久々に AWS の設定を行う

cp ~/Downloads/secret.pem ~/.ssh
chmod 400 ~/.ssh/secret.pem

{
  "MaxCount": 1,
  "MinCount": 1,
  "ImageId": "ami-0a2e10c1b874595a1",
  "InstanceType": "t2.micro",
  "KeyName": "xxxx",
  "EbsOptimized": false,
  "BlockDeviceMappings": [
    {
      "DeviceName": "/dev/xvda",
      "Ebs": {
        "Encrypted": false,
        "DeleteOnTermination": false,
        "Iops": 3000,
        "SnapshotId": "snap-0296c4bd17a888d11",
        "VolumeSize": 100,
        "VolumeType": "gp3",
        "Throughput": 125
      }
    }
  ],
  "NetworkInterfaces": [
    {
      "AssociatePublicIpAddress": true,
      "DeviceIndex": 0,
      "Groups": [
        "<groupId of the new security group created below>"
      ]
    }
  ],
  "TagSpecifications": [
    {
      "ResourceType": "instance",
      "Tags": [
        {
          "Key": "Name",
          "Value": "WordPress"
        }
      ]
    }
  ],
  "PrivateDnsNameOptions": {
    "HostnameType": "ip-name",
    "EnableResourceNameDnsARecord": true,
    "EnableResourceNameDnsAAAARecord": false
  }
}

{
  "GroupName": "launch-wizard-1",
  "Description": "launch-wizard-1 created 2023-09-15T08:39:14.400Z",
  "VpcId": "vpc-0acb0bc7e7d21ae65"
}

{
  "GroupId": "<groupId of the security group created above>",
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [
        {
          "CidrIp": "0.0.0.0/0"
        }
      ]
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 443,
      "ToPort": 443,
      "IpRanges": [
        {
          "CidrIp": "0.0.0.0/0"
        }
      ]
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 80,
      "ToPort": 80,
      "IpRanges": [
        {
          "CidrIp": "0.0.0.0/0"
        }
      ]
    }
  ]
}

Host xxxx
  User ec2-user
  HostName 1.2.3.4
  Port 22
  IdentityFile ~/.ssh/secret.pem

ssh xxxx

   ,     #_
   ~\_  ####_        Amazon Linux 2023
  ~~  \_#####\
  ~~     \###|
  ~~       \#/ ___   https://aws.amazon.com/linux/amazon-linux-2023
   ~~       V~' '->
    ~~~         /
      ~~._.   _/
         _/ _/
       _/m/'

# HTTP サーバーをインストールします。
sudo yum install -y httpd
# サーバーを起動します。
sudo systemctl start httpd
# 自動起動の設定を確認します。
sudo systemctl is-enabled httpd
# 自動起動を有効にします。
sudo systemctl enable httpd
# もう一度、自動起動の設定を確認します。
sudo systemctl is-enabled httpd

sudo yum list | grep mariadb

sudo yum install -y mariadb105-server
sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none): 
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] 
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n]  
New password: 
Re-enter new password: 
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] 
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] 
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] 
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] 
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

sudo yum install -y php8.2 php8.2-gd php8.2-mbstring php8.2-mysqlnd php8.2-pdo

sudoedit /etc/httpd/conf/httpd.conf
# or
sudo vi /etc/httpd/conf/httpd.conf

sudo systemctl start httpd

# ホームディレクトリに戻ります。
cd
# zip ファイルをダウンロードします。
curl -O https://ja.wordpress.org/latest-ja.zip
# zip ファイルを展開します。
unzip latest-ja.zip
# ディレクトリを移動します。
sudo mv wordpress /var/www/html/
# パーミッションを設定します。
sudo chown -R apache:apache /var/www/html/wordpress

sudo systemctl reload httpd

mysql -u root -p
# パスワードを入力する。

create database wordpress_db charset utf8mb4;
create user wordpress_user@localhost identified by 'xxxx';
grant all privileges on wordpress_db.* to wordpress_user@localhost;

# アップロードのテスト用ファイルを作成します。
echo hello > test.txt
# バケットへのアップロードを試みます。
aws s3 cp test.txt s3://{BUCKET_NAME}/test.txt

aws s3 cp test.txt s3://{BUCKET_NAME}/test.txt

touch ~/s3-backup.sh
chmod 755 ~/s3-backup.sh
touch ~/.my.cnf
chmod 600 ~/.my.cnf

# アップロード先のバケット名です。
BUCKET_NAME=xxxx
# バックアップ時点の日時です。
DATE=`date --iso-8601=seconds`

# WordPress ディレクトリの zip ファイルを作成します。
cd /var/www/html && zip ~/wordpress.zip -r wordpress && cd
# S3 バケットにアップロードします。
aws s3 cp ~/wordpress.zip s3://${BUCKET_NAME}/${DATE}/wordpress.zip
# ファイルを削除します。
rm -f ~/wordpress.zip

# データベースの内容をダンプします。
mysqldump -u wordpress_user wordpress_db > ~/wordpress_db.sql
# S3 バケットにアップロードします。
aws s3 cp ~/wordpress_db.sql s3://${BUCKET_NAME}/${DATE}/wordpress_db.sql
# ファイルを削除します。
rm -f ~/wordpress_db.sql

[mysqldump]
password="xxxx"

0 18 * * * ec2-user /home/ec2-user/s3-backup.sh

# crond インストール
sudo yum install cronie
# 起動状態の確認（停止している）
sudo systemctl status crond
# crond 起動
sudo systemctl start crond
# 起動状態の確認（起動している）
sudo systemctl status crond
# システム開始時の起動（有効になっている）
sudo systemctl is-enabled crond
# 有効になっていない場合は有効にする。
sudo systemctl enable crond

