Linux 运维手册之 APACHE 网页服务

LOGO

软件部署

APACHE 是一个软件基金会旗下有很多款软件。但是一般提到 APACHE 都是指代其网页服务器 HTTPD ，因此本文后提到的 APACHE 统一指代 HTTPD 服务。

常见的 Linux 发行版都内置了 Apache 仓库，只不过更新频率较慢，特别是 Radhat 系列仓库（Fedora 除外）。

导入仓库源

1). 为 RHEL 或 CentOS 设置 yum 仓库，例如编辑：

$ sudo vi /etc/yum.repos.d/httpd.repo

插入以下内容：

[CodeIT]
name=CodeIT repo
baseurl=https://repo.codeit.guru/packages/OS/OSRELEASE/$basearch/
enabled=1
gpgkey=https://repo.codeit.guru/RPM-GPG-KEY-codeit
gpgcheck=1

小贴士：需要将 "< OS >" 替换为系统发行版，将 "< OSRELEASE >" 替换为系统版本。

例如：在 CentOS 7 上可以使用

[CodeIT]
name=CodeIT repo
baseurl=https://repo.codeit.guru/packages/centos/7/$basearch
enabled=1
gpgkey=https://repo.codeit.guru/RPM-GPG-KEY-codeit
gpgcheck=1

2). Debian 或 Ubuntu 及其衍生版无需设置仓库即可直接安装，但是仓库内的版本低于官方最新版

从仓库安装

配置仓库后即可使用官方的软件包管理命令安装仓库中的最新版本。

在 RHEL 或 CentOS 从官方仓库安装 Apache：

# yum makecache
# yum install httpd

在 Debian 或 Ubuntu 从官方仓库安装 Apache：

# apt update
# apt install apache

小贴士：在 RedHat 系列发行版中包名为 httpd ，在 Debian 系列发行版中为 apache。

快捷安装

使用此命令可以一键配置仓库（仅 CentOS ），需要使用 wget 命令。

# cd /etc/yum.repos.d && wget https://repo.codeit.guru/codeit.el`rpm -q --qf "%{VERSION}" $(rpm -q --whatprovides redhat-release)`.repo

然后从仓库安装即可。

# yum makecache
# yum install httpd

软件配置

软件包的内容可用以下命令进行查看。

# rpm -ql httpd

重点目录为以下几个

配置：/etc/httpd/
站点：/var/www/html/
日志：/var/log/httpd/

日志文件默认情况下有以下两种

access_log      # 站点访问成功记录
error_log       # 站点访问失败记录

查看版本

# httpd -V
Server version: Apache/2.4.38
Server built:   Jan 19 2019 20:40:31
Server's Module Magic Number: 20120211:83
Server loaded:  APR 1.5.2, APR-UTIL 1.5.2
Compiled using: APR 1.5.2, APR-UTIL 1.5.2
Architecture:   64-bit
Server MPM:     event
  threaded:     yes (fixed thread count)
    forked:     yes (variable process count)
Server compiled with....
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=256
 -D HTTPD_ROOT="/etc/httpd"
 -D SUEXEC_BIN="/usr/sbin/suexec"
 -D DEFAULT_PIDLOG="/run/httpd/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"

小贴士：2.2 版本使用 Prefork 模型；2.4 版本后与 NGINX 一致使用 Event 模型，更加高效。

Apache 一共有 3 种稳定的 MPM 模式（多进程处理模块）：Prefork、Worker、Event。

Prefork 工作模式

服务在启动之初，就预先fork一些子进程，然后等待请求进来。之所以这样做，是为了减少频繁创建和销毁进程的开销。每个子进程只有一个线程，在一个时间点内，只能处理一个请求。

优点：成熟稳定，兼容所有新老模块。同时，不需要担心线程安全的问题。
缺点：一个进程相对占用更多的系统资源，消耗更多的内存。而且，它并不擅长处理高并发请求。

Worker 工作模式

使用了多进程和多线程的混合模式。它也预先fork了几个子进程(数量比较少)，然后每个子进程创建一些线程，同时包括一个监听线程。每个请求过来，会被分配到1个线程来服务。线程比起进程会更轻量，因为线程通常会共享父进程的内存空间，因此，内存的占用会减少一些。在高并发的场景下，因为比起 Prefork 有更多的可用线程，表现会更优秀一些。

优点：占据更少的内存，高并发下表现更优秀。
缺点：必须考虑线程安全的问题。

Event 工作模式

与 Worker 模式很像，最大的区别在于，它解决了 keep-alive 场景下，长期被占用的线程的资源浪费问题。Event MPM 中，会有一个专门的线程来管理这些 keep-alive 类型的线程，当有真实请求过来的时候，将请求传递给服务线程，执行完毕后，又允许它释放。这样增强了高并发场景下的请求处理能力。

优点：占用内存较少，高并发下表现非常优秀。
缺点：HTTPS 下多路复用较差。

HTTP 采用 keepalive 方式减少TCP连接数量，但是由于需要与服务器线程或进程进行绑定，导致一个繁忙的服务器会消耗完所有的线程。Event MPM 是解决这个问题的一种新模型。

它把服务进程从连接中分离出来。在服务器处理速度很快，同时具有非常高的点击率时，可用的线程数量就是关键的资源限制，此时 Event MPM 方式是最有效的，但不能在 HTTPS 访问下工作。

虚拟主机

与 NGINX 相同，阿帕奇也支持虚拟主机。

# mkdir /var/www/website1 /var/www/website2

编辑配置文件

<Virtualhost 192.168.1.188>
   DocumentRoot /var/www/website1
   DirectