11.28 限定某个目录禁止解析php 11.29 限制user_agent 11.30/11.31 php相关配置

11.28 限定某个目录禁止php解析

本节内容应用于对静态文件目录或可写的目录进行优化设置,通过限制解析/访问权限来避免别恶意攻击,提高安全性。

编辑虚拟主机配置文件:

[root@cham002 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf 
    <Directory /data/wwwroot/111.com/upload>
        php_admin_flag engine off
        <FilesMatch (.*)\.php(.*)>
        Order allow,deny
        deny from,all
        </FilesMatch>
    </Directory>

添加PHP访问限制

154735_2jUC_3708120.png

说明: 如果只设置禁止PHP解析,用户访问PHP文件时会显示源代码,添加该参数可以避免用户看到服务器PHP源码,进一步提升安全性。

创建相应的目录:

[root@cham002 ~]# cd /data/wwwroot/111.com/
[root@cham002 111.com]# mkdir upload
[root@cham002 111.com]# ls
123.php  admin  index.php  photo1.jpg  upload
[root@cham002 111.com]# cp 123.php upload/

测试:

[root@cham002 111.com]# curl -x127.0.0.1:80 'http://111.com/upload/123.php' -I
HTTP/1.1 403 Forbidden
Date: Tue, 26 Dec 2017 16:00:13 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1

[root@cham002 111.com]# curl -x127.0.0.1:80 'http://111.com/upload/123.php' 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /upload/123.php
on this server.<br />
</p>
</body></html>

说明: 此时访问123.php的状态码为403,即无法访问!

现在把FilesMatch  PHP访问限制这几行去掉

000130_VHmr_3708120.png

[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl graceful
#来看看效果
[root@cham002 111.com]# curl -x127.0.0.1:80 'http://111.com/upload/123.php' 
<?php
echo " hello 123.php";
#直接解析不了,直接显示源代码

用浏览器打开的话会直接下载,说明没办法解析。

000552_lvcT_3708120.png

我们重新打开,让它访问的机会都没有。

000717_E5os_3708120.png

重新检测加载。

[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl graceful

来看一看效果,直接Forbidden!!访问不存在的文件同样也是Forbidden。

000816_ZyQt_3708120.png

 

11.29 限制user_agent

user_agent(用户代理):是指浏览器(搜索引擎)的信息包括硬件平台、系统软件、应用软件和用户个人偏好。

 

需求背景:
有时候网站受到CC攻击,其原理是:攻击者借助代理服务器(肉机)生成指向受害主机的合法请求,实现DDOS和伪装。CC攻击的一个特点就是其useragent是一致的,所以,可以通过限制攻击者useragent的方法来阻断其攻击。

编辑虚拟主机配置文件:

[root@cham002 111.com]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf 
    
<IfModule mod_rewrite.c>
        RewriteEngine on
        RewriteCond %{HTTP_USER_AGENT}  .*curl.* [NC,OR]
        RewriteCond %{HTTP_USER_AGENT}  .*baidu.com.* [NC]
        RewriteRule  .*  -  [F]
    </IfModule>
说明: NC表示忽略大小写,OR选项表示或者(不加任何选项表并且)连接下一个条件,F=forbidden禁止。

:wq保存

检测加载
[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 111.com]# /usr/local/apache2.4/bin/apachectl graceful

002036_KUhR_3708120.png

测试:

[root@cham002 111.com]# !curl
curl -x127.0.0.1:80 'http://111.com/upload/123.php' 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /upload/123.php
on this server.<br />
</p>
</body></html>
[root@cham002 111.com]# curl -x127.0.0.1:80 'http://111.com/upload/123.php'  -I
HTTP/1.1 403 Forbidden
Date: Tue, 26 Dec 2017 16:22:39 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1

[root@cham002 111.com]# curl -x127.0.0.1:80 'http://111.com/123.php'  -I
HTTP/1.1 403 Forbidden
Date: Tue, 26 Dec 2017 16:22:51 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
Content-Type: text/html; charset=iso-8859-1


[root@cham002 111.com]# tail /usr/local/apache2.4/logs/111.com-access_20171227.log 
127.0.0.1 - - [27/Dec/2017:00:02:50 +0800] "HEAD http://111.com/upload/123.php HTTP/1.1" 200 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:02:57 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 200 29 "-" "curl/7.29.0"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET / HTTP/1.1" 200 18 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://111.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:47 +0800] "GET /123.php HTTP/1.1" 200 14 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:56 +0800] "GET /upload/123.php HTTP/1.1" 200 29 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:08:06 +0800] "GET /upload/123.php HTTP/1.1" 403 223 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
127.0.0.1 - - [27/Dec/2017:00:22:27 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 403 223 "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:39 +0800] "HEAD http://111.com/upload/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:51 +0800] "HEAD http://111.com/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"
[root@cham002 111.com]# tail /usr/local/apache2.4/logs/111.com-access_20171227.log 
127.0.0.1 - - [27/Dec/2017:00:02:50 +0800] "HEAD http://111.com/upload/123.php HTTP/1.1" 200 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:02:57 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 200 29 "-" "curl/7.29.0"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET / HTTP/1.1" 200 18 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://111.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:47 +0800] "GET /123.php HTTP/1.1" 200 14 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:56 +0800] "GET /upload/123.php HTTP/1.1" 200 29 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:08:06 +0800] "GET /upload/123.php HTTP/1.1" 403 223 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
127.0.0.1 - - [27/Dec/2017:00:22:27 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 403 223 "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:39 +0800] "HEAD http://111.com/upload/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:51 +0800] "HEAD http://111.com/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"


