Apache优化之防盗链和隐藏版本

最新推荐文章于 2024-05-30 10:07:37 发布

double_happy111

最新推荐文章于 2024-05-30 10:07:37 发布

阅读量310

点赞数 1

分类专栏：云计算架构文章标签： Apache优化防盗链隐藏Apache版本

本文链接：https://blog.csdn.net/double_happy111/article/details/103595216

版权

云计算架构专栏收录该内容

40 篇文章 1 订阅

订阅专栏

Apache优化之防盗链和隐藏版本

前言

在线网当中，有些人为了解决没有图片的问题就去找别人的图片，建立一个盗链，自己的网页就有图片了，然后，别人通过访问你的网站的时候，访问会流经你盗链所链接的服务器，服务器压力逐渐增大，就会给服务器这家公司造成一定的影响。所以，防盗链就应运而生。在别人访问服务器时候，如果不把版本信息隐藏起来，黑客就会知道Apache版本的漏洞，从而攻击网站，造成不可估量的损失。所以，从安全角度来看，我们在搭建Apache服务器的时候就应该隐藏Apache的版本。

Apache防盗链

实验环境

centos7虚拟机两台

win10虚拟机一台

实验步骤

1.先安装bind域名解析服务，并进行配置

[root@localhost ~]# yum -y install bind
[root@localhost ~]# vim /etc/named.conf
        listen-on port 53 { any; };
		allow-query     { any; };
[root@localhost ~]# vim /etc/named.rfc1912.zones
zone "hello.com" IN {
        type master;
        file "hello.com.zone";
        allow-update { none; };
};
[root@localhost ~]# cd /var/named/
[root@localhost named]# ls
data  dynamic  named.ca  named.empty  named.localhost  named.loopback  slaves
[root@localhost named]# cp -p named.localhost hello.com.zone
[root@localhost named]# vim hello.com.zone
$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
www IN  A       192.168.73.167

2.重启域名解析服务，并关闭防火墙

[root@localhost named]# systemctl restart named
[root@localhost named]# systemctl stop firewalld
[root@localhost named]# setenforce 0

3.开始手工编译Apache

[root@localhost named]# cd
[root@localhost ~]# ls
anaconda-ks.cfg   apr-util-1.6.0.tar.gz  initial-setup-ks.cfg  模板  图片  下载  桌面
apr-1.6.2.tar.gz  httpd-2.4.29.tar.bz2   公共                  视频  文档  音乐
[root@localhost ~]# tar -zxvf apr-1.6.2.tar.gz -C /opt/
[root@localhost ~]# tar -zxvf apr-util-1.6.0.tar.gz -C /opt/
[root@localhost ~]# tar -jxvf httpd-2.4.29.tar.bz2 -C /opt/
[root@localhost ~]# cd /opt
[root@localhost opt]# ls
apr-1.6.2  apr-util-1.6.0  httpd-2.4.29  rh
[root@localhost opt]# mv apr-1.6.2/ httpd-2.4.29/srclib/apr
[root@localhost opt]# mv apr-util-1.6.0/ httpd-2.4.29/srclib/apr-util
[root@localhost opt]# cd httpd-2.4.29/
[root@localhost httpd-2.4.29]# ls
ABOUT_APACHE     BuildBin.dsp    emacs-style     LAYOUT        NOTICE            srclib
acinclude.m4     buildconf       httpd.dep       libhttpd.dep  NWGNUmakefile     support
Apache-apr2.dsw  CHANGES         httpd.dsp       libhttpd.dsp  os                test
Apache.dsw       CMakeLists.txt  httpd.mak       libhttpd.mak  README            VERSIONING
apache_probes.d  config.layout   httpd.spec      LICENSE       README.cmake
ap.d             configure       include         Makefile.in   README.platforms
build            configure.in    INSTALL         Makefile.win  ROADMAP
BuildAll.dsp     docs            InstallBin.dsp  modules       server
[root@localhost httpd-2.4.29]# yum -y install gcc gcc-c++ pcre make pcre-devel zlib-devel expat-devel
[root@localhost httpd-2.4.29]# ./configure \
> --prefix=/usr/local/httpd \
> --enable-deflate \
> --enable-so \
> --enable-rewrite \
> --enable-charset-lite \
> --enable-cgi
[root@localhost httpd-2.4.29]# make && make install

