LAMP架构二
安装PHP7
1.查看php配置文件信息（phpinfo），php有两个配置文件开发环境和生产环境
[root@localhost php-5.6.30]# /usr/local/php/bin/php -i |less
2.我们将配置文件放到/usr/local/php/etc/php.ini下
[root@localhost php-5.6.30]# cp php.ini-production /usr/local/php/etc/php.ini [root@localhost php-5.6.30]#
3.安装php7（bz2的压缩包用 tar -jxvf解压）
[root@localhost php-7.1.6]# cd /usr/local/src/^C [root@localhost php-7.1.6]# wget http://mirrors.sohu.com/php/php-7.1.6.tar.gz^C [root@localhost php-7.1.6]# tar -zxvf php-7.1.6.tar.gz ^C [root@localhost php-7.1.6]# cd php-7.1.6/^C [root@localhost php-7.1.6]#
4.php7配置文件
[root@localhost php-7.1.6]# ./configure --prefix=/usr/local/php7
--with-apxs2=/usr/local/apache2.4/bin/apxs
--with-config-file-path=/usr/local/php7/etc
--with-pdo-mysql=/usr/local/mysql
--with-mysqli=/usr/local/mysql/bin/mysql_config
--with-libxml-dir
--with-gd
--with-jpeg-dir
--with-png-dir
--with-freetype-dir
--with-iconv-dir
--with-zlib-dir
--with-bz2
--with-openssl
--with-mcrypt
--enable-soap
--enable-gd-native-ttf
--enable-mbstring
--enable-sockets
--enable-exif
5.make && make install
6.查看文件php7模块文件
[root@localhost php-7.1.6]# ls /usr/local/apache2.4/modules/libphp7.so /usr/local/apache2.4/modules/libphp7.so [root@localhost php-7.1.6]# du -sh /usr/local/apache2.4/modules/libphp7.so 37M /usr/local/apache2.4/modules/libphp7.so [root@localhost php-7.1.6]#
7.发现apache加载了
php5_module (shared)
php7_module (shared)
[root@localhost php-7.1.6]# /usr/local/apache2.4/bin/apachectl -M AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message Loaded Modules: core_module (static) so_module (static) http_module (static) mpm_event_module (static) authn_file_module (shared) authn_core_module (shared) authz_host_module (shared) authz_groupfile_module (shared) authz_user_module (shared) authz_core_module (shared) access_compat_module (shared) auth_basic_module (shared) reqtimeout_module (shared) filter_module (shared) mime_module (shared) log_config_module (shared) env_module (shared) headers_module (shared) setenvif_module (shared) version_module (shared) unixd_module (shared) status_module (shared) autoindex_module (shared) dir_module (shared) alias_module (shared) php5_module (shared) php7_module (shared) [root@localhost php-7.1.6]#
8.想要只支持一个php怎么做呢，修改httpd.conf，将php5模块所在的行注释掉
[root@localhost php-7.1.6]# !vim vim /usr/local/apache2.4/conf/httpd.conf [root@localhost php-7.1.6]#
Apache和PHP结合
1.解决启动apache提示警告信息文件，编辑apache配置文件将ServerName注释状态打开
2.启动apache，查看httpd服务是否启动成功
[root@localhost php-7.1.6]# /usr/local/apache2.4/bin/apachectl restart [root@localhost php-7.1.6]# ps aux|grep httpd daemon 60694 0.0 0.3 435528 3740 ? Sl 09:42 0:00 /usr/local/apache2.4/bin/httpd -k start daemon 60695 0.0 0.3 435528 3736 ? Sl 09:42 0:00 /usr/local/apache2.4/bin/httpd -k start daemon 60696 0.0 0.3 435528 3740 ? Sl 09:42 0:00 /usr/local/apache2.4/bin/httpd -k start root 60779 2.0 0.0 112680 976 pts/5 S+ 09:42 0:00 grep --color=auto httpd root 99405 0.0 0.6 146616 6988 ? Ss 2月01 0:07 /usr/local/apache2.4/bin/httpd -k start [root@localhost php-7.1.6]#
