sudo yum groupinstall "Development Tools" -y
sudo yum install gcc openssl-devel bzip2-devel libffi-devel zlib-devel sqlite-devel readline-devel tk-devel -y

# 下載最新Python源碼（以Python 3.12.2為例）
wget https://www.python.org/ftp/python/3.12.2/Python-3.12.2.tgz
tar -xf Python-3.12.2.tgz
cd Python-3.12.2

# 配置編譯選項(xiàng)
./configure --enable-optimizations --with-openssl=$(which openssl)

# 編譯并安裝（使用altinstall避免覆蓋系統(tǒng)Python）
make -j $(nproc)
sudo make altinstall

import ssl
# ModuleNotFoundError: No module named '_ssl'

# 確保安裝了最新版的openssl和開(kāi)發(fā)包
sudo yum install openssl openssl-devel

# 清理之前的編譯文件（如果存在）
make clean

# 重新配置并指定openssl路徑
./configure --enable-optimizations --with-openssl=$(which openssl)

# 重新編譯和安裝
make -j $(nproc)
sudo make altinstall

# 編輯bash配置文件
echo 'export PATH=/usr/local/bin:$PATH' >> ~/.bashrc
echo 'export PYTHON_HOME=/usr/local/bin/python3.12' >> ~/.bashrc
source ~/.bashrc

# 檢查Python版本
python3.12 --version

# 檢查pip是否可用
pip3.12 --version

# 驗(yàn)證SSL模塊是否正常
python3.12 -c "import ssl; print(ssl.OPENSSL_VERSION)"

# 設(shè)置Python版本 alternatives
sudo alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.12 1
sudo alternatives --config python3

# 安裝SCL倉(cāng)庫(kù)
sudo yum install centos-release-scl

# 安裝Python 3.8
sudo yum install rh-python38

# 啟用Python 3.8環(huán)境
scl enable rh-python38 bash

# 永久啟用（添加到bashrc）
echo "source scl_source enable rh-python38" >> ~/.bashrc

# 需要root權(quán)限才能安裝到系統(tǒng)目錄
sudo pip3.12 install package_name

# 使用--user標(biāo)志安裝到用戶目錄
pip3.12 install --user package_name

# 可能會(huì)卸載當(dāng)前版本，安裝新版本，影響其他依賴舊版本的應(yīng)用
pip install django==3.2
# 另一個(gè)項(xiàng)目需要django==4.0

# 使用清華源安裝包
pip3.12 install -i https://pypi.tuna.tsinghua.edu.cn/simple package_name

# 或者永久更改配置
pip3.12 config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple

# 創(chuàng)建虛擬環(huán)境
python3.12 -m venv my_project_env

# 激活虛擬環(huán)境
source my_project_env/bin/activate

# 激活后，pip安裝的包都會(huì)在虛擬環(huán)境內(nèi)
pip install django

# 安裝virtualenv
sudo pip3.12 install virtualenv

# 使用virtualenv創(chuàng)建虛擬環(huán)境
virtualenv my_project_env

# 激活后提示符變化
(my_project_env) [user@centos ~]$

# 生成當(dāng)前環(huán)境的需求文件
pip freeze > requirements.txt

# 從需求文件安裝所有依賴
pip install -r requirements.txt

Django==3.2.12
psycopg2-binary==2.9.3
celery==5.2.7

sudo yum update

# 安裝兼容版本
pip install package_name==1.2.3

# 從源碼編譯安裝
pip install --no-binary :all: package_name

home = /usr/local/bin
include-system-site-packages = false
version = 3.12.2

import sys
print(sys.path)

# 安裝缺失的模塊
pip install missing_module

# 檢查當(dāng)前Python解釋器路徑
which python

# 確保使用正確的pip安裝
which pip
pip install target_module

# 正確
import requests

# 錯(cuò)誤（如果模塊名是requests）
import Requests

# 錯(cuò)誤：_ssl模塊找不到
# 解決方案：安裝openssl-devel并重新編譯Python
sudo yum install openssl-devel

# 更改模塊文件權(quán)限
chmod o+r /path/to/module.py

# 臨時(shí)添加（當(dāng)前會(huì)話有效）
export PYTHONPATH="/path/to/my/modules:$PYTHONPATH"

# 永久添加（添加到bashrc）
echo 'export PYTHONPATH="/path/to/my/modules:$PYTHONPATH"' >> ~/.bashrc
source ~/.bashrc

# 在站點(diǎn)包目錄中創(chuàng)建mypaths.pth文件
echo "/path/to/my/modules" >> /usr/local/lib/python3.12/site-packages/mypaths.pth

# 以可編輯模式安裝當(dāng)前項(xiàng)目，這樣代碼變更立即生效
pip install -e .

# 安裝sqlite開(kāi)發(fā)包
sudo yum install sqlite-devel

# 重新編譯Python
cd Python-3.12.2
./configure --enable-optimizations
make -j $(nproc)
sudo make altinstall

# 安裝libffi-devel
sudo yum install libffi-devel

# 重新編譯Python

python -v -c "import problem_module"

