sa-sa-ki.jpのblog

ログイン後、rootユーザにスイッチします
[centos@centos ~]$ su -
パスワード: rootユーザーのパスワード

MySQLにログインします
[root@centos ~]# mysql -u root -p
Enter password: rootユーザのパスワードを入力
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 25
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

WordPress用データベース作成
mysql> create database wordpress;
Query OK, 1 row affected (0.01 sec)

wordpressユーザ作成
mysql> grant all privileges on wordpress.* to wordpress@localhost identified by 'wordpressのパスワード';
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye

WordPressをダウンロードします
[root@centos ~]# wget http://ja.wordpress.org/wordpress-2.7.1-ja.tar.gz
--22:39:59-- http://ja.wordpress.org/wordpress-2.7.1-ja.tar.gz
ja.wordpress.org をDNSに問いあわせています“ 72.233.56.138, 72.233.56.139
ja.wordpress.org|72.233.56.138|:80 に接続しています“ 接続しました。
HTTP による接続要求を送信しました、応答を待っています“ 200 OK
長さ: 1843152 (1.8M) [application/octet-stream]
Saving to: `wordpress-2.7.1-ja.tar.gz'

100%[===========================================================================>] 1,843,152 537K/s in 3.4s

22:40:04 (537 KB/s) - `wordpress-2.7.1-ja.tar.gz' を保存しました [1843152/1843152]

WordPressインストールします
[root@centos ~]# tar xzvf wordpress-2.7.1-ja.tar.gz -C /var/www/html/

WordPressのディレクトリ名をblogに変更します
※ブログサイトのURLが http://www.sa-sa-ki.jp/wordpress から http://www.sa-sa-ki.jp/blog になります
[root@centos ~]# mv /var/www/html/wordpress /var/www/html/blog

アクセス権をユーザapache、グループをapacheに変更します
[root@centos ~]# chown -R apache.apache /var/www/html/blog

サーバー証明書作成用作業ディレクトリを作成します
[root@centos ~]# mkdir /etc/pki/tls/yasu
サーバー証明書作成用作業ディレクトリはrootユーザのみ読み書きできるように権限を変更します
[root@centos ~]# chmod 600 /etc/pki/tls/yasu

OpenSSLの設定ファイルを編集します
/etc/pki/tls直下にOpenSSLの設定ファイルがあるので、それを/etc/pki/tls/yasuにコピーします
[root@centos ~]# cp -p /etc/pki/tls/openssl.cnf /etc/pki/tls/yasu

/etc/pki/tls/yasuにコピーしたOpenSSLの設定ファイルをviエディタで開き、以下の箇所を編集します
[root@centos ~]# cd /etc/pki/tls/yasu
[root@centos yasu]# vi openssl.cnf
■修正前
[37～39行目]
dir = ./demoCA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
[43行目]
new_certs_dir = $dir/newcerts # default place for new certs.
[50～51行目]
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file

■修正後
[37～39行目]
dir = . # Where everything is kept
certs = $dir # Where the issued certs are kept
crl_dir = $dir # Where the issued crl are kept
[43行目]
new_certs_dir = $dir # default place for new certs.
[50～51行目]
private_key = $dir/cakey.pem# The private key
RANDFILE = $dir/.rand # private random number file

/etc/pki/tls/yasu に中身が空っぽのテキストファイル index.txt と01と書いた serial ファイルを作成します
[root@centos yasu]# touch index.txt
[root@centos yasu]# echo 01 > serial

[root@centos yasu]# ls -l
合計 28
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial

[root@centos yasu]# openssl genrsa -out ./cakey.pem -des3 1024
Generating RSA private key, 1024 bit long modulus
““““““++++++
“““““““““““““““““++++++
e is 65537 (0x10001)
Enter pass phrase for ./cakey.pem:任意のパスフレーズを入力
Verifying - Enter pass phrase for ./cakey.pem:もう一度任意のパスフレーズを入力

[root@centos yasu]# ls -l
合計 36
-rw-r--r-- 1 root root 963 3月 17 15:28 cakey.pem
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial

これで/etc/pki/tls/yasu ディレクトリにはcakey.pemというファイルが作成されましたね。
これが認証局の秘密鍵になります。

[root@centos yasu]# openssl req -new -x509 -days 3650 -config ./openssl.cnf -key ./cakey.pem -out ./cacert.pem
Enter pass phrase for ./cakey.pem:「２．認証局の秘密鍵作成」で指定したパスフレーズを応答
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
---
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:chiba
Locality Name (eg, city) [Newbury]:urayasu
Organization Name (eg, company) [My Company Ltd]:sa-sa-ki.jp
Organizational Unit Name (eg, section) []:何も入力しないで[Enter]キーを押下
Common Name (eg, your name or your server's hostname) []:www.sa-sa-ki.jp
Email Address []:何も入力しないで[Enter]キーを押下

[root@centos yasu]# ls -l
合計 44
-rw-r--r-- 1 root root 1164 3月 17 15:33 cacert.pem
-rw-r--r-- 1 root root 963 3月 17 15:28 cakey.pem
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial

cacert.pem というファイルが作成されました。

[root@centos yasu]# openssl x509 -days 3650 -inform pem -outform der -in ./cacert.pem -out ./ca.der
[
[root@centos yasu]# ls -l
合計 52
-rw-r--r-- 1 root root 818 3月 17 15:36 ca.der
-rw-r--r-- 1 root root 1164 3月 17 15:33 cacert.pem
-rw-r--r-- 1 root root 963 3月 17 15:28 cakey.pem
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial

ca.der というファイルが作成されました。
「１３．SSLの動作確認および認証局の証明書インポート」で使うのでそれまで大切に保管してください。

[root@centos yasu]# openssl genrsa -out ./server.key -des3 1024
Generating RSA private key, 1024 bit long modulus
“.++++++
“..++++++
e is 65537 (0x10001)
Enter pass phrase for ./server.key:任意のパスフレーズを入力
Verifying - Enter pass phrase for ./server.key:もう一度任意のパスフレーズを入力

WebサーバーにSSLでアクセスした時に毎回パスフレーズを聞かれないようにサーバー秘密鍵のパスフレーズを削除します。
[root@centos yasu]# openssl rsa -in ./server.key -out ./server.key
Enter pass phrase for server.key:上記パスフレーズを応答
writing RSA key

[root@centos yasu]# ls -l
合計 60
-rw-r--r-- 1 root root 818 3月 17 15:36 ca.der
-rw-r--r-- 1 root root 1164 3月 17 15:33 cacert.pem
-rw-r--r-- 1 root root 963 3月 17 15:28 cakey.pem
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial
-rw-r--r-- 1 root root 887 3月 17 15:38 server.key

server.key というファイルが作成されました。

[root@centos yasu]# openssl req -new -days 3650 -config ./openssl.cnf -key ./server.key -out ./server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
---
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:chiba
Locality Name (eg, city) [Newbury]:urayasu
Organization Name (eg, company) [My Company Ltd]:sa-sa-ki.jp
Organizational Unit Name (eg, section) []:何も入力しないで[Enter]キーを押下
Common Name (eg, your name or your server's hostname) []:www.sa-sa-ki.jp
Email Address []:何も入力しないで[Enter]キーを押下

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:何も入力しないで[Enter]キーを押下
An optional company name []:何も入力しないで[Enter]キーを押下

[root@centos yasu]# ls -l
合計 68
-rw-r--r-- 1 root root 773 3月 17 16:49 ca.der
-rw-r--r-- 1 root root 1103 3月 17 16:48 cacert.pem
-rw-r--r-- 1 root root 963 3月 17 16:48 cakey.pem
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 11:31 serial
-rw-r--r-- 1 root root 639 3月 17 16:49 server.csr
-rw-r--r-- 1 root root 891 3月 17 16:46 server.key

server.csr というファイルが作成されました。

[root@centos yasu]# openssl ca -config ./openssl.cnf -days 3650 -in ./server.csr -keyfile ./cakey.pem -cert ./cacert.pem -out ./server.cer
Using configuration from ./openssl.cnf
Enter pass phrase for ./cakey.pem:「２．認証局の秘密鍵作成」で指定したパスフレーズを応答
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar 17 07:50:57 2009 GMT
Not After : Mar 15 07:50:57 2019 GMT
Subject:
countryName = JP
stateOrProvinceName = chiba
organizationName = sa-sa-ki.jp
commonName = www.sa-sa-ki.jp
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
F9:35:8B:89:22:16:B6:C8:F5:7E:C9:CB:28:DE:FF:0B:F9:7D:54:77
X509v3 Authority Key Identifier:
keyid:FE:40:F5:F1:60:78:3F:F4:BF:63:2B:FE:DE:CE:D9:32:5B:44:05:52

