防止服務器的圖片和其他資源被非本機的站點引用，被其他網站引用後會導致流量圖片的用戶的數量暴增，
而帶寬流量增加、增加站點的成本；

編輯虛擬配置文件

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

增加代碼

  <Directory /data/wwwroot/szl.com>;
        SetEnvIfNoCase Referer "szl.com"; local_ref                //設置白名單szl.com
        SetEnvIfNoCase Referer "www.szl.com"; local_ref        //設置白名單www.szl.com
        SetEnvIfNoCase Referer "^$" local_ref                        //設置白名單網址為空時，復制地址直接訪問
        <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif|png)">                //設置禁止引用的文件後綴
            Order Allow,Deny                                                    //拒絕所有人引用
            Allow from env=local_ref                                        //只允許白名單的容許
        </filesmatch>
    </Directory>
 

代碼預覽

<VirtualHost *:80>
    DocumentRoot "/data/wwwroot/szl.com"
    ServerName szl.com
    ServerAlias www.example.com www.szl.com
   <Directory /data/wwwroot/szl.com>
        SetEnvIfNoCase Referer "http://www.szl.com"; local_ref
        SetEnvIfNoCase Referer "http://szl.com"; local_ref
        SetEnvIfNoCase Referer "^$" local_ref
        <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif|png)">
            Order Allow,Deny
            Allow from env=local_ref
        </filesmatch>
    </Directory>
    ErrorLog "logs/szl.com-error_log"
    CustomLog "logs/szl.com-access_log" combined
</VirtualHost>
 

配置生效

/usr/local/apache2.4/bin/apachectl -t
/usr/local/apache2.4/bin/apachectl graceful

設置訪問控制Directory（針對目錄）

設置某目錄只有指定的ip才能訪問

創建訪問文件目錄

mkdir /data/wwwroot/szl.com/admin/
touch /data/wwwroot/szl.com/admin/admin.php

編輯虛擬配置文件

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

增加代碼

<Directory /data/wwwroot/szl.com/admin/>;                //設置訪問控制的路徑為admin目錄
        Order deny,allow                                                    //定義規則，先拒絕，後允許（先允許後拒絕，會使所有人不能訪問）
        Deny from all                                                          //拒絕所有人
        Allow from 127.0.0.1                                                //容許ip127.0.0.1 能夠訪問admin目錄
    </Directory>
 

代碼預覽

<VirtualHost *:80>
    DocumentRoot "/data/wwwroot/szl.com"
    ServerName szl.com
    ServerAlias www.example.com www.szl.com
   <Directory /data/wwwroot/szl.com/admin/>;
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
    </Directory>
    ErrorLog "logs/szl.com-error_log"
    CustomLog "logs/szl.com-access_log" combined
</VirtualHost>

配置生效

/usr/local/apache2.4/bin/apachectl -t
/usr/local/apache2.4/bin/apachectl graceful

測試

使用127.0.0.1訪問，成功代碼200

curl -x127.0.0.1:80 szl.com/admin/admin.php -I

HTTP/1.1 200 OK
Date: Tue, 06 Mar 2018 11:47:56 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Type: text/html; charset=UTF-8

使用192.168.188.2訪問，禁止訪問403

curl -x192.168.188.2:80 szl.com/admin/admin.php -I

HTTP/1.1 403 Forbidden
Date: Tue, 06 Mar 2018 11:48:47 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1

訪問控制FilesMatch（針對單鏈接）

編輯虛擬配置文件

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

增加代碼

<Directory /data/wwwroot/szl.com>
    <FilesMatch  "admin.php(.*)">            //設置單鏈接文件為admin.php後綴有或無
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
    </FilesMatch>
</Directory>

代碼預覽

<VirtualHost *:80>
    DocumentRoot "/data/wwwroot/szl.com"
    ServerName szl.com
    ServerAlias www.example.comwww.szl.com

<Directory /data/wwwroot/szl.com>
     <FilesMatch  "admin.php(.*)">
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
     </FilesMatch>
   </Directory>

    ErrorLog "logs/szl.com-error_log"
    CustomLog "logs/szl.com-access_log" combined
</VirtualHost>

配置生效

/usr/local/apache2.4/bin/apachectl -t
/usr/local/apache2.4/bin/apachectl graceful

測試

使用127.0.0.1訪問，成功，提示沒有這個文件404

curl -x127.0.0.1:80 ‘szl.com/admin.php?dfsldfjkso‘ -I

HTTP/1.1 404 Not Found
Date: Tue, 06 Mar 2018 12:09:06 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1

使用192.168.188.2訪問，拒絕訪問、403

curl -x192.168.188.2:80 ‘szl.com/admin/admin.php?dfsldfjkso‘ -I

HTTP/1.1 403 Forbidden
Date: Tue, 06 Mar 2018 12:07:59 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1

lamp-配置防盜鏈、訪問控制Directory（針對目錄）、訪問控制（針對單文件）