My Apache Security Hardening

The following configuration is used for my formal environment. More than Apache before, now basically not. Now share it.

1.  <Location />  #SetEnvIfNoCase  User-Agent  spider  bad_bot for  spider  BrowserMatchNoCase bingbot bad_bot BrowserMatchNoCase Googlebot bad_bot       browsermatchnocase 360spider bad_bot  browsermatchnocase   "Iaskspider"  badguy BrowserMatchNoCase  "Qihoobot"  badguy browsermatchnocase   "Larbin"  badguy BrowserMatchNoCase  "Iearthworm"  badguy BrowserMatchNoCase  "Outfoxbot"  badguy BrowserMatchNoCase  "Lanshanbot"  badguy BrowserMatchNoCase  " Arthur " badguy BrowserMatchNoCase " InfoPath " badguy BrowserMatchNoCase " Digext "  badguy BrowserMatchNoCase  "Embedded"  badguy BrowserMatchNoCase  "EMBEDDEDWB"  badguy BrowserMatchNoCase  "Wget"  badguy BrowserMatchNoCase  "Cncdialer"   Badguy browsermatchnocase  "Lwp::simple"  badguy BrowserMatchNoCase  "WPS"  badguy order deny,allow  deny from 124.115.4. 124.115.0. 64.69.34.135 216.240.136.125 218.15.197.69  155.69.160.99 58.60.13. 121.14.96. 58.60.14. 58.61.164. 202.108.7.209 deny  from env=bad_bot</Location>

2. Use rewrite to harden Apache

# # # # # # # # # #APACHE  url keyword Hardening Strategy # # # # # #请自行添加删减关键字 #并做好测试 Examples are as follows: Rewriteengine onrewritecond %{request_uri} xwork|java|redirect|passwd|hosts|windows|script | SCRIPT|LOCATION|PROMPT|PROC\/SELF\/ENVIRON|MOSCONFIG_[A-ZA-Z_]{1,21} (=|%3d) |base64_encode.* (. *) | (<|%3c). *script.* (>|%3e) | GLOBALS (=|[| %[0-9a-z]{0,2}) |_request (=|[| %[0-9a-z]{0,2}) |limit|\/web-inf\/web\.xml|applicationcontext\.xml|\/manager\/html|\/jmx-console\/|\.properties |\.class|phpinfo\.php|\/conn\.asp|\/conn\.php|\/conn\.jsp|\/cmd\.asp|\/diy\.asp|\.asp;|\/(\w+) \. (\w+) \ (\w+) \.php|\.php\.| Eval\ (|%eval|\.jsp?action=|fsaction=|/etc/passwd|\/%c0%ae%c0%ae|\/%2e%2e|boot\.ini|win\.ini|access\.log|httpd\ . conf|nginx\.conf|boot\.ini|\/etc\/hosts| ((\. (bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|php|php5|jspx) |~) $)  [nc]rewriterule ^/(. *)  http ://www.baidu.com/ [r,f]rewritecond %{query_string} xwork|java|redirect|passwd|hosts|windows| Script| Script|location|prompt|proc\/self\/environ|mosconfig_[a-zA-Z_]{1,21} (=|%3d) |base64_encode.* (. *) | (<|%3c). *script.* (>|%3e) | GLOBALS (=|[| %[0-9a-z]{0,2}) |_request (=|[| %[0-9a-z]{0,2}) |limit|\/web-inf\/web\.xml|applicationcontext\.xml|\/manager\/html|\/jmx-console\/|\.properties |\.class|phpinfo\.php|\/conn\.asp|\/conn\.php|\/conn\.jsp|\/cmd\.asp|\/diy\.asp|\.asp;|\/(\w+) \. (\w+) \ (\w+) \.php|\.php\.| Eval\ (|%eval|\.jsp?action=|fsaction=|/etc/passwd|\/%c0%ae%c0%ae|\/%2e%2e|boot\.ini|win\.ini|access\.log|httpd\ . conf|nginx\.conf|boot\.ini|\/etc\/hosts| ((\. (bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|php|php5|jspx) |~) $)  [nc]rewriterule ^/(. *)  http ://www.baidu.com/ [r,f]

In fact, the feeling function is still some chicken. My side is also used in conjunction with WAF. Oh.

This article from "Low EQ Technology House" blog, declined to reprint!

My Apache Security Hardening