HTTPS « Hey! Linux.

HAProxy RPM SPECS与HTTPS Load配置分享

由 mcsrainbow 发表在 Linux&Unix 分类，时间 2015/12/28

话不多说，具体内容如下：
haproxy-1.5.17.spec

Name:           haproxy
Version:        1.5.17
Release:        el6
Summary:        The Reliable, High Performance TCP/HTTP Load Balancer

Group:          System Environment/Daemons
License:        GPL
URL:            http://www.haproxy.org
Source:         haproxy-1.5.17.tar.gz

Vendor:         Willy Tarreau

BuildRequires:  gcc gcc-c++ autoconf automake cmake openssl openssl-devel pcre pcre-devel pcre-static
Requires: pcre pcre-devel pcre-static openssl openssl-devel

%description
HAProxy is a free, very fast and reliable solution offering high availability,
load balancing, and proxying for TCP and HTTP-based applications.

%prep
tar xzvf $RPM_SOURCE_DIR/haproxy-1.5.17.tar.gz

%build
cd haproxy-1.5.17/
make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_CPU_AFFINITY=1

%install
rm -rf $RPM_BUILD_ROOT
cd haproxy-1.5.17/
make install DESTDIR=$RPM_BUILD_ROOT

mkdir -p $RPM_BUILD_ROOT/etc/init.d
cp examples/haproxy.init $RPM_BUILD_ROOT/etc/init.d/haproxy
chmod 755 $RPM_BUILD_ROOT/etc/init.d/haproxy

mkdir -p $RPM_BUILD_ROOT/etc/haproxy
cp examples/examples.cfg $RPM_BUILD_ROOT/etc/haproxy/haproxy.cfg

mkdir -p $RPM_BUILD_ROOT/var/lib/haproxy
touch $RPM_BUILD_ROOT/var/lib/haproxy/stats

%clean
rm -rf $RPM_BUILD_DIR/haproxy-1.5.17

%preun
rm -f /usr/sbin/haproxy

%postun
userdel haproxy

%files
/etc/haproxy
/etc/init.d/haproxy
/usr/local/doc/haproxy
/usr/local/sbin/haproxy
/usr/local/share/man/man1/haproxy.1
/var/lib/haproxy

%post
useradd haproxy -M -d /var/lib/haproxy
ln -sf /usr/local/sbin/haproxy /usr/sbin/haproxy

%changelog

Name: haproxy

Version: 1.5.17

Release: el6

Summary: The Reliable, High Performance TCP/HTTP Load Balancer

Group: System Environment/Daemons

License: GPL

URL: http://www.haproxy.org

Source: haproxy-1.5.17.tar.gz

Vendor: Willy Tarreau

BuildRequires: gcc gcc-c++ autoconf automake cmake openssl openssl-devel pcre pcre-devel pcre-static

Requires: pcre pcre-devel pcre-static openssl openssl-devel

%description

HAProxy is a free, very fast and reliable solution offering high availability,

load balancing, and proxying for TCP and HTTP-based applications.

%prep

tar xzvf $RPM_SOURCE_DIR/haproxy-1.5.17.tar.gz

%build

cd haproxy-1.5.17/

make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_CPU_AFFINITY=1

%install

rm -rf $RPM_BUILD_ROOT

cd haproxy-1.5.17/

make install DESTDIR=$RPM_BUILD_ROOT

mkdir -p $RPM_BUILD_ROOT/etc/init.d

cp examples/haproxy.init $RPM_BUILD_ROOT/etc/init.d/haproxy

chmod 755 $RPM_BUILD_ROOT/etc/init.d/haproxy

mkdir -p $RPM_BUILD_ROOT/etc/haproxy

cp examples/examples.cfg $RPM_BUILD_ROOT/etc/haproxy/haproxy.cfg

mkdir -p $RPM_BUILD_ROOT/var/lib/haproxy

touch $RPM_BUILD_ROOT/var/lib/haproxy/stats

%clean

rm -rf $RPM_BUILD_DIR/haproxy-1.5.17

%preun

rm -f /usr/sbin/haproxy

%postun

userdel haproxy

%files

/etc/haproxy

/etc/init.d/haproxy

/usr/local/doc/haproxy

/usr/local/sbin/haproxy

/usr/local/share/man/man1/haproxy.1

/var/lib/haproxy

%post

useradd haproxy -M -d /var/lib/haproxy

ln -sf /usr/local/sbin/haproxy /usr/sbin/haproxy

%changelog

haproxy.cfg

global
    # /etc/sysconfig/syslog
    # local2.* /var/log/haproxy.log
    log 127.0.0.1 local2 notice

    maxconn 100000
    chroot  /var/lib/haproxy
    pidfile /var/run/haproxy.pid
    user  haproxy
    group haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats level admin
    stats bind-process 1

    nbproc 6

    debug

    # default ciphers to use on SSL-enabled listening sockets
    ssl-default-bind-ciphers ALL:!SSLv2:!SSLv3:!LOW:!EXP:!MD5:!aNULL:!eNULL