# 查找模塊文件位置
find / -name "problem_module.py" 2>/dev/null

# 顯示模塊信息
pip show installed_module

# 啟動(dòng)干凈的Python環(huán)境
python -c "import problem_module; print('成功導(dǎo)入')"

# 為項(xiàng)目文件設(shè)置適當(dāng)權(quán)限（所有者可讀可寫，組用戶可讀，其他用戶無(wú)權(quán)限）
chmod 640 *.py
chmod 750 main_script.py  # 可執(zhí)行腳本需要執(zhí)行權(quán)限

# 創(chuàng)建數(shù)據(jù)目錄并設(shè)置適當(dāng)權(quán)限
sudo mkdir /var/lib/myapp
sudo chown myapp:myapp /var/lib/myapp
sudo chmod 755 /var/lib/myapp

import tempfile

# 安全創(chuàng)建臨時(shí)文件
with tempfile.NamedTemporaryFile(delete=False) as tmp:
    tmp.write(b"臨時(shí)數(shù)據(jù)")
    temp_path = tmp.name

# 使用后清理
os.unlink(temp_path)

# 創(chuàng)建不帶登錄shell的系統(tǒng)用戶
sudo adduser --system --no-create-home myappuser
sudo groupadd myappgroup
sudo usermod -a -G myappgroup myappuser

# 以專用用戶身份運(yùn)行應(yīng)用
sudo -u myappuser python /path/to/myapp.py

# 查看SELinux狀態(tài)
sestatus

# 暫時(shí)禁用SELinux（不推薦）
setenforce 0

# 啟用SELinux
setenforce 1

# 查看SELinux拒絕信息
sudo ausearch -m avc -ts recent

# 修改文件上下文
sudo chcon -t httpd_sys_content_t /path/to/myapp.py

# 允許網(wǎng)絡(luò)訪問(wèn)
sudo setsebool -P httpd_can_network_connect 1

# 查看SELinux審計(jì)日志
sudo cat /var/log/audit/audit.log | grep AVC

# 查看活動(dòng)區(qū)域和規(guī)則
sudo firewall-cmd --list-all

# 開(kāi)放特定端口（如Flask默認(rèn)的5000端口）
sudo firewall-cmd --permanent --add-port=5000/tcp
sudo firewall-cmd --reload

# 添加HTTP和HTTPS服務(wù)
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

import os

# 從環(huán)境變量讀取敏感信息
db_password = os.environ.get('DB_PASSWORD', 'default_password')
api_key = os.environ.get('API_KEY')

# 使用pass管理密碼
sudo yum install pass
pass init "My GPG Key"

# 設(shè)置配置文件權(quán)限，僅允許所有者讀取
chmod 600 config.ini
chown myappuser:myappgroup config.ini

# 使用altinstall避免覆蓋系統(tǒng)Python
cd Python-3.12.2
./configure --enable-optimizations
make -j $(nproc)
sudo make altinstall  # 這會(huì)安裝python3.12而不是替換python3

# 編輯yum配置文件，明確指定Python解釋器
sudo vi /usr/bin/yum

# 將第一行修改為：
#!/usr/bin/python2.7

# CentOS 7上重新安裝Python 2.7和yum
sudo yum reinstall python python2 yum

# CentOS 8上重新安裝Python 3和dnf
sudo dnf reinstall python3 dnf

# 為系統(tǒng)工具創(chuàng)建虛擬環(huán)境
sudo python2.7 -m virtualenv /opt/system_tools_venv

# 在虛擬環(huán)境中安裝所需包
sudo /opt/system_tools_venv/bin/pip install some_package

# 檢查腳本是否能在特定Python版本上運(yùn)行
python3.12 -m py_compile my_script.py

# 安裝tox
pip install tox

# 運(yùn)行多版本測(cè)試
tox

# Dockerfile示例
FROM centos:7

# 安裝Python 3.12
RUN yum install -y gcc openssl-devel bzip2-devel libffi-devel && \
    curl -O https://www.python.org/ftp/python/3.12.2/Python-3.12.2.tgz && \
    tar xzf Python-3.12.2.tgz && \
    cd Python-3.12.2 && \
    ./configure --enable-optimizations && \
    make altinstall && \
    cd .. && \
    rm -rf Python-3.12.2*

