溫馨提示×
您好，登錄后才能下訂單哦！
點(diǎn)擊 登錄注冊(cè) 即表示同意《億速云用戶服務(wù)條款》
您好，登錄后才能下訂單哦！
前言
在之前的一篇博文《Apache httpd2.2版本以及2.4版本部分實(shí)驗(yàn)》的實(shí)驗(yàn)二里面，提到了協(xié)議認(rèn)證使用了mod_auth_mysql.so模塊，本文將闡述該模塊的安裝，配置，以及對(duì)于aes加密特性的支持。
基于開發(fā)者文檔的安裝步驟
注：在筆者的CentOS7測(cè)試環(huán)境下并不支持aes加密
首先從模塊提供的官方站點(diǎn)下載mod_auth_mysql-3.0.0.tar.gz，并下載對(duì)應(yīng)的補(bǔ)丁mod_auth_mysql_3.0.0_patch_apache2.4.diff，解壓縮之后，將補(bǔ)丁拷貝到解壓目錄下面，運(yùn)行如下命令進(jìn)行打補(bǔ)丁：
$ patch -p1 < mod_auth_mysql_3.0.0_patch_apache2.4.diff
確保安裝了mariadb-libs和mariadb-devel包，并且安裝有development Tools包組，如果沒有，請(qǐng)自行安裝。其目的是為了解決編譯安裝可能遇到的頭文件依賴以及庫依賴問題。
利用httpd-tools包中帶的apxs工具進(jìn)行編譯：
$ apxs -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c
編譯完之后，會(huì)生成mod_auth_mysql.la文件，再利用如下命令將該模塊安裝到httpd里面：
$ apxs -i mod_auth_mysql.la
安裝完成之后，在/etc/httpd/conf.modules.d目錄下面添加一個(gè)配置文件，這里為10-mysql.conf，添加如下內(nèi)容：
LoadModule mysql_auth_module modules/mod_auth_mysql.so
初步添加如下配置信息到/etc/httpd/conf.d/virtualhost.conf里面，配合mysql數(shù)據(jù)庫，即可進(jìn)行認(rèn)證：
<VirtualHost 192.168.5.181:80>
ServerName www3.stuX.com
LogFormat "%h %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\"" custom3
CustomLog /web/vhosts/www3/access_log custom3
ErrorLogFormat "[%t] [%l] [pid %P] %F: %E: [client %a] %M"
ErrorLog /web/vhosts/www3/error_log
LogLevel info
<Location /status>
SetHandler server-status
AuthType Basic
AuthBasicAuthoritative Off
AuthName "auth login"
AuthUserFile /dev/null
AuthMySQLHost 192.168.5.121
AuthMySQLPort 3306
AuthMySQLUser root
AuthMySQLPassword 123456
AuthMySQLDB http_auth
AuthMySQLUserTable mysql_auth
AuthMySQLNameField user_name
AuthMySQLPasswordField user_passwd
AuthMySQLEnable on
AuthMySQLPwEncryption md5
Require valid-user
</Location>
</Virtualhost>上述內(nèi)容當(dāng)中，關(guān)于AuthMySQL的指令，可以從編譯安裝包中的CONFIGURE文件中查詢到。上文所用到的參數(shù)的解釋如下所示：
| 指令 | 解釋 |
|---|---|
| AuthMySQLHost | mysql的IP地址 |
| AuthMySQLPort | mysql的連接端口 |
| AuthMySQLUser | mysql的連接用戶 |
| AuthMySQLPassword | mysql的登錄密碼 |
| AuthMySQLDB | 登錄的數(shù)據(jù)庫名稱 |
| AuthMySQLUserTable | 需要進(jìn)行用戶查詢的數(shù)據(jù)表 |
| AuthMySQLNamedField | httpd驗(yàn)證的用戶名字段 |
| AuthMySQLPasswordField | httpd驗(yàn)證的密碼字段 |
| AuthMySQLEnable | 開啟認(rèn)證 |
| AuthMySQLPwEncryption | 密碼加密形式為MD5 |
配置完畢，重啟之后，即可進(jìn)行認(rèn)證。
關(guān)于mod_auth_mysql.so對(duì)于AES加密支持
在該模塊的CONFIGURE文檔中，提及了兩條指令，分別是AuthMySQLPwEncryption以及AuthMySQLSaltField。前者可以在其指令后面添加加密算法，在文檔中，該指令的介紹如下所示：
AuthMySQLPwEncryption none | crypt | scrambled | md5 | aes | sha1
The encryption type used for the passwords in AuthMySQLPasswordField:
none: not encrypted (plain text)
crypt: UNIX crypt() encryption
scrambled: MySQL PASSWORD encryption
md5: MD5 hashing
aes: Advanced Encryption Standard (AES) encryption
