Linux學習

11.28 限定某個目錄禁止解析php

訪問控制 - 禁止PHP解析

<Directory /data/wwwroot/111.com/upload>
  php_admin_flag engine off
</Directory>

curl 測試時直接返回php源代碼，並未解析

操作過程

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com

ServerAlias www.exampl.com 2111.com.cn
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI ".*.css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[root@aming-01 ~]# mkdir /data/wwwroot/111.com/upload
[root@aming-01 ~]# cd /data/wwwroot/111.com/
[root@aming-01 111.com]# vim 123.php
[root@aming-01 111.com]# cp 123.php upload/

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:13:20 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:13:20 GMT
Content-Type: text/html; charset=UTF-8

[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:14:00 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

11.29 限制user_agent

訪問控制 - user_agent

user_agent 可以理解為瀏覽器標識

核心配置內容

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC]
    RewriteRule .* - [F]
</IfModule>

curl -A "123123" 指定 user_agent

操作過程

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .curl. [NC,OR]
RewriteCond %{HTTP_USER_AGENT} .baidu.com. [NC]
RewriteRule . - [F]
</IfModule>
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI "..css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[root@aming-01 111.com]# vim /data/wwwroot/111.com/123.php

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:41:05 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:41:05 GMT
Content-Type: text/html; charset=UTF-8

[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@aming-01 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[root@aming-01 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:42:54 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

[root@aming-01 111.com]# curl -A "aminglinux aminglinux"  -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:43:25 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:43:25 GMT
Content-Type: text/html; charset=UTF-8

11.30-31 PHP相關配置

查看PHP配置文件位置

/usr/local/php/bin/php -i|grep -i "loaded configuration file" //可能會找不到

/usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

設置以下幾項可以保存錯誤日誌：
display_errors = Off    //設置為 Off, 為 On 時，瀏覽器訪問phpinfo時會顯示錯誤信息，不建議設置為on
log_errors = On     //錯誤日誌開啟
error_log = /tmp/php_errors.log    //設置錯誤日誌路徑
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT    //設置錯誤日誌級別

安全相關:
vim /usr/local/php/etc/php.ini
    open_basedir = /data/wwwroot/111.com:/tmp/

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf    //能夠針對各個虛擬主機設置open_basedir
    php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"

PHP信息內容
    [root@aming-01 111.com]# vim index.php
    <?php
    phpinfo();
    設置完可通過瀏覽器訪問111.com/index.php 查看phpinfo

操作過程

[root@aming-01 ~]# /usr/local/php/bin/php -i|grep -i "loaded configuration file"
PHP Warning:  Unknown: It is not safe to rely on the system‘s timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone ‘UTC‘ for now, but please set date.timezone to select your timezone. in Unknown on line 0
Loaded Configuration File => /usr/local/php/etc/php.ini

[root@aming-01 ~]# vim /usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai
display_errors = On
log_errors = On
error_log = /tmp/php_errors.log
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
open_basedir = /data/wwwroot/111.com:/tmp/

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

[root@aming-01 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/data/wwwroot/abc.com"
ServerName abc.com
ServerAlias www.abc.com www.123.com
php_admin_value open_basedir "/data/wwwroot/abc.com:/tmp/"
ErrorLog "logs/abc.com-error_log"
CustomLog "logs/abc.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"

2018-04-18 Linux學習