zabbix-web切换为nginx及https

zabbix-web切换为nginx及https

1、背景和环境

zabbix使用了很久，安装的时候并没有选择复杂的源码编译安装，所以默认采用了apache的httpd提供web服务。由于对httpd并没有深入研究，而且个人对httpd的配置文件格式很不感冒，怎么办？当然是换nginx呀！顺便加上https证书安全安全。

本文中的环境如下：

系统版本：CentOS Linux release 7.4.1708 (Core)

软件版本：

zabbix 4.0.0

nginx 1.16.0

php 5.6.40

2、安装nginx

2.1、编译参数

apache httpd通过模块来使用php，nginx连接php则需要单独安装php，首先编译安装nginx

编译参数和步骤如下，来自我的github

#!/bin/bash

#定义版本

VERSION=1.16.0

#安装依赖包

yum install gcc gcc-c++ glibc pcre-devel zlib-devel openssl-devel -y

#用户创建

/usr/sbin/useradd -M -s /sbin/nologin www

#编译安装

cd ~

wget http://nginx.org/download/nginx-${VERSION}.tar.gz

tar xf nginx-${VERSION}.tar.gz

cd nginx-${VERSION}

./configure --prefix=/usr/local/nginx --pid-path=/usr/local/nginx/run/nginx.pid --user=www --group=www --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module

make && make install

cd /usr/local/nginx/conf/

grep -Ev '^$|#' nginx.conf.default > nginx.conf

#清除包

cd ~

rm -rf nginx-${VERSION} nginx-${VERSION}.tar.gz

2.2、修改配置文件并配置https

/usr/local/nginx/confnginx.conf

[root@zabbix ~]# cat /usr/local/nginx/conf/nginx.conf

worker_processes  1;

events {

    worker_connections  1024;

}

http {

    include       mime.types;

    default_type  application/octet-stream;

    sendfile        on;

    keepalive_timeout  65;

    server_tokens   off;

    include /usr/local/nginx/conf/Include/*.conf;

}

cat /usr/local/nginx/conf/Include/zabbix.conf

[root@zabbix ~]# cat /usr/local/nginx/conf/Include/zabbix.conf

server {

    listen       80;

    server_name  www.zabbix.cn;

    return 301   https://www.zabbix.cn$request_uri;

}

server {

    listen       443 ssl;

    server_name  www.zabbix.cn

    if ($host != 'www.zabbix.cn') {

        return 403;

    }

    root /usr/share/zabbix;

    index index.php index.html index.htm;

    ssl_certificate     /usr/local/nginx/ssl-certs/2505454_www.zabbix.cn.pem;

    ssl_certificate_key /usr/local/nginx/ssl-certs/2505454_www.zabbix.cn.key;

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_prefer_server_ciphers on;

    access_log      /var/log/nginx/ngnix_access.log;

    error_log       /var/log/nginx/ngnix_error.log;

    location / {

        try_files $uri $uri/ /index.php?$query_string;

    }

    location ^~ /app {

        deny all;

    }

    location ^~ /conf {

        deny all;

    }

    location ^~ /local {

        deny all;

    }

    location ^~ /include {

        deny all;

    }

    location ~ \.php$ {

        try_files $uri =404;

        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        fastcgi_pass   127.0.0.1:9000;

        fastcgi_index  index.php;

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        include        fastcgi_params;

    }

}

2.3、配置nginx为系统服务

vim /lib/systemd/system/nginx.service

[Unit]

Description=nginx - high performance web server

Documentation=http://nginx.org/en/docs/

After=network.target

[Service]

Type=forking

ExecStart=/usr/local/nginx/sbin/nginx

ExecReload=/usr/local/nginx/sbin/nginx -s reload

ExecStop=/usr/local/nginx/sbin/nginx -s stop

PrivateTmp=true

[Install]

WantedBy=multi-user.target

加载系统服务

systemctl daemon-reload

设置开机启动

systemctl enable nginx

启动 nginx

systemctl start nginx

停止

systemctl stop nginx

加载配置文件

systemctl reload nginx

3、安装php

3.1、编译安装

3.1.1、编译参数

php的编译安装稍微复杂，复杂点就在于它的编译参数，php的编译参数很多，这里尽量最小化安装，如何选择参数，可通过在第一次安装zabbix的时候环境检测查看到，参数不满足是无法正常安装使用的，我通过本地虚拟机重新安装了一遍zabbix，得到具体环境参数如下，每列可依次理解为：名称、检测结果、需满足的结果、检测是否通过。