说明: curl -A 指定useragent。
[root@cham002 111.com]# curl -A "chamlinux chamlinux" -x127.0.0.1:80 'http://111.com/123.php'  -I
HTTP/1.1 200 OK
Date: Tue, 26 Dec 2017 16:25:36 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Content-Type: text/html; charset=UTF-8

[root@cham002 111.com]# tail /usr/local/apache2.4/logs/111.com-access_20171227.log 
127.0.0.1 - - [27/Dec/2017:00:02:57 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 200 29 "-" "curl/7.29.0"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET / HTTP/1.1" 200 18 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:36 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://111.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:47 +0800] "GET /123.php HTTP/1.1" 200 14 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:04:56 +0800] "GET /upload/123.php HTTP/1.1" 200 29 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
192.168.230.1 - - [27/Dec/2017:00:08:06 +0800] "GET /upload/123.php HTTP/1.1" 403 223 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
127.0.0.1 - - [27/Dec/2017:00:22:27 +0800] "GET http://111.com/upload/123.php HTTP/1.1" 403 223 "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:39 +0800] "HEAD http://111.com/upload/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:22:51 +0800] "HEAD http://111.com/123.php HTTP/1.1" 403 - "-" "curl/7.29.0"
127.0.0.1 - - [27/Dec/2017:00:25:36 +0800] "HEAD http://111.com/123.php HTTP/1.1" 200 - "-" "chamlinux chamlinux"
[root@cham002 111.com]# 

 

11.30 PHP相关配置

查看PHP配置文件:

[root@cham002 php-7.1.6]# /usr/local/php/bin/php -i|grep -i "loaded configuration file" 
Loaded Configuration File => /usr/local/php/etc/php.ini
PHP Warning:  Unknown: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone. in Unknown on line 0


[root@cham002 php-7.1.6]# /usr/local/php7/bin/php -i|grep -i "loaded configuration file" 
Loaded Configuration File => /usr/local/php7/etc/php.ini
 
[root@cham002 111.com]# ls
123.php  admin  index.php  photo1.jpg  upload
 
[root@cham002 111.com]# vim index.php 
<?php
#echo "welcome to 111.com";
phpinfo();
#?>
[root@cham002 111.com]# cd /usr/local/src/php-7.1.6/

[root@cham002 php-7.1.6]# cp php.ini-development  /usr/local/php7/etc/php.ini

[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl graceful
[root@cham002 php-7.1.6]# vim /usr/local/php7/etc/php.ini
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl graceful
[root@cham002 php-7.1.6]# vim /usr/local/php7/etc/php.ini
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl graceful
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK

PHP参数

设定时区

 date.timezone 

010109_8DcL_3708120.png

一些功能选

disable_function=

项:“eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo ”

以上功能选项可以通过“disable_function”来限制,以达到提高网站安全性的目的:

005109_A6t9_3708120.png

005137_ejab_3708120.png

display_errors=On/Off :设定是否显示错误原因,需要注意的是,此处设置为off(防止用户看到)后必须设置错误日志,设定保存路径,和错误日志级别,否则将无法查找错误原因 

display_errors = Off

010435_mqWp_3708120.png

日志相关

log_errors=On/Off 开启/关闭错误日志

log_errors = On
这样就是打开

010807_OCSz_3708120.png

定义路径错误日志记录路径

设定错误日志的保存路径。如果定义好路径后无法生产日志,此时需要检查日志文件所在目录是否有写(w)权限

error_log = /tmp/php_errors.log

010928_Df22_3708120.png

定义error_log错误日志的级别(如果级别过高,非常严谨的话,仅仅会记录一些比较严峻的错误。像一般警告就不记录。)” 设定错误日志级别,级别有:E_ ALL 、~E_ NOTICE 、~E_ STRICT 、~E_DEPRECATED(可以自由组合)。生产环境使用:E_ ALL & ~E_ NOTICE就可以。

error_reporting = E_ALL

011518_IBu5_3708120.png

[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 php-7.1.6]# /usr/local/apache2.4/bin/apachectl graceful
[root@cham002 php-7.1.6]# curl -A "a" -x127.0.0.1:80 http://111.com/index.php
[root@cham002 php-7.1.6]# ls /tmp/
mysql.sock      systemd-private-02f767b5881a41e284ed51ccdd17a7e8-vmtoolsd.service-5E7yid
pear            systemd-private-784ef142e2ac49208717f87ed079faeb-vmtoolsd.service-vHephM
php_errors.log
[root@cham002 php-7.1.6]# cat /tmp/php_errors.log 
[26-Dec-2017 17:16:28 UTC] PHP Warning:  phpinfo() has been disabled for security reasons in /data/wwwroot/111.com/index.php on line 3
[root@cham002 php-7.1.6]# ls -l /tmp/php_errors.log 
-rw-r--r-- 1 daemon daemon 135 12月 27 01:16 /tmp/php_errors.log
[root@cham002 php-7.1.6]# ps aux |grep httpd
root      2717  0.0  1.3 258996 13680 ?        Ss   12月25   0:06 /usr/local/apache2.4/bin/httpd -k start
daemon    8815  0.0  1.4 613472 14920 ?        Sl   01:16   0:00 /usr/local/apache2.4/bin/httpd -k start
daemon    8816  0.0  1.0 545824 10468 ?        Sl   01:16   0:00 /usr/local/apache2.4/bin/httpd -k start
daemon    8817  0.0  1.0 545824 10456 ?        Sl   01:16   0:00 /usr/local/apache2.4/bin/httpd -k start
root      8918  0.0  0.0 112684   976 pts/0    S+   01:17   0:00 grep --color=auto httpd

再模拟一个错误
[root@cham002 php-7.1.6]# vim /data/wwwroot/111.com/2.php
[root@cham002 php-7.1.6]# cat !$
cat /data/wwwroot/111.com/2.php
<?php
echo 123;
adsfasdffsdfsdfsdfsdfsdfsfdsfs
[root@cham002 php-7.1.6]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php
[root@cham002 php-7.1.6]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php -I
HTTP/1.0 500 Internal Server Error
Date: Tue, 26 Dec 2017 17:26:03 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Connection: close
Content-Type: text/html; charset=UTF-8

[root@cham002 php-7.1.6]# cat /tmp/php_errors.log 
[26-Dec-2017 17:16:28 UTC] PHP Warning:  phpinfo() has been disabled for security reasons in /data/wwwroot/111.com/index.php on line 3
[26-Dec-2017 17:25:53 UTC] PHP Parse error:  syntax error, unexpected end of file in /data/wwwroot/111.com/2.php on line 4
[26-Dec-2017 17:26:03 UTC] PHP Parse error:  syntax error, unexpected end of file in /data/wwwroot/111.com/2.php on line 4
有时候为了保险一点,不是已经在php.ini里面定义了error_log
[root@cham002 php-7.1.6]# grep error_log /usr/local/php7/etc/php.ini
; server-specific log, STDERR, or a location specified by the error_log
; Set maximum length of log_errors. In error_log information about the source is
error_log = /tmp/php_errors.log
;error_log = syslog
; OPcache error_log file name. Empty string assumes "stderr".
;opcache.error_log=
[root@cham002 php-7.1.6]# touch /tmp/php_error.log ; chamd 777 /tmp/php_errors.log  ^C
                         可以先创建好。再给他个777权限

安全参数“open_basedir”

open_basedir = /data/wwwroot/111.com:/tmp

译:如果设置了open_basedir选项,将会把所有关于文件的操作限制在指定目录及其子目录。
将该指令设定在每个目录或者虚拟主机web服务器配置文件中非常重要。

013751_VUsq_3708120.png

[root@cham002 ~]# vim /data/wwwroot/111.com/2.php 我们把2.php改正确
[root@cham002 ~]# cat /data/wwwroot/111.com/2.php 
<?php
echo 123;

[root@cham002 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@cham002 ~]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php -I
HTTP/1.1 200 OK
Date: Tue, 26 Dec 2017 17:42:32 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Content-Type: text/html; charset=UTF-8
[root@cham002 ~]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php 
123

说明: php.ini文件中的内容是针对所有虚拟主机进行的配置!!!!!!!!这点要明白。014746_CZAO_3708120.png所以我们取消掉

问题: 一台服务器运行着不止一台虚拟主机,所以在该文件下设置该选项并不合适。那么,该如何设定该配置呢?

办法: 分别在每个虚拟主机的配置文件进行相关设置。

编辑虚拟主机配置文件:

[root@cham002 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf 
 php_admin_value open_basedir "/data/wwwroot/abc.com:/tmp/"


[root@cham002 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@cham002 ~]# /usr/local/apache2.4/bin/apachectl graceful

[root@cham002 ~]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php 
123[root@cham002 ~]# curl -A "a" -x127.0.0.1:80 http://111.com/2.php -I
HTTP/1.1 200 OK
Date: Tue, 26 Dec 2017 17:53:26 GMT
Server: Apache/2.4.29 (Unix) PHP/7.1.6
X-Powered-By: PHP/7.1.6
Content-Type: text/html; charset=UTF-8

014928_380o_3708120.png

说明: “php_admin_value”可以定义php.ini中的参数。使用该办法分别在每个虚拟主机设定相关的“open_basedir”即可!
在此开放“/tmp/”目录是为了使临时文件能正常写入。

 

 

转载于:https://my.oschina.net/u/3708120/blog/1595397

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值