Linux Server Phpcms v9 Security Configuration detailed _linux

First, the directory permissions set is very important: can effectively prevent hackers upload trojan files.

If you pass chmod 644 *-R, the PHP file has no access.
If you pass chmod 755 *-R, the PHP file has a high permission.
So you need to set directory permissions and file permissions separately:
Linux Server permissions: frequently used commands:

Find/path-type f-exec chmod 644 {} \; Set file permissions to 644
Find/path-type d-exec chmod 755 {} \; Set directory permissions to 755
When the setting is complete, then command: Chown root:root *-R to change the owner of the directory and file to root.
It's more secure.
FTP user, determined to be using a Linux host. Windows needs to log on to the settings in the server.
Go to the PHPCMS installation root directory and select all files:
Set the numeric value to: 755, and select: recursively process subdirectories, apply to directory only
Also select all files, the numeric value is: 644, select the recursive processing subdirectory, only apply to the file
If the setting is wrong, you can set it again.

Second, Linux find command to look for suspicious Trojan files

Find: Files modified within 30 days
Find./-mtime-30-type f-exec ls-l {} \;
Locate all txt files in the directory
Find./-name "*.txt"-print
Locate all txt files in the directory and delete them
Find./-name "*.txt"-exec rm-rf {} \;
Locate all the PHP files in the directory and modify the files in 30 days
Find./-name "*.php"-mtime-30-typef-exec ls-l {} \;
Locate all the PHP files in the directory at the same time, meet within 30 days, 1 days before the
Find./-name "*.php"-mtime-30-mtime +1-type f-execls-l {} \;

Third, through the Apache configuration qualification:

1, Apache prohibit directory execution PHP

Restrict permissions by placing the. htaccess file under the directory.
This method will use the PHP file as an attachment and download. At the same time, the file can be accessed through the browser.

Copy Code code as follows:

Php_flag engine off

Usage scenario: Placing in the following directory

Copy Code code as follows:

\uploadfile\
\statics\
\html\
\phpsso_server\uploadfile\
\phpsso_server\statics\

2, prohibit access to all files through the browser

Restrict permissions by placing the. htaccess file under the directory.
Rewriteengine on
Rewriterule ^ (. *)/index.html
Usage scenarios:
\caches\
\phpsso_server\caches\

3, Prohibit php Cross directory browsing permissions configuration:

Examples of virtual host configuration:

Copy Code code as follows:

<virtualhost *:80>
ServerAdmin root@phpip.com
Documentroot/data/wwwroot/www
ServerName www.phpip.com
<Directory/data/wwwroot/www>
Options FollowSymLinks
AllowOverride Options FileInfo
Order Allow,deny
Allow from all
Php_admin_value open_basedir/data/wwwroot/www/:/var/tmp/
DirectoryIndex index.htm index.html index.php
</Directory>
ErrorLog "| /usr/sbin/rotatelogs/data/logs/%m_%d_www.phpip.com-error_log 86400 480 "
Customlog "| /usr/sbin/rotatelogs/data/logs/%m_%d_www.phpip.com-access_log 86400 "Common
</VirtualHost>

4. Store Apache logs by day:

Refer to the above configuration file:

Copy Code code as follows:

ErrorLog "| /usr/sbin/rotatelogs/data/logs/%m_%d_www.phpip.com-error_log 86400 480 "
Customlog "| /usr/sbin/rotatelogs/data/logs/%m_%d_www.phpip.com-access_log 86400 "Common