使用 centOS 7 注意事项(踩过的坑)

约定不等于承诺〃 2022-01-05 04:13 175阅读 0赞

### 文章目录 ###

*   *   *  1 centOS 7 与 centOS 6 区别
         *  2 防火墙设置
         *  3 引入 SELinux
         *  4 Nginx 端口转发 502
         *  5 使用 systemctl 命令实现服务开机启动

### 1 centOS 7 与 centOS 6 区别 ###

后台开发常用到的区别:

*  1 加入了 `systemctl` 这一神器
 *  2 防火墙设置不同
 *  3 加入了更高级别的安全设置(SELinux)

centOS 7 与 centOS 6 区别可参考:

[Linux学习总结（29）——CentOS 6和CentOS 7区别总结][Linux_29_CentOS 6_CentOS 7]

[【Linux】CentOS6与CentOS7区别][Linux_CentOS6_CentOS7]

[CentOS7与CentOS6区别][CentOS7_CentOS6]

### 2 防火墙设置 ###

centOS 7 开始防火墙使用 `firewalld` 代替了 `iptables`

**firewalld** 简单使用:

开机启动 | 开机不启动 | 启动 | 停止 | 重启 | 查询状态 `firewalld` 防火墙服务

永久(`--permanent`) 开放(`--zone=public`) 某一个端口:

sudo firewall-cmd --add-port=666/tcp --zone=public --permanent

同时永久(`--permanent`) 开放(`--zone=public`) 多个(包括连续的和不连续的)端口:

sudo firewall-cmd --add-port=667/tcp --add-port=888-890/tcp --zone=public --permanent

永久(`--permanent`) 移除(`remove`) 一个或多个开放的(`--zone=public`)端口:

firewall-cmd --remove-port=6666/tcp --zone=public --permanent

查询开放的端口:

firewall-cmd --list-port

刷新/重新载入 防火墙:

sudo firewall-cmd --reload

在每一次更新防火墙规则(包括更新端口、添加屏蔽 ip 等操作) 之后都必须重新载入才会生效

关于 **firewalld** 参考资料:

[What is the difference between iptables and uncomplicated firewall(UFW) in Linux?][What is the difference between iptables and uncomplicated firewall_UFW_ in Linux]

[IPTABLES VS FIREWALLD][]

[How to Set Up a Firewall with FirewallD on CentOS 7][]

### 3 引入 SELinux ###

什么是 **SELinux** ? 其全名是: **Security Enhanced Linux**,简单来讲就是更高级别的安全设置(这玩意儿的戏特别多,一不小心就会被它坑了)

有些时候,当你以为使用 `firewalld` 开放了防火墙端口就万事大吉的时候,说不定你的服务就被这玩意给拦截了

`SELinux` 端口管理简单使用:

安装 `SELinux` 管理工具 `semanage` :

yum install policycoreutils-python

查看某一项服务(如 `http`) 相关的端口:

semanage port -l | grep http

向 `SELinux` 中添加一项服务(如 `xxx` 服务)的开放端口

semanage port -a -t xxx_port_t -p tcp 2333

将 `SELinux` 中的端口移除:

semanage port --delete -t http_port_t -p tcp 8899-8902

重启 `SELinux` 服务:

systemctl restart sshd.service

关于 **SELinux** 参考资料:

[An Introduction to SELinux on CentOS 7][]

[How to Disable SELinux on CentOS 7][]

[CentOS 7 在SELinux保护下安全打开端口][CentOS 7 _SELinux]

[Use SELinux Port Labeling To Allow Services To Use Non-Standard Ports][]

### 4 Nginx 端口转发 502 ###

你绝对想不到当你按照 Nginx 官网教程来安装使用 Nginx 的时候，竟然也会报错，而罪魁祸首就是 **SELinux**

关于 **Nginx** 参考资料:

[官方文档 Installing NGINX Open Source][Installing NGINX Open Source]

[官方文档 Controlling NGINX Processes at Runtime][Controlling NGINX Processes at Runtime]

[官方文档 Creating NGINX Plus and NGINX Configuration Files][Creating NGINX Plus and NGINX Configuration Files]

[How to Remove / Uninstall Nginx on CentOS 7 / RHEL 7 / Oracle Linux 7][How to Remove _ Uninstall Nginx on CentOS 7 _ RHEL 7 _ Oracle Linux 7]

[Linux下使用Nginx端口转发出现502错误的一种解决办法][Linux_Nginx_502]

[CentOS 7中nginx反向代理因为selinux出现错误的解决办法][CentOS 7_nginx_selinux]

### 5 使用 systemctl 命令实现服务开机启动 ###

**systemctl** 这一命令工具堪称神器,设置开机启动只是其功能的一项牛刀小试

思路:

*  1 将某一个程序(包含程序运行参数)设置为服务
 *  2 执行 `systemctl enable xxx.service` 即可实现开机启动
 *  3 执行 `systemctl disable xxx.service` 关闭开机启动
 *  4 如果某一个程序安装之后本身就会注册成为服务(如mysql 安装之后其服务名称为 `mysqld`),则跳过第 1 步

个人公众号:**404Code**,分享半个互联网人的技术与思考，感兴趣的可以关注.  
![404Code][]

[Linux_29_CentOS 6_CentOS 7]: https://blog.csdn.net/u012562943/article/details/71107137
[Linux_CentOS6_CentOS7]: https://www.jianshu.com/p/69aa9b2fc213
[CentOS7_CentOS6]: https://blog.csdn.net/xu_Melon/article/details/79043898
[What is the difference between iptables and uncomplicated firewall_UFW_ in Linux]: https://www.quora.com/What-is-the-difference-between-iptables-and-uncomplicated-firewall-UFW-in-Linux
[IPTABLES VS FIREWALLD]: https://www.unixmen.com/iptables-vs-firewalld/
[How to Set Up a Firewall with FirewallD on CentOS 7]: https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7
[An Introduction to SELinux on CentOS 7]: https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts
[How to Disable SELinux on CentOS 7]: https://linuxize.com/post/how-to-disable-selinux-on-centos-7/
[CentOS 7 _SELinux]: https://blog.csdn.net/caoshiying/article/details/74925514
[Use SELinux Port Labeling To Allow Services To Use Non-Standard Ports]: https://www.rootusers.com/use-selinux-port-labeling-to-allow-services-to-use-non-standard-ports/
[Installing NGINX Open Source]: https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/
[Controlling NGINX Processes at Runtime]: https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/
[Creating NGINX Plus and NGINX Configuration Files]: https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/
[How to Remove _ Uninstall Nginx on CentOS 7 _ RHEL 7 _ Oracle Linux 7]: https://webhostinggeeks.com/howto/how-to-remove-uninstall-nginx-on-centos-7-rhel-7-oracle-linux-7/
[Linux_Nginx_502]: https://blog.csdn.net/only_yu_yy/article/details/78825151
[CentOS 7_nginx_selinux]: https://my.oschina.net/songxinqiang/blog/636241
[404Code]: /images/20211230/c8b1ec2be494417a9880927d9a2f4f6d.png