Certificate is to be certified until Mar 15 07:50:57 2019 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@centos yasu]# ls -l
合計 108
-rw-r--r-- 1 root root 3050 3月 17 16:51 01.pem
-rw-r--r-- 1 root root 773 3月 17 16:49 ca.der
-rw-r--r-- 1 root root 1103 3月 17 16:48 cacert.pem
-rw-r--r-- 1 root root 963 3月 17 16:48 cakey.pem
-rw-r--r-- 1 root root 76 3月 17 16:51 index.txt
-rw-r--r-- 1 root root 21 3月 17 16:51 index.txt.attr
-rw-r--r-- 1 root root 0 3月 17 11:31 index.txt.old
-rw-r--r-- 1 root root 9534 3月 17 11:30 openssl.cnf
-rw-r--r-- 1 root root 3 3月 17 16:51 serial
-rw-r--r-- 1 root root 3 3月 17 11:31 serial.old
-rw-r--r-- 1 root root 3050 3月 17 16:51 server.cer
-rw-r--r-- 1 root root 639 3月 17 16:49 server.csr
-rw-r--r-- 1 root root 891 3月 17 16:46 server.key

server.cer というファイルが作成されました。

各ファイルをrootユーザ読み取り専用に権限を変更します。
[root@centos yasu]# chmod 400 *
[root@centos yasu]# ls -l
合計 108
-r---- 1 root root 3050 3月 17 16:51 01.pem
-r---- 1 root root 773 3月 17 16:49 ca.der
-r---- 1 root root 1103 3月 17 16:48 cacert.pem
-r---- 1 root root 963 3月 17 16:48 cakey.pem
-r---- 1 root root 76 3月 17 16:51 index.txt
-r---- 1 root root 21 3月 17 16:51 index.txt.attr
-r---- 1 root root 0 3月 17 11:31 index.txt.old
-r---- 1 root root 9534 3月 17 11:30 openssl.cnf
-r---- 1 root root 3 3月 17 16:51 serial
-r---- 1 root root 3 3月 17 11:31 serial.old
-r---- 1 root root 3050 3月 17 16:51 server.cer
-r---- 1 root root 639 3月 17 16:49 server.csr
-r---- 1 root root 891 3月 17 16:46 server.key

[root@centos yasu]# vi /etc/httpd/conf.d/ssl.conf
viエディタが起動するので設定ファイルを変更します。
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these
# directives see
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#

LoadModule ssl_module modules/mod_ssl.so

#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443

##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##

#
# Some MIME-types for downloading Certificates and CRLs
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin

# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
#SSLSessionCache dc:UNIX:/var/cache/mod_ssl/distcache
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300

# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
SSLMutex default

# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the
# SSL library. The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512

#
# Use "SSLCryptoDevice" to enable any supported hardware
# accelerators. Use "openssl engine -v" to list supported
# engine names. NOTE: If you enable an accelerator and the
# server does not start, consult the error logs and ensure
# your accelerator is functioning properly.
#
SSLCryptoDevice builtin
#SSLCryptoDevice ubsec

##
## SSL Virtual Host Context
##

# General setup for the virtual host, inherited from global configuration
先頭の#を外してコメントを解除します
DocumentRoot "/var/www/html"
先頭の#を外してコメントを解除し、サーバー名を修正します
ServerName www.sa-sa-ki.jp:443

# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log
TransferLogのファイル名をssl_access_logからssl_transfer_logに変更します
TransferLog logs/ssl_transfer_log
LogLevel warn

ログファイルのフォーマットを定義します
#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%h %l %u %t "%r" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

#
# For a single logfile with access, agent, and referer information
# (Combined Logfile Format), use the following directive:
#
CustomLog logs/ssl_access_log combined

# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on

# SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2

# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command.
先頭に#をつけてコメント化します
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
追加します
SSLCertificateFile /etc/pki/tls/certs/server.cer

# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
先頭に#をつけてコメント化します
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
追加します
SSLCertificateKeyFile /etc/pki/tls/private/server.key

# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt

# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10

# Access Control:
# With SSLRequire you can do per-directory access control based
# on arbitrary complex boolean expressions containing server
# variable checks and other lookup directives. The syntax is a
# mixture between C and Perl. See the mod_ssl documentation
# for more details.
#
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd."
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} < = 5
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} < = 20 )
# or %{REMOTE_ADDR} =~ m/^192.76.162.[0-9]+$/
#

# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o StrictRequire:
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
# under a "Satisfy any" situation, i.e. when it applies access is denied
# and no other module can change it.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

SSLOptions +StdEnvVars


SSLOptions +StdEnvVars

# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
SetEnvIf User-Agent ".*MSIE.*"
nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0

# Per-Server Logging:
# The home of a custom SSL log file. Use this when you want a
# compact non-error SSL logfile on a virtual host basis.
CustomLog logs/ssl_request_log
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"

内容を保存しviエディタを終了します

[root@centos yasu]# cp -p server.cer /etc/pki/tls/certs/
[root@centos yasu]# cp -p server.key /etc/pki/tls/private/
[root@centos yasu]# ls -l /etc/pki/tls/certs/ /etc/pki/tls/private/
/etc/pki/tls/certs/:
合計 472
-rw-r--r-- 1 root root 2240 1月 9 08:40 Makefile
-rw-r--r-- 1 root root 441017 1月 9 08:40 ca-bundle.crt
-rw--- 1 root root 1444 2月 3 23:11 localhost.crt
-rwxr-xr-x 1 root root 610 1月 9 08:40 make-dummy-cert
-r---- 1 root root 3050 3月 17 16:51 server.cer

/etc/pki/tls/private/:
合計 16
-rw--- 1 root root 891 2月 3 23:11 localhost.key
-r---- 1 root root 891 3月 17 16:46 server.key

[root@centos yasu]# vi /etc/sysconfig/iptables
viエディタが起動するので設定ファイルを変更します。
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
下記1行を追加してTCPの443番ポート(https)を開放します
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

内容を保存しviエディタを終了します

設定内容を反映します
[root@centos ~]# /etc/rc.d/init.d/iptables restart
ファイアウォールルールを適用中: [ OK ]
チェインポリシーを ACCEPT に設定中filter [ OK ]
iptables モジュールを取り外し中 [ OK ]
iptables ファイアウォールルールを適用中: [ OK ]
iptables モジュールを読み込み中ip_conntrack_netbios_ns [ OK ]

Apacheを再起動してSSLの設定を反映させます
[root@centos yasu]# /etc/rc.d/init.d/httpd restart
httpd を停止中: [ OK ]
httpd を起動中: [ OK ]

MySQLの設定ファイル変更
[root@centos ~]# vi /etc/my.cnf
viエディタが起動するので設定ファイルを変更します。
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
user=mysql
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1
MySQLの文字コードをUTF-8に変更します
default-character-set = utf8

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

MySQLクライアントの文字コードをUTF-8に変更します
[mysql]
default-character-set = utf8

内容を保存しviエディタを終了します

MySQLを起動します
[root@centos ~]# /etc/rc.d/init.d/mysqld start
MySQL データベースを初期化中: Installing MySQL system tables“
OK
Filling help tables“
OK

To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !
To do so, start the server, then issue the following commands:
/usr/bin/mysqladmin -u root password 'new-password'
/usr/bin/mysqladmin -u root -h centos.sa-sa-ki.jp password 'new-password'
See the manual for more instructions.
You can start the MySQL daemon with:
cd /usr ; /usr/bin/mysqld_safe &

You can test the MySQL daemon with mysql-test-run.pl
cd mysql-test ; perl mysql-test-run.pl

Please report any problems with the /usr/bin/mysqlbug script!

The latest information about MySQL is available on the web at

http://www.mysql.com

Support MySQL by buying support/licenses at http://shop.mysql.com
[ OK ]
MySQL を起動中: [ OK ]

OS再起動時にMySQLを自動起動するようにします
[root@centos ~]# chkconfig mysqld on
[root@centos ~]# chkconfig --list | grep mysqld
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off

MySQLサーバーへrootユーザでログインします
[root@centos ~]# mysql -u root
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 2
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

MySQLのユーザ、パスワードを確認
mysql> select user,host,password from mysql.user;
+--+--------+----+
| user | host | password |
+--+--------+----+
| root | localhost | |
| root | centos.sa-sa-ki.jp | |
| root | 127.0.0.1 | |
+--+--------+----+
3 rows in set (0.00 sec)

MySQLに接続する時のホスト名がlocalhost、centos.sa-sa-ki.jp、127.0.0.1でユーザ名がrootのパスワードが未登録な事が確認できます。
これら全てにパスワードを設定していきます。

ホスト名がlocalhostのrootユーザにパスワード設定します
mysql> set password for root@localhost=password('rootパスワード');
Query OK, 0 rows affected (0.00 sec)

ホスト名がcentos.sa-sa-ki.jpのrootユーザにパスワード設定します
mysql> set password for root@"centos.sa-sa-ki.jp"=password('rootパスワード');
Query OK, 0 rows affected (0.00 sec)

ホスト名が127.0.0.1のrootユーザにパスワード設定します
mysql> set password for root@127.0.0.1=password('rootパスワード');
Query OK, 0 rows affected (0.00 sec)

MySQLのユーザ、パスワードを再確認します
mysql> select user,host,password from mysql.user;
+--+--------+------+
| user | host | password |
+--+--------+------+
| root | localhost | ++++++++++++++++ |
| root | centos.sa-sa-ki.jp | ++++++++++++++++ |
| root | 127.0.0.1 | ++++++++++++++++ |
+--+--------+------+
3 rows in set (0.00 sec)

MySQLに接続する時のホスト名がlocalhost、centos.sa-sa-ki.jp、127.0.0.1でユーザ名がrootのパスワードが設定された事が確認できました。

MySQLからログアウトします。
mysql> exit
Bye

ホスト名がlocalhostのrootユーザでパスワードなしでログイン施行
[root@centos ~]# mysql -u root -h localhost
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ホスト名がlocalhostのrootユーザでパスワードなしでMySQLサーバーへログインできないことが確認できました。
同様にホスト名centos.sa-sa-ki.jpや127.0.0.1の場合も試してみます。

ホスト名がcentos.sa-sa-ki.jpのrootユーザでパスワードなしでログイン施行
[root@centos ~]# mysql -u root -h 'centos.sa-sa-ki.jp'
ERROR 1130 (00000): Host 'sa-sa-ki.jp' is not allowed to connect to this MySQL server

ホスト名が127.0.0.1のrootユーザでパスワードなしでログイン施行
[root@centos ~]# mysql -u root -h 127.0.0.1
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

ホスト名がlocalhostのrootユーザでパスワードありでログイン施行
[root@centos ~]# mysql -u root -h localhost -p
Enter password: 設定したrootユーザのパスワードを入力
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 21
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

接続できたのでログアウトします。
mysql> exit
Bye

同様にホスト名centos.sa-sa-ki.jpや127.0.0.1の場合も試してみます。
ホスト名がcentos.sa-sa-ki.jpのrootユーザでパスワードありでログイン施行
[root@centos ~]# mysql -u root -h 'centos.sa-sa-ki.jp' -p
Enter password: 設定したrootユーザのパスワードを入力
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 22
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

接続できたのでログアウトします。
mysql> exit
Bye

ホスト名が127.0.0.1のrootユーザでパスワードありでログイン施行
[root@centos ~]# mysql -u root -h 127.0.0.1 -p
Enter password: 設定したrootユーザのパスワードを入力
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 23
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

接続できたのでログアウトします。
mysql> exit
Bye

MySQLへrootでログインします
[root@centos ~]# mysql -u root -h localhost -p
Enter password: 設定したrootユーザのパスワードを入力
Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 24
Server version: x.x.xx Source distribution

Type 'help;' or 'h' for help. Type 'c' to clear the buffer.

登録データベースを確認します
mysql> show databases;
+--------+
| Database |
+--------+
| information_schema |
| mysql |
| test |
+--------+
3 rows in set (0.00 sec)

testデータベースを削除します
mysql> drop database test;
Query OK, 0 rows affected (0.00 sec)

