Apache+PHP环境下虚拟主机防被旁注
来源:互联网 发布:php 异步执行 编辑:程序博客网 时间:2024/06/07 00:50
IIS环境下比较容易实现,可以通过独立“匿名访问账户” + NTFS权限来防止。
查了一下,Apache下类似IIS的独立虚拟主机账户的方案貌似不太好实现,但有一种更简单的方法:
就是在VirtualHost节中通过添加
php_admin_value open_basedir /data/wwwroot/www.xxxxx.com
来限制当前虚拟主机PHP的操作权限仅在/data/wwwroot/www.xxxx.com目录下。
我用Phpspy测试了一下,果然很有效,未加该限制时可以列出文件)。
注意:
因为Web服务器在处理文件上传时会用到系统的临时目录(对于Linux来说就是/tmp),所以还必须要有这个目录的操作权限才可以。
php_admin_value open_basedir支持同时设置多个目录,目录之前要用:分隔。完整如下:
php_admin_value open_basedir /data/wwwroot/www.redicecn.com/:/tmp/
来自于PHP官方的更多说明:http://www.php.net/manual/en/ini.core.php#ini.open-basedir www.chnhack.com
open_basedir stringLimit the files that can be opened by PHP to the specified directory-tree, including the file itself. This directive is NOT affected by whether Safe Mode is turned On or Off.
When a script tries to open a file with, for example, fopen() or gzopen(), the location of the file is checked. When the file is outside the specified directory-tree, PHP will refuse to open it. All symbolic links are resolved, so it’s not possible to avoid this restriction with a symlink. If the file doesn’t exist then the symlink couldn’t be resolved and the filename is compared to (a resolved) open_basedir .
The special value . indicates that the working directory of the script will be used as the base-directory. This is, however, a little dangerous as the working directory of the script can easily be changed with chdir().
In httpd.conf, open_basedir can be turned off (e.g. for some virtual hosts) the same way as any other configuration directive with “php_admin_value open_basedir none“.
Under Windows, separate the directories with a semicolon. On all other systems, separate the directories with a colon. As an Apache module, open_basedir paths from parent directories are now automatically inherited.
The restriction specified with open_basedir is a directory name since PHP 5.2.16 and 5.3.4. Previous versions used it as a prefix. This means that “open_basedir = /dir/incl” also allowed access to “/dir/include” and “/dir/incls” if they exist. When you want to restrict access to only the specified directory, end with a slash. For example: open_basedir = /dir/incl/
The default is to allow all files to be opened.
Note:
As of PHP 5.3.0 open_basedir can be tightened at run-time. This means that if open_basedir is set to /www/ in php.ini a script can tighten the configuration to /www/tmp/ at run-time with ini_set(). When listing several directories, you can use the PATH_SEPARATOR
另外看到了另外一种设置临时目录的方法: http://brandonwamboldt.ca/multiple-directories-w-php-open_basedir-540/
php_admin_value open_basedir /var/www/vhosts/saebermedia.com
php_admin_value upload_tmp_dir /var/www/vhosts/saebermedia.com/.tmp
- Apache+PHP环境下虚拟主机防被旁注
- Apache与PHP环境下配置本地虚拟主机
- 关于旁注虚拟主机 经验
- windows下配置虚拟主机wamp php+apache
- Windows Apache 下防 PHP 木马设置
- 【LAMP环境搭建】Apache和PHP结合、Apache默认虚拟主机
- PHP环境搭建:设置Zend+Apache Httpd的虚拟主机
- PHP Apache 配置虚拟主机
- 用vhost.map 实现APACHE虚拟主机方式(win7环境下)
- Linux环境下Apache配置多个虚拟主机
- Windows下的Apache+PHP+MySql+虚拟主机设置全功略
- Windows下的Apache+PHP+MySql+虚拟主机设置全功略
- LINUX下 PHP+JSP+MYSQL+APACHE+RESIN虚拟主机配置过程
- Apache下配置虚拟主机
- PHP服务器Apache虚拟主机配置
- php Apache 虚拟主机配置方法
- php设置Apache虚拟主机vhost
- php设置Apache虚拟主机vhost
- csdn第四课····
- 使用google code托管开源项目时,/hosting/settings页面被墙的靠谱解决方法
- 使用crosstool-0.43构建arm交叉编译工具链
- 多态性
- str
- Apache+PHP环境下虚拟主机防被旁注
- 周立功写给学单片机的年轻人
- 我的C/C++之路(004课)
- java 解析 plist文件
- 如何学好Java
- nasm-64_hello.asm
- 2010年浙江大学计算机及软件工程研究生机试真题(1)
- kill函数,raise函数,alarm函数,pause函数
- 手机银行有哪些安全注意事项