2018-04-18 Linux学习

Posted 2020-10-31

11.28 限定某个目录禁止解析php

访问控制 - 禁止PHP解析

<Directory /data/wwwroot/111.com/upload>
  php_admin_flag engine off
</Directory>

curl 测试时直接返回php源代码，并未解析

操作过程

[[email protected] ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI ".*.css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[[email protected] ~]# mkdir /data/wwwroot/111.com/upload
[[email protected] ~]# cd /data/wwwroot/111.com/
[[email protected] 111.com]# vim 123.php
[[email protected] 111.com]# cp 123.php upload/

[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:13:20 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:13:20 GMT
Content-Type: text/html; charset=UTF-8

[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:14:00 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

11.29 限制user_agent

访问控制 - user_agent

user_agent 可以理解为浏览器标识

核心配置内容

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC]
    RewriteRule .* - [F]
</IfModule>

curl -A "123123" 指定 user_agent

操作过程

[[email protected] ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost :80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .curl. [NC,OR]
RewriteCond %{HTTP_USER_AGENT} .baidu.com. [NC]
RewriteRule . - [F]
</IfModule>
<Directory /data/wwwroot/111.com/upload>
php_admin_flag engine off
<FilesMatch (.).php(.)>
Order allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory /data/wwwroot/111.com>
<FilesMatch "admin.php(.)">
Order deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
SetEnvIf Request_URI "..gif$" img
SetEnvIf Request_URI "..jpg$" img
SetEnvIf Request_URI "..png$" img
SetEnvIf Request_URI "..bmp$" img
SetEnvIf Request_URI "..swf$" img
SetEnvIf Request_URI "..js$" img
SetEnvIf Request_URI "..css$" img
ErrorLog "logs/111.com-errorlog"
CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/111.com-access%Y%m%d.log 86400" combined env=!img
</VirtualHost>

[[email protected] 111.com]# vim /data/wwwroot/111.com/123.php

[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:41:05 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:41:05 GMT
Content-Type: text/html; charset=UTF-8

[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl graceful

[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 403 Forbidden
Date: Tue, 17 Apr 2018 15:42:54 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
Content-Type: text/html; charset=iso-8859-1

[[email protected] 111.com]# curl -A "aminglinux aminglinux"  -x127.0.0.1:80 ‘http://111.com/123.php‘ -I
HTTP/1.1 200 OK
Date: Tue, 17 Apr 2018 15:43:25 GMT
Server: Apache/2.4.29 (Unix) PHP/5.6.35
X-Powered-By: PHP/5.6.35
Cache-Control: max-age=0
Expires: Tue, 17 Apr 2018 15:43:25 GMT
Content-Type: text/html; charset=UTF-8

11.30-31 PHP相关配置

查看PHP配置文件位置

/usr/local/php/bin/php -i|grep -i "loaded configuration file" //可能会找不到

/usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

设置以下几项可以保存错误日志：
display_errors = Off    //设置为 Off, 为 On 时，浏览器访问phpinfo时会显示错误信息，不建议设置为on
log_errors = On     //错误日志开启
error_log = /tmp/php_errors.log    //设置错误日志路径
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT    //设置错误日志级别

安全相关:
vim /usr/local/php/etc/php.ini
    open_basedir = /data/wwwroot/111.com:/tmp/

vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf    //能够针对各个虚拟主机设置open_basedir
    php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"

PHP信息内容
    [[email protected] 111.com]# vim index.php
    <?php
    phpinfo();
    设置完可通过浏览器访问111.com/index.php 查看phpinfo

操作过程

[[email protected] ~]# /usr/local/php/bin/php -i|grep -i "loaded configuration file"
PHP Warning:  Unknown: It is not safe to rely on the system‘s timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone ‘UTC‘ for now, but please set date.timezone to select your timezone. in Unknown on line 0
Loaded Configuration File => /usr/local/php/etc/php.ini

[[email protected] ~]# vim /usr/local/php/etc/php.ini

date.timezone = Asia/Shanghai
display_errors = On
log_errors = On
error_log = /tmp/php_errors.log
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
open_basedir = /data/wwwroot/111.com:/tmp/

disable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

[[email protected] ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/data/wwwroot/abc.com"
ServerName abc.com
ServerAlias www.abc.com www.123.com
php_admin_value open_basedir "/data/wwwroot/abc.com:/tmp/"
ErrorLog "logs/abc.com-error_log"
CustomLog "logs/abc.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.exampl.com 2111.com.cn
php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"