4.修改主配置文件，创建软链接，便于操作

[root@localhost httpd-2.4.29]# vim /usr/local/httpd/conf/httpd.conf
ServerName www.hello.com:80
Listen 192.168.73.167:80
#Listen 80
[root@localhost httpd-2.4.29]# ln -s /usr/local/httpd/conf/httpd.conf /etc/httpd.conf
[root@localhost httpd-2.4.29]# cd /usr/local/httpd/bin/
[root@localhost bin]# pwd
/usr/local/httpd/bin
[root@localhost bin]# cd ..
[root@localhost httpd]# ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  lib  logs  man  manual  modules
[root@localhost httpd]# cd htdocs/
[root@localhost htdocs]# ls
E2A44F9213403D04017939019ADDED89.gif  index.html
[root@localhost htdocs]# vim index.html
<html><body><h1>It works!</h1>
<img src="E2A44F9213403D04017939019ADDED89.gif" \ ></body></html>
[root@localhost htdocs]# cd /usr/local/httpd/bin
[root@localhost bin]# ./apachectl start
[root@localhost bin]# netstat -ntap | grep 80
tcp        0      0 192.168.73.167:80       0.0.0.0:*               LISTEN      69230/httpd

5.win10中修改域名，并用服务器查看

在这里插入图片描述

ipconfig /release
ipconfig /renew
ipconfig /all

在这里插入图片描述

6.在另外一台虚拟机上面，安装httpd，并进行配置

[root@localhost ~]# yum -y install httpd
[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
ServerName www.world.com:80
Listen 192.168.73.147:80
#Listen 80
[root@localhost ~]# vim /var/www/html/index.html
[root@localhost ~]# vim /var/www/html/index.html 
<html>
<body>
   this is test web <br />
   <img src="http://192.168.73.167/E2A44F9213403D04017939019ADDED89.gif" / >
</body>
</html>
[root@localhost ~]# systemctl start httpd

7.在win10主机里面测试

在这里插入图片描述

8.接下来我们去开启Apache的防盗链的功能

[root@localhost htdocs]# cd ..
[root@localhost httpd]# ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  lib  logs  man  manual  modules
[root@localhost httpd]# cd conf
[root@localhost conf]# ls
extra  httpd.conf  magic  mime.types  original
[root@localhost conf]# vim httpd.conf
LoadModule rewrite_module modules/mod_rewrite.so
<Directory "/usr/local/httpd/htdocs">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   AllowOverride FileInfo AuthConfig Limit
    #
    AllowOverride None

    #
    # Controls who can get stuff from this server.
    #
    Require all granted
    Require all granted
    RewriteEngine On
    RewriteCond %{HTTP_REFERER} !^http://hello.com/.*$ [NC]
    RewriteCond %{HTTP_REFERER} !^http://hello.com$ [NC]
    RewriteCond %{HTTP_REFERER} !^http://www.hello.com/.*$ [NC]
    RewriteCond %{HTTP_REFERER} !^http://www.hello.com/$ [NC]
    RewriteRule .*\.(gif|jpg|swf)$ http://www.hello.com/error.png
</Directory>
[root@localhost conf]# cd 
[root@localhost ~]# cd /usr/local/httpd/bin/
[root@localhost bin]# ./apachectl stop
[root@localhost bin]# ./apachectl start

9.去win10主机中查看防盗链

清空缓存数据

在这里插入图片描述

清空浏览数据后重启服务器

在这里插入图片描述

Apache版本的隐藏

实验步骤

1.打开win10里面的抓包工具，直接开启抓包

在这里插入图片描述

2.修改Apache的主配置文件，并重启Apache服务

[root@localhost htdocs]# vim /usr/local/httpd/conf/httpd.conf
Include conf/extra/httpd-default.conf
[root@localhost htdocs]# cd ..
[root@localhost httpd]# ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  lib  logs  man  manual  modules
[root@localhost httpd]# cd conf/
[root@localhost conf]# ls
extra  httpd.conf  magic  mime.types  original
[root@localhost conf]# cd extra/
[root@localhost extra]# ls
httpd-autoindex.conf  httpd-info.conf       httpd-mpm.conf                 httpd-userdir.conf
httpd-dav.conf        httpd-languages.conf  httpd-multilang-errordoc.conf  httpd-vhosts.conf
httpd-default.conf    httpd-manual.conf     httpd-ssl.conf                 proxy-html.conf
[root@localhost extra]# vim httpd-default.conf
ServerTokens Prod
ServerSignature Off
[root@localhost extra]# /usr/local/httpd/bin/apachectl stop
[root@localhost extra]# /usr/local/httpd/bin/apachectl start

3.清空win10的浏览器中的浏览数据

在这里插入图片描述