访问需输入密码:
[[email protected] www]# pwd
/data/www
[[email protected] www]# mkdir abc
[[email protected] www]# cd abc/
[[email protected] abc]# ls
[[email protected] abc]# cp /etc/passwd ./12.txt
windows客户端可访问:
现访问需先通过认证,才能访问该文件。
[[email protected] abc]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
# ErrorLog "logs/dummy-host.example.com-error_log"
# CustomLog "logs/dummy-host.example.com-access_log" common
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
</VirtualHost>
[[email protected] abc]# vim /etc/profile.d/path.sh
export PATH=$PATH:/usr/local/mysql/bin:/usr/local/apache2/bin
[[email protected] abc]# !source
source /etc/profile.d/path.sh
[[email protected] abc]# htpasswd -c /data/.htpasswd user1
New password:
Re-type new password:
Adding password for user user1
[[email protected] abc]# cat /data/.htpasswd
user1:piGphq8lkIbXM
[[email protected] abc]# htpasswd /data/.htpasswd user2
New password:
Re-type new password:
Adding password for user user2
[[email protected] abc]# !cat
cat /data/.htpasswd
user1:piGphq8lkIbXM
user2:sssH0X1U8VwUs
[[email protected] abc]# apachectl graceful
windows访问:
输入用户、密码后:
默认虚拟主机配置:
windows客户端
C:\Windows\System32\drivers\etc中hosts文件:
当访问www.test.com、www.aaa.com时,能访问网站,当其他域名解析到该IP时,也能访问该IP。如下:
访问www.111.com
现www.111.com使之不能访问,使访问到默认的虚拟主机
[[email protected] abc]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/tmp/123"
ServerName 111.com
</VirtualHost>
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
# ErrorLog "logs/dummy-host.example.com-error_log"
# CustomLog "logs/dummy-host.example.com-access_log" common
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
</VirtualHost>
[[email protected] abc]# apachectl -t
Warning: DocumentRoot [/tmp/123] does not exist
Syntax OK
[[email protected] abc]# mkdir /tmp/123
[[email protected] abc]# chmod 600 /tmp/123/
[[email protected] abc]# apachectl -t
Syntax OK
[[email protected] abc]# apachectl restart
windows访问:www.111.com 、www.test.com
域名跳转:
[[email protected] ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
# ErrorLog "logs/dummy-host.example.com-error_log"
# CustomLog "logs/dummy-host.example.com-access_log" common
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
</VirtualHost>
[[email protected] ~]# apachectl -t
[[email protected] ~]# apachectl graceful
windows访问www.aaa.com,自动跳转至www.test.com
[[email protected] ~]# curl -x192.168.137.22:80 www.aaa.com/fff -I
HTTP/1.1 301 Moved Permanently
Date: Tue, 09 Jun 2015 03:36:02 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
Location: http://www.test.com/fff
Content-Type: text/html; charset=iso-8859-1
在虚拟主机中加:
[[email protected] ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
# ErrorLog "logs/dummy-host.example.com-error_log"
# CustomLog "logs/dummy-host.example.com-access_log" common
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$ [OR]
RewriteCond %{HTTP_HOST} ^www.bbb.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
</VirtualHost>
[[email protected] ~]# apachectl -t
Syntax OK
[[email protected] ~]# apachectl graceful
window上写hosts文件:
windows上访问www.bbb.com自动跳转到www.test.com
[[email protected] ~]# curl -x192.168.137.22:80 www.bbb.com/fff -I
HTTP/1.1 301 Moved Permanently
Date: Tue, 09 Jun 2015 03:53:52 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
Location: http://www.test.com/fff
Content-Type: text/html; charset=iso-8859-1
apache日志切割
[[email protected] ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
ErrorLog "logs/test.com_error_log"
CustomLog "logs/test.com-access_log" combined
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$ [OR]
RewriteCond %{HTTP_HOST} ^www.bbb.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
</VirtualHost>
[[email protected] ~]# apachectl -t
Syntax OK
[[email protected] ~]# apachectl graceful
[[email protected] ~]# cd /usr/local/apache2/logs/
[[email protected] logs]# ls
test.com_error_log test.com-access_log
[[email protected] logs]# cat test.com-access_log
