【问题标题】:Upgrading openssl from 0.9.8 to 1.0.2 / Ubuntu 8.04 LTS将 openssl 从 0.9.8 升级到 1.0.2 / Ubuntu 8.04 LTS
【发布时间】:2018-07-14 08:10:23
【问题描述】:

首先,感谢您花时间提供帮助。

我有一台旧服务器 Ubuntu 8.04,不再受支持。 自 6 月以来,我正在使用的支付平台已停用 TLSv1 和 SSL。

我的服务器正在运行:

Apache 2.2.8 /
Openssl 0.9.8 /
PHP 5.2.17 /
Ubuntu 8.04

我已经安装了新版本的 openssl(使用 wget):

openssl version 
OpenSSL 1.0.2o  27 Mar 2018

我的apache版本太旧,不支持TLSv1.2,需要升级到apache 2.2.23最低版本。

如何编译 apache 以适应新的 OpenSSL 版本?

PS:我只是用一个新的服务器来迁移我的网站,但是调整代码需要时间...暂时无法更改服务器..我需要使其尽快运行,并且那么我将能够专注于 PHP 7 引入的错误...

提前感谢帮助我的新手..

【问题讨论】:

  • 我只是认为 8.04 是错字...旧版本可以帮助您吗? old-releases.ubuntu.com/ubuntu
  • 你好。没有没有帮助..我用这个网址替换了源列表,但没有解决我的问题......

标签: apache ubuntu openssl


【解决方案1】:

由于不再支持这个旧的 Ubuntu,你很可能不使用 repos 来安装 Apache。

您可以按照此处的说明自行编译:http://httpd.apache.org/docs/2.2/install.html

当您运行./configure 时,您必须使用--enable-ssl--with-ssl=DIR。 DIR 是 OpenSSL 所在的位置(不是源代码,而是安装目录)。检查./configure 输出以确定任何缺少的必要条件。

运行make install 后,您必须使用新的OpenSSL 编译PHP,并链接到新编译的Apache。 http://ca3.php.net/manual/en/install.unix.apache2.php


这就是我编译我的 HTTP 的方式(不久前的笔记,某些版本可能会有所不同)。适应您的需求,这是“按原样”提供的,没有保修 :-) 先决条件基于 RHEL 6 或 7,根据需要进行调整。

Required software:
- apr-1.6.2
- apr-iconv-1.2.1
- apr-util-1.5.4
- httpd-2.4.26
  (identical  procedure used with previous versions of 2.4)
- openssl-1.0.2l 
  (identical prodecure used with older versions of 1.0)
- Unzip and untar these under /opt/app/SOURCES

System setup

Ask Unix to create:
- /opt/app/httpd, owner httpd, group httpd, permissions 775
-  user httpd, group httpd

Create these directories
- /opt/app/apr
- /opt/app/apr-iconv
- /opt/app/apr-util
- /opt/app/httpd
- /opt/app/openssl
- all owned by httpd, group httpd, permissions 750

Procedure

Get Unix to install prerequisites
for F in libxml2.i686 libxml2.x86_64 libxml2-devel.i686 libxml2-devel.x86_64 apr-devel.i686 apr-devel.x86_64 apr-util.i686 apr-util.x86_64 pcre-devel.i686 pcre-devel.x86_64 autoconf libtool
do
        yum install -y $F
done

Switch to the httpd user.

Install APR
cd /opt/app/SOURCES/apr-1.6.2
./buildconf
./configure --prefix=/opt/app/apr
make
make install 

Keep the directory as is, APR Util and APR Iconv require the APR sources to refer to. 

Install APR Util
cd /opt/app/SOURCES/apr-util-1.5.4
./buildconf --with-apr=/opt/app/SOURCES/apr-1.6.2
./configure --prefix=/opt/app/apr-util --with-apr=/opt/app/apr
make
make install

Install APR Iconv
cd /opt/app/SOURCES/apr-iconv-1.2.1
./configure --prefix=/opt/app/apr-iconv --with-apr=/opt/app/apr
make
make install

Install OpenSSL
cd /opt/app/SOURCES/openssl-1.0.2l
export CFLAGS=-fPIC
./config --prefix=/opt/app/openssl --openssldir=/opt/app/openssl shared
make clean
make
make test
make install 

Install Apache
cd /opt/app/SOURCES/httpd-2.4.26
export  LD_LIBRARY_PATH=/opt/app/openssl/lib
./configure --prefix=/opt/app/httpd --with-mpm=worker --enable-rewrite --enable-ssl --with-ssl=/opt/app/openssl --enable-proxy --enable-rewrite --enable-log-forensic --enable-log-debug --enable-expires --enable-headers --enable-unique-id --with-apr=/opt/app/apr --with-apr-util=/opt/app/apr-util
make
make install
vi /opt/app/httpd/bin/envvars
    Add /opt/app/openssl/lib to the LD_LIBRARY_PATH 

Note for the ./configure:  this was done to build an Apache used as a proxy.  change the --enable* options as required.


