Apache连接保持
Apache连接保持相关参数
-
KeepAlive
- 是否打开连接保持，OFF关闭，ON打开
- KeepAlive‘ Timeout
- 一次连接多次请求之间的最大间隔时间，两次请求超过该时间连接断开
- MaxKeepAliveRequests
- 一次连接能够 传输的最大请求数量
Apache访问控制
- 作用
- 控制对网站资源的访问
- 为特定的网站目录添加访问授权
- 常用访问控制方式
- 客户机地址限制
- 用户授权限制
基于客户端地址的访问控制
- 使用
Require配置项实现访问控制，按先后顺序限制 - 可用于
<Location>、<Directory>、<Files>、 <Limit>配置段中 Require配置项的常见语法
Require all granted
Require all denied
Require local
Require [not] host <主机名或域名列表>
//使用not禁止访问时要将其置于<RequireAll> </RequireAll>容器中并在容器中指定相应的限制策略
Require [not] ip <IP地址或网段列表>配置实例
在Linux系统中安装DNS、HTTP服务，并设置DNS服务。
[[email protected] ~]# yum install bind httpd -y //安装服务
已加载插件：fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirrors.aliyun.com
* extras: mirrors.aliyun.com
...//省略部分内容...
已安装:
bind.x86_64 32:9.11.4-9.P2.el7 httpd.x86_64 0:2.4.6-90.el7.centos
...//省略部分内容...
完毕！
[[email protected] conf]# vim /etc/named.conf //编辑DNS配置文件
...//省略部分内容...
options {
listen-on port 53 { any; }; //更改IP地址为any
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; }; //更改监听主机为any
...//省略部分内容...
:wq
[[email protected] conf]# vim /etc/named.rfc1912.zones //编辑区域配置文件
...//省略部分内容...
zone "kgc.com" IN { //更改域名
type master;
file "kgc.com.zone"; //更改区域数据文件名
allow-update { none; };
};
...//省略部分内容...
:wq
[[email protected] conf]# cd /var/named/ //进入区域数据文件目录
[[email protected] named]# ls //查看目录
data dynamic named.ca named.empty named.localhost named.loopback slaves
[[email protected] named]# cp -p named.localhost kgc.com.zone //复制区域数据文件
[[email protected] named]# vim kgc.com.zone //进入编辑文件
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
www IN A 192.168.144.133 //设置域名解析
:wq //保存退出开启两台win 10客户机，并查看客户机IP地址
在Linux系统中进入http服务站点目录，编辑主页内容，并开启DNS、HTTP服务，关闭防火墙及增强性安全功能
[[email protected] named]# cd /var/www/html/ //进入http服务站点目录
[[email protected] html]# vim index.html //编辑默认主页
<h1>this is kgc web</h1> //编辑内容
:wq
[[email protected] html]# ls //查看
index.html
[[email protected] html]# cat index.html //查看网页内容
<h1>this is kgc web</h1>
[[email protected] html]# systemctl start httpd.service //启动http服务
[[email protected] html]# systemctl start named //启动DNS服务
[[email protected] html]# systemctl stop firewalld.service //关闭防火墙
[[email protected] html]# setenforce 0 //关闭增强性安全功能使用两台win 10客户机分别访问往网站信息，看服务是否正常提供
在Linux系统中配置HTTP服务配置文件，设置客户机访问权限
[[email protected] html]# vim /etc/httpd/conf/httpd.conf
//编辑主配置文件内容（现网中不建议直接修改主配置文件内容，可以重新添加子配置文件进行限制）
...//省略部分内容...
<Directory "/var/www/html">
#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn‘t give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None
#
# Controls who can get stuff from this server.
#
<RequireALL> //在此容器下添加子容器
Require not ip 192.168.144.128
//添加限制访问主机的IP地址（如若限制网段直接添加192.168.144.0/24即可，注意限制网段需填写子网掩码）
Require all granted
</RequireALL>
</Directory>
...//省略部分内容...
:wq
[[email protected] html]# systemctl restart httpd.service 查看限制的第一台win 10客户端是否还可以访问网站
用户授权限制
配置实例
创建用户认证数据库
[[email protected] html]# htpasswd -c /etc/httpd/conf/pwd test01
//创建用户认证数据库（-c为创建，如果已经存在数据认证文件可以不用-c，直接就可以使用命令添加进认证文件中）
New password: //输入设置的密码
Re-type new password: //再次输入密码
Adding password for user test01 //成功创建
[[email protected] html]# cd /etc/httpd/conf //进入目录
[[email protected] conf]# ls //查看
httpd.conf magic pwd //成功创建文件
[[email protected] conf]# cat pwd //查看文件内容
test01:$apr1$zDZ/54yz$rUCXaWixaltHE6ZBvjv0h/ //创建的用户及密码添加用户授权配置
[[email protected] conf]# vim httpd.conf
...//省略部分内容...
<Directory "/var/www/html">
#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn‘t give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None
#
# Controls who can get stuff from this server.
#
AuthName "DocumentRoot" //更改上面的访问控制条目，此条目声明验证信息
AuthType Basic //验证类型为基本验证
AuthUserFile /etc/httpd/conf/pwd //验证文件路径
Require valid-user //设置为授权用户验证
</Directory>
...//省略部分内容...
:wq //保存退出
[[email protected] conf]# systemctl restart httpd.service //重新启动服务在客户机中验证配置
原文地址：https://blog.51cto.com/14473285/2447906
时间： 2024-10-30 01:21:26