[[email protected] logs]# cat test.com_error_log
[[email protected] logs]# cat /usr/local/apache2/conf/httpd.conf
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
ErrorLog "logs/test.com_error_log"
CustomLog "|/usr/local/apache2/bin/rotatelogs -l /usr/local/apache2/logs/test.com-access_%Y%m%d_log 86400" combined
[[email protected] logs]# apachectl -t
Syntax OK
[[email protected] logs]# apachectl graceful
windows访问网站
[[email protected] logs]# ls
test.com-access_20150609_log
[[email protected] logs]# date -s "2015-07-17 10:14:45"
Fri Jul 17 10:14:45 CST 2015
[[email protected] logs]# ls
access_log httpd.pid test.com-access_20150717_log test.com_error_log
error_log test.com-access_20150609_log test.com-access_log
apache不记录指定文件类型日志
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
ErrorLog "logs/test.com_error_log"
SetEnvIf Request_URI ".*\.gif$" image-request
SetEnvIf Request_URI ".*\.jpg$" image-request
SetEnvIf Request_URI ".*\.png$" image-request
SetEnvIf Request_URI ".*\.bmp$" image-request
SetEnvIf Request_URI ".*\.swf$" image-request
SetEnvIf Request_URI ".*\.js$" image-request
SetEnvIf Request_URI ".*\.css$" image-request
CustomLog "|/usr/local/apache2/bin/rotatelogs -l /usr/local/apache2/logs/test.com-access_%Y%m%d_log 86400" combined env=!image-request
[[email protected] logs]# apachectl -t
Syntax OK
[[email protected] logs]# apachectl graceful
客户端访问:
[[email protected] logs]# ls
[[email protected] logs]# less test.com-access_20150718_log
apache配置静态缓存
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
ErrorLog "logs/test.com_error_log"
SetEnvIf Request_URI ".*\.gif$" image-request
SetEnvIf Request_URI ".*\.jpg$" image-request
SetEnvIf Request_URI ".*\.png$" image-request
SetEnvIf Request_URI ".*\.bmp$" image-request
SetEnvIf Request_URI ".*\.swf$" image-request
SetEnvIf Request_URI ".*\.js$" image-request
SetEnvIf Request_URI ".*\.css$" image-request
CustomLog "|/usr/local/apache2/bin/rotatelogs -l /usr/local/apache2/logs/test.com-access_%Y%m%d_log 86400" combined env=!image-request
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType image/gif "access plus 1 days"
ExpiresByType image/jpeg "access plus 24 hours"
ExpiresByType image/png "access plus 24 hours"
ExpiresByType text/css "now plus 2 hour"
ExpiresByType application/x-javascript "now plus 2 hours"
ExpiresByType application/javascript "now plus 2 hours"
ExpiresByType application/x-shockwave-flash "now plus 2 hours"
ExpiresDefault "now plus 0 min"
</IfModule>
[[email protected] logs]# apachectl graceful
[[email protected] logs]# curl -x127.0.0.1:80 ‘http://www.test.com/static/image/common/logo_88_31.gif‘ -I
HTTP/1.1 200 OK
Date: Sat, 18 Jul 2015 02:30:55 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
Last-Modified: Tue, 09 Jun 2015 02:21:10 GMT
ETag: "ffa22-9e0-5180c695e1180"
Accept-Ranges: bytes
Content-Length: 2528
Cache-Control: max-age=86400
Expires: Sun, 19 Jul 2015 02:30:55 GMT
Content-Type: image/gif
apache配置防盗链
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType image/gif "access plus 1 days"
ExpiresByType image/jpeg "access plus 24 hours"
ExpiresByType image/png "access plus 24 hours"
ExpiresByType text/css "now plus 2 hour"
ExpiresByType application/x-javascript "now plus 2 hours"
ExpiresByType application/javascript "now plus 2 hours"
ExpiresByType application/x-shockwave-flash "now plus 2 hours"
ExpiresDefault "now plus 0 min"
</IfModule>
SetEnvIfNoCase Referer "^http://.*\.test\.com" local_ref
SetEnvIfNoCase Referer ".*\.aaa\.com" local_ref
SetEnvIfNoCase Referer "^$" local_ref
<filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
Order Allow,Deny
Allow from env=local_ref
Deny from all
</filesmatch>
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$ [OR]
RewriteCond %{HTTP_HOST} ^www.bbb.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
<Directory /data/www/abc>
AllowOverride AuthConfig
AuthName "frank share web"
AuthType Basic
AuthUserFile /data/.htpasswd
require valid-user
</Directory>
[[email protected] logs]# apachectl -t
Syntax OK
[[email protected] logs]# apachectl graceful
apache访问控制
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
<Directory "/data/www">
AllowOverride None
Options None
Order allow,deny
Allow from all
Deny from 127.0.0.1
</Directory>
[[email protected] logs]# apachectl graceful
[[email protected] logs]# curl -x127.0.0.1:80 -I www.text.com
HTTP/1.1 403 Forbidden
Date: Sat, 18 Jul 2015 06:11:17 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
Content-Type: text/html; charset=iso-8859-1
[[email protected] logs]# curl -x192.168.137.22:80 -I www.test.com
HTTP/1.1 301 Moved Permanently
Date: Sat, 18 Jul 2015 06:13:31 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
X-Powered-By: PHP/5.3.27
location: forum.php
Cache-Control: max-age=0
Expires: Sat, 18 Jul 2015 06:13:31 GMT
Content-Type: text/html
[[email protected] logs]# curl -x192.168.137.22:80 -I www.test.com/forum.php
HTTP/1.1 200 OK
包含admin的页面请求只允许特定IP
[[email protected] logs]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
<Directory "/data/www">
AllowOverride None
Options None
Order allow,deny
Allow from all
Deny from 127.0.0.1
</Directory>
<filesmatch "(.*)admin(.*)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</filesmatch>
[[email protected] logs]# apachectl -t
[[email protected] logs]# apachectl restart
[[email protected] logs]# curl -x192.168.137.22:80 -I www.test.com/admin.php
HTTP/1.1 403 Forbidden
Date: Sat, 18 Jul 2015 06:21:22 GMT
Server: Apache/2.2.24 (Unix) PHP/5.3.27
Content-Type: text/html; charset=iso-8859-1
apache禁止解析php
[[email protected] 18]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
# SetEnvIfNoCase Referer "^http://.*\.test\.com" local_ref
# SetEnvIfNoCase Referer ".*\.aaa\.com" local_ref
# SetEnvIfNoCase Referer "^$" local_ref
# <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
# Order Allow,Deny
# Allow from env=local_ref
# Deny from all
# </filesmatch>
//将上一步做的防盗链取消了,不然影响后面实验
[[email protected] logs]# ls /data/www/
[[email protected] logs]# ls -l /data/www/data/
发表一个图片的帖子
[[email protected] logs]# cd /data/www/data/attachment/forum/
[[email protected] forum]# ls
201507
[[email protected] forum]# cd 201507/
[[email protected] 201507]# ls
18 index.html
[[email protected] 201507]# cd 18
[[email protected] 18]# ls
143402wcfzfhtlpb9lftpb.jpg 143827hm5f7mjkjwkrojrk.jpg index.html
浏览器输入
http://www.test.com/data/attachment/forum/201507/18/143827hm5f7mjkjwkrojrk.jpg就能访问并解析了:
如果用户上传了病毒,如此访问后,就执行了。现禁止其解析
[[email protected] 18]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
CustomLog "|/usr/local/apache2/bin/rotatelogs -l /usr/local/apache2/logs/test.com-access_%Y%m%d_log 86400" combined env=!image-request
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType image/gif "access plus 1 days"
ExpiresByType image/jpeg "access plus 24 hours"
ExpiresByType image/png "access plus 24 hours"
ExpiresByType text/css "now plus 2 hour"
ExpiresByType application/x-javascript "now plus 2 hours"
ExpiresByType application/javascript "now plus 2 hours"
ExpiresByType application/x-shockwave-flash "now plus 2 hours"
ExpiresDefault "now plus 0 min"
</IfModule>
# SetEnvIfNoCase Referer "^http://.*\.test\.com" local_ref
# SetEnvIfNoCase Referer ".*\.aaa\.com" local_ref
# SetEnvIfNoCase Referer "^$" local_ref
# <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
# Order Allow,Deny
# Allow from env=local_ref
# Deny from all
# </filesmatch>
<Directory /data/www/data>
php_admin_flag engine off
# <filesmatch "(.*)php">
# Order deny,allow
# Deny from all
# Allow from 127.0.0.1
# </filesmatch>
</Directory>
[[email protected] 18]# cd /data/www/data/
[[email protected] data]# vim info.php
<?php
phpinfo();
?>
[[email protected] data]# apachectl -t
Syntax OK
[[email protected] data]# apachectl restart
浏览器访问
禁止解析,但可以下载,为防止文件被用户下载;
[[email protected] data]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
# SetEnvIfNoCase Referer "^http://.*\.test\.com" local_ref
# SetEnvIfNoCase Referer ".*\.aaa\.com" local_ref
# SetEnvIfNoCase Referer "^$" local_ref
# <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
# Order Allow,Deny
# Allow from env=local_ref
# Deny from all
# </filesmatch>
<Directory /data/www/data>
php_admin_flag engine off
<filesmatch "(.*)php">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</filesmatch>
</Directory>
[[email protected] data]# curl -x127.0.0.1:80 www.test.com/data/info.php
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
//解析不出来
IP访问,也不能下载了
Apache禁止指定user_agent
[[email protected] ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^.*cutl.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*chrome* [NC]
RewriteRule .* - [F]
</IfModule>
[[email protected] ~]# apachectl -t
Syntax OK
[[email protected] ~]# apachectl restart
[[email protected] ~]# curl -A ‘ADGE‘ -x192.168.137.22:80 www.test.com/forum.php -I
HTTP/1.1 200 OK
[[email protected] ~]# curl -A ‘abchrome‘ -x192.168.137.22:80 www.test.com/forum.php -I
HTTP/1.1 403 Forbidden
apache通过rewrite限制某个目录
一些目录不允许用户访问
[[email protected] ~]# cd /data/www/
[[email protected] www]# ls
[[email protected] www]# mkdir tmp
[[email protected] www]# cd tmp/
[[email protected] tmp]# ls
[[email protected] tmp]# vim 12.txt
abc
客户端访问tmp/12.txt
现禁止其访问该目录
[[email protected] tmp]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^.*/tmp/.* [NC]
RewriteRule .* - [F]
</IfModule>
[[email protected] tmp]# apachectl restart
该不目录不能被访问
php.in配置文件详解
[[email protected] tmp]# ls /usr/local/php/etc/php.ini
[[email protected] tmp]# /usr/local/php/bin/php -i |head
Loaded Configuration File => /usr/local/php/etc/php.ini
disable_functions =
display_errors = on
[[email protected] tmp]# apachectl graceful
[[email protected] tmp]# vim /data/www/forum.php
aaaaaa //随意加入一行,使网站文件出错
客户端访问后,报错出现在网页上,此会暴露网站漏洞之类、
[[email protected] tmp]# vim /usr/local/php/etc/php.ini
display_errors = off
[[email protected] tmp]# apachectl graceful
现网页有错误后,不显示在网页上了。无报错。
[[email protected] tmp]# curl -x127.0.0.1:80 www.test.com/forum.php -I
HTTP/1.1 403 Forbidden
[[email protected] tmp]# vim /usr/local/php/etc/php.ini
log_errors = On
error_log=/usr/local/php/logs/php_errors.log
[[email protected] tmp]# mkdir /usr/local/php/logs
[[email protected] tmp]# chmod 777 !$
chmod 777 /usr/local/php/logs
[[email protected] tmp]# !vim
vim /usr/local/php/etc/php.ini
error_reporting = E_ALL & ~E_NOTICE
[[email protected] tmp]# apachectl graceful
再次访问:网页无报错,但有报错日志产生:
[[email protected] tmp]# ls /usr/local/php/logs/
php_errors.log
[[email protected] tmp]# cat /usr/local/php/logs/php_errors.log
[19-Jul-2015 21:45:05 Asia/Chongqing] PHP Parse error: syntax error, unexpected T_STRING in /data/www/forum.php on line 11
[[email protected] tmp]# vim /data/www/forum.php
删除aaaaaa //即改回原文件,删除自己添加的错误配置
访问即正常:
[[email protected] tmp]# vim /usr/local/php/etc/php.ini
open_basedir =/data/www:/tmp
//将访问限定在该目录下,(网站程序所在目录)---------安全选项
[[email protected] tmp]# apachectl graceful
[[email protected] tmp]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
# ServerAdmin [email protected]
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
ServerAlias www.bbb.com
php_admin_value open_basedir "/data/www:/tmp/"
//可在虚拟主机配置文件中,一个网站限制一个目录
[[email protected] tmp]# vim /usr/local/php/etc/php.ini
#open_basedir =/data/www:/tmp //注销php.ini里的限制
[[email protected] tmp]# apachectl graceful
访问正常:
[[email protected] tmp]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
php_admin_value open_basedir "/data/www2/:/tmp/"
//将访问目录改成/data/www2/,访问出错,因为该网站目录在/data/www下。
[[email protected] tmp]# tail /usr/local/php/logs/php_errors.log
//可查看报错日志
[[email protected] tmp]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
php_admin_value open_basedir "/data/www/:/tmp/" //修改回
[[email protected] tmp]# apachectl graceful