AWS 实战 2

创建 AMI（Amazon Machine Image）

进入 EC2 > 实例 > 启动新实例
选择 Amazon Linux 2023（内核-6.18）AMI
选择现有密钥对或创建密钥对

连接新实例

$ ssh -i "xxx.pem" ec2-user@my.public.dns.amazonaws.com

[ec2-user ~]$ # 更新系统
[ec2-user ~]$ sudo dnf update -y

配置 LAMP 服务器

[ec2-user ~]$ # 安装 Apache
[ec2-user ~]$ sudo dnf install -y httpd
Complete!
[ec2-user ~]$ sudo systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
[ec2-user ~]$ sudo usermod -a -G apache ec2-user
临时退出
[ec2-user ~]$ exit
再连接
[ec2-user ~]$ groups
ec2-user adm wheel apache systemd-journal
[ec2-user ~]$ sudo chown -R ec2-user:apache /var/www
[ec2-user ~]$ sudo chmod 2775 /var/www
[ec2-user ~]$ find /var/www -type d -exec sudo chmod 2775 {} \;
[ec2-user ~]$ find /var/www -type f -exec sudo chmod 0664 {} \;


[ec2-user ~]$ # 安装 MariaDB（AL2023 默认提供的是 MariaDB，兼容 MySQL）
[ec2-user ~]$ # sudo dnf install -y mariadb-server
[ec2-user ~]$ sudo dnf install -y mariadb105-server
Complete!
[ec2-user ~]$ sudo systemctl enable --now mariadb
Created symlink /etc/systemd/system/mysql.service → /usr/lib/systemd/system/mariadb.service.
Created symlink /etc/systemd/system/mysqld.service → /usr/lib/systemd/system/mariadb.service.
Created symlink /etc/systemd/system/multi-user.target.wants/mariadb.service → /usr/lib/systemd/system/mariadb.service.

[ec2-user ~]$ # 安装 PHP（AL2023 仓库中 PHP 8.x，具体版本取决于你启用的仓库）
[ec2-user ~]$ sudo dnf install -y php php-mysqlnd php-fpm
Complete!
[ec2-user ~]$ sudo systemctl enable --now php-fpm
Created symlink /etc/systemd/system/multi-user.target.wants/php-fpm.service → /usr/lib/systemd/system/php-fpm.service.

[ec2-user ~]$ # 安装后运行数据库安全配置
[ec2-user ~]$ sudo mysql_secure_installation
Switch to unix_socket authentication [Y/n] 
 ... Success!
Change the root password? [Y/n] 
New password: 
Re-enter new password: 
 ... Success!
Remove anonymous users? [Y/n] 
 ... Success!
Disallow root login remotely? [Y/n] n
 ... Success!
All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

安装 phpMyAdmin

[ec2-user ~]$ sudo dnf install php-mbstring php-xml -y
Complete!
[ec2-user ~]$ sudo systemctl restart httpd
[ec2-user ~]$ sudo systemctl restart php-fpm

[ec2-user ~]$ cd /var/www/html
[ec2-user ~]$ sudo wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.tar.gz
2026-10-20 20:38:19 (278 MB/s) - ‘phpMyAdmin-latest-all-languages.tar.gz’ saved [14446385/14446385]
[ec2-user ~]$ sudo mkdir phpMyAdmin && sudo tar -xvzf phpMyAdmin-latest-all-languages.tar.gz -C phpMyAdmin --strip-components 1
[ec2-user ~]$ sudo rm phpMyAdmin-latest-all-languages.tar.gz

[ec2-user ~]$ sudo chown -R ec2-user:apache /var/www/html/phpMyAdmin
[ec2-user ~]$ sudo find /var/www/html/phpMyAdmin -type d -exec chmod 2775 {} \;
[ec2-user ~]$ sudo find /var/www/html/phpMyAdmin -type f -exec chmod 0664 {} \;

免费数字证书

假设网站域名为 example.com, 别名是 www.example.com：

[ec2-user ~]$ curl --silent https://raw.githubusercontent.com/srvrco/getssl/master/getssl > getssl
[ec2-user ~]$ chmod 700 getssl
[ec2-user ~]$ ./getssl -c example.com
creating main config file /home/ec2-user/.getssl/getssl.cfg
Making domain directory - /home/ec2-user/.getssl/example.com
creating domain config file in /home/ec2-user/.getssl/example.com/getssl.cfg
Adding SANS=www.example.com from certificate installed on example.com to new configuration file
created domain config file in /home/ec2-user/.getssl/example.com/getssl.cfg

先编辑 /home/ec2-user/.getssl/getssl.cfg

CA="https://acme-v02.api.letsencrypt.org"

然后编辑 /home/ec2-user/.getssl/example.com/getssl.cfg

CA="https://acme-v02.api.letsencrypt.org"
ACL=('/var/www/html/.well-known/acme-challenge')
USE_SINGLE_ACL="true"

然后新建目录

[ec2-user ~]$ sudo mkdir -p /var/www/html/.well-known/acme-challenge

最后下载证书：

[ec2-user ~]$ sudo ./getssl example.com
example.com: no certificate obtained from host
Registering account
Verify each domain
Verifying example.com
copying challenge token to /var/www/html/.well-known/acme-challenge/TepTweIp5p0QPS4PjHoo_UjeO5fMnxiBYcooPoffhKA
sending request to ACME server saying we're ready for challenge
checking if challenge is complete
Pending
checking if challenge is complete
Verified example.com
Verifying www.example.com
copying challenge token to /var/www/html/.well-known/acme-challenge/5behfpmlr3IjNABU5md-yvzgUuvZ7Xim-GLrCo8Ca-w
sending request to ACME server saying we're ready for challenge
checking if challenge is complete
Pending
checking if challenge is complete
Verified www.example.com
Verification completed, obtaining certificate.
Requesting Finalize Link
Checking Finalize status
Requesting certificate
Certificate saved in /home/ec2-user/.getssl/example.com/example.com.crt
/home/ec2-user/.getssl/example.com/example.com.crt didn't match server
getssl: example.com - prime256v1 certificate obtained but certificate on server is different from the new certificate

查看所下载的数字证书文件。

[ec2-user ~]$ ls .getssl/example.com/
archive fullchain.crt example.com.crt example.com.key
chain.crt getssl.cfg example.com.csr

需要配置 Apache 以利用这些数字证书文件。

http to https apache redirection
Redirect non www to www using httpd.conf
How To Redirect www to Non-www with Apache on Ubuntu 14.04

下面修改 Apache 的配置文件1
[ec2-user ~]$ sudo nano /etc/httpd/conf/httpd.conf
在Listen 80这行下面
添加以下几行：（希望 example.com 转向 www.example.com 的话）

<VirtualHost *:80>
DocumentRoot /var/www/html
ServerAlias example.com
Redirect permanent / https://www.example.com/
</VirtualHost>

或者 （希望 www.example.com 转向 example.com 的话）

<VirtualHost *:80>
DocumentRoot /var/www/html
ServerAlias www.example.com
Redirect permanent / https://example.com/
</VirtualHost>

安装 mod_ssl

[ec2-user ~]$ sudo dnf install -y mod_ssl
Complete!

下面修改 Apache 的配置文件2
[ec2-user ~]$ sudo nano /etc/httpd/conf.d/ssl.conf
注意这个文件的内容实际上是对443端口的配置

Listen 443 https
# ...
<VirtualHost _default_:443>
# ...
SSLEngine on
# ...
</VirtualHost>

在相应的提示性的注释下
分别添加以下几行：（希望 example.com 转向 www.example.com 的话）

SSLCertificateFile /home/ec2-user/.getssl/example.com/example.com.crt
SSLCertificateKeyFile /home/ec2-user/.getssl/example.com/example.com.key
SSLCertificateChainFile /home/ec2-user/.getssl/example.com/chain.crt

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

或者 （希望 www.example.com 转向 example.com 的话）

SSLCertificateFile /home/ec2-user/.getssl/example.com/example.com.crt
SSLCertificateKeyFile /home/ec2-user/.getssl/example.com/example.com.key
SSLCertificateChainFile /home/ec2-user/.getssl/example.com/chain.crt

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1$1 [R=301,L]

最后重启服务器
[ec2-user ~]$ sudo systemctl restart httpd