2018-04-17 Linux Learning

11.25 Configuring the anti-theft chain

Ability to implement anti-theft chains by restricting Referer

配置文件增加如下内容vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf<Directory /data/wwwroot/111.com>    SetEnvIfNoCase Referer "http://www.111.com" local_ref    SetEnvIfNoCase Referer "http://111.com" local_ref    SetEnvIfNoCase Referer "^$" local_ref    <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">      Order Allow,Deny      Allow from env=local_ref    </filesmatch></Directory>重新加载配置 -t , gracefulcurl -e "http://www.qq.com/123.txt" -x127.0.0.1:80 111.com/baidu.png1 -I   自定义 referer

Operation Process

[Email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf

<virtualhost : 80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
<directory/data/wwwroot/111.com>
setenvifnocase Referer "http:// Www.111.com "Local_ref
setenvifnocase Referer" http://111.com "Local_ref
setenvifnocase Referer" ^$ "Local_ref
<filesmatch. (txt|doc|mp3|zip|rar|jpg|gif) "
Order allow,deny
Allow from Env=local_ref
</filesmatch>
< /directory>
Errorlog "Logs/111.com-error_log"
setenvif request_uri ". . Gif$ "img
setenvif Request_uri". . Jpg$ "img
setenvif Request_uri". . Png$ "img
setenvif Request_uri". . Bmp$ "img
setenvif Request_uri". . Swf$ "img
setenvif Request_uri". . Js$ "img
setenvif Request_uri". . Css$ "img
Customlog" |/usr/local/apache2.4/bin/rotatelogs-l logs/111.com-access_%y%m%d.log 86400 "combined env=! IMG
</virtualhost>

[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful[[email protected] ~]# curl -e "http://www.qq.com/123.txt" -x127.0.0.1:80 111.com/baidu.png1 -IHTTP/1.1 404 Not FoundDate: Fri, 23 Mar 2018 16:53:25 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.34Content-Type: text/html; charset=iso-8859-1

11.26 Access Control Directory

Core configuration file Contents

<Directory /data/wwwroot/111.com/admin/>    Order deny,allow    Deny from all    Allow from 127.0.0.1</Directory>

The Curl Test status code of 403 is restricted to access the

Operation Process

[[email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost : 80
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
Errorlog "Logs/111.com-error_log"
<directory/data/wwwroot/111.com/admin/>
Order deny,allow
Deny From any
allow from 127.0.0.1
</directory>
setenvif Request_uri. . Gif$ "img
setenvif Request_uri". . Jpg$ "img
setenvif Request_uri". . Png$ "img
setenvif Request_uri". . Bmp$ "img
setenvif Request_uri". . Swf$ "img
setenvif Request_uri". . Js$ "img
setenvif Request_uri". . Css$ "img
Customlog" |/usr/local/apache2.4/bin/rotatelogs-l logs/111.com-access_%y%m%d.log 86400 "combined env=! IMG
</virtualhost>

[[email protected] ~]# mkdir /data/wwwroot/111.com/admin[[email protected] ~]# vim /data/wwwroot/111.com/admin/index.php[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful[[email protected] ~]# curl -x127.0.0.1:80 111.com/admin/index.php -IHTTP/1.1 200 OKDate: Fri, 23 Mar 2018 21:08:20 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.34X-Powered-By: PHP/5.6.34Content-Type: text/html; charset=UTF-8[[email protected] ~]# curl -x192.168.106.160:80 111.com/admin/index.php -IHTTP/1.1 403 ForbiddenDate: Fri, 23 Mar 2018 21:08:48 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.34Content-Type: text/html; charset=iso-8859-1

11.27 Access Control FilesMatch

Access Control-FilesMatch

核心配置文件内容<Directory /data/wwwroot/111.com>    <FilesMatch "admin.php(.*)">      Order deny,allow      Deny from all      Allow from 127.0.0.1    </FilesMatch></Directory>

Operation Process

[[email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost : 80
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
Errorlog "Logs/111.com-error_log"
<directory/data/wwwroot/111.com>
<filesmatch "admin.php (. )"
Order Deny,allow
deny from the all
allow from 127.0.0.1
</filesmatch>
</directory>
Setenvif Request_uri ". . gif$ "img
setenvif Request_uri". . Jpg$ "img
setenvif Request_uri". . Png$ "img
setenvif Request_uri". . Bmp$ "img
setenvif Request_uri". . Swf$ "img
setenvif Request_uri". . Js$ "img
setenvif Request URI". *.css$ "img
Customlog" |/usr/local/apache2.4/bin/rotatelogs-l logs/111. Com-access %y%m%d.log 86400 "combined env=!img
</virtualhost>

[[email protected] ~]# vim /data/wwwroot/111.com/admin.php[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful[[email protected] ~]# curl -x127.0.0.1:80 111.com/admin.php -IHTTP/1.1 200 OKDate: Tue, 17 Apr 2018 14:35:37 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.35X-Powered-By: PHP/5.6.35Cache-Control: max-age=0Expires: Tue, 17 Apr 2018 14:35:37 GMTContent-Type: text/html; charset=UTF-8[[email protected] ~]# curl -x192.168.106.160:80 111.com/admin.php -IHTTP/1.1 403 ForbiddenDate: Tue, 17 Apr 2018 14:34:37 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.35Content-Type: text/html; charset=iso-8859-1[[email protected] ~]# curl -x192.168.106.160:80 111.com/admin.php?lkajskdfj -IHTTP/1.1 403 ForbiddenDate: Tue, 17 Apr 2018 14:34:20 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.35Content-Type: text/html; charset=iso-8859-1

2018-04-17 Linux Learning