配置防盗链
我的网站遇到最多的是两类盗链，一是图片盗链，二是文件盗链。曾经有一个访问量极大的网站盗链我网站的图片，一天竟然消耗了数G的流量。同时，我站放的不少几十兆的大型软件也常遭到文件盗链，大量消耗我站资源。
1、新增内容
[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.111.com www.example.com
<Directory /data/wwwroot/111.com>
SetEnvIfNoCase Referer "http://111.com" local_ref
SetEnvIfNoCase Referer "http://ask.apelearn.com" local_ref
SetEnvIfNoCase Referer "^$" local_ref
#定义referer白名单
<FilesMatch "\.(txt|doc|mp3|zip|rar|jpg|gif|png)">
Order Allow,Deny
Allow from env=local_ref
#定义规则：允许变量local_ref指定的referer访问，拒绝其他所有访问。
</FilesMatch>
</Directory>
2、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful
3、-e :表示指定referer，现在http://ask.apelearn.com/已经在白名单，所以是允许的
[[email protected] local]# curl -e "http://ask.apelearn.com/" -x127.0.0.1:80 111.com/3.png -I
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2017 12:45:00 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Last-Modified: Thu, 09 Nov 2017 12:45:00 GMT
ETag: W/"a102-55d97420ac440"
Accept-Ranges: bytes
Content-Length: 41218
Cache-Control: max-age=86400
Expires: Fri, 10 Nov 2017 12:45:00 GMT
Content-Type: image/png
4、不在白名单中就403
[[email protected] local]# curl -e "http://1323.com/" -x127.0.0.1:80 111.com/3.png -I
HTTP/1.1 403 Forbidden
Date: Thu, 09 Nov 2017 12:49:29 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1
访问控制Directory
1、[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.111.com www.example.com
<Directory /data/wwwroot/111.com/admin/>
Order deny,allow
Deny from all
Allow from 127.0.0.1
#只允许IP--127.0.0.1访问“/data/wwwroot/111.com/admin/”目录中的内容
#先拒绝所有的，在允许allow的，先后顺序
</Directory>
2、mkdir /data/wwwroot/111.com/admin/ && vi admin.html
3、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful
验证：
[[email protected] local]# curl -x127.0.0.1:80 111.com/admin/admin.html
this is admin.html
[[email protected] local]# curl -x192.168.3.74:80 111.com/admin/admin.html -I
HTTP/1.1 403 Forbidden
Date: Thu, 09 Nov 2017 12:53:39 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1
访问控制FilesMatch
1、[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.111.com www.example.com
<Directory /data/wwwroot/111.com>
<FilesMatch admin.html(.*)>
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
2、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful
3、[[email protected] local]# curl -x127.0.0.1:80 111.com/admin.html
this file admin.html
扩展：
1. 禁止访问某些文件/目录
增加Files选项来控制，比如要不允许访问 .inc 扩展名的文件，保护php类库：
<Files~"\.inc$">
Order Allow,Deny
Deny from all
</Files>
2. 禁止访问某些指定的目录：（可以用 来进行正则匹配）
<Directory~"^/var/www/(.+/)*[0-9]{3}">
Order Allow,Deny
Deny from all
</Directory>
3. 通过文件匹配来进行禁止，比如禁止所有针对图片的访问：
<FilesMatch \.?i:gif|jpe?g|png)$>
Order Allow,Deny
Deny from all
<FilesMatch>
4. 针对URL相对路径的禁止访问
<Location /dir/>
Order Allow,Deny
Deny from all
</Location>