3.查看服务器是否开启80端口，发现并没有开启
[root@localhost php-7.1.6]# iptables -nvL
4.临时将80端口规则加到防火墙中（-I 添加规则、-D 删除规则），发现浏览器可以访问服务器了，telnet也可以连接服务器了
[root@localhost php-7.1.6]# iptables -I INPUT -p tcp --dport 80 -j ACCEPT
5.编辑apache配置文件denied改为granted
6.查看配置文件是否有语法错误
[root@localhost local]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@localhost local]#
7.重新加载配置文件
[root@localhost local]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost local]#
8.添加配置文件，检查配置文件是否正常。
[root@localhost local]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@localhost local]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost local]#
9.可以正常访问服务器
10.支持php
Apache默认虚拟主机
1.编辑httpd.conf文件去掉虚拟主机配置文件#号
2.编辑虚拟主机配置文件并建立相对应的目录
<VirtualHost *:80>
ServerAdmin webmaster@dummy-host.example.com
DocumentRoot "/data/wwwroot/abc.com"
ServerName abc.com
ServerAlias www.abc.com www.123.com
ErrorLog "logs/abc.com-error_log"
CustomLog "logs/abc.com-access_log" common
</VirtualHost>
<VirtualHost *:80>
ServerAdmin webmaster@dummy-host2.example.com
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.example.com
ErrorLog "logs/111.com-error_log"
CustomLog "logs/111.com-access_log" common
</VirtualHost>
[root@localhost ~]# mkdir /data/wwwroot/ [root@localhost ~]# mkdir /data/wwwroot/abc.com [root@localhost ~]# mkdir /data/wwwroot/111.com [root@localhost ~]# vim /data/wwwroot/abc.com/index.php [root@localhost ~]#
3.创建index.php文件并写点代码
[root@localhost ~]# vim /data/wwwroot/111.com/index.php [root@localhost ~]#
4.检查配置文件
[root@localhost ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@localhost ~]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost ~]#
5.curl命令来检测是否可以访问-x 选项可以为CURL添加代理功能，用浏览器看需要本地做host
[root@localhost ~]# curl -x10.21.95.122:80 abc.com abc.com[root@localhost ~]# curl -x10.21.95.122:80 abce.com abc.com[root@localhost ~]# curl -x10.21.95.122:80 abcee.com abc.com[root@localhost ~]# curl -x10.21.95.122:80 www.example.com 111.com[root@localhost ~]#
6.打开虚拟主机配置文件，主配置文件将失效
Apache用户认证
1.修改虚拟主机配置文件
<VirtualHost *:80>
ServerAdmin webmaster@dummy-host2.example.com
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
ServerAlias www.example.com
<Directory /data/wwwroot/111.com>
AllowOverride AuthConfig
AuthName "Restricted Files"
AuthType Basic
AuthUserFile /data/.htpasswd
Require valid-user
</Directory>
ErrorLog "logs/111.com-error_log"
CustomLog "logs/111.com-access_log" common
</VirtualHost>
2.生成用户密码文件
[root@localhost ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf [root@localhost ~]# /usr/local/apache2.4/bin/htpasswd -c -m /data/.htpasswd apache New password: Re-type new password: Adding password for user apache [root@localhost ~]#
