標籤：user-agent
一、限定某個目錄禁止解析php
並不是所有的網站目錄是需要解析php的，比如上傳圖片的目錄等。禁止解析php能夠防止被攻擊者以php的方式搞破壞。
1、配置虛擬機器主機
[[email protected] ~]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf<VirtualHost *:80> DocumentRoot "/data/www/123.com" ServerName 123.com ErrorLog "logs/123.com-error_log" CustomLog "logs/123.com-access_log" common <Directory /data/www/123.com/upload> php_admin_flag engine off ##upload目錄中的php不解析 <FilesMatch (.*)\.php(.*)> Order allow,deny deny from all ##所有.php檔案拒絕訪問 </FilesMatch> </Directory></VirtualHost>
2、檢查重新載入
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful[[email protected] ~]# ls /data/www/123.com/upload1.php upload[[email protected] ~]# cat /data/www/123.com/upload/1.php <?phpecho "123.com";?>[[email protected] ~]# cat /data/www/123.com/upload/upload <?phpecho "123.com";?>
3、測實驗證
[[email protected] ~]# curl -x127.0.0.1:80 123.com/1.php123.com[[email protected] ~]# curl -x127.0.0.1:80 123.com/upload/1.php<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don‘t have permission to access /upload/1.phpon this server.<br /></p></body></html>[[email protected] ~]# curl -x127.0.0.1:80 123.com/upload/upload<?phpecho "123.com";?>
二、限制user_agent
User Agent意為使用者代理程式，簡稱 UA，它是一個特殊字元串頭，使得伺服器能夠識別客戶使用的作業系統及版本、CPU 類型、瀏覽器及版本、瀏覽器渲染引擎、瀏覽器語言、瀏覽器外掛程式等。
cc攻擊是我們經常見到的最常見的一種攻擊，它是駭客利用所能利用的肉雞去高頻訪問你的網站，導致網站不可以被正常的使用者所瀏覽。在攻擊的時候有一個規律的特徵，user_agent是一致的。通過對user_agent做限制，可以解決這個問題。
1、配置虛擬機器主機
[[email protected] ~]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf <VirtualHost *:80> DocumentRoot "/data/www/123.com" ServerName 123.com ErrorLog "logs/123.com-error_log" CustomLog "logs/123.com-access_log" common <IfModule mod_rewrite.c> RewriteEngine on RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR] ##匹配curl的訪問 OR=或關係 RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC] ##NC=忽略大小寫 RewriteRule .* - [F] ##F：Forbidden 禁止 </IfModule></VirtualHost>
2、檢查重新載入
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful
3、測實驗證
[[email protected] ~]# curl -x127.0.0.1:80 123.com<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don‘t have permission to access /on this server.<br /></p></body></html>[[email protected] ~]# curl -A "360Sec" -x127.0.0.1:80 123.com ##-A指定user-agent123.com[[email protected] ~]# curl -A "baidu.com" -x127.0.0.1:80 123.com<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don‘t have permission to access /on this server.<br /></p></body></html>
本文出自 “Gorilla Grodd” 部落格，請務必保留此出處http://juispan.blog.51cto.com/943137/1953440
LAMP-php解析與user_agent
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