sha1: Secure Hash Algorihm (SHA1)WARNING: When using aes encryption, the password field MUST be a BLOB type
(i.e. TINYBLOB). MySQL will strip trailing x’20’ characters (blanks), EVEN
IF THE COLUMN TYPE IS BINARY!AuthMySQLSaltField <> | | mysql_column_name
Contains information on the salt field to be used for crypt and aes
encryption methods. It can contain one of the following:
<>: password itself is the salt field (use with crypt() only)
: “string” as the salt field
mysql_column_name: the salt is take from the mysql_column_name field in the
same row as the passwordThis field is required for aes encryption, optional for crypt encryption.
It is ignored for all other encryption types.
可以看到，文檔中提及到了支持aes加密算法，并且配合AuthMySQLSaltField指令，指明鹽字段。不過，在筆者的CentOS7環(huán)境上面，如果使用了aes加密，會(huì)使得配置了認(rèn)證的目標(biāo)頁面失效，如下所示：
curl -u admin:admin http://www3.stuX.com/status <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>401 Unauthorized</title> </head><body> <h2>Unauthorized</h2> <p>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.</p> </body></html>
在httpd的錯(cuò)誤日志中，可以看到如下一條：
[error] [pid 9958] mod_auth_mysql.c(1188): [client 192.168.5.180:55586] mysql invalid encryption method as
初步斷定，在編譯的時(shí)候可能沒有把a(bǔ)es算法編譯進(jìn)去。依據(jù)網(wǎng)上的兩篇資料：
Works plain text, AES or SHA-1 fails
mod_auth_mysql with AES encryption (on Fedora 14 x64)
解決方案是在編譯的時(shí)候添加上-DAES，該選項(xiàng)在文檔中并未明文提及到，相關(guān)的源代碼部分內(nèi)容如下：
...... ...... #if _AES /* Only needed if AES encryption desired */ #include <my_global.h> #endif #include <mysql.h> #if _AES #include <my_aes.h> #endif ...... ......
因此編譯的時(shí)候還需要注意，-DAES需要my_global.h以及my_aes.h的支持。筆者這里的my_global.h由mariadb-devel的rpm包提供，而my_aes.h由mariadb的源碼包提供。在這里，筆者為了方便，直接將解壓之后的源碼包中的my_aes.h拷貝到/usr/include/mysql頭文件目錄當(dāng)中。再進(jìn)行編譯：
注：下面編譯的warning可以忽略。
$ apxs -c -L/usr/lib64/mysql -I/usr/include/mysql -DAES -lmysqlclient -lm -lz mod_auth_mysql.c /usr/lib64/apr-1/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -DLINUX -D_REENTRANT -D_GNU_SOURCE -pthread -I/usr/include/httpd -I/usr/include/apr-1 -I/usr/include/apr-1 -I/usr/include/mysql -DAES -c -o mod_auth_mysql.lo mod_auth_mysql.c && touch mod_auth_mysql.slo In file included from /usr/include/mysql/my_config.h:14:0, from /usr/include/mysql/my_global.h:79, from mod_auth_mysql.c:267: /usr/include/mysql/my_config_x86_64.h:631:0: warning: "PACKAGE_NAME" redefined [enabled by default] #define PACKAGE_NAME "MySQL Server" ^ In file included from /usr/include/httpd/ap_config.h:138:0, from /usr/include/httpd/httpd.h:44, from mod_auth_mysql.c:198: /usr/include/httpd/ap_config_auto.h:228:0: note: this is the location of the previous definition #define PACKAGE_NAME "" ^ In file included from /usr/include/mysql/my_config.h:14:0, from /usr/include/mysql/my_global.h:79, from