[root@localhost ~]# /usr/local/apache2.4/bin/htpasswd -m /data/.htpasswd apache1 New password: Re-type new password: Adding password for user apache1 [root@localhost ~]# cat /data/.htpasswd apache:$apr1$7yblTxbh$nuIrcwIU3nlsee3Aek8jJ. apache1:$apr1$1bnu4tPX$/u15wjn1vuexrW8ROHC9u0 [root@localhost ~]#
[root@localhost ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@localhost ~]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost ~]#
3.curl访问提示401 -I 只看状态码不看返回的内容
[root@localhost ~]# curl -x127.0.0.1:80 111.com -I HTTP/1.1 401 Unauthorized Date: Fri, 02 Feb 2018 07:44:52 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 WWW-Authenticate: Basic realm="Restricted Files" Content-Type: text/html; charset=iso-8859-1 [root@localhost ~]#
4.用浏览器访问，编辑客户端host文件，访问111.com
5.用curl方式输入用户名密码方式访问
[root@localhost ~]# curl -x127.0.0.1:80 -uapache:apache 111.com 111.com[root@localhost ~]#
1.filesmatch指定文件认证
域名跳转
1.修改配置文件域名跳转需要在虚拟主机配置中添加别名和一个 rewrite 模块，如下，配置当访问 www.aaa.com 时跳转到 www.test.com
[root@localhost ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
</VirtualHost>
[root@localhost ~]# /usr/local/apache2/bin/apachectl -t [root@localhost ~]# /usr/local/apache2/bin/apachectl graceful
2.扩展：如果有多个域名跳转到一个域名如何配置，如下，配置当访问 www.aaa.com 或访问 www.bbb.com 时跳转到 www.test.com
[root@localhost ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/data/www"
ServerName www.test.com
ServerAlias www.aaa.com # 这里配置两个别名
ServerAlias www.bbb.com
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.aaa.com$ [OR] # 这里末尾要加[OR]，表示或者
RewriteCond %{HTTP_HOST} ^www.bbb.com$
RewriteRule ^/(.*)$ http://www.test.com/$1 [R=301,L]
</IfModule>
</VirtualHost>
3.查看是否加载了rewrite模块
[root@localhost ~]# /usr/local/apache2.4/bin/apachectl -M |grep rewrite [root@localhost ~]# vi /usr/local/apache2.4/conf/httpd.conf [root@localhost ~]# /usr/local/apache2.4/bin/apachectl -M |grep rewrite rewrite_module (shared) [root@localhost ~]#
[root@localhost ~]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost ~]#
Apache访问日志
常用命令
1.查看apache的进程数
ps -aux | grep httpd | wc -l
2.分析日志查看当天的ip连接数
cat default-access_log | grep "10/Dec/2010" | awk '{print $2}' | sort | uniq -c | sort -nr
3.查看指定的ip在当天究竟访问了什么url
cat default-access_log | grep "10/Dec/2010" | grep "218.19.140.242" | awk '{print $7}' | sort | uniq -c | sort -nr
4.查看当天访问排行前10的url
cat default-access_log | grep "10/Dec/2010" | awk '{print $7}' | sort | uniq -c | sort -nr | head -n 10
5.看到指定的ip究竟干了什么
cat default-access_log | grep 218.19.140.242 | awk '{print $1"\t"$8}' | sort | uniq -c | sort -nr | less
6.查看访问次数最多的几个分钟(找到热点)
awk '{print $4}' default-access_log |cut -c 14-18|sort|uniq -c|sort -nr|head
1.查看日志
