yum -y install gcc gcc-c++ autoconf libjpeglibjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel {color} bzip2 bzip2-devel ncursesncurses-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5 \ krb5-devel libidnlibidn-devel openssl openssl-devel make patch pcre-devel
cd /root
wget http://tengine.taobao.org/download/tengine-1.5.2.tar.gz
tar zxvf tengine-1.5.2.tar.gz

yum install git pcre pcre-devel
git clone git://github.com/alibaba/tengine.git
cd tengine
./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf \ 
--pid-path=/var/run/nginx/nginx.pid --error-log-path=/var/log/nginx/nginx.log \ 
--http-log-path=/var/log/nginx/nginx-http.log
make
make install

wget http://www.vim.org/scripts/download_script.php?src_id=19394
mkdir -p ~/.vim/syntax/
cp nginx.vim ./.vim/syntax/
vi .vim/syntax/filetype.vim
au BufRead,BufNewFile /etc/nginx/,/usr/local/nginx/conf/ if &ft == '' | setfiletype nginx | endif

vim /etc/init.d/nginx
chmod +x /etc/init.d/nginx
chkconfig –-add nginx
chkcnfig –-level 35 nginx on 

#!/bin/sh
# nginx - this script starts and stops the nginx daemin#
# chkconfig: - 85 15
# description: Nginx is an HTTP(S) server, HTTP(S) reverse \
# proxy and IMAP/POP3 proxy server
# processname: nginx
# config: /etc/nginx/nginx.conf
# pidfile: /var/run/nginx/nginx.pid
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0
nginx="/usr/local/nginx/sbin/nginx"
prog=$(basename $nginx)
NGINX_CONF_FILE="/etc/nginx/nginx.conf"
lockfile=/var/lock/subsys/nginx
start() {
[ -x $nginx ] || exit 5
[ -f $NGINX_CONF_FILE ] || exit 6
echo -n $"Starting $prog: "
daemon $nginx -c $NGINX_CONF_FILE
retval=$?
echo
[ $retval -eq 0 ] && touch $lockfile
return $retval
}
stop() {
echo -n $"Stopping $prog: "
killproc $prog -QUIT
retval=$?
echo
[ $retval -eq 0 ] && rm -f $lockfile
return $retval
}
restart() {
configtest || return $?
stop
start
}
reload() {
configtest || return $?
echo -n $"Reloading $prog: "
killproc $nginx -HUP
RETVAL=$?
echo
}
force_reload() {
restart
}
configtest() {
$nginx -t -c $NGINX_CONF_FILE
}
rh_status() {
status $prog
}

rh_status_q() {
rh_status >/dev/null 2>&1
}

case "$1" in
start)
rh_status_q && exit 0
$1
;;
stop)
rh_status_q || exit 0
$1
;;
restart|configtest)
$1
;;
force-reload)
force_reload
;;
status)
rh_status
;;
condrestart|try-restart)
rh_status_q || exit 0
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload|configtest}"
exit 2
esac

yum install php-fpm
chkconfig --level 345 php-fpm on 
service php-fpm start

location ~ \.php$ {
root /var/www/html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;

vim /var/www/html/info.php

yum --enablerepo=remi,remi-php71 install php-fpm php-common
yum --enablerepo=remi,remi-php71 install php-opcache php-pecl-apcu php-cli php-pear php-pdo php-mysqlnd php-pgsql php-pecl-mongodb php-pecl-redis php-pecl-memcache php-pecl-memcached php-gd php-mbstring php-mcrypt php-xml

location ~ \.php { 
try_files $uri =404;
fastcgi_split_path_info ^(.\.php)(/.)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_index index.php;
fastcgi_pass 127.0.0.1:9004;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|ico)$ { 
expires 30d;
access_log off;
}
location ~ .*\.(js|css)?$ { 
expires 7d;
access_log off;
}

php-cgi -b 127.0.0.1:9004

tar zxvf jdk-7u45-linux-x64.tar.gz
mv /root/jdk1.7.0_45/ /usr/local/jdk
vim /etc/profile
export JAVA_HOME=/usr/local/jdk
export JRE_HOME=/usr/local/jdk/jre
export PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$PATH
export CLASSPATH=$CLASSPATH:.:$JAVA_HOME/lib:$JAVA_HOME/jre/lib

update-alternatives --install /usr/bin/java java /usr/local/jdk/bin/java 300
update-alternatives --install /usr/bin/javac javac /usr/local/jdk/bin/javac 300
update-alternatives --config java
update-alternatives --config javac

java –version

wget http://apache.dataguru.cn/tomcat/tomcat-7/v7.0.47/bin/apache-tomcat-7.0.47.tar.gz
tar zxvf apache-tomcat-7.0.47.tar.gz
mv apache-tomcat-7.0.47 /usr/local/tomcat
/usr/local/tomcat/bin/startup.sh
ps aux |grep tomcat
netstat –tlnp

vim /usr/local/tomcat/conf/server.xml
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Host name="localhost" appBase="/var/www/html"
unpackWARs="true" autoDeploy="true">

mkdir /var/www/html/ROOT
vim /var/www/html/ROOT/index.jsp

vim /usr/local/tomcat/conf/web.xml

vim /etc/nginx/proxy.conf
proxy_redirect          off; 
proxy_set_header        Host $host; 
proxy_set_header        X-Real-IP $remote_addr; #获取真实IP#
proxy_set_header       X-Forwarded-For   $proxy_add_x_forwarded_for; #获取代理者的真实ip 
client_max_body_size    10m; 
client_body_buffer_size 128k; 
proxy_connect_timeout   90; 
proxy_send_timeout      90; 
proxy_read_timeout      90; 
proxy_buffer_size       4k; 
proxy_buffers           4 32k; 
proxy_busy_buffers_size 64k; 
proxy_temp_file_write_size 64k;
vim /etc/nginx/nginx.conf
location ~ *.jsp$ {
root ./ROOT;
index index.jsp;
proxy_pass http://127.0.0.1:8080;
}

vim /var/www/html/index.html
the port:80
kill `ps aux |grep tomcat |awk '/\[0-9\]/\{print $2\}' | head -n1`
/usr/local/tomcat/bin/startup.sh
service nginx restart

wget http://geolite.maxmind.com/download/geoip/api/c/GeoIP.tar.gz
tar zxvf GeoIP.tar.gz
cd GeoIP-1.4.8/
./configure
make
make install

yum install libtool
aclocal
libtoolize –force

wget http://geolite.maxminx.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
gzip -d GeoIP.dat.gz
gzip -d GeoLiteCity.dat.gz
mkdir /usr/local/nginx/geoip
mv /root/*.dat ./

./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid --error-log-path=/var/log/nginx/nginx.log --http-log-path=/var/log/nginx/nginx-http.log --with-http_geoip_module
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.orig
cp /root/tengine/obj/nginx /usr/local/nginx/sbin/

vim /etc/nginx/nginx.conf
geoip_country /usr/local/nginx/geoip/GeoIP.dat;
geoip_city /usr/local/nginx/geoip/GeoLiteCity.dat;

fastcgi_param GEOIP_COUNTRY_CODE3 $geoip_country_code3;
fastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name;
fastcgi_param GEOIP_CITY_COUNTRY_CODE $geoip_city_country_code;
fastcgi_param GEOIP_CITY_COUNTRY_CODE3 $geoip_city_country_code3;
fastcgi_param GEOIP_CITY_COUNTRY_NAME $geoip_city_country_name;
fastcgi_param GEOIP_REGION $geoip_region;
fastcgi_param GEOIP_CITY $geoip_city;
fastcgi_param GEOIP_POSTAL_CODE $geoip_city_continent_code;
fastcgi_param GEOIP_LATITUDE $geoip_latitude;
fastcgi_param GEOIP_LONGITUDE $geoip_longitude;
include fastcgi_params;

vim /var/www/html/geoip.php
<html>
<head>
<title>What is my IP address - determine or retrieve my IP address </title>
</head>
<body>
<?php
if (getenv(HTTP_X_FORWARDED_FOR)){
$pipaddress = getenv(HTTP_X_FORWARDED_FOR);
$ipaddress = getenv(REMOTE_ADDR);
echo "You Proxy IP address is :".$pipaddress."(via $ipaddress)";
} else {
$ipaddress = getenv(REMOTE_ADDR);
echo "Your IP address is :$ipaddress";
}
$country = getenv(GEOIP_COUNTRY_NAME);
$country_code = getenv(GEOIP_COUNTRY_CODE);
echo "<br/>Your country :$country($country_code)";
?>
</body>
</html>

