配置防盗链访问控制Directory访问控制FilesMatch

Posted 2020-10-14

配置防盗链

我的网站遇到最多的是两类盗链，一是图片盗链，二是文件盗链。曾经有一个访问量极大的网站盗链我网站的图片，一天竟然消耗了数G的流量。同时，我站放的不少几十兆的大型软件也常遭到文件盗链，大量消耗我站资源。

1、新增内容

[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

<VirtualHost *:80>

    DocumentRoot "/data/wwwroot/111.com"

    ServerName 111.com

    ServerAlias www.111.com www.example.com

 <Directory /data/wwwroot/111.com>

        SetEnvIfNoCase Referer "http://111.com" local_ref

        SetEnvIfNoCase Referer "http://ask.apelearn.com" local_ref

        SetEnvIfNoCase Referer "^$" local_ref

        #定义referer白名单

        <FilesMatch "\.(txt|doc|mp3|zip|rar|jpg|gif|png)">

            Order Allow,Deny

            Allow from env=local_ref

        #定义规则：允许变量local_ref指定的referer访问，拒绝其他所有访问。

        </FilesMatch>

    </Directory>

2、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful

3、-e :表示指定referer，现在http://ask.apelearn.com/已经在白名单，所以是允许的

[[email protected] local]# curl -e "http://ask.apelearn.com/" -x127.0.0.1:80 111.com/3.png -I

HTTP/1.1 200 OK

Date: Thu, 09 Nov 2017 12:45:00 GMT

Server: Apache/2.4.29 (Unix) php/5.6.30

Last-Modified: Thu, 09 Nov 2017 12:45:00 GMT

ETag: W/"a102-55d97420ac440"

Accept-Ranges: bytes

Content-Length: 41218

Cache-Control: max-age=86400

Expires: Fri, 10 Nov 2017 12:45:00 GMT

Content-Type: image/png

4、不在白名单中就403

[[email protected] local]# curl -e "http://1323.com/" -x127.0.0.1:80 111.com/3.png -I

HTTP/1.1 403 Forbidden

Date: Thu, 09 Nov 2017 12:49:29 GMT

Server: Apache/2.4.29 (Unix) PHP/5.6.30

Content-Type: text/html; charset=iso-8859-1

访问控制Directory

1、[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

<VirtualHost *:80>

    DocumentRoot "/data/wwwroot/111.com"

    ServerName 111.com

    ServerAlias www.111.com www.example.com

 <Directory /data/wwwroot/111.com/admin/>

        Order deny,allow

        Deny from all

        Allow from 127.0.0.1

        #只允许IP--127.0.0.1访问“/data/wwwroot/111.com/admin/”目录中的内容

       #先拒绝所有的，在允许allow的，先后顺序

    </Directory>

2、mkdir /data/wwwroot/111.com/admin/ && vi admin.html

3、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful

验证：

[[email protected] local]# curl -x127.0.0.1:80 111.com/admin/admin.html

this is admin.html

[[email protected] local]# curl -x192.168.3.74:80 111.com/admin/admin.html -I

HTTP/1.1 403 Forbidden

Date: Thu, 09 Nov 2017 12:53:39 GMT

Server: Apache/2.4.29 (Unix) PHP/5.6.30

Content-Type: text/html; charset=iso-8859-1

访问控制FilesMatch

1、[[email protected] local]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf

<VirtualHost *:80>

    DocumentRoot "/data/wwwroot/111.com"

    ServerName 111.com

    ServerAlias www.111.com www.example.com

    <Directory /data/wwwroot/111.com>

        <FilesMatch admin.html(.*)>

        Order deny,allow

        Deny from all

        Allow from 127.0.0.1

        </FilesMatch>

    </Directory>

2、[[email protected] local]# /usr/local/apache2.4/bin/apachectl graceful

3、[[email protected] local]# curl -x127.0.0.1:80 111.com/admin.html

this file admin.html

扩展：

1.  禁止访问某些文件/目录

增加Files选项来控制，比如要不允许访问 .inc 扩展名的文件，保护php类库：

<Files~"\.inc$">

Order Allow,Deny

Deny from all

</Files>

2. 禁止访问某些指定的目录：（可以用  来进行正则匹配）

<Directory~"^/var/www/(.+/)*[0-9]{3}">

Order Allow,Deny

Deny from all

</Directory>

3. 通过文件匹配来进行禁止，比如禁止所有针对图片的访问：

<FilesMatch \.?i:gif|jpe?g|png)$>

Order Allow,Deny

Deny from all

<FilesMatch>

  

4. 针对URL相对路径的禁止访问

<Location /dir/>

Order Allow,Deny

Deny from all

</Location>

本文出自 “探索发现新事物” 博客，请务必保留此出处http://shenj.blog.51cto.com/5802843/1980632