7.配置防盜鏈,訪問控制
阿新 • • 發佈：2018-03-09
配置防盜鏈 訪問控制 [toc]
11.25 配置防盜鏈
1.防盜鏈和referer概念
防盜鏈，通俗講就是不讓別人盜用你網站上的資源，這個資源指的是圖片、視頻、歌曲、文檔等，在這之前需要理解一下referer的概念，如果你通過A網站的一個頁面http://a.com/a.html裏面的鏈接去訪問B網站的一個頁面http://b.com/b.html,那麽這個B網站頁面的referer就是http://a.com/a.html。也就是說，一個referer就是一個網址。
2.編輯虛擬主機配置文件httpd-vhosts
[root@xavi ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf <VirtualHost *:80> DocumentRoot "/data/wwwroot/xavi.com" ServerName xavi.com ServerAlias www.example.com <Directory /data/wwwroot/xavi.com> //把xavi.com設為白名單，對應規則Allow SetEnvIfNoCase Referer "http://xavi.com" local_ref 定義允許訪問鏈接的referer SetEnvIfNoCase Referer "http://aaa.com" local_ref SetEnvIfNoCase Referer "^$" //把空referer設為白名單，對應規則Allow；其中^$為空referer，即直接訪問的地址 當直接再瀏覽器裏輸入圖片地址去訪問它時，它的referer就為空。 local_ref <filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)"> // 對txt、doc等格式的文件執行訪問控制 訪問這樣類型的文件時就會被限制. Order Allow,Deny //白名單地址allow，其他deny 執行順序依次為allow、deny，反過來將導致都被禁止訪問 Allow from env=local_ref // 白名單為local_ref對應的地址 </filesmatch>
3.開啟httpd服務，-t，graceful重新加載
[root@xavi ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@xavi ~]# /usr/local/apache2.4/bin/apachectl graceful httpd not running, trying to start [root@xavi ~]# /usr/local/apache2.4/bin/apachectl start httpd (pid 3773) already running [root@xavi ~]# /usr/local/apache2.4/bin/apachectl graceful
4. 測試
創建測試需要條件：
[root@xavi ~]# touch /data/wwwroot/xavi.com/xavi.jpg [root@xavi ~]# touch /data/wwwroot/xavi.com/xavi.txt [root@xavi ~]# curl -x127.0.0.1:80 -I xavi.com/xavi.jpg HTTP/1.1 200 OK Date: Thu, 08 Mar 2018 14:11:57 GMT Server: Apache/2.4.29 (Unix) PHP/7.1.6 Last-Modified: Thu, 08 Mar 2018 14:11:27 GMT ETag: "0-566e7406be177" Accept-Ranges: bytes Content-Type: image/jpeg [root@xavi ~]# curl -x127.0.0.1:80 -I xavi.com/xavi.txt HTTP/1.1 200 OK Date: Thu, 08 Mar 2018 14:12:13 GMT Server: Apache/2.4.29 (Unix) PHP/7.1.6 Last-Modified: Thu, 08 Mar 2018 14:11:34 GMT ETag: "0-566e740d104e7" Accept-Ranges: bytes Content-Type: text/plain
這裏使用-e來定義referer，且這個referer一定要以http：//開頭.
[root@xavi ~]# curl -x192.168.72.130:80 -I -e "http://xavi.com/xavi.txt" http://xavi.com/xavi.jpg
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:13:17 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:11:27 GMT
ETag: "0-566e7406be177"
Accept-Ranges: bytes
Content-Type: image/jpeg使用非允許的referre會返回403狀態碼
[root@xavi ~]# curl -x192.168.72.130:80 -I -e "http://xavix.com/xavi.txt" http://xavi.com/xavi.jpg
HTTP/1.1 403 Forbidden
Date: Thu, 08 Mar 2018 14:20:18 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-111.26 訪問控制Directory
對於一些比較重要的網站內容，除了可以使用用戶認證限制訪問之外，還可以通過其他一些方法做到限制，比如限制IP，也可以限制user_agent。限制IP指的是限制訪問網址的來源IP，而限制user_agent,通常用來限制惡意或者不正常的請求.
1. 限制IP訪問，編輯配置文件
<Directory /data/wwwroot/xavi.com/admin/>
Order deny,allow
//設定Deny和Allow的先後順序
Deny from all
Allow from 127.0.0.1
//只允許來源IP為127.0.0.1的訪問
</Directory>
2.驗證過程
匹配127.0.0.1IP訪問
[root@xavi ~]# mkdir /data/wwwroot/xavi.com/admin/
[root@xavi ~]# echo "admin" > /data/wwwroot/xavi.com/admin/index.html
[root@xavi ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@xavi ~]# curl -x127.0.0.1:80 -I xavi.com/admin/index.html
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 14:49:45 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Last-Modified: Thu, 08 Mar 2018 14:45:59 GMT
ETag: "6-566e7bbe73f30"用本機ip訪問，被阻止訪問
[root@xavi ~]# curl -x192.168.72.130:80 -I xavi.com/admin/index.html
HTTP/1.1 403 Forbidden
Date: Thu, 08 Mar 2018 14:52:21 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1查看錯誤日誌cat /usr/local/apache2.4/logs/xavi-access_log
[root@xavi ~]# cat /usr/local/apache2.4/logs/xavi-access_log
127.0.0.1 - - [06/Mar/2018:22:48:23 +0800] "GET HTTP://xavi.com/ HTTP/1.1" 401 381
127.0.0.1 - - [06/Mar/2018:22:50:18 +0800] "HEAD HTTP://xavi.com/ HTTP/1.1" 401 -
192.168.72.1 - - [06/Mar/2018:22:54:46 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - xavi [06/Mar/2018:22:54:56 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - xavi [06/Mar/2018:22:55:48 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - xavi [06/Mar/2018:22:55:49 +0800] "GET /favicon.ico HTTP/1.1" 404 209
192.168.72.1 - xavi [06/Mar/2018:22:57:00 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - xavi [06/Mar/2018:22:58:37 +0800] "GET / HTTP/1.1" 200 8
192.168.72.1 - - [06/Mar/2018:22:58:52 +0800] "GET / HTTP/1.1" 401 381
192.168.72.1 - - [06/Mar/2018:22:59:22 +0800] "GET /favicon.ico HTTP/1.1" 401 381
127.0.0.1 - xavi [06/Mar/2018:23:03:45 +0800] "GET HTTP://xavi.com/ HTTP/1.1" 401 38111.27 訪問控制FilesMatch
1.編輯配置filesmatch
[root@xavi ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<Directory /data/wwwroot/xavi.com/admin/>
<Filesmatch "admin.php(.*)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Filesmatch>
</Directory>測試
[root@xavi ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@xavi ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@xavi ~]# curl -x192.168.72.130:80 http://xavix.com/admin/alsdedadsdk -I
HTTP/1.1 404 Not Found
Date: Thu, 08 Mar 2018 15:08:06 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1[root@xavi ~]# vim /data/wwwroot/xavi.com/admin/index.php
[root@xavi ~]# curl -x127.0.0.1:80 ‘http://xavi.com/admin/index.php?alsdedadsd‘ -I
HTTP/1.1 200 OK
Date: Thu, 08 Mar 2018 15:19:19 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Content-Type: text/html; charset=UTF-8
[root@xavi ~]# curl -x127.0.0.1:80 ‘http://xavi.com/admin/.php?alsdedadsd‘ -I
HTTP/1.1 404 Not Found
Date: Thu, 08 Mar 2018 15:19:57 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1測試不出來403結果？？
7.配置防盜鏈,訪問控制