[root@localhost ~]# cat /usr/local/apache2.4/logs/ 111.com-access_log abc.com-error_log httpd.pid 111.com-error_log access_log abc.com-access_log error_log [root@localhost ~]# cat /usr/local/apache2.4/logs/111.com-access_log 10.21.95.122 - - [02/Feb/2018:15:19:15 +0800] "GET HTTP://www.example.com/ HTTP/1.1" 200 7 127.0.0.1 - - [02/Feb/2018:15:44:52 +0800] "HEAD HTTP://111.com/ HTTP/1.1" 401 - 10.21.95.218 - - [02/Feb/2018:15:48:48 +0800] "GET / HTTP/1.1" 401 381 10.21.95.218 - apache [02/Feb/2018:15:50:00 +0800] "GET / HTTP/1.1" 401 381 10.21.95.218 - apache [02/Feb/2018:15:50:26 +0800] "GET / HTTP/1.1" 200 7 10.21.95.218 - apache [02/Feb/2018:15:50:26 +0800] "GET /favicon.ico HTTP/1.1" 404 209 127.0.0.1 - apache [02/Feb/2018:15:53:11 +0800] "GET HTTP://111.com/ HTTP/1.1" 200 7 [root@localhost ~]#
2.查看gz压缩包内容
zcat access_log.2018020209.gz |head
3.定义新的日志文件格式common改为combined，日志记录更详细。
4.让配置文件生效
[root@localhost ~]# /usr/local/apache2.4/bin/apachectl graceful [root@localhost ~]#
访问日志不记录静态文件
1,当访问很多图片，文档等静态资源的时候，会加大你日志的容量，日志容量占用你磁盘空间后，会出现服务器宕机等很严重的问题，这时需要将日志进行配置优化。当访问网页时不记录这些图片、css、js等信息日志。
SetEnvIf Request_URI ".*\.gif$" img
SetEnvIf Request_URI ".*\.jpg$" img
SetEnvIf Request_URI ".*\.png$" img
SetEnvIf Request_URI ".*\.bmp$" img
SetEnvIf Request_URI ".*\.swf$" img
SetEnvIf Request_URI ".*\.js$" img
SetEnvIf Request_URI ".*\.css$" img
CustomLog "logs/111.com-access_log" combined env=!img
2.重新加载配置文件
[root@bogon ~]# /usr/local/apache2.4/bin/apachectl graceful
[root@bogon ~]# curl -x127.0.0.1:80 111.com/aaaa.jpg <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /aaaa.jpg was not found on this server.</p> </body></html> [root@bogon ~]#
3.访问不是规则包含的链接被记录到日志，jpg结尾的不记录到日志
[root@bogon ~]# curl -x127.0.0.1:80 111.com/aaaa.jpg1
[root@bogon ~]# tail /usr/local/apache2.4/logs/111.com-access_log 127.0.0.1 - - [02/Feb/2018:15:44:52 +0800] "HEAD HTTP://111.com/ HTTP/1.1" 401 - 10.21.95.218 - - [02/Feb/2018:15:48:48 +0800] "GET / HTTP/1.1" 401 381 10.21.95.218 - apache [02/Feb/2018:15:50:00 +0800] "GET / HTTP/1.1" 401 381 10.21.95.218 - apache [02/Feb/2018:15:50:26 +0800] "GET / HTTP/1.1" 200 7 10.21.95.218 - apache [02/Feb/2018:15:50:26 +0800] "GET /favicon.ico HTTP/1.1" 404 209 127.0.0.1 - apache [02/Feb/2018:15:53:11 +0800] "GET HTTP://111.com/ HTTP/1.1" 200 7 10.21.95.218 - apache [02/Feb/2018:17:48:08 +0800] "GET / HTTP/1.1" 200 7 10.21.95.218 - apache [02/Feb/2018:18:11:59 +0800] "GET / HTTP/1.1" 200 7 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36" 10.21.95.218 - apache [02/Feb/2018:18:12:00 +0800] "GET / HTTP/1.1" 200 7 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36" 127.0.0.1 - - [05/Feb/2018:17:53:08 +0800] "GET HTTP://111.com/aaaa.jpg1 HTTP/1.1" 401 381 "-" "curl/7.29.0" [root@bogon ~]#
访问日志切割
1.添加配置文件选项rotatelogs -l 切割命令 -l 指定以什么时间格式切割 86400 每天0点生成一个新的文件
2.生成了记录日期格式的日志文件111.com-access_20180206.log
[root@bogon ~]# curl -x127.0.0.1:80 111.com/index.php 111.com[root@bogon ~]# ls /usr/local/apache2.4/logs/ 111.com-access_20180206.log 111.com-error_log abc.com-error_log error_log 111.com-access_log abc.com-access_log access_log httpd.pid [root@bogon ~]#
[root@bogon ~]# cat /usr/local/apache2.4/logs/111.com-access_20180206.log 127.0.0.1 - - [06/Feb/2018:09:14:26 +0800] "GET HTTP://111.com/123.php HTTP/1.1" 404 205 "-" "curl/7.29.0" 127.0.0.1 - - [06/Feb/2018:09:15:44 +0800] "GET HTTP://111.com/index.php HTTP/1.1" 200 7 "-" "curl/7.29.0" [root@bogon ~]#
3.还需要写一个任务计划超过多少天的日志删除减小空间占用crontab
00 * * * * find /applog/app -type f -mtime +1 -exec rm -f {} \;
静态元素过期时间
1.在虚拟主机配置文件中添加expires_module模块配置文件
[root@bogon 111.com]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType image/gif "access plus 1 days"
ExpiresByType image/jpeg "access plus 24 hours"
ExpiresByType image/png "access plus 24 hours"
ExpiresByType test/css "now plus 2 hours"
ExpiresByType application/x-javascripts "now plus 2 hours"
ExpiresByType application/x-shockwave-flash "now plus 2 hours"
ExpiresDefault "now plus 0 min"
</IfModule>
[root@bogon 111.com]# /usr/local/apache2.4/bin/apachectl -t
2.查看模块是否打开，打开expires模块
[root@bogon 111.com]# /usr/local/apache2.4/bin/apachectl -M|grep expires [root@bogon 111.com]#
[root@bogon 111.com]# /usr/local/apache2.4/bin/apachectl graceful [root@bogon 111.com]# /usr/local/apache2.4/bin/apachectl -M|grep expires expires_module (shared) [root@bogon 111.com]#
配置防盗链
1.配置文件增加，111.com和aaa.com允许，其他的拒绝
<Directory /data/wwwroot/111.com>
SetEnvIfNoCase Referer "http://111.com" local_ref
SetEnvIfNoCase Referer "http://aaa.com" local_ref
<filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif|png)">
Order Allow,Deny
Allow from env=local_ref
Deny from all
</filesmatch>
</Directory>
[root@bogon ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf [root@bogon ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@bogon ~]# /usr/local/apache2.4/bin/apachectl graceful [root@bogon ~]#
2.直接不能访问，应该ref为空，必须把这个图片放到111.com和aaa.com相关的内容里，来源ref是白名单的情况才能访问。
3.如果想在浏览器直接能访问配置空ref
SetEnvIfNoCase Referer "^$" local_ref
[root@bogon ~]# /usr/local/apache2.4/bin/apachectl graceful
4.可以用curl -e 直接创造referrer
[root@bogon ~]# curl -e "http://111.com/a.jpg" -x127.0.0.1:80 111.com/a.jpg -I HTTP/1.1 200 OK Date: Tue, 06 Feb 2018 03:45:11 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 Last-Modified: Sat, 12 Aug 2017 09:29:53 GMT ETag: "8f393-5568b126b0640" Accept-Ranges: bytes Content-Length: 586643 Cache-Control: max-age=86400 Expires: Wed, 07 Feb 2018 03:45:11 GMT Content-Type: image/jpeg [root@bogon ~]#
访问控制Directory
1.添加配置文件，创建admin目录添加index.php文件
1.看Order后面的，哪个在前，哪个在后
2.如果deny在前，那么就需要看deny from 这句，然后看allow from这一句
3.规则是一条一条的匹配的，不管是deny在前面还是allow在前，都是会生效的。比如例子中。先deny了所有，然后又allow了127.0.0.1，所以127.0.0.1是通过的。
Order allow ,deny
deny from all
allow from 127.0.0.1
这个就会deny所有了，127.0.0.1也会被deny。因为顺序是先allow然后deny，虽然一开始allow了127.0.0.1，但是后面有拒绝了它。
Order allow,deny
deny from all
上面的规则就表示，全部都不能通过
Order deny,allow
deny from all
上面的规则表示，全部都不能通过
Order deny,allow
只有顺序，没有具体规则，表示，全部都可以通行（默认的），因为allow在最后了。
Order allow,deny
这个表示，全部不能通行（默认的），因为deny在最后了。
讲完了allow ，deny我们再来看看具体的应用吧。
（1）某个目录做限制，比如该目录很重要，只允许我们公司的IP访问，当然这个目录可以使网站根目录，也就是整个站点都要做限制了。
<Directory /data/www/>
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Directory>
说明：只允许127.0.0.1访问，其他IP全部拒绝掉。
<Directory "/data/wwwroot/111.com/admin">
Order deny,allow
Deny from all # 表示禁止 1.1.1.1 访问 abc 目录
Allow from 127.0.0.1
</Directory>
[root@bogon 111.com]# mkdir admin [root@bogon 111.com]# touch index.php [root@bogon 111.com]# echo 121212 > index.php [root@bogon 111.com]# cat index.php 121212 [root@bogon 111.com]#
[root@bogon admin]# curl -x127.0.0.1:80 111.com/admin/index.php -I HTTP/1.1 200 OK Date: Tue, 06 Feb 2018 04:55:21 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 X-Powered-By: PHP/5.6.30 Cache-Control: max-age=0 Expires: Tue, 06 Feb 2018 04:55:21 GMT Content-Type: text/html; charset=UTF-8 [root@bogon admin]#
[root@bogon admin]# curl -x10.21.95.122:80 111.com/admin/index.php -I HTTP/1.1 403 Forbidden Date: Tue, 06 Feb 2018 04:56:25 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 Content-Type: text/html; charset=iso-8859-1 [root@bogon admin]#
访问控制FilesMatch
1针对请求的uri去限制，前面安装的discuz论坛，访问后台是admin.php,那我们就可以针对admin.php做限制。
<filesmatch "(.*)admin(.*)">
Order deny ,allow
Deny from all
Allow from 127.0.0.1
说明：这里用到了filesmatch语法，表示匹配的意思。
限定某个目录禁止解析php
1.某个目录下解析PHP，这个很有用，我们做网站安全的时候，这个用的很多，比如某些目录可以上传文件，为了避免上传文件有木马，所以我们禁止这个目录下面的 访问解析PHP。
2.配置文件添加如下代码，禁止upload目录下的php文件解析
<Directory "/data/wwwroot/111.com/upload">
php_admin_flag engine off
<FilesMatch (.*)\.php(.*)>
Order deny,allow
Deny from all
</FilesMatch>
</Directory>
[root@bogon admin]# mkdir /data/wwwroot/111.com/upload [root@bogon admin]# touch /data/wwwroot/111.com/upload/index.php [root@bogon admin]# echo 111 > /data/wwwroot/111.com/upload/index.php [root@bogon admin]#
3.php_admin_flag engine off这个语句就是禁止解析php的控制语句，但只这样配置还不够，因为这样配置之后用户依然可以访问PHP文件，只不过不解析了，但可以下载，用户下载PHP文件也是不合适的，所以有必要在禁止一下。
[root@bogon admin]# curl -x127.0.0.1:80 111.com/upload/index.php -I HTTP/1.1 403 Forbidden Date: Wed, 07 Feb 2018 01:41:52 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 Content-Type: text/html; charset=iso-8859-1 [root@bogon admin]#
限制user_agent
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR] # 如果要禁止多种浏>览器要在后面加[OR]，表示或者 NC 忽略大小写
RewriteCond %{HTTP_USER_AGENT} .*chrome.* [NC] # 这里禁止 curl 和 chrome 访问我们的网站（只是做实验）
RewriteRule .* - [F] # 表示 Forbidden
</IfModule>
[root@bogon admin]# /usr/local/apache2.4/bin/apachectl graceful -t Syntax OK [root@bogon admin]# /usr/local/apache2.4/bin/apachectl graceful [root@bogon admin]# curl -x127.0.0.1:80 111.com/upload/index.php -I HTTP/1.1 403 Forbidden Date: Wed, 07 Feb 2018 02:33:37 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 Content-Type: text/html; charset=iso-8859-1 [root@bogon admin]#
1. -A 模拟useragent
[root@bogon admin]# curl -A "sun sun" -x127.0.0.1:80 111.com/index.php -I HTTP/1.1 200 OK Date: Wed, 07 Feb 2018 02:35:50 GMT Server: Apache/2.4.28 (Unix) PHP/5.6.30 X-Powered-By: PHP/5.6.30 Cache-Control: max-age=0 Expires: Wed, 07 Feb 2018 02:35:50 GMT Content-Type: text/html; charset=UTF-8 [root@bogon admin]#
