RHEL 5 安装nginx以及配置SELINUX POLICY

1. 安装EPEL，启用RHEL的附加软件包

$ sudo rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-2.noarch.rpm

上面的i386可以替换成x86_64

2. 安装nginx

$ sudo yum install -y nginx

配置信息增加

$ cat /etc/nginx/fastcgi.conf

fastcgi_param GATEWAY_INTERFACE CGI/1.1;

fastcgi_param SERVER_SOFTWARE nginx;

fastcgi_param QUERY_STRING $query_string;

fastcgi_param REQUEST_METHOD $request_method;

fastcgi_param CONTENT_TYPE $content_type;

fastcgi_param CONTENT_LENGTH $content_length;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param SCRIPT_NAME $fastcgi_script_name;

fastcgi_param REQUEST_URI $request_uri;

fastcgi_param DOCUMENT_URI $document_uri;

fastcgi_param DOCUMENT_ROOT $document_root;

fastcgi_param SERVER_PROTOCOL $server_protocol;

fastcgi_param REMOTE_ADDR $remote_addr;

fastcgi_param REMOTE_PORT $remote_port;

fastcgi_param SERVER_ADDR $server_addr;

fastcgi_param SERVER_PORT $server_port;

fastcgi_param SERVER_NAME $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect

fastcgi_param REDIRECT_STATUS 200;

3.安装lighttpd-fastcgi和php-cli以及其它软件包

$ sudo yum install -y lighttpd-fastcgi

4.由于nginx和php-cgi不在SELINUX 的policy里面，为了安全和简单将nginx和php-cgi进程domain设置为httpd_t

$ sudo chcon system_u:object_r:httpd_exec_t /usr/sbin/nginx

$ sudo chcon system_u:object_r:httpd_exec_t /usr/bin/php-cgi

$ sudo chcon -t httpd_config_t -R /etc/nginx

$ sudo chcon -t httpd_cache_t -R /var/lib/nginx

$sudo chcon -t httpd_log_t -R /var/log/nginx

$sudo /usr/sbin/setsebool -P httpd_can_network_connect=1

5.创建phpcgi启动脚本

$ cat /etc/init.d/phpcgi

#!/bin/sh

#

# php-cgi - this script starts and stops the php-cgi daemin

#

# chkconfig: - 85 15

# description: Fast CGI php

# processname: php-cgi

# config: /etc/php.ini

# pidfile: /var/run/php-cgi.pid

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

[ "$NETWORKING" = "no" ] && exit 0

phpcgi="/usr/bin/php-cgi"

prog=$(basename ${phpcgi})

FCGIPORT="8888"

FCGIADDR="127.0.0.1"

FCGIUSER="apache"

FCGIGROUP="apache"

PHP_FCGI_CHILDREN=5

PHP_FCGI_MAX_REQUESTS=1000

export PHP_FCGI_CHILDREN PHP_FCGI_MAX_REQUESTS

[ -e /etc/sysconfig/php-cgi ] && . /etc/sysconfig/php-cgi

lockfile=/var/lock/subsys/php-cgi

start() {

echo -n $"Starting $prog: "

/usr/bin/spawn-fcgi -a $FCGIADDR  -p $FCGIPORT -C $PHP_FCGI_CHILDREN -u $FCGIUSER -g $FCGIGROUP -P /var/run/php-cgi.pid -f "${phpcgi}" >> /

dev/null 2>&1

retval=$?

echo

[ $retval -eq 0 ] && touch $lockfile

return $retval

}

stop() {

echo -n $"Stopping $prog: "

killproc $prog -QUIT

retval=$?

echo

[ $retval -eq 0 ] && rm -f $lockfile

return $retval

}

restart() {

stop

start

}

force_reload() {

restart

}

fdr_status() {

status $prog

}

case "$1" in

start|stop|restart)

$1

;;

status)

fdr_status

;;

condrestart|try-restart)

[ ! -f $lockfile ] || restart

;;

*)

echo $"Usage: $0 {start|stop|status|restart|try-restart|force-reload}"

exit 2

esac

$ sudo /sbin/chkconfig --add phpcgi

$ sudo /sbin/chkconfig --level 345 phpcgi on

$ sudo /sbin/chkconfig --level 345 nginx on

5.启动

$ sudo /sbin/service phpcgi start

$ sudo /sbin/service nginx start

6.解决audit错误

$ sudo cat /var/log/audit/audit.log| audit2allow -M local

$ sudo /usr/sbin/semodule -i local.pp

重新启动