmWTB5iKtorBRxJ3BPGYUYtUcwSJBFt9VXYSiiqNx1frDN/passby02.gif"]}
created2018-07-17 08:09:33
last_update2018-07-17 08:11:18
depth1
children1
last_payout2018-07-24 08:09:33
cashout_time1969-12-31 23:59:59
total_payout_value0.050 HBD
curator_payout_value0.015 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length144
author_reputation242,407,633,843,306
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,963,513
net_rshares31,932,197,947
author_curate_reward""
vote details (1)
@oflyhigh ·
飘得不错呀:)
properties (22)
authoroflyhigh
permlinkre-catwomanteresa-re-oflyhigh-ubuntu-18-04-mpm-itk-20180718t125950755z
categorylinux
json_metadata{"tags":["linux"],"app":"steemit/0.1"}
created2018-07-18 12:59:54
last_update2018-07-18 12:59:54
depth2
children0
last_payout2018-07-25 12:59:54
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length7
author_reputation6,302,438,912,882,690
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id65,114,139
net_rshares0
@cn-cutie.pie ·
@oflyhigh, 写得好好哇~~~ ![img](https://i.imgur.com/VnFLWKq.png)

properties (22)
authorcn-cutie.pie
permlink20180717t060009497z-post
categorylinux
json_metadata{"tags":["cn"]}
created2018-07-17 06:00:09
last_update2018-07-17 06:00:09
depth1
children0
last_payout2018-07-24 06:00:09
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length61
author_reputation717,169,219,933
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,953,439
net_rshares0
@cn-naughty.boy ·
@oflyhigh, 要不是我膝盖上中了一箭,我的膝盖就送给你了!
properties (22)
authorcn-naughty.boy
permlink20180717t053906267z-post
categorylinux
json_metadata{"tags":["cn"]}
created2018-07-17 05:39:06
last_update2018-07-17 05:39:06
depth1
children0
last_payout2018-07-24 05:39:06
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length33
author_reputation803,970,857,060
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,951,937
net_rshares0
@flagfixer ·
@oflyhigh you were flagged by a worthless gang of trolls, so, I gave you an upvote to counteract it!  Enjoy!!
properties (22)
authorflagfixer
permlinkflagfixer-re-oflyhighubuntu-18-04-mpm-itk
categorylinux
json_metadata""
created2018-07-17 20:16:24
last_update2018-07-17 20:16:24
depth1
children0
last_payout2018-07-24 20:16:24
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length109
author_reputation2,148,467,197,579
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id65,032,278
net_rshares0
@fr3eze ·
$0.07
很简单是没有啦,还是需要些基础的。
👍  
properties (23)
authorfr3eze
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180717t073552020z
categorylinux
json_metadata{"community":"busy","app":"busy/2.5.2","format":"markdown","tags":["linux"],"users":[],"links":[],"image":[]}
created2018-07-17 07:35:54
last_update2018-07-17 07:35:54
depth1
children0
last_payout2018-07-24 07:35:54
cashout_time1969-12-31 23:59:59
total_payout_value0.050 HBD
curator_payout_value0.015 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length17
author_reputation62,201,653,753,684
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id64,960,752
net_rshares31,932,197,947
author_curate_reward""
vote details (1)
@jlsycxy ·
$0.07
最好弄个一键安装的!这个还是需要些代码!
👍  ,
properties (23)
authorjlsycxy
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180718t015712250z
categorylinux
json_metadata{"tags":["linux"],"app":"steemit/0.1"}
created2018-07-18 01:50:21
last_update2018-07-18 01:50:21
depth1
children0
last_payout2018-07-25 01:50:21
cashout_time1969-12-31 23:59:59
total_payout_value0.052 HBD
curator_payout_value0.014 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length20
author_reputation10,919,118,367
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id65,057,404
net_rshares32,324,098,489
author_curate_reward""
vote details (2)
@shine.wong ·
没觉得简单~~能不弄就不弄,看着就懒癌发作~
properties (22)
authorshine.wong
permlinkre-oflyhigh-ubuntu-18-04-mpm-itk-20180718t071311588z
categorylinux
json_metadata{"tags":["linux"],"app":"steemit/0.1"}
created2018-07-18 07:13:15
last_update2018-07-18 07:13:15
depth1
children0
last_payout2018-07-25 07:13:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length22
author_reputation1,329,335,530,903
root_title"Ubuntu 18.04 使用独立用户运行虚拟主机 (mpm-itk)"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id65,083,641
net_rshares0