限定某个目录禁止解析php
[root@wsl-001 ~]# /usr/local/apache2.4/bin/apachectl graceful
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch "(.*)\.php(.*)">
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
[root@wsl-001 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@wsl-001 ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@wsl-001 ~]# cd /data/wwwroot/111.com/
[root@wsl-001 111.com]# mkdir upload
[root@wsl-001 111.com]# ls
admin admin.php index.php test.jpg upload
[root@wsl-001 111.com]# cp index.php upload/
[root@wsl-001 111.com]# curl -x 127.0.0.1:80 'http://111.com/upload/index.php' -I
HTTP/1.1 403 Forbidden
Date: Wed, 18 Apr 2018 13:03:23 GMT
Server: Apache/2.4.33 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1
限制user_agent
限制user_agent
[root@wsl-001 111.com]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC]
RewriteRule .* - [F] #直接禁止403
</IfModule>
[root@wsl-001 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@wsl-001 ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@wsl-001 111.com]# curl -x 127.0.0.1:80 'http://111.com/index.php' -I
HTTP/1.1 403 Forbidden
Date: Wed, 18 Apr 2018 13:17:30 GMT
Server: Apache/2.4.33 (Unix) PHP/5.6.30
Content-Type: text/html; charset=iso-8859-1
[root@wsl-001 111.com]# curl -A "123" -x 127.0.0.1:80 'http://111.com/index.php' -I
HTTP/1.1 200 OK
Date: Wed, 18 Apr 2018 13:17:50 GMT
Server: Apache/2.4.33 (Unix) PHP/5.6.30
X-Powered-By: PHP/5.6.30
Cache-Control: max-age=0
Expires: Wed, 18 Apr 2018 13:17:50 GMT
Content-Type: text/html; charset=UTF-8
[root@wsl-001 111.com]# tail /usr/local/apache2.4/logs/111.com-access_20180418.log
172.16.79.140 - - [18/Apr/2018:16:35:51 +0800] "HEAD http://111.com/admin.php?dasfa HTTP/1.1" 200 - "-" "curl/7.29.0"
172.16.79.140 - - [18/Apr/2018:16:37:12 +0800] "HEAD http://111.com/admin/admin.php?dasfa HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [18/Apr/2018:16:37:25 +0800] "HEAD http://111.com/admin/admin.php?dasfa HTTP/1.1" 404 - "-" "curl/7.29.0"
127.0.0.1 - - [18/Apr/2018:21:03:13 +0800] "HEAD http://111.com/upload/index.php HTTP/1.1" 200 - "-" "curl/7.29.0"
127.0.0.1 - - [18/Apr/2018:21:03:23 +0800] "HEAD http://111.com/upload/index.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [18/Apr/2018:21:17:30 +0800] "HEAD http://111.com/index.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [18/Apr/2018:21:17:50 +0800] "HEAD http://111.com/index.php HTTP/1.1" 200 - "-" "123"
PHP相关配置
PHP相关配置
通过phpinfo()可以查看php的配置文件所在位置
如果没有需要在源码包中复制到下图位置
php.ini配置文件所在
[root@wsl-001 111.com]# vim /usr/local/php/etc/php.ini
#禁止函数
disable_functions =eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo
#定义时区
date.timezone = Asia/Shanghai
#页面打印错误
display_errors = Off
#错误日志记录
log_errors = On
#错误日志记录位置
error_log = /tmp/php_errors.log
#错误记录级别，级别可更改，视情况而定
error_reporting = E_ALL
#限定所有php的文件目录权限所在位置
open_basedir = /data/wwwroot/
[root@wsl-001 111.com]# /usr/local/apache2.4/bin/apachectl graceful
[root@wsl-001 111.com]# cat /tmp/php_errors.log
[18-Apr-2018 22:10:10 Asia/Shanghai] PHP Warning: phpinfo() has been disabled for security reasons in /data/wwwroot/111.com/index.php on line 2
[root@wsl-001 111.com]# !curl
curl -A "123" -x 127.0.0.1:80 'http://111.com/index.php' -I
HTTP/1.1 200 OK
Date: Wed, 18 Apr 2018 14:11:01 GMT
Server: Apache/2.4.33 (Unix) PHP/5.6.30
X-Powered-By: PHP/5.6.30
Cache-Control: max-age=0
Expires: Wed, 18 Apr 2018 14:11:01 GMT
Content-Type: text/html; charset=UTF-8
[root@wsl-001 111.com]# cat /tmp/php_errors.log
[18-Apr-2018 22:10:10 Asia/Shanghai] PHP Warning: phpinfo() has been disabled for security reasons in /data/wwwroot/111.com/index.php on line 2
[18-Apr-2018 22:11:01 Asia/Shanghai] PHP Warning: phpinfo() has been disabled for security reasons in /data/wwwroot/111.com/index.php on line 2
[root@wsl-001 111.com]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
#在httpd-vhosts.conf 中针对站点做目录权限限制
php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"
[root@wsl-001 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@wsl-001 111.com]# /usr/local/apache2.4/bin/apachectl graceful
扩展
apache开启压缩 http://ask.apelearn.com/question/5528
apache2.2到2.4配置文件变更 http://ask.apelearn.com/question/7292
apache options参数 http://ask.apelearn.com/question/1051
apache禁止trace或track防止xss http://ask.apelearn.com/question/1045
apache 配置https 支持ssl http://ask.apelearn.com/question/1029
