2018-04-18 Linux学习

标签：Linux学习

访问控制 - 禁止PHP解析

<Directory /data/wwwroot/111.com/upload>
  php_admin_flag engine off
</Directory>

curl 测试时直接返回php源代码，并未解析

操作过程

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI ".*.css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[root@aming-01 ~]# mkdir /data/wwwroot/111.com/upload
[root@aming-01 ~]# cd /data/wwwroot/111.com/
[root@aming-01 111.com]# vim 123.php
[root@aming-01 111.com]# cp 123.php upload/

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:13:20 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:13:20 GMT
Content-Type: text/html; charset=UTF-8

[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:14:00 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

11.29 限制user_agent

访问控制 - user_agent

user_agent 可以理解为浏览器标识

核心配置内容

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC]
    RewriteRule .* - [F]
</IfModule>

curl -A "123123" 指定 user_agent

操作过程

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .curl. [NC,OR]
RewriteCond %{HTTP_USER_AGENT} .baidu.com. [NC]
RewriteRule . - [F]
</IfModule>
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI "..css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[root@aming-01 111.com]# vim /data/wwwroot/111.com/123.php

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:41:05 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:41:05 GMT
Content-Type: text/html; charset=UTF-8

[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:42:54 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

[root@aming-01 111.com]# curl -A "aminglinux aminglinux"  -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:43:25 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:43:25 GMT
Content-Type: text/html; charset=UTF-8

11.30-31 PHP相关配置

查看PHP配置文件位置

/usr/local/php/bin/php -i|grep -i "loaded configuration file" //可能会找不到

/usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

设置以下几项可以保存错误日志：
display_errors = Off    //设置为 Off, 为 On 时，浏览器访问phpinfo时会显示错误信息，不建议设置为on
log_errors = On     //错误日志开启
error_log = /tmp/php_errors.log    //设置错误日志路径
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT    //设置错误日志级别

安全相关:
vim /usr/local/php/etc/php.ini
    open_basedir = /data/wwwroot/111.com:/tmp/

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf    //能够针对各个虚拟主机设置open_basedir
    php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"

PHP信息内容
    [root@aming-01 111.com]# vim index.php
    <?php
    phpinfo();
    设置完可通过浏览器访问111.com/index.php 查看phpinfo

操作过程

[root@aming-01 ~]# /usr/local/php/bin/php -i|grep -i "loaded configuration file"
PHP Warning:  Unknown: It is not safe to rely on the system‘s timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone ‘UTC‘ for now, but please set date.timezone to select your timezone. in Unknown on line 0
Loaded Configuration File => /usr/local/php/etc/php.ini

[root@aming-01 ~]# vim /usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai
display_errors = On
log_errors = On
error_log = /tmp/php_errors.log
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
open_basedir = /data/wwwroot/111.com:/tmp/

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
ServerAdmin abc@test.com
DocumentRoot "/data/wwwroot/abc.com"
ServerName abc.com
ServerAlias www.abc.com www.123.com
php_admin_value open_basedir "/data/wwwroot/abc.com:/tmp/"
ErrorLog "logs/abc.com-error_log"
CustomLog "logs/abc.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"

2018-04-18 Linux学习

标签：Linux学习

原文地址：http://blog.51cto.com/9298822/2105105