# 設(shè)置工作目錄
WORKDIR /app

# 復(fù)制應(yīng)用代碼
COPY . .

# 安裝應(yīng)用依賴
RUN python3.12 -m pip install -r requirements.txt

# 運(yùn)行應(yīng)用
CMD ["python3.12", "app.py"]

# 安裝Podman
sudo dnf install podman

# 運(yùn)行Python容器
podman run -it python:3.12 /bin/bash

# 安裝Gunicorn
pip install gunicorn

# 運(yùn)行Flask應(yīng)用
gunicorn --bind 0.0.0.0:5000 --workers 4 app:app

# /etc/nginx/conf.d/pythonapp.conf
server {
    listen 80;
    server_name your_domain.com;

    # 靜態(tài)文件處理
    location /static {
        alias /path/to/your/static/files;
        expires 30d;
    }

    # 動(dòng)態(tài)請(qǐng)求轉(zhuǎn)發(fā)到Gunicorn
    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# /etc/systemd/system/pythonapp.service
[Unit]
Description=Python Web Application
After=network.target

[Service]
User=myappuser
Group=myappgroup
WorkingDirectory=/opt/myapp
Environment="PATH=/opt/myapp/venv/bin"
Environment="DATABASE_URL=postgresql://user:pass@localhost/dbname"
ExecStart=/opt/myapp/venv/bin/gunicorn --workers 4 --bind 0.0.0.0:5000 app:app
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

# 啟用并啟動(dòng)服務(wù)
sudo systemctl daemon-reload
sudo systemctl enable pythonapp
sudo systemctl start pythonapp

# 查看服務(wù)狀態(tài)
sudo systemctl status pythonapp

# 跟蹤日志
sudo journalctl -u pythonapp -f

# gunicorn_config.py
workers = (2 * cpu_count()) + 1
worker_class = "gevent"
worker_connections = 1000
timeout = 120
keepalive = 5
max_requests = 1000
max_requests_jitter = 100
preload_app = True

# 使用Psycopg2連接池
from psycopg2 import pool

connection_pool = pool.SimpleConnectionPool(
    1, 20,
    host="localhost",
    database="mydb",
    user="user",
    password="password"
)

# 使用Redis緩存
import redis
from functools import wraps

redis_client = redis.Redis(host='localhost', port=6379, db=0)

def cache_result(expire_time=300):
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            cache_key = f"{func.__name__}:{str(args)}:{str(kwargs)}"
            cached_result = redis_client.get(cache_key)
            if cached_result:
                return cached_result.decode()
            result = func(*args, **kwargs)
            redis_client.setex(cache_key, expire_time, result)
            return result
        return wrapper
    return decorator

# 安裝Prometheus客戶端
pip install prometheus-client

# 在應(yīng)用中暴露指標(biāo)
from prometheus_client import start_http_server, Counter

REQUEST_COUNT = Counter('app_requests_total', 'Total app requests')

@app.route('/')
def index():
    REQUEST_COUNT.inc()
    return "Hello World"

import json
import logging
from datetime import datetime

class StructuredLogger:
    def __init__(self, name):
        self.logger = logging.getLogger(name)
        
    def log_request(self, request, response, time_taken):
        log_data = {
            "timestamp": datetime.utcnow().isoformat(),
            "level": "INFO",
            "method": request.method,
            "path": request.path,
            "status": response.status_code,
            "time_taken_ms": round(time_taken * 1000, 2),
            "user_agent": request.headers.get('User-Agent'),
            "ip": request.remote_addr
        }
        self.logger.info(json.dumps(log_data))

# /etc/logrotate.d/pythonapp
/var/log/pythonapp/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 644 myappuser myappgroup
    postrotate
        systemctl reload pythonapp > /dev/null 2>&1 || true
    endrotate
}

# 設(shè)置最小必要權(quán)限
sudo chown -R myappuser:myappgroup /opt/myapp
sudo find /opt/myapp -type d -exec chmod 750 {} \;
sudo find /opt/myapp -type f -exec chmod 640 {} \;

# 僅開(kāi)放必要端口
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept'
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

# 自動(dòng)化安全更新
sudo yum install -y yum-cron
sudo systemctl enable yum-cron
sudo systemctl start yum-cron

# 使用漏洞掃描工具
sudo yum install -y openscap-scanner
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig \
  --results scan_results.xml \
  --report scan_report.html \
  /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml