如何将你的 apache 把控的'密不透风'

# vi /usr/local/httpd/conf/httpd.conf
ServerRoot "/usr/local/httpd-2.2.34" # 定义apache的安装目录
Listen 80       # apache默认监听的web端口,没有指定ip的情况下,默认是监听在0.0.0.0
Listen 81       # 在后面配置基于端口的虚拟主机时需要先在此定义好监听端口
Listen 82
<IfModule !mpm_netware_module>
<IfModule !mpm_winnt_module>
User httpd   	# apache的服务用户,再次强调,不要傻到用root身份来运行apache服务
Group httpd  	# apache的服务用户组
</IfModule>
</IfModule>
ServerAdmin klion@sec.org    # 管理员邮箱地址
ServerName 127.0.0.1:80	     # 解决FQDN的问题
<Directory />		     # 对系统根目录的权限设置
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow	     # 禁止用户直接访问系统根目录
    Deny from all			
</Directory>
<IfModule dir_module>
    DirectoryIndex index.html index.php  # 设置主页索引文件
</IfModule>
<FilesMatch "^\.ht">	# 当匹配到以.ht开头的文件apache要做什么样的反应
    Order allow,deny
    Deny from all
    Satisfy All
</FilesMatch>
ErrorLog "logs/error_log" 	# apache自身的错误日志存放位置 
LogLevel warn			# 定义apache日志的报告级别,默认是警告
<IfModule log_config_module>	# 定义访问日志格式
    # 在下面combined格式日志中还要多记录一个字段`X-Forwarded-For`,用于记录客户端真实ip
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Forwarded-For}i\"" combined 
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" common
</IfModule>
DefaultType text/plain
<IfModule headers_module>
    RequestHeader unset Proxy early
</IfModule>
<IfModule mime_module>	# mime类型设定,也就是说,遇到什么类型的文件就做什么样的操作
    TypesConfig conf/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz	
    # 意思就是说,当apache遇到.php这样的后缀就丢给libphp5模块去处理,也就是说,如果这里是.jpg,它依然会被当做php去解析,如,图片马...
    AddType application/x-httpd-php .php 
</IfModule>
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Include conf/extra/httpd-mpm.conf  # 包含apache扩展配置文件
Include conf/extra/httpd-vhosts.conf	  
Include conf/extra/httpd-default.conf
<Directory "/var/html/bwapp">
    # 我们在Indexes前面加上了'-',意思就是禁止目录遍历,防止敏感文件泄露,此项非常重要,另外,关闭CGI,SSI,以及Follow Symbolic Links
    Options -Indexes -Includes -ExecCGI –FollowSymLinks 
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>
<Directory "/var/html/dvws">
    Options -Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>
<Directory "/var/html/drupal7">
    Options -Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>
#LoadModule php5_module  /usr/local/httpd-2.2.34/modules/libphp5.so
LoadModule php5_module   modules/libphp5.so	# 该模块在你编译安装完php以后会自动生成并自动加入该配置文件
#LoadModule rewrite_module modules/mod_rewrite.so
TraceEnable off 	# 禁用trace方法,防止xss

# vi /usr/local/httpd/conf/extra/httpd-vhosts.conf
NameVirtualHost *:81
<VirtualHost *:81>
    ServerAdmin dvws@sec.org
    DocumentRoot "/var/html/dvws"
    ServerName dvws.cc
    ServerAlias www.dvws.cc
    ErrorLog "logs/dvws-error_log"
    CustomLog "logs/dvws-access_log" combined
</VirtualHost>

# vi /usr/local/httpd/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
    ServerAdmin bwapp@sec.org
    DocumentRoot "/var/html/bwapp"
    ServerName bwapp.cc
    ServerAlias www.bwapp.cc
    ErrorLog "logs/bwapp-error_log"
    CustomLog "|/usr/local/sbin/cronolog /usr/local/httpd/logs/bwapp-access_%Y%m%d.log" combined
</VirtualHost>
# /usr/local/httpd/bin/apachectl -t
# /usr/local/httpd/bin/apachectl graceful

# vi /usr/local/httpd/conf/httpd.conf
<Directory "/var/html/bwapp">
    SetEnvIf Request_URI ".*\.gif$" img
    SetEnvIf Request_URI ".*\.jpg$" img
    SetEnvIf Request_URI ".*\.png$" img
    SetEnvIf Request_URI ".*\.bmp$" img
    SetEnvIf Request_URI ".*\.swf$" img
    SetEnvIf Request_URI ".*\.js$" img
    SetEnvIf Request_URI ".*\.css$" img
    Options -Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

# vi /usr/local/httpd/conf/extra/httpd-vhosts.conf
<VirtualHost *:80>
    ServerAdmin bwapp@sec.org
    DocumentRoot "/var/html/bwapp/bWAPP/"
    ServerName bwapp.cc
    ServerAlias www.bwapp.cc
    ErrorLog "logs/bwapp-error_log"
    CustomLog "|/usr/local/sbin/cronolog /usr/local/httpd/logs/bwapp-access_%Y%m%d.log" combined env=!img
</VirtualHost>

<Directory "/var/html/bwapp/bWAPP/upload">
<FilesMatch "\.(?i:php|php3|php4|php5)$">
    Order allow,deny
    Deny from all
</FilesMatch>
</Directory>

<Directory "/var/html/bwapp/bWAPP/admin_login">
    Order deny,allow
    allow from 192.168.3.0/24
    deny from all
</Directory>