[toc]
11.25 配置防盗链
1.防盗链和referer概念
防盗链，通俗讲就是不让别人盗用你网站上的资源，这个资源指的是图片、视频、歌曲、文档等，在这之前需要理解一下referer的概念，如果你通过A网站的一个页面http://a.com/a.html里面的链接去访问B网站的一个页面http://b.com/b.html,那么这个B网站页面的referer就是http://a.com/a.html。也就是说，一个referer就是一个网址。
2.编辑虚拟主机配置文件httpd-vhosts
[[email protected] ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/wwwroot/xavi.com"
ServerName xavi.com
ServerAlias www.example.com
<Directory /data/wwwroot/xavi.com>
//把xavi.com设为白名单，对应规则Allow
SetEnvIfNoCase Referer "http://xavi.com" local_ref
定义允许访问链接的referer
SetEnvIfNoCase Referer "http://aaa.com" local_ref
SetEnvIfNoCase Referer "^$"
//把空referer设为白名单，对应规则Allow；其中^$为空referer，即直接访问的地址
当直接再浏览器里输入图片地址去访问它时，它的referer就为空。
local_ref
<filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
// 对txt、doc等格式的文件执行访问控制
访问这样类型的文件时就会被限制.
Order Allow,Deny
//白名单地址allow，其他deny
执行顺序依次为allow、deny，反过来将导致都被禁止访问
Allow from env=local_ref // 白名单为local_ref对应的地址
</filesmatch>3.开启httpd服务，-t，graceful重新加载
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful
httpd not running, trying to start
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl start
httpd (pid 3773) already running
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful4. 测试
创建测试需要条件：
[[email protected] ~]# touch /data/wwwroot/xavi.com/xavi.jpg
[[email protected] ~]# touch /data/wwwroot/xavi.com/xavi.txt
[[email protected] ~]# curl -x127.0.0.1:80 -I xavi.com/xavi.jpg
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:11:57 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:11:27 GMT
ETag: "0-566e7406be177"
Accept-Ranges: bytes
Content-Type: image/jpeg
[[email protected] ~]# curl -x127.0.0.1:80 -I xavi.com/xavi.txt
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:12:13 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:11:34 GMT
ETag: "0-566e740d104e7"
Accept-Ranges: bytes
Content-Type: text/plain这里使用-e来定义referer，且这个referer一定要以http：//开头.
[[email protected] ~]# curl -x192.168.72.130:80 -I -e "http://xavi.com/xavi.txt" http://xavi.com/xavi.jpg
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:13:17 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:11:27 GMT
ETag: "0-566e7406be177"
Accept-Ranges: bytes
Content-Type: image/jpeg使用非允许的referre会返回403状态码
[[email protected] ~]# curl -x192.168.72.130:80 -I -e "http://xavix.com/xavi.txt" http://xavi.com/xavi.jpg
HTTP/1.1 403 Forbidden
Date: Thu, 08 Mar 2018 14:20:18 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-111.26 访问控制Directory
对于一些比较重要的网站内容，除了可以使用用户认证限制访问之外，还可以通过其他一些方法做到限制，比如限制IP，也可以限制user_agent。限制IP指的是限制访问网址的来源IP，而限制user_agent,通常用来限制恶意或者不正常的请求.
1. 限制IP访问，编辑配置文件
<Directory /data/wwwroot/xavi.com/admin/>
Order deny,allow
//设定Deny和Allow的先后顺序
Deny from all
Allow from 127.0.0.1
//只允许来源IP为127.0.0.1的访问
</Directory>
2.验证过程
匹配127.0.0.1IP访问
[[email protected] ~]# mkdir /data/wwwroot/xavi.com/admin/
[[email protected] ~]# echo "admin" > /data/wwwroot/xavi.com/admin/index.html
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful
[[email protected] ~]# curl -x127.0.0.1:80 -I xavi.com/admin/index.html
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:49:45 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:45:59 GMT
ETag: "6-566e7bbe73f30"用本机ip访问，被阻止访问
[[email protected] ~]# curl -x192.168.72.130:80 -I xavi.com/admin/index.html
HTTP/1.1 403 Forbidden
Date: Thu, 08 Mar 2018 14:52:21 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1查看错误日志cat /usr/local/apache2.4/logs/xavi-access_log
[[email protected] ~]# cat /usr/local/apache2.4/logs/xavi-access_log
127.0.0.1 - - [06/Mar/2018:22:48:23 +0800] "GET HTTP://xavi.com/ HTTP/1.1" 401 381
127.0.0.1 - - [06/Mar/2018:22:50:18 +0800] "HEAD HTTP://xavi.com/ HTTP/1.1" 401 -
192.168.72.1 - - [06/Mar/2018:22:54:46 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - xavi [06/Mar/2018:22:54:56 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - xavi [06/Mar/2018:22:55:48 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - xavi [06/Mar/2018:22:55:49 +0800] "GET /favicon.ico HTTP/1.1" 404 209
192.168.72.1 - xavi [06/Mar/2018:22:57:00 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - xavi [06/Mar/2018:22:58:37 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - - [06/Mar/2018:22:58:52 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - - [06/Mar/2018:22:59:22 +0800] "GET /favicon.ico HTTP/1.1" 401 381
127.0.0.1 - xavi [06/Mar/2018:23:03:45 +0800] "GET HTTP://xavi.com/ HTTP/1.1" 401 38111.27 访问控制FilesMatch
1.编辑配置filesmatch
[[email protected] ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<Directory /data/wwwroot/xavi.com/admin/>
<Filesmatch "admin.php(.*)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Filesmatch>
</Directory>测试
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[[email protected] ~]# /usr/local/apache2.4/bin/apachectl graceful
[[email protected] ~]# curl -x192.168.72.130:80 http://xavix.com/admin/alsdedadsdk -I
HTTP/1.1 404 Not Found
Date: Thu, 08 Mar 2018 15:08:06 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1[[email protected] ~]# vim /data/wwwroot/xavi.com/admin/index.php
[[email protected] ~]# curl -x127.0.0.1:80 ‘http://xavi.com/admin/index.php?alsdedadsd‘ -I
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 15:19:19 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Content-Type: text/html; charset=UTF-8
[[email protected] ~]# curl -x127.0.0.1:80 ‘http://xavi.com/admin/.php?alsdedadsd‘ -I
HTTP/1.1 404 Not Found
Date: Thu, 08 Mar 2018 15:19:57 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1测试不出来403结果？？
原文地址：http://blog.51cto.com/12995218/2084492
时间： 2024-10-13 14:32:22