再度登録データベースを確認します
mysql> show databases;
+--------+
| Database |
+--------+
| information_schema |
| mysql |
+--------+
2 rows in set (0.00 sec)

testデータベースが削除されている事が確認できました

mysql> exit
Bye

ログイン後、rootユーザにスイッチします
[centos@centos ~]$ su -
パスワード: rootユーザーのパスワード

Apache、PHP、MySQLをインストールします
[root@centos ~]# yum -y install httpd php php-mbstring mod_ssl mysql-server php-mysql
Loading "priorities" plugin
Loading "fastestmirror" plugin
Loading mirror speeds from cached hostfile
* base: ftp.iij.ad.jp
* updates: ftp.iij.ad.jp
* addons: ftp.iij.ad.jp
* extras: ftp.iij.ad.jp
0 packages excluded due to repository priority protections
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
-> Package php-mbstring.i386 0:x.x.x-xx.xxx_x.x set to be updated
--> Processing Dependency: php-common = x.x.x-xx.xxx_x.x for package: php-mbstring
-> Package mysql-server.i386 0:x.x.xx-x.xxx set to be updated
--> Processing Dependency: libmysqlclient.so.15(libmysqlclient_15) for package: mysql-server
--> Processing Dependency: perl-DBI for package: mysql-server
--> Processing Dependency: perl
-DBD-MySQL for package: mysql-server
--> Processing Dependency: perl(DBI) for package: mysql-server
--> Processing Dependency: libmysqlclient_r.so.15(libmysqlclient_15) for package: mysql-server
--> Processing Dependency: libmysqlclient_r.so.15 for package: mysql-server
--> Processing Dependency: mysql = x.x.xx-x.xxx for package: mysql-server
--> Processing Dependency: libmysqlclient.so.15 for package: mysql-server
-> Package httpd.i386 0:x.x.x-xx.xxx_x.centos.4 set to be updated
filelists.xml.gz 100% |=========================| 2.8 MB 00:00
filelists.xml.gz 100% |=========================| 2.7 MB 00:00
filelists.xml.gz 100% |=========================| 133 kB 00:00
filelists.xml.gz 100% |=========================| 150 B 00:00
-> Package php-mysql.i386 0:x.x.x-xx.xxx_x.x set to be updated
--> Processing Dependency: php-pdo for package: php-mysql
-> Package php.i386 0:x.x.x-xx.xxx_x.x set to be updated
--> Processing Dependency: php-cli = x.x.x-xx.xxx_x.x for package: php
-> Package mod_ssl.i386 1:x.x.x-xx.xxx_x.centos.4 set to be updated
--> Processing Dependency: libdistcache.so.1 for package: mod_ssl
--> Processing Dependency: libnal.so.1 for package: mod_ssl
--> Running transaction check
-> Package distcache.i386 0:x.x.x-xx.x set to be updated
-> Package php-cli.i386 0:x.x.x-xx.xxx_x.x set to be updated
-> Package perl-DBI.i386 0:x.xx-x.xxx set to be updated
-> Package php-pdo.i386 0:x.x.x-xx.xxx_x.x set to be updated
-> Package php-common.i386 0:x.x.x-xx.xxx_x.x set to be updated
-> Package perl-DBD-MySQL.i386 0:x.xxxx-x.xxx set to be updated
-> Package mysql.i386 0:x.x.xx-x.xxx set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================
Package Arch Version Repository Size
=============================================================================
Installing:
mod_ssl i386 1:x.x.x-xx.xxx_x.centos.4 updates 85 k
mysql-server i386 x.x.xx-x.xxx base 9.7 M
php i386 x.x.x-xx.xxx_x.x updates 1.1 M
php-mbstring i386 x.x.x-xx.xxx_x.x updates 969 k
php-mysql i386 x.x.x-xx.xxx_x.x updates 84 k
Installing for dependencies:
distcache i386 x.x.x-xx.x base 119 k
httpd i386 x.x.x-xx.xxx_x.centos.4 updates 1.1 M
mysql i386 x.x.xx-x.xxx base 4.1 M
perl-DBD-MySQL i386 x.xxxx-x.xxx base 147 k
perl-DBI i386 x.xx-x.xxx base 605 k
php-cli i386 x.x.x-xx.xxx_x.x updates 2.1 M
php-common i386 x.x.x-xx.xxx_x.x updates 154 k
php-pdo i386 x.x.x-xx.xxx_x.x updates 62 k

Transaction Summary
=============================================================================
Install 13 Package(s)
Update 0 Package(s)
Remove 0 Package(s)

Total download size: 20 M
Downloading Packages:
(1/13): mod_ssl-x.x.x-xx. 100% |=========================| 85 kB 00:00
(2/13): php-x.x.x-xx.xxx_ 100% |=========================| 1.1 MB 00:00
(3/13): mysql-x.x.xx-x.xx 100% |=========================| 4.1 MB 00:00
(4/13): php-mysql-x.x.x-x 100% |=========================| 84 kB 00:00
(5/13): perl-DBD-MySQL-x. 100% |=========================| 147 kB 00:00
(6/13): httpd-x.x.x-xx.xx 100% |=========================| 1.1 MB 00:00
(7/13): mysql-server-x.x. 100% |=========================| 9.7 MB 00:02
(8/13): php-common-x.x.x- 100% |=========================| 154 kB 00:00
(9/13): php-mbstring-x.x. 100% |=========================| 969 kB 00:00
(10/13): php-pdo-x.x.x-xx 100% |=========================| 62 kB 00:00
(11/13): perl-DBI-x.xx-x. 100% |=========================| 605 kB 00:00
(12/13): php-cli-x.x.x-xx 100% |=========================| 2.1 MB 00:00
(13/13): distcache-x.x.x- 100% |=========================| 119 kB 00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing: php-common ####################### [ 1/13]
Installing: perl-DBI ####################### [ 2/13]
Installing: mysql ####################### [ 3/13]
Installing: httpd ####################### [ 4/13]
Installing: perl-DBD-MySQL ####################### [ 5/13]
Installing: php-cli ####################### [ 6/13]
Installing: php-pdo ####################### [ 7/13]
Installing: distcache ####################### [ 8/13]
Installing: php-mbstring ####################### [ 9/13]
Installing: mysql-server ####################### [10/13]
Installing: php-mysql ####################### [11/13]
Installing: php ####################### [12/13]
Installing: mod_ssl ####################### [13/13]

Installed: mod_ssl.i386 1:x.x.x-xx.xxx_x.centos.4 mysql-server.i386 0:x.x.xx-x.xxx php.i386 0:x.x.x-xx.xxx_x.x php-mbstring.i386 0:x.x.x-xx.xxx_x.x php-mysql.i386 0:x.x.x-xx.xxx_x.x
Dependency Installed: distcache.i386 0:x.x.x-xx.x httpd.i386 0:x.x.x-xx.xxx_x.centos.4 mysql.i386 0:x.x.xx-x.xxx perl-DBD-MySQL.i386 0:x.xxxx-x.xxx
perl-DBI.i386 0:x.xx-x.xxx php-cli.i386 0:x.x.x-xx.xxx_x.x php-common.i386 0:x.x.x-xx.xxx_x.x php-pdo.i386 0:x.x.x-xx.xxx_x.x
Complete!

Apacheの設定ファイル変更
[root@centos ~]# vi /etc/httpd/conf/httpd.conf
viエディタが起動するので設定ファイルを変更します。
設定ファイルが大きいので設定箇所のみピックアップしています。
#
# Don't give away too much information about all the subcomponents
# we are running. Comment out this line if you don't mind remote sites
# finding out what major optional modules you are running
HTTPヘッダーやエラーページにApacheのバージョンやOSの情報が表示されないようにOS から Prod に変更
ServerTokens Prod

#
# ServerAdmin: Your address, where problems with the server should be
# e-mailed. This address appears on some server-generated pages, such
# as error documents. e.g. admin@your-domain.com
#
管理者メールアドレスを変更します
ServerAdmin centos@sa-sa-ki.jp

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If this is not set to valid DNS name for your host, server-generated
# redirections will not work. See also the UseCanonicalName directive.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
# You will have to access it by its address anyway, and this will make
# redirections work in a sensible way.
#
先頭の#を取ってコメントを解除し、サーバー名を変更します
ServerName www.sa-sa-ki.jp:80

#
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
#
# First, we configure the "default" to be a very restrictive set of
# features.
#
<Directory />
　　FollowSymLinksからNoneに変更してオプションを無効にします
　　Options None
　　AllowOverride None
　　全てのアクセスを拒否します
　　Order deny,allow
　　Deny from all
</Directory>

<Directory "/var/www/html">

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* - "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.2/mod/core.html#options
# for more information.
#
　　IndexesからExecCGIに変更してCGIスクリプトの実行を許可しドキュメントルートのファイル一覧を表示しないようにします
　　Options ExecCGI FollowSymLinks

