目錄
zabbix-web切換為nginx及https
1、背景和環境
zabbix使用了很久，安裝的時候並沒有選擇復雜的源碼編譯安裝，所以默認采用了apache的httpd提供web服務。由於對httpd並沒有深入研究，而且個人對httpd的配置文件格式很不感冒，怎么辦？當然是換nginx呀！順便加上https證書安全安全。
本文中的環境如下：
系統版本：CentOS Linux release 7.4.1708 (Core)
軟件版本：
zabbix 4.0.0
nginx 1.16.0
php 5.6.40
2、安裝nginx
2.1、編譯參數
apache httpd通過模塊來使用php，nginx連接php則需要單獨安裝php，首先編譯安裝nginx
編譯參數和步驟如下，來自我的github
#!/bin/bash
#定義版本
VERSION=1.16.0
#安裝依賴包
yum install gcc gcc-c++ glibc pcre-devel zlib-devel openssl-devel -y
#用戶創建
/usr/sbin/useradd -M -s /sbin/nologin www
#編譯安裝
cd ~
wget http://nginx.org/download/nginx-${VERSION}.tar.gz
tar xf nginx-${VERSION}.tar.gz
cd nginx-${VERSION}
./configure --prefix=/usr/local/nginx --pid-path=/usr/local/nginx/run/nginx.pid --user=www --group=www --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module
make && make install
cd /usr/local/nginx/conf/
grep -Ev '^$|#' nginx.conf.default > nginx.conf
#清除包
cd ~
rm -rf nginx-${VERSION} nginx-${VERSION}.tar.gz
2.2、修改配置文件並配置https
/usr/local/nginx/confnginx.conf
[root@zabbix ~]# cat /usr/local/nginx/conf/nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server_tokens off;
include /usr/local/nginx/conf/Include/*.conf;
}
cat /usr/local/nginx/conf/Include/zabbix.conf
[root@zabbix ~]# cat /usr/local/nginx/conf/Include/zabbix.conf
server {
listen 80;
server_name www.zabbix.cn;
return 301 https://www.zabbix.cn$request_uri;
}
server {
listen 443 ssl;
server_name www.zabbix.cn
if ($host != 'www.zabbix.cn') {
return 403;
}
root /usr/share/zabbix;
index index.php index.html index.htm;
ssl_certificate /usr/local/nginx/ssl-certs/2505454_www.zabbix.cn.pem;
ssl_certificate_key /usr/local/nginx/ssl-certs/2505454_www.zabbix.cn.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/ngnix_access.log;
error_log /var/log/nginx/ngnix_error.log;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ^~ /app {
deny all;
}
location ^~ /conf {
deny all;
}
location ^~ /local {
deny all;
}
location ^~ /include {
deny all;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
2.3、配置nginx為系統服務
vim /lib/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network.target
[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true
[Install]
WantedBy=multi-user.target
- 加載系統服務
systemctl daemon-reload
- 設置開機啟動
systemctl enable nginx
- 啟動 nginx
systemctl start nginx
- 停止
systemctl stop nginx
- 加載配置文件
systemctl reload nginx
3、安裝php
3.1、編譯安裝
3.1.1、編譯參數
php的編譯安裝稍微復雜，復雜點就在於它的編譯參數，php的編譯參數很多，這里盡量最小化安裝，如何選擇參數，可通過在第一次安裝zabbix的時候環境檢測查看到，參數不滿足是無法正常安裝使用的，我通過本地虛擬機重新安裝了一遍zabbix，得到具體環境參數如下，每列可依次理解為：名稱、檢測結果、需滿足的結果、檢測是否通過。
PHP version 5.6.40 5.4.0 OK
PHP option "memory_limit" 128M 128M OK
PHP option "post_max_size" 8M 16M Fail
PHP option "upload_max_filesize" 2M 2M OK
PHP option "max_execution_time" 30 300 Fail
PHP option "max_input_time" -1 300 OK
PHP option "date.timezone" unknown Fail
PHP databases support MySQL OK
PHP bcmath on OK
PHP mbstring on OK
PHP option "mbstring.func_overload" off off OK
PHP option "always_populate_raw_post_data" on off Fail
PHP sockets on OK
PHP gd 2.1.0 2.0 OK
PHP gd PNG support on OK
PHP gd JPEG support on OK
PHP gd FreeType support on OK
PHP libxml 2.9.1 2.6.15 OK
PHP xmlwriter on OK
PHP xmlreader on OK