PHP version		5.6.40					5.4.0		OK

PHP option 		"memory_limit"			128M	128M	OK

PHP option 		"post_max_size"			8M	16M	Fail

PHP option 		"upload_max_filesize"	2M	2M	OK

PHP option 		"max_execution_time"	30	300	Fail

PHP option 		"max_input_time"	    -1	300	OK

PHP option 		"date.timezone"			unknown		Fail

PHP databases support					MySQL 			OK

PHP bcmath		on						OK

PHP mbstring	on						OK

PHP option 		"mbstring.func_overload"	off	off	OK

PHP option 		"always_populate_raw_post_data"	on	off	Fail

PHP sockets		on				OK

PHP gd			2.1.0	2.0		OK

PHP gd PNG 		support	on		OK

PHP gd JPEG 	support	on		OK

PHP gd FreeType support	on		OK

PHP libxml		2.9.1			2.6.15	OK

PHP xmlwriter	on				OK

PHP xmlreader	on				OK

PHP LDAP		off				Warning

PHP ctype		on				OK

PHP session		on				OK

PHP option 		"session.auto_start"	off	off	OK

PHP gettext		off		Warning

PHP option 		"arg_separator.output"	&	&	OK

查看上述参数，最后确认一个合适的编译参数，如果第一次编译少了某些参数，也可通过不重新编译添加模块的方法，最终编译参数如下：

./configure --prefix=/usr/local/php-5.6.40 \

--enable-opcache \

--with-config-file-path=/usr/local/php-5.6.40/etc \

--with-mysql=mysqlnd \

--with-mysqli=mysqlnd \

--with-pdo-mysql=mysqlnd \

--enable-fpm \

--enable-static \

--enable-inline-optimization \

--enable-sockets \

--enable-wddx \

--enable-zip \

--enable-calendar \

--enable-bcmath \

--enable-soap \

--with-zlib \

--with-iconv \

--with-gd \

--with-xmlrpc \

--enable-mbstring \

--with-curl \

--with-gettext \

--with-ldap \

--enable-ftp \

--with-mcrypt  \

--with-freetype-dir=/usr/local/freetype.2.1.10 \

--with-jpeg-dir=/usr/local/jpeg.6 \

--with-png-dir=/usr/local/libpng.1.2.50 \

--disable-ipv6 \

--disable-debug \

--with-openssl \

--disable-maintainer-zts \

--disable-fileinfo

3.1.2、排错

编译安装时可能出现的报错和解决办法如下，具体不做分析

报错一：

configure: error: Cannot find ldap.h

解决办法：

yum install -y openldap openldap-devel

报错二：

configure: error: Cannot find ldap libraries in /usr/lib.

解决办法：

cp -frp /usr/lib64/libldap* /usr/lib/

报错三：

//.usrlibs//lib64ldap.o/:liblber -undefined2.4.so.2 :reference  errorto  addingsymbol  symbols':ber_scanf 'DSO

 /missingusr /fromlib64 /commandliblber -line2.4.so.2

: error adding symbols: DSO missing from command line

collect2: error: ld returned 1 exit status

collect2: error: ld returned 1 exit status

make: *** [sapi/cli/php] Error 1

make: *** Waiting for unfinished jobs....

make: *** [sapi/cgi/php-cgi] Error 1

/usr/bin/ld: ext/ldap/.libs/ldap.o: undefined reference to symbol 'ber_scanf'

/usr/lib64/liblber-2.4.so.2: error adding symbols: DSO missing from command line

collect2: error: ld returned 1 exit status

解决办法：

vim Makefile 在这行最后添加-llber

EXTRA_LIBS = -lcrypt -lz -lresolv -lcrypt -lrt -lmcrypt -lldap -lpng -lz -ljpeg -lcurl -lz -lrt -lm -ldl -lnsl -lxml2 -lz -lm -ldl -lssl -lcrypto -lcurl -lxml2 -lz -lm -ldl -lssl -lcrypto -lfreetype -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lcrypt -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lxml2 -lz -lm -ldl -lssl -lcrypto -lcrypt -llber

3.2、配置

编译安装完php后，需要修改配置文件php.ini中的内容以满足上述检测：

post_max_size = 16M

max_input_time = 300

max_execution_time = 300

date.timezone = Asia/Shanghai

always_populate_raw_post_data = -1

3.3、配置php为系统服务

编译安装php的，会在php目录生成很多二进制文件，找到init.d.php-fpm，拷贝到init.d下。

cp /usr/local/src/php-5.6.33/sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm

设置权限

chmod 755 /etc/init.d/php-fpm

配置php-fpm.conf

vim /usr/local/etc/php-fpm.conf

如果打开了pid配置，需要将pid（;pid = run/php-fpm.pid）前的;去掉。

启动

/etc/init.d/php-fpm start

3.4、启动

编译配置没有问题，可正常启动

4、访问及排错

访问时出现的报错及解决办法如下

报错一：

FastCGI sent in stderr: "PHP message: PHP Warning:  require_once(/etc/zabbix/web/maintenance.inc.php):   failed to open stream: Permission denied in /app/nginx/html/zabbix/include/classes/core/ZBase.php on line 292

PHP message: PHP Fatal error:  require_once(): Failed opening required '/etc/zabbix/web/mainte‘

解决办法：

chmod -R 755 /etc/zabbix/web

报错二：

Database error

Error connecting to database: No such file or directory

解决办法：修改php.ini

mysqli.default_socket = /var/lib/mysql/mysql.sock

最终，切换nginx及配置https成功：