    # fix the Logjam issue
    tune.ssl.default-dh-param 2048

defaults
    mode    http
    log     global
    option  httplog
    option  forwardfor      except 127.0.0.0/8
    option  dontlognull
    option  abortonclose
    option  redispatch
    retries 3
    timeout http-request    30s
    timeout queue           30s
    timeout connect         30s
    timeout client          30s
    timeout server          30s
    timeout http-keep-alive 30s
    timeout check           5s
    maxconn 100000

listen stats 0.0.0.0:9000
    stats uri /haproxy_stats
    stats hide-version

frontend http-in
    bind 0.0.0.0:80
    default_backend webapp-http

frontend https-in
    bind 0.0.0.0:443 ssl crt /etc/haproxy/star.heylinux.com.pem
    reqadd X-Forwarded-Proto:\ https
    reqadd X-SSL-Secure:\ true
    option forwardfor
    default_backend webapp-http

backend webapp-http
    mode http
    option httplog
    option forwardfor except 127.0.0.0/8
    balance leastconn
    cookie JSESSIONID prefix
    option httpchk HEAD /keepalive.html HTTP/1.0       # health check file
    server webapp1 10.192.1.11:80 cookie webapp1 check maxconn 5000 weight 2
    server webapp2 10.192.1.12:80 cookie webapp2 check maxconn 5000 weight 2
    server webapp3 10.192.1.13:80 cookie webapp3 check maxconn 5000 weight 2
    server webapp4 10.192.1.14:80 cookie webapp4 check maxconn 5000 weight 2
    server webapp5 10.192.1.15:80 cookie webapp5 check maxconn 5000 weight 2

global

# /etc/sysconfig/syslog

# local2.* /var/log/haproxy.log

log 127.0.0.1 local2 notice

maxconn 100000

chroot /var/lib/haproxy

pidfile /var/run/haproxy.pid

user haproxy

group haproxy

daemon

# turn on stats unix socket

stats socket /var/lib/haproxy/stats level admin

stats bind-process 1

nbproc 6

debug

# default ciphers to use on SSL-enabled listening sockets

ssl-default-bind-ciphers ALL:!SSLv2:!SSLv3:!LOW:!EXP:!MD5:!aNULL:!eNULL

# fix the Logjam issue

tune.ssl.default-dh-param 2048

defaults

mode http

log global

option httplog

option forwardfor except 127.0.0.0/8

option dontlognull

option abortonclose

option redispatch

retries 3

timeout http-request 30s

timeout queue 30s

timeout connect 30s

timeout client 30s

timeout server 30s

timeout http-keep-alive 30s

timeout check 5s

maxconn 100000

listen stats 0.0.0.0:9000

stats uri /haproxy_stats

stats hide-version

frontend http-in

bind 0.0.0.0:80

default_backend webapp-http

frontend https-in

bind 0.0.0.0:443 ssl crt /etc/haproxy/star.heylinux.com.pem

reqadd X-Forwarded-Proto:\ https

reqadd X-SSL-Secure:\ true

option forwardfor

default_backend webapp-http

backend webapp-http

mode http

option httplog

option forwardfor except 127.0.0.0/8

balance leastconn

cookie JSESSIONID prefix

option httpchk HEAD /keepalive.html HTTP/1.0 # health check file

server webapp1 10.192.1.11:80 cookie webapp1 check maxconn 5000 weight 2

server webapp2 10.192.1.12:80 cookie webapp2 check maxconn 5000 weight 2

server webapp3 10.192.1.13:80 cookie webapp3 check maxconn 5000 weight 2

server webapp4 10.192.1.14:80 cookie webapp4 check maxconn 5000 weight 2

server webapp5 10.192.1.15:80 cookie webapp5 check maxconn 5000 weight 2

HAProxy, HTTPS, RPM, SPECS

2 Comments

360杀毒出现Bug，导致用户系统时间“穿越”回2011年6月1日

由 mcsrainbow 发表在 Windows 分类，时间 2012/06/01

由于360杀毒中BD引擎调用程序出现Bug，导致部分用户系统时间被更改为2011年6月1日，整整“年轻”了一年，主要影响360杀毒并开启BD引擎的用户。该问题影响了用户系统的多项功能，例如安全证书错误，HTTPS网站无法访问，财务系统出错，Dropbox无法同步等诸多问题；而其它一些软件也会因此出现过期，授权失效等问题（如Outlook等），影响比较严重，且如果很多人没有发现该问题的原因（也不会轻易想到会有这个问题），多半会走上重装系统的悲剧之路。

解决问题的方法很简单：
将你的电脑日期从“2011年”还原为“2012年”！

这算是360送给用户的“六一”儿童节礼物么？真坑爹啊！

下面，贴一些错误信息方便他人搜索定位：
此网站出具的安全证书已过期或还未生效所有网站浏览器 HTTPS 无法打开证书错误提示 Dropbox同步失败 Outlook登陆失败

截至此时，2012-06-01 13:20，360杀毒已经做出的相关响应，以下是360官方给出的致歉信：
——————————–
尊敬的用户：

由于360杀毒中BD引擎调用程序出现Bug，导致部分用户系统时间被更改为2011年6月1日，主要影响360杀毒3.0以下版本并开启BD引擎的用户。

今早发现程序Bug后，360杀毒产品团队全力进行了紧急处理，目前已经发布修复程序：开启“自动升级”的用户，系统时间将自动恢复正常；如果您需要立即修复，点击360杀毒界面上的“检查更新”按钮，即可解决系统时间错误的问题。

对于此次产品Bug给您造成的不便，我们深表歉意。

360安全中心
2012年6月1日
http://bbs.360.cn/4077772/254084394.html

HTTPS

2 Comments

Hey! Linux.

标签为 HTTPS 的文章

HAProxy RPM SPECS与HTTPS Load配置分享

360杀毒出现Bug，导致用户系统时间“穿越”回2011年6月1日

标签云(Tags)

近期评论(Recent Comments)

新浪微博(Sina Weibo)

友情链接(Blogroll)

文章归档(Archives)

功能(Meta)

美国时间(US Time)

Google +1 (Plusone Button)

广告(Google Adsense)