mod_auth_mysql.c:267: /usr/include/mysql/my_config_x86_64.h:632:0: warning: "PACKAGE_STRING" redefined [enabled by default] #define PACKAGE_STRING "MySQL Server 5.5.44" ^ In file included from /usr/include/httpd/ap_config.h:138:0, from /usr/include/httpd/httpd.h:44, from mod_auth_mysql.c:198: /usr/include/httpd/ap_config_auto.h:231:0: note: this is the location of the previous definition #define PACKAGE_STRING "" ^ In file included from /usr/include/mysql/my_config.h:14:0, from /usr/include/mysql/my_global.h:79, from mod_auth_mysql.c:267: /usr/include/mysql/my_config_x86_64.h:633:0: warning: "PACKAGE_TARNAME" redefined [enabled by default] #define PACKAGE_TARNAME "mysql" ^ In file included from /usr/include/httpd/ap_config.h:138:0, from /usr/include/httpd/httpd.h:44, from mod_auth_mysql.c:198: /usr/include/httpd/ap_config_auto.h:234:0: note: this is the location of the previous definition #define PACKAGE_TARNAME "" ^ In file included from /usr/include/mysql/my_config.h:14:0, from /usr/include/mysql/my_global.h:79, from mod_auth_mysql.c:267: /usr/include/mysql/my_config_x86_64.h:634:0: warning: "PACKAGE_VERSION" redefined [enabled by default] #define PACKAGE_VERSION "5.5.44" ^ In file included from /usr/include/httpd/ap_config.h:138:0, from /usr/include/httpd/httpd.h:44, from mod_auth_mysql.c:198: /usr/include/httpd/ap_config_auto.h:240:0: note: this is the location of the previous definition #define PACKAGE_VERSION "" ^ mod_auth_mysql.c: In function 'str_format': mod_auth_mysql.c:891:7: warning: format '%d' expects argument of type 'int', but argument 8 has type 'long int' [-Wformat=] LOG_ERROR_2(APLOG_ERR|APLOG_NOERRNO, 0, r, "MySQL ERROR: Invalid formatting character at position %d: \"%s\"", ^ /usr/lib64/apr-1/build/libtool --silent --mode=link gcc -std=gnu99 -Wl,-z,relro,-z,now -o mod_auth_mysql.la -L/usr/lib64/mysql -lmysqlclient -lm -lz -rpath /usr/lib64/httpd/modules -module -avoid-version mod_auth_mysql.lo
之后利用apxs -i mod_auth_mysql.la進(jìn)行安裝，安裝完畢之后，通過systemctl restart httpd.service命令對(duì)服務(wù)進(jìn)行重啟操作，但是發(fā)現(xiàn)無法啟動(dòng)：
$ systemctl restart httpd.service Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details. $ systemctl status httpd.service -l | grep error httpd: Syntax error on line 56 of /etc/httpd/conf/httpd.conf: Syntax error on line 1 of /etc/httpd/conf.modules.d/10-mysql.conf: Cannot load modules/mod_auth_mysql.so into server: /etc/httpd/modules/mod_auth_mysql.so: undefined symbol: my_aes_encrypt
可以看到，缺少了my_aes_encrypt函數(shù)，初步斷定是缺少了庫依賴所導(dǎo)致。從上文的mod_auth_mysql with AES encryption (on Fedora 14 x64)當(dāng)中，給出了一種手動(dòng)添加動(dòng)態(tài)庫的方式，利用httpd的LoadFile指令，將其加載進(jìn)來：
LoadFile /usr/lib64/mysql/libmysqld.so
經(jīng)過筆者測(cè)試，這樣做的話確實(shí)能將httpd服務(wù)啟動(dòng)，但是仍然無法正常使用aes加密，甚至連mod_auth_mysql.so模塊本身都無法正常工作了。利用curl命令訪問指定頁面的時(shí)候，會(huì)返回empty response的錯(cuò)誤。
改進(jìn)的措施
既然無法用LoadFile來加載共享庫，所以這里采用直接將libmysqld編譯到mod_auth_mysql模塊的方法。首先需要獲取libmysqld庫，以mariadb5.5.44版本為例，需要將其源碼編譯。先解壓源碼包，進(jìn)入源碼目錄，使用如下命令進(jìn)行cmake：
cmake . -DWITH_EMBEDDED_SERVER=ON
之后進(jìn)入libmysqld子目錄，確保Makefile已經(jīng)生成，之后利用make命令編譯該模塊。
編譯完成之后，會(huì)發(fā)現(xiàn)當(dāng)前l(fā)ibmysqld子目錄下面多出了libmysqld.a，以及l(fā)ibmysqld.so文件。
注意！到這里為止，往后可以采用兩種方式進(jìn)行編譯：
利用libmysqld.a將libmysqld靜態(tài)編譯進(jìn)mod_auth_mysql當(dāng)中
利用libmysqld.so將libmysqld動(dòng)態(tài)編譯進(jìn)mod_auth_mysql當(dāng)中
在此，筆者采用第一種方法。將libmysqld.a拷貝到mod_auth_mysql的源碼目錄當(dāng)中，用如下命令進(jìn)行編譯，并且安裝到httpd當(dāng)中，再將httpd服務(wù)進(jìn)行重啟：
$ apxs -c -L/usr/lib64/mysql -I/usr/include/mysql -DAES -lmysqlclient -lm -lz -l:libmysqld.a mod_auth_mysql.c $ apxs -i mod_auth_mysql.la $ systemctl restart httpd.service
利用curl命令進(jìn)行訪問，發(fā)現(xiàn)認(rèn)證成功：
$ curl -u admin:admin http://www3.stuX.com/status | less % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 3789 100 3789 0 0 339k 0 --:--:-- --:--:-- --:--:-- 411k <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html><head> <title>Apache Status</title> </head><body> <h2>Apache Server Status for www3.stux.com (via 192.168.5.181)</h2> <dl><dt>Server Version: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.4.16</dt> <dt>Server MPM: prefork</dt> <dt>Server Built: Nov 19 2015 21:43:13 </dt></dl><hr /><dl> <dt>Current Time: Thursday, 08-Jun-2017 16:06:30 CST</dt> <dt>Restart Time: Thursday, 08-Jun-2017 16:04:36 CST</dt> <dt>Parent Server Config. Generation: 1</dt> <dt>Parent Server MPM Generation: 0</dt> <dt>Server uptime: 1 minute 53 seconds</dt> <dt>Server load: 0.01 0.02 0.05</dt> <dt>Total accesses: 1 - Total Traffic: 3 kB</dt> <dt>CPU Usage: u0 s0 cu0 cs0<dt>.00885 requests/sec - 27 B/second - 3072 B/request</dt> <dt>1 requests currently being processed, 4 idle workers</dt> </dl><pre>_W___........................................................... ................................................................ ................................................................ ................................................................
其他
筆者并未測(cè)試動(dòng)態(tài)編譯libmysqld.so的可用性，不過筆者認(rèn)為動(dòng)態(tài)編譯仍然是可行的，不過需要將動(dòng)態(tài)庫納入ldconfig管理范疇即可。
諸如此類的第三方模塊多半由開發(fā)者在Fedora平臺(tái)上面測(cè)試，而頭文件依賴和庫依賴的不一致性，總會(huì)導(dǎo)致各種問題，因此有些時(shí)候，需要使用者對(duì)其進(jìn)行一定程度的“量體裁衣”，不能盲目迷信文檔。
免責(zé)聲明：本站發(fā)布的內(nèi)容（圖片、視頻和文字）以原創(chuàng)、轉(zhuǎn)載和分享為主，文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng)，如果涉及侵權(quán)請(qǐng)聯(lián)系站長郵箱：is@yisu.com進(jìn)行舉報(bào)，并提供相關(guān)證據(jù)，一經(jīng)查實(shí)，將立刻刪除涉嫌侵權(quán)內(nèi)容。
億速云公眾號(hào)
手機(jī)網(wǎng)站二維碼