vim /var/www/html/geoip_city.php
<html>
<head>
<title>What is my IP address - determine or retrieve my IP address</title>
</head>
<body>
<?php
if (getenv (HTTP_X_FORWARDED_FOR)) {
$pipaddress = getenv(HTTP_X_FORWARDED_FOR);
$ipaddress = getenv(REMOTE_ADDR);
echo"<br>Your Proxy IP address is :".$pipaddress."(via $ipaddress)";
} else {
$ipaddress = getenv (REMOTE_ADDR);
echo"<br>Your IP address is : $ipaddress";
}
$geoip_city_country_code = getenv(GEOIP_CITY_COUNTRY_CODE);
$geoip_city_country_code3 = getenv(GEOIP_CITY_COUNTRY_CODE3);
$geoip_city_country_name = getenv(GEOIP_CITY_COUNTRY_NAME);
$geoip_region = getenv(GEOIP_REGION);
$geoip_city = getenv(GEOIP_CITY);
$geoip_postal_code = getenv(GEOIP_POSTAL_CODE);
$geoip_city_continent_code = getenv(GEOIP_CITY_CONTTINENT_CODE);
$geoip_latitude = getenv(GEOIP_LATITUDE);
$geoip_longitude = getenv(GEOIP_LONGITUDE);
echo"<br>Country:$geoip_city_country_name ($geoip_city_country_code3,$geoip_city_country_code)";
echo"<br>Region:$geoip_region";
echo"<br>City:$geoip_city";
echo"<br>Postal code:$geoip_postal_code";
echo"<br>City continent code:$geoip_city_continent_code";
echo"<br>Geoip latitude:$geoip_latitude";
echo"<br>Geoip longitude:$geoip_longitude";
?>
</body>

http {
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=two:10m;
}

limit_req zone=one burst=5;
limit_conn two 15;

git clone http://luajit.org/git/luajit-2.0.git
make
make install ln -sv /usr/local/lib/libluajit-5.1.so.2.0.3 /lib64/libluajit-5.1.so.2
wget https://github.com/simpl/ngx_devel_kit/archive/v0.2.19.tar.gz –-no-check-certificate
tar zxvf v0.2.19.tar.gz
wget https://github.com/openresty/lua-nginx-module/archive/v0.9.13.tar.gz --no-check-certificate

./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid --error-log-path=/var/log/nginx/nginx.log --http-log-path=/var/log/nginx/nginx-http.log --add-module=/root/ngx_devel_kit-0.2.19/ --add-module=/root/lua-nginx-module-0.9.13/ --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"
make –j2
service nginx stop
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.orig
cp ./objs/nginx /usr/local/nginx/sbin/nginx
service nginx start

wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip --no-check-certificate
unzip master
mv ngx_lua_waf-master/ /etc/nginx/waf
mkdir -p /var/log/nginx/hack
chmod -R 755 /var/log/nginx/hack/

git clone https://github.com/SpiderLabs/ModSecurity.git
cd ModSecurity/
./autogen.sh
./configure --enable-standalone-module --disable-mlogc
make
cd tengine/
./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid --error-log-path=/var/log/nginx/nginx.log --http-log-path=/var/log/nginx/nginx-http.log --add-module=/root/ngx_devel_kit-0.2.19/ --add-module=/root/lua-nginx-module-0.9.13/ --add-module=/root/ModSecurity/nginx/modsecurity/ --with-ld-opt=" -Wl,-rpath,$LUAJIT_LIB"
make

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
cp -R owasp-modsecurity-crs /etc/nginx/
cp /etc/nginx/owasp-modsecurity-crs/ modsecurity_crs_10_setup.conf.example /etc/nginx/owasp-modsecurity-crs/ modsecurity_crs_10_setup.conf
cd ModSecurity/
cp modsecurity.conf-recommended /etc/nginx/modsecurity.conf
cp unicode.mapping /etc/nginx
vim modsecurity.conf

SecRuleEngine on
nclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf

ModSecurityEnabled on; 
ModSecurityConfig modsecurity.conf;

# yum install -y keepalived
# keepalived –v

#!/bin/bash
counter=$(ps -C nginx --no-heading|wc -l)
if [ "${counter}" = "0" ]; then
/bin/systemctl start nginx
sleep 2
counter=$(ps -C nginx --no-heading|wc -l)
if [ "${counter}" = "0" ]; then
/bin/systemctl stop keepalived
/usr/bin/python /usr/sbin/sendsms.py 13788888888 "vip转移" "192.168.0.142出现故障"
/usr/bin/python /usr/sbin/sendsms.py 13688888888 "vip转移" "192.168.0.142出现故障"
fi
fi

! Configuration File for keepalived
global_defs {
notification_email {
#zhouxiao@example.com
#itsection@example.com
}
#notification_email_from itsection@example.com
#smtp_server mail.example.com
#smtp_connect_timeout 30
router_id LVS_DEVEL
}
vrrp_script chk_nginx {
script "/etc/keepalived/check_nginx.sh"
interval 2
weight -5
fall 3
rise 2
}
vrrp_instance VI_1 {
state MASTER
interface eno1
mcast_src_ip 192.168.0.142
virtual_router_id 60
priority 100
advert_int 2
authentication {
auth_type PASS
auth_pass 1111
} 
virtual_ipaddress {
192.168.0.144
}
track_script {
chk_nginx
}
}