PHP LDAP off Warning
PHP ctype on OK
PHP session on OK
PHP option "session.auto_start" off off OK
PHP gettext off Warning
PHP option "arg_separator.output" & & OK
查看上述參數，最后確認一個合適的編譯參數，如果第一次編譯少了某些參數，也可通過不重新編譯添加模塊的方法，最終編譯參數如下：
./configure --prefix=/usr/local/php-5.6.40 \
--enable-opcache \
--with-config-file-path=/usr/local/php-5.6.40/etc \
--with-mysql=mysqlnd \
--with-mysqli=mysqlnd \
--with-pdo-mysql=mysqlnd \
--enable-fpm \
--enable-static \
--enable-inline-optimization \
--enable-sockets \
--enable-wddx \
--enable-zip \
--enable-calendar \
--enable-bcmath \
--enable-soap \
--with-zlib \
--with-iconv \
--with-gd \
--with-xmlrpc \
--enable-mbstring \
--with-curl \
--with-gettext \
--with-ldap \
--enable-ftp \
--with-mcrypt \
--with-freetype-dir=/usr/local/freetype.2.1.10 \
--with-jpeg-dir=/usr/local/jpeg.6 \
--with-png-dir=/usr/local/libpng.1.2.50 \
--disable-ipv6 \
--disable-debug \
--with-openssl \
--disable-maintainer-zts \
--disable-fileinfo
3.1.2、排錯
編譯安裝時可能出現的報錯和解決辦法如下，具體不做分析
報錯一：
configure: error: Cannot find ldap.h
解決辦法：
yum install -y openldap openldap-devel
報錯二：
configure: error: Cannot find ldap libraries in /usr/lib.
解決辦法：
cp -frp /usr/lib64/libldap* /usr/lib/
報錯三：
//.usrlibs//lib64ldap.o/:liblber -undefined2.4.so.2 :reference errorto addingsymbol symbols':ber_scanf 'DSO
/missingusr /fromlib64 /commandliblber -line2.4.so.2
: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
collect2: error: ld returned 1 exit status
make: *** [sapi/cli/php] Error 1
make: *** Waiting for unfinished jobs....
make: *** [sapi/cgi/php-cgi] Error 1
/usr/bin/ld: ext/ldap/.libs/ldap.o: undefined reference to symbol 'ber_scanf'
/usr/lib64/liblber-2.4.so.2: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
解決辦法：
vim Makefile 在這行最后添加-llber
EXTRA_LIBS = -lcrypt -lz -lresolv -lcrypt -lrt -lmcrypt -lldap -lpng -lz -ljpeg -lcurl -lz -lrt -lm -ldl -lnsl -lxml2 -lz -lm -ldl -lssl -lcrypto -lcurl -lxml2 -lz -lm -ldl -lssl -lcrypto -lfreetype -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lcrypt -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lssl -lcrypto -lcrypt -llber
3.2、配置
編譯安裝完php后，需要修改配置文件php.ini中的內容以滿足上述檢測：
post_max_size = 16M
max_input_time = 300
max_execution_time = 300
date.timezone = Asia/Shanghai
always_populate_raw_post_data = -1
3.3、配置php為系統服務
編譯安裝php的，會在php目錄生成很多二進制文件，找到init.d.php-fpm，拷貝到init.d下。
cp /usr/local/src/php-5.6.33/sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
設置權限
chmod 755 /etc/init.d/php-fpm
配置php-fpm.conf
vim /usr/local/etc/php-fpm.conf
如果打開了pid配置，需要將pid（;pid = run/php-fpm.pid）前的;去掉。
啟動
/etc/init.d/php-fpm start
3.4、啟動
編譯配置沒有問題，可正常啟動
4、訪問及排錯
訪問時出現的報錯及解決辦法如下
報錯一：
FastCGI sent in stderr: "PHP message: PHP Warning: require_once(/etc/zabbix/web/maintenance.inc.php): failed to open stream: Permission denied in /app/nginx/html/zabbix/include/classes/core/ZBase.php on line 292
PHP message: PHP Fatal error: require_once(): Failed opening required '/etc/zabbix/web/mainte‘
解決辦法：
chmod -R 755 /etc/zabbix/web
報錯二：
Database error
Error connecting to database: No such file or directory
解決辦法：修改php.ini
mysqli.default_socket = /var/lib/mysql/mysql.sock
最終，切換nginx及配置https成功：
