Apache webpage security and security optimization--webpage cache, hidden version information, Apache anti-leech

Table of contents

--------Web cache--------

1. Check if the mod_expires module is installed

2. If the mod_expires module is not installed, recompile and install Apache to add the mod_expires module

3. Configure the mod_expires module to enable

4. Check the installation and start the service

5. Test whether the cache is effective

--------Hide version information--------

--------Apache Anti-leech--------

1. Check whether the mod_rewrite module is installed

2. If the mod_rewrite module is not installed, recompile and install Apache to add the mod_rewrite module

3. Configure the mod_rewrite module to enable

EDIT 4. Web page preparation


--------Web cache--------

1. Check if the mod_expires module is installed

apachectl -t -D DUMP_MODULES | grep "expires"

 

 

2. If the mod_expires module is not installed, recompile and install Apache to add the mod_expires module

systemctl stop httpd.service

 

cd /usr/local/httpd/conf

 

 

mv httpd.conf httpd.conf.bak2

 

 

yum -y install gcc gcc-c++ pcre pcre-devel zlib-devel
cd /opt/httpd-2.4.29/
./configure \
--prefix=/usr/local/httpd \
--enable-so \
--enable-rewrite \
--enable-charset-lite \
--enable-cgi \
--enable-deflate \
--enable-expires            #加入mod_expires 模块

 

 

make && make install

 

 

3. Configure the mod_expires module to enable

vim /usr/local/httpd/conf/httpd.conf


--line 52--Modify

Listen 192.198.80.10:80


-- Line 111 -- Uncomment

LoadModule expires_module modules/mod_expires.so        #开启mod_expires 模块


--line 199--uncomment, modify

ServerName www.kgc.com:80


--Add at the end--

<IfModule mod_expires.c>
  ExpiresActive On                                #打开网页缓存功能
  ExpiresDefault "access plus 60 seconds"         #设置缓存60秒
</IfModule>  

 

4. Check the installation and start the service

apachectl -t                                         #验证配置文件的配置是否正确
apachectl -t -D DUMP_MODULES | grep "expires"        #检查 mod_deflate 模块是否已安装
expires_module (shared)                              #已安装的正确结果

 

 

 

systemctl start httpd.service

5. Test whether the cache is effective

cat /usr/local/httpd/htdocs/index.html

Method 1 :
In the Linux system, open the Firefox browser, right-click and click View Elements,
select Network ---> select HTML, WS, and others 
to access http://192.168.110.60, double-click the 200 message to view the Expires item in the response header

 

Method 2:
Install Microsoft.NET4 and fiddler software in sequence in the Windows system, open the fiddler software,
select inspectors ---> select Headers
browser to visit http://192.168.110.60, double-click the 200 message to view the Expires item    


--------Hide version information--------

vim /usr/local/httpd/conf/httpd.conf

--line 491--uncomment

Include conf/extra/httpd-default.conf

 

vim /usr/local/httpd/conf/extra/httpd-default.conf


--line 55--Modify

ServerTokens Prod            #将原本的 Full 改为 Prod,只显示名称,没有版本
                             #ServerTokens 表示 Server 回送给客户端的响应头域是否包含关于服务器 OS 类型和编译过的模块描述信息。
systemctl restart httpd.service

Browser access http://192.168.110.60, double-click the 200 message to view the Server item

 


--------Apache Anti-leech--------

1. Check whether the mod_rewrite module is installed

apachectl -t -D DUMP_MODULES | grep "rewrite"

 

2. If the mod_rewrite module is not installed, recompile and install Apache to add the mod_rewrite module

systemctl stop httpd.service
cd /usr/local/httpd/conf
mv httpd.conf httpd.conf.bak2

 

yum -y install gcc gcc-c++ pcre pcre-devel zlib-devel


 

cd /opt/httpd-2.4.29/
./configure \
--prefix=/usr/local/httpd \
--enable-so \
--enable-rewrite \                    #加入mod_rewrite 模块
--enable-charset-lite \
--enable-cgi \
--enable-deflate \
--enable-expires

 

 

make && make install

 

3. Configure the mod_rewrite module to enable

make && make install

-- Line 157 -- Uncomment

LoadModule rewrite_module modules/mod_rewrite.so



--224行--
<Directory "/usr/local/httpd/htdocs">
  Options Indexes FollowSymLinks
  AllowOverride None
  Require all granted

 

  RewriteEngine On                                              #打开 rewrite 功能,加入 mode_rewrite 模块内容
 
  RewriteCond %{HTTP_REFERER} !^http://kgc.com/.*$ [NC]         #设置匹配规则
  RewriteCond %{HTTP_REFERER} !^http://kgc.com$ [NC]
  RewriteCond %{HTTP_REFERER} !^http://www.kgc.com/.*$ [NC]
  RewriteCond %{HTTP_REFERER} !^http://www.kgc.com/$ [NC]

  RewriteRule .*\.(gif|jpg|swf)$ http://www.kgc.com/error.png   #设置跳转动作
</Directory>

The field meaning of RewriteCond %{HTTP_REFERER} !^http://www.kgc.com/.*$ [NC]:
"%{HTTP_REFERER}": store a URL of a link, indicating which link to transfer to access the static under the directory resource.
"!^": Indicates that it does not start with the following string.
"http://www.kgc.com": It is the path of this website, matched according to the entire string.
".*$": Indicates that it ends with any character.
"[NC]": Indicates case-insensitive letters.

Field meanings of RewriteRule .*\.(gif|jpg|swf)$ http://www.kgc.com/error.png:
".": means match a character.
"*": means to match 0 to multiple characters, combined with "." means to match 0 to multiple previous characters, if it is 1 to multiple matches, you can use "+" to indicate.
"\.": "\" here is an escape character, and "\." means the symbol ".". Because "." is a regular character in the command and has a corresponding meaning. If it needs to be matched, it needs to add an escape character "\" in front of it. If other regular characters need to be matched, do the same.
"(gif|jpg|swf)": means match any of "gif", "jpg" and "swf", and "$" means end. The final rule ends with ".gif", ".jpg", and ".swf", preceded by a string of 1 to more characters, that is, a file that matches the image type.
"http://www.kgc.com/error.png": indicates forwarding to this path.

The meaning of the entire configuration is that when using a domain name other than this website to access the image file of this website, the image error.png will be displayed.

4. Web page preparation

Web source host configuration:

cd /usr/local/httpd/htdocs


Transfer the game.jpg and error.png files to the /usr/local/httpd/htdocs directory

vim index.html
<html><body><h1>this is kgc.com!</h1>
<img src="game.jpg"/>
</body></html>

Note: The webpage text in the original index.html does not need to be changed, just put the wrong picture into the /var/local/httpd/htdocs directory

 

Guess you like

Origin blog.csdn.net/2302_76824193/article/details/130945359