使用檔案：FreeBSD-14.1-RELEASE-amd64-dvd1.iso
1.設定SSH
修改方式：
# vi /etc/ssh/sshd_config
PermitRootLogin yes
PermitEmptyPasswords no
PasswordAuthentication yes
Port 22(修改Port的Num)
開機啟動：
# vi /etc/rc.conf加入
sshd_enable="yes"
重新啟動服務：
# /etc/rc.d/sshd restart
AllowUsers UserName(允許特定IP或User)
2.putty字型大小調整
3.安裝Appache
(1) pkg info 第一次安裝pkg / 之後可看裝了那些套件
(2) pkg update 更新pkg
[1] pkg search
[2] pkg install
[3] pkg delete
[4] pkg info -a
(3) 安裝Appache
[1] pkg search apache
[2] pkg install apache24-2.4.62
[3] ee /etc/rc.conf 寫入 apache24_enable="YES"
[4] service apache24 restart
[5] /usr/local/etc/apache24/httpd.conf (編輯設定)
[6] Options Indexes FollowSymLinks >> Options FollowSymLinks (取消觀看目錄)
[7] DirectoryIndex index.html index.htm index.php (預設首頁格式)
(4) 安裝Mysql
[1] pkg search mysql
[2] pkg install mysql84-server
[3] ee /etc/rc.conf 寫入 mysql_enable="YES"
[4] service mysql-server restart
[5] service mysql-server status //測試mysql有沒有啟動
[6] mysql_secure_installation //設定Mysql的root密碼和一些安全性設定
[7] 登入Mysql ： mysql -u root -p
[8] 離開 mysql> \q
[9] /usr/local/etc/my.cnf (my.cnf位置)
[10] find / -name mysql.sock (搜尋)
[11] SELECT User, Host FROM mysql.user; (觀看目前帳號狀況)
[13] mysql指令
show databases;
use mysql
show tables;
select host, user, plugin from mysql.user; (查詢密碼的編碼)
alter user 'root' identified with mysql_native_password by 'passwd'; (修改密碼編碼)
(因為mysql84預設值會把mysql_native_password關閉，所以需要做以下修改)
ee /usr/local/etc/my.cnf 編輯my.cnf
mysql_native_password = ON 加入這行
bind-address = 0.0.0.0 把127.0.0.1改成0.0.0.0
alter user 'root' IDENTIFIED BY 'passwd'; (修改密碼)
update mysql.user set host = '%' where user = 'root'; (開放所有IP連線)
如有失敗，先設定密碼安全程度
{1} SHOW VARIABLES LIKE 'validate_password%'; (查詢密碼策略)
{2} set global validate_password.policy=0; (修改策略)
{3} set global validate_password.length=1; (修改長度)
{4} flush privileges; (刷新權限表)
(5) 設定防火牆
新建一個檔案 /etc/ipfw.rules
ipfw -q -f flush
ipfw add 100 allow all from any to any via lo0
ipfw add 200 check-state
ipfw add 300 allow tcp from any to any established
ipfw add 400 allow tcp from any to me 21,22 keep-state
ipfw add 500 allow tcp from any to me 80,443 keep-state
ipfw add 600 allow all from me to any keep-state
# Deny everything else
ipfw add 65000 deny log all from any to any
在 /etc/rc.conf 加上
firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
查看目前的防火牆設定的指令： ipfw list
service ipfw start
service ipfw status
4.安裝PHP
[1] pkg install php84
[2] pkg install mod_php84
[3] pkg install php84-session-8.4.0.r1 (安裝session)
[4] pkg install php84-mysqli-8.4.0.r1 (安裝Mysqli延伸套件)
[5] pkg install php84-mbstring-8.4.0.r1 (mbstring套件)
[6] php.ini ( /usr/local/etc/php.ini )
(1) ;extension=mysqli (更改為啟用)
(2) ;session.save_path = "/var/lib/php/session"
(3) ;date.timezone = Asia/Taipei (改為啟動並設定台北時間)
(4) extension=pdo_mysql (啟用PDO功能)
[8] pkg install phpMyAdmin5-php84-5.2.2