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
　　NoneからAllに変更してファイルアクセス(.htaccess)の使用可能な指示子を全て許可にします
　　AllowOverride All

#
# Controls who can get stuff from this server.
#
Order allow,deny
Allow from all

</Directory>

#
# AddHandler allows you to map certain file extensions to "handlers":
# actions unrelated to filetype. These can be either built into the server
# or added with the Action directive (see below)
#
# To use CGI scripts outside of ScriptAliased directories:
# (You will also need to add "ExecCGI" to the "Options" directive.)
#
CGIスクリプトに拡張子.plを追加します
AddHandler cgi-script .cgi .pl

#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory
# listings, mod_status and mod_info output etc., but not CGI generated
# documents or custom error documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of: On | Off | EMail
#
エラーページにApacheのバージョンを表示しないようにOn から Off に変更
ServerSignature Off

#
# Aliases: Add here as many aliases as you need (with no limit). The format is
# Alias fakename realname
#
# Note that if you include a trailing / on fakename then the server will
# require it to be present in the URL. So "/icons" isn't aliased in this
# example, only "/icons/". If the fakename is slash-terminated, then the
# realname must also be slash terminated, and if the fakename omits the
# trailing slash, the realname must also omit it.
#
# We include the /icons/ alias for FancyIndexed directory listings. If you
# do not use FancyIndexing, you may comment this out.
#
Alias /icons/ "/var/www/icons/"

<Directory "/var/www/icons">

Options Indexesを削除してiconsディレクトリのファイル一覧を表示しないようにします
Options MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

内容を保存しviエディタを終了します

ドキュメントルートの権限変更
[root@centos ~]# chown -R apache.apache /var/www
[root@centos ~]# ls -l /var/www
合計 32
drwxr-xr-x 2 apache apache 4096 11月 13 00:44 cgi-bin
drwxr-xr-x 3 apache apache 4096 2月 3 23:11 error
drwxr-xr-x 6 apache apache 4096 3月 19 09:58 html
drwxr-xr-x 3 apache apache 4096 2月 3 23:11 icons

所有ユーザとグループがapacheになっている事を確認します

PHPの設定ファイル変更
[root@centos ~]# vi /etc/php.ini
viエディタが起動するので設定ファイルを変更します。
設定ファイルが大きいので設定箇所のみピックアップしています。
;
; Misc
;
; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server
header). It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
HTTPヘッダーにPHPのバージョンを表示しないようにOn から Off に変更
expose_php = Off

内容を保存しviエディタを終了します

[root@centos ~]# vi /etc/sysconfig/iptables
viエディタが起動するので設定ファイルを変更します。
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
下記1行を追加してTCPの80番ポート(http)を開放します
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

内容を保存しviエディタを終了します

設定内容を反映します
[root@centos ~]# /etc/rc.d/init.d/iptables restart
ファイアウォールルールを適用中: [ OK ]
チェインポリシーを ACCEPT に設定中filter [ OK ]
iptables モジュールを取り外し中 [ OK ]
iptables ファイアウォールルールを適用中: [ OK ]
iptables モジュールを読み込み中ip_conntrack_netbios_ns [ OK ]

Apacheを起動します
[root@centos ~]# /etc/rc.d/init.d/httpd start
httpd を起動中: [ OK ]

OS再起動時にApacheを自動起動するようにします
[root@centos ~]# chkconfig httpd on
[root@centos ~]# chkconfig --list | grep httpd
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

テスト用PHPページを作成します
[root@centos ~]# vi /var/www/html/test.php
viエディタが起動するので入力します。
<?php
　　phpinfo();
?>

内容を保存しviエディタを終了します

telnetコマンドでhttpヘッダーの内容を確認します
[root@centos ~]# telnet www.sa-sa-ki.jp 80
Trying 192.168.0.20“
Connected to www.sa-sa-ki.jp (192.168.0.20).
Escape character is '^]'.
HEAD /index.html HTTP/1.0
もう一度[Enter]キーを押下してください

HTTP/1.1 200 OK
Date: Fri, 27 Mar 2009 02:20:01 GMT
Apacheのバージョンが表示されていない
Server: Apache
X-Powered-By: PHP/x.x.xも表示されていない
X-Pingback: http://www.sa-sa-ki.jp/blog/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8

Connection closed by foreign host.