用Apache Proxy的指令改进LAMP安全性-技术开发专区

用Apache Proxy的指令改进LAMP安全性

作者：ITPUB论坛编辑： ITPUB实习编辑 2008-07-01 00:00

后端 Apache 实例的配置
清单 2 和清单 3 中的代码片段说明了与标准 Apache 配置的基本差异。应该根据需要将它们添加到适当的配置中，比如这里忽略的 PHP 功能配置。
清单 2. 在线创业企业的 Apache 配置:

# Stuff every Apache configuration needs
            ServerType standalone
            LockFile /var/lock/apache/accept.startup.lock
            PidFile /var/run/apache.startup.pid
            ServerName necessaryevil.startup.tld
            DocumentRoot "/home/startup/web"
            # Essential modules
            LoadModule access_module /usr/lib/apache/1.3/mod_access.so
            # Which user to run this Apache configuration as
            User startup
            Group startup
            # This must be off else the host isn't passed correctly
            UseCanonicalName Off
            # The IP/port combination to listen on
            Listen 127.0.0.2:10000
            # Using name-based virtual hosting allows
            you to host multiple sites per IP/port combo
            NameVirtualHost 127.0.0.2:10000
            
            ServerName www.startup.tld
            # You can add aliases so long as the facade server is aware of them!
            ServerAlias startup.tld
            DocumentRoot "/home/startup/web/www.startup.tld"
            
            Options Indexes FollowSymLinks MultiViews ExecCGI Includes
            AllowOverride All
            Order allow,deny
            Allow from all

清单 3. 个人客户的 Apache 配置

# Stuff every Apache configuration needs
            ServerType standalone
            LockFile /var/lock/apache/accept.nimrod.lock
            PidFile /var/run/apache.nimrod.pid
            ServerName necessaryevil.nimrod.tld
            DocumentRoot "/home/nimrod/web"
            # Essential modules
            LoadModule access_module /usr/lib/apache/1.3/mod_access.so
            # Which user to run this Apache configuration as
            User nimrod
            Group nimrod
            # This must be off else the host isn't passed correctly
            UseCanonicalName Off
            # The IP/port combination to listen on
            Listen 127.0.0.2:10001
            # Using name-based virtual hosting allows you
            to host multiple sites per IP/port combo
            NameVirtualHost 127.0.0.2:10001
            
            ServerName www.reckless.tld
            # You can add aliases so long as the facade server is aware of them!
            ServerAlias reckless.tld
            DocumentRoot "/home/nimrod/web/www.reckless.tld"
            
            Options Indexes FollowSymLinks MultiViews ExecCGI Includes
            AllowOverride All
            Order allow,deny
            Allow from all

清单 4. 门面 Apache 实例的 Apache 配置

# Stuff every Apache configuration needs
            LockFile /var/lock/apache/accept.www-data.lock
            PidFile /var/run/apache.www-data.pid
            ServerName necessaryevil.facade.server
            DocumentRoot "/home/www-data"
            # Essential modules
            LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
            LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so
            # Which user to run this Apache configuration as
            User www-data
            Group www-data
            # These must be set else the host isn't passed correctly
            UseCanonicalName Off
            ProxyVia On
            ProxyRequests Off
            # This must also be set, though it's only an option in Apache2
            ProxyPreserveHost On
            # The IP/port combination to listen on
            Listen 9.20.1.1:80
            # Using name-based virtual hosting allows
            you to host multiple sites per IP/port combo
            NameVirtualHost 9.20.1.1:80
            # Configuration to forward requests for startup.tld
            
            ServerName www.startup.tld
            ServerAlias startup.tld
            ProxyPass / http://127.0.0.2:10000/
            ProxyPassReverse / http://127.0.0.2:10000/
            ProxyPassReverse / http://www.startup.tld:10000/
            ProxyPassReverse / http://startup.tld:10000/
            # Configuration to forward requests for reckless.tld
            
            ServerName www.reckless.tld
            ServerAlias reckless.tld
            ProxyPass / http://127.0.0.2:10001/
            ProxyPassReverse / http://127.0.0.2:10001/
            ProxyPassReverse / http://www.reckless.tld:10001/
            ProxyPassReverse / http://reckless.tld:10001/

一定要注意这里的 ProxyPreserveHost 指令。这个指令是 Apache 2 提供的，它解决了将正确的 HTTP 头转发给后端服务器的一些问题。因此，强烈建议使用 Apache 2 实例作为 facade 服务器。

第1页：用Apache Proxy的指令改进LAMP安全性(1 第2页：用Apache Proxy的指令改进LAMP安全性(2)第3页：用Apache Proxy的指令改进LAMP安全性(3)

关注我们