0 20 * * * root /usr/sbin/reboot

last reboot

last reboot

reboot   system boot  6.1.49-70.116.am Tue Sep 19 20:00   still running
reboot   system boot  6.1.49-70.116.am Fri Sep 15 09:03 - 20:00 (4+10:56)

sudo systemctl restart php-fpm
sudo systemctl restart httpd

sudo yum install -y vsftpd

userlist_deny=NO
pasv_enable=YES
pasv_min_port=60001
pasv_max_port=60010

sudo useradd ftp-user
sudo passwd ftp-user

ftp-user

sudo systemctl start vsftpd
sudo systemctl enable vsftpd

# ftp-user を apache グループに追加します。
sudo gpasswd -a ftp-user apache
# ftp-user が apache グループに追加されたかを確認します。
groups ftp-user

sudo chmod -R g+w /var/www/html/wordpress

nslookup -type=CNAME www.loremipsum.co.jp

# 依存関係をインストールします。
sudo dnf install php-mbstring php-xml -y
# Web サーバーを起動して反映します。
sudo systemctl restart httpd
sudo systemctl restart php-fpm

# ホームディレクトリに移動します。
cd
# phpMyAdmin をダウンロードします。
wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.tar.gz
# tar ファイルを展開します。
tar -xzf phpMyAdmin-latest-all-languages.tar.gz
# tar ファイルを削除します。
rm -f phpMyAdmin-latest-all-languages.tar.gz
# ディレクトリ名をランダムに決めます。
DIRNAME=`openssl rand -hex 16`
# ファイルを移動します。
sudo mv phpMyAdmin-5.2.1-all-languages /var/www/html/wordpress/${DIRNAME}
# 所有者を変更します。
sudo chown apache:apache -R /var/www/html/wordpress/${DIRNAME}
# ディレクトリ名を確認します。
echo ${DIRNAME}

# phpMyAdmin のディレクトリに移動します。
cd /var/www/html/wordpress/${DIRNAME}
# .htaccess ファイルを作成して下記の内容を入力します。
sudo touch .htaccess
# .htpasswd ファイルを作成します。
sudo htpasswd -c .htpasswd pma_user

AuthType Basic
AuthName "Restricted Files"
AuthUserFile /var/www/html/wordpress/(DIRNAME をコピーします)/.htpasswd
Require valid-user

curl -v http://localhost

> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/8.2.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 09 Nov 2023 02:34:28 GMT
< Server: Apache/2.4.56 (Amazon Linux)
< Expires: Thu, 09 Nov 2023 03:34:28 GMT
< Cache-Control: max-age=3600
< X-Redirect-By: WordPress
< Set-Cookie: _mw-wp-form-token=57fba3fc142a426c13c79ac4dafac23ab5215185afab2c00c0c9bd4fe35ade24; path=/; HttpOnly
< Location: http://52.197.109.189/
< Content-Length: 0
< Content-Type: text/html; charset=UTF-8
< 

if ($_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
        $_SERVER['HTTPS'] = 'on';
        $_ENV['HTTPS'] = 'on';
}

free

sudo dd if=/dev/zero of=/swapfile bs=1M count=1024
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

/swapfile swap swap defaults 0 0

select
  @@global.key_buffer_size + @@global.innodb_buffer_pool_size + @@global.innodb_log_buffer_size + @@global.net_buffer_length as global_buffer_size,
  @@global.sort_buffer_size + @@global.myisam_sort_buffer_size + @@global.read_buffer_size + @@global.join_buffer_size + @@global.read_rnd_buffer_size as thread_buffer_size,
  @@global.key_buffer_size + @@global.innodb_buffer_pool_size + @@global.innodb_log_buffer_size + @@global.net_buffer_length
  + (@@global.sort_buffer_size + @@global.myisam_sort_buffer_size + @@global.read_buffer_size + @@global.join_buffer_size + @@global.read_rnd_buffer_size) * @@global.max_connections as total_memory_size;

; The number of child processes to be created when pm is set to 'static' and the
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
; This value sets the limit on the number of simultaneous requests that will be
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
; CGI. The below defaults are based on a server without much resources. Don't
; forget to tweak pm.* to fit your needs.
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
; Note: This value is mandatory.
pm.max_children = 8

; The number of child processes created on startup.
; Note: Used only when pm is set to 'dynamic'
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
pm.start_servers = 2

; The desired minimum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.min_spare_servers = 2

; The desired maximum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.max_spare_servers = 6

sudo systemctl reload php-fpm

ps -aux | grep maria

sudo systemctl edit mariadb.service

[Service]
OOMScoreAdjust=-1000

systemctl restart mariadb.service

cat /proc/1234/oom_score
cat /proc/1234/oom_adj
cat /proc/1234/oom_score_adj

for dir in /proc/[0-9]*; do   
  if [ "`cat $dir/oom_score_adj`" != 0 ]; then   
    echo "`cat $dir/comm` : `cat $dir/oom_score_adj`"   
  fi   
done 

sudo systemctl status amazon-ssm-agent

{
    "metrics": {
        "metrics_collected": {
            "procstat": [
                {
                    "pattern": "httpd",
                    "measurement": [
                        "pid_count"
                    ],
                    "metrics_collection_interval": 60
                },
                {
                    "pattern": "mariadbd",
                    "measurement": [
                        "pid_count"
                    ],
                    "metrics_collection_interval": 60
                }
            ]
        }
    }
}

ls -ald /proc/{pid}/exe のシンボリックリンク先