Configure HTTP
- The original configuration files after installation are saved in /opt/app/httpd/conf/original
- While it is impossible to cover all configuration options, at least these should be changed from the install configuration:
--- Listen 80: change as required.
--- User httpd
--- Group httpd
--- ServerAdmin EMAILADDRESS
--- ServerName <HOSTNAME>:80
--- Comment or uncomment the modules, as required
--- Uncomment slotmem_shm_module
--- Comment: CustomLog "logs/access_log" common
--- Uncomment: CustomLog "logs/access_log" combined
--- Comment the following sections (the entire section!):
----- <IfModule alias_module>
----- <IfModule cgid_module>
----- <Directory "/opt/app/httpd/cgi-bin">
--- Uncomment:
----- Include conf/extra/httpd-mpm.conf
----- Include conf/extra/httpd-default.conf
----- Edit conf/extra/httpd-mpm.conf
----- Change performance options as required.  The defaults are ok until you have a large amount of traffic.
----- Edit conf/extra/httpd-default.conf
----- Comment AccessFileName .htaccess
----- ServerTokens Prod

--- Test the configuration:     /opt/app/httpd/bin/apachectl -t
--- Start it and access it with a browser.  It should return a simple "It works!" message (unless you have installed some HTML content).

这是我的 PHP 编译程序,同样没有保证,“按原样”。不连接DB2、Oracle、PostgreSQL的部分可以忽略。

Prerequisites
- A compiled version of Apache HTTP and it's requisites.  See HTTP installation.
- It "could" work with RedHat's compiled Apache, but it is not recommended.  If RH's Apache is used, might as well use RH's PHP build.
- PHP source code: download from http://php.net
- This procedure has been tested with success on versions: 5.3.13, 5.5.7, 5.6.3, 5.6.30.  No modifications were required.

Install Red Hat pre-requisites:
- libxml, libxml-devel
- libpng, libpng-devel
- libjpg, libjpg-devel

If using DB2
- Install DB2 client under /opt/app
- PHP searches for the lib directory, so:
       cd /opt/app/ibm/db2/V10.5
       ln -s lib64 lib

If using Oracle
- Install the Oracle Instant Client in /opt/app/oracle

Overview
PHP must be compiled and "linked" to Apache.  Apache must therefore be compiled before PHP.
Depending on which database PHP will connect to, the configure options must be changed.
http://php.net has more documentation and details for the build process, this is just what was used.

Build

Pre-compile configure

The configure command will detect what other software is installed on the system and link libraries.
Note for the database clients: they can all be linked at the same time, but it is recommended to link only the ones required.

The command is:
       ./configure --with-apxs2=/opt/app/httpd/bin/apxs \
                   --prefix=/opt/app/php \
                   --with-config-file-path=/opt/app/php \
                   --enable-zip \
                   --with-zlib \
                   --enable-mbstring \
                   --with-gd \
                   --with-pear \
                   --with-pdo-odbc=ibm-db2,/opt/app/ibm/db2/V10.5 \              # if using DB2 only!
                   --with-oci8=instantclient,/opt/app/oracle/instantclient_11_2  # if using Oracle only!
                   --with-pgsql \                                                # if using PostgreSQL only!
                   --with-pdo-pgsql                                              # if using PostgreSQL with PDO only!


Compile
     make clean
     make
     make test
     make install 


$(make test) will report errors for the Oracle driver. MANY errors! The driver will still work (it was used for the nettracker replacement scripts to load Pharmaclik IBM HTTP Server logs into Oracle). But it will be impossible to use bind variables on Integers. That explains why that script does not use oci_bind* functions.



Post-compile configure
     libtool --finish /opt/app/php/lib

     cp php.ini-development /opt/app/php/php.ini
OR
     cp php.ini-production /opt/app/php/php.ini 

In php.ini, add these:
          include_path = ".:/php/includes:/opt/app/php/lib/php"
          date.timezone = 'America/Montreal'

Configure Apache

These lines are possibly already there since the PHP $(make install) takes care of it, if the httpd.conf file is "clean" (i.e. has not been modified from the originally installed file).
Add these to httpd.conf:
          LoadModule php5_module modules/libphp5.so
          AddType application/x-httpd-php .php .phtml

【讨论】:

  • 感谢您帮助我,Nic。我应该删除实际的 apache(随发行版一起安装)吗?此外,命令 a1ensite 是否可以使用新编译的 apache。我如何知道所有用 php 安装的模块,以便用相同的模块编译 PHP?
  • 如果你重新编译Apache,我强烈建议你在你的./configure中使用--prefix=APACHEDIR。这将为您的安装定义顶级目录。大多数发行版 Apache 分布在整个操作系统中,可能已经安装在其他地方(实际上我从不使用发行版 Apache 并将其放在 /opt/httpd 中)。无需删除它。对于PHP,你的环境还能运行吗?您将显示 ` 这将告诉你 PHP 所需的一切。
  • 对于a1ensite,我搜索了它,因为我不知道它是什么,结果很少而且令人困惑。抱歉帮不上忙。
猜你喜欢
  • 2017-02-19
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2011-05-11
相关资源
最近更新 更多