(下載最新版的phpmyadmin)
To make phpMyAdmin available through your web site, I suggest
that you add something like the following to httpd.conf:
Alias /phpmyadmin/ "/usr/local/www/phpMyAdmin/"
<Directory "/usr/local/www/phpMyAdmin/">
Options None
AllowOverride Limit
Require local
Require host .example.com
</Directory>
[9] /var/lib/php/session (session儲存的地方)
[10] pkg install php84-sodium-8.4.0.r1 (phpmyadmin會用到的套件)
[11] ;extension=sodium (啟用)
[12] pkg install php82-curl (為了爬蟲而安裝的套件)
5.掛載新的磁碟機
[1] gpart create -s GPT ada1
[2] gpart add -t freebsd-ufs -a 1M ada1
[3] newfs -U /dev/ada1p1
[4] mkdir /newdisk (可以修改成自己想要的資料夾名稱)
[5] 將磁碟項目加入到 /etc/fstab，讓啟動時會自動掛載新的磁碟：
/dev/ada1p1 /newdisk ufs rw 2 2
[6] mount /newdisk (手動掛載 )
6.啟用FTP
[1] 使用 inetd
編輯 /etc/inetd.conf，將 ftp 設定開頭的 # 移除
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l
[2] vi /etc/rc.conf //修改 rc.conf 設定檔
inetd_enable="YES" //加入此行
[3] /etc/rc.d/inetd start //啟動 inetd 服務
[4] telnet localhost 21 //測試 ftp 服務是否啟動
quit //輸入 quit 離開
[5] 修改 /etc/ftpchroot
※加入使用者名稱，讓該使用者不能離開他的家目錄
[6] ln -s /www/web /home/chocho/web (在家目錄建立連結)
7.安裝Samba
[1] pkg install samba419
[2] ee /etc/rc.conf
nmbd_enable="YES"
winbindd_enable="YES"
samba_enable="YES"
samba_server_enable="YES"
[3] ee /usr/local/etc/smb4.conf (創立設定檔，原本為空的)
[root]
comment = root's stuff
path = /root
public = no
browseable = yes
writable = yes
printable = no
create mask = 0755
[4] smbpasswd -a root (建立用戶)
[5] cd /usr/local/etc
[6] service samba_server start
[7] service samba_server status
8.帳號設定
[1] 帳號相關檔案: /etc/passwd 、 /etc/shadow
[2] 群組(group)相關檔案: /etc/group
9.修改系統時間
[1] tzsetup /usr/share/zoneinfo/Asia/Taipei (更改時區為台灣)
[2] ntpdate -u pool.ntp.org (線上同步對時)
10.設定安全性憑證 SSL
10.指令集
systat -if 1 查詢流量
uptime 查詢開機多久
11.架設Bind DNS Server
(1) pkg install bind918
| 設定檔 | /usr/local/etc/namedb/named.conf |
| 區域檔 | /usr/local/etc/namedb/master/ |
啟動腳本 /usr/local/etc/rc.d/named
|
|
(2) sysrc named_enable="YES" //啟動
(3) ee /usr/local/etc/namedb/named.conf
options {
// All file and path names are relative to the chroot directory,
// if any, and should be fully qualified.
directory "/usr/local/etc/namedb/working";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
listen-on { any; };
listen-on-v6 { none; };
recursion yes;
allow-recursion {
163.26.79.15;
114.27.35.108;
127.0.0.1;
};
allow-query {
163.26.79.15;
114.27.35.108;
127.0.0.1;
};
// 上游 DNS
forwarders {
8.8.8.8;
8.8.4.4;
};
forward only;
dnssec-validation auto;
response-policy {
zone "rpz.blacklist";
};
}
zone "rpz.blacklist" {
type master;
file "master/rpz.blacklist.zone";
allow-query { none; };
};
(4) 開啟防火牆
ipfw add 510 allow tcp from any to me 53 keep-state
ipfw add 520 allow udp from any to me 53 keep-state
(5) 黑名單位置
/usr/local/etc/namedb/working/master/rpz.blacklist.zone
(6) 重開指令
service named restart
