Apache: rewrite Jump security chain

lab environment

第一台centos7源码安装apache2.4.38 IP 192.169.1.13 关闭防火墙

A .rewrite Jump

Rewrite main function is to achieve rewrite the URL. It is based on regular expression rules Perl language, for modifying inbound HTTP request Url. These rules, such as the presentation of more user-friendly URL namespace for several purposes for your Web site, the request Url redirected to a new location, or block access to Url to provide services.

简单来说,作用就是,例如输入baidu.com实际上跳转跳转到了www.baidu.com,这就是rewrite跳转, 只是对用户访问的URL更加友好

This example domain is www.ajbn.com, such as access ajbn.com.cn, or ajbn.com all jump to www.ajbn.com

1. Installation rewrite module

On the use of DOS mode installation, you compile the source code when --enable-rewrite mode [root @ apache1 ~] # apxs -c -i -a /root/httpd-2.4.38/modules/mappers/mod_rewrite.c [ apache1 ~ @ root] # apachectl -M | grep rewrite #DOS installation
不过编译的时候安装的,检测不出来,最好使用DOS安装一次


rewrite_module (shared)

2. modify the configuration file

跳转可以基于指定某个虚拟主机,和基于某个指定目录,我们这里做全局配置,就是所有目录,和所有虚拟主机生效

Enter the main configuration file to modify parameters

[root @ apache1 ~] # vim /usr/local/httpd/conf/httpd.conf
Search Group key word, add the following below

RewriteEngine on
RewriteCond %{HTTP_HOST} !^www.ajbn.com [NC]
RewriteCond %{HTTP_HOST} !^192.168.1.13 [NC]
RewriteCond %{HTTP_HOST} !^$
RewriteRule ^/(.*) http://www.ajbn.com/ [L]

Here Insert Picture Description
Explain
RewriteEngine on `: open rewrite Jump

RewriteCond %{HTTP_HOST} !^www.ajbn.com [NC]: Indicates the domain name for client access (host headers) are not www.ajbn.com, [NC] mean ignoring the Client Access domain name case

RewriteCond %{HTTP_HOST} !^192.168.1.13 [NC]:It indicates that the client is not using 192.168.1.13IP accessed here [NC] no effect

RewriteCond %{HTTP_HOST} !^$ :Access domain (host headers) are not empty '

RewriteRule ^/(.*) http://www.ajbn.com/ [L] :If the client indicates domain names (host head), the composite above conditions, the process directly jumps to www.ajbn.com, [L]: This is the last rule, the matching stops here

[root@apache1 ~]# echo "<h1>God Bye</h1>" >> /usr/local/httpd/htdocs/index.html
[root@apache1 ~]# /etc/init.d/apache restart

3. Modify the two hosts file

模拟公网环境,这些域名都被注册

The first is the server itself

[root@apache1 ~]# vim /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.13 www.ajbn.com
192.168.1.13 ajbn.ajbn.com
192.168.1.13 ajbn.com
192.168.1.13 ajbn.com.cn

Client

You can use the real machine windows, C: \ Windows \ System32 \ drivers \ etc have a hosts file, use Notepad to open, slipping Finally, add the following, and save

If the display is saved when the Save As, can not, put the file onto the desktop, and then modified in tow back cover
Here Insert Picture Description

4. Access test

Browser to access the test ajbn.ajbn.com or just write to any address hosts
have to jump up as follows
Here Insert Picture Description

II. Configuring anti-hotlinking

The concept of anti-hotlinking

If that is not a picture on my site, but there are other sites when accessed by a client this image on my site, automatic return to the client a URL, and the URL is someone else's site, the client automatically I went to visit the designated website,

客户端看不到这个过程,实际上一直还是在我的网站上,浪费了他人网站的带宽,骗取了浏量

防盗链就是为了,拒绝转发过来的这种连接,而返回一个自己定义资源,不会影响正常连接

1. Module

还是上面的机器
Anti-theft chain, you need to install and open rewrite module, it opens the default is not open when we installed above DOS, is as follows, into the httpd.conf

LoadModule rewrite_module     modules/mod_rewrite.so

2. modify the configuration file

We do here is global, most of all directories, and virtual hosts to take effect

[root@apache1 ~]# vim /usr/local/httpd/conf/httpd.conf
为防止干扰,把我们上面添加的rewrite的语句都删了,添加如下语句,还是关键词Group下面

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !ajbn\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !www\.ajbn\.com/.*$ [NC]
RewriteRule .*\.(gif|jpg|swf)$ http://www.ajbn.com/2.jpg [R,NC,L]

Here Insert Picture Description
Explain
RewriteEngine on: open rewrie jump must be open, otherwise it is impossible to achieve
RewriteCond %{HTTP_REFERER} !^$: the host header is not empty
RewriteCond %{HTTP_REFERER} !ajbn\.com/.*$ [NC]: the host header is not ajbn.com, [NC] to ignore the meaning of the case the host header
RewriteCond %{HTTP_REFERER} !www\.ajbn\.com/.*$ [NC] :host header is not www.ajb.com

RewriteRule .*\.(gif|jpg|swf)$ http://www.ajbn.com/2.jpg [R,NC,L]: meet the above conditions and return to their designated a picture, do not meet the above conditions return the correct picture
[R] is forced to jump the meaning of [L] this is the last rule

Web sites and route (gif | | jpg swf) and the meaning behind that is that if these resources format on this website, stolen, then returned to their designated images 2.jpg, if not properly display these formats are stolen pictures

3. Prepare the contents of two different jpg format pictures

Named in the windows as 1.jpg and 2.jpg uploaded to the apache server's / usr / local / htdocs / under
Here Insert Picture Description
1.jpg as stolen pictures, 2.jpg returned as picture
[root @ apache1 htdocs] # / etc / the init .d / apache restart

4. re-open a virtual machine as a machine theft pictures

再开启一台centos7,IP 192.168.1.14 ,关闭防火墙,yum安装httpd服务
[root@apache2 ~]# yum -y install httpd
[root@apache2 ~]# cd /var/www/html/
[root@apache2 html]# ls
[root@apache2 html]# vim index.html
<h1>盗取图片测试 </h1>
<a href="http://www.ajbn.coim/1.jpg">测试</a>

5. Test stolen pictures

Access 192.168.1.14, and point hyperlinks,
Here Insert Picture Description
access is 1.jpg, 2.jpg content is displayed, because it belongs to the site after forwarding a connection is called Pirates of the picture, we will display the specified above picture normal access 1.jpg without passing through the forwarding site (Pirates) will not go wrong
如果提示重定向过多,或者显示的是1.jpg就是浏览器的问题,多换几个浏览器试一试就可以
Here Insert Picture Description

Here Insert Picture Description

Experiment was a success! !

Published 54 original articles · won praise 57 · views 20000 +

Guess you like

Origin blog.csdn.net/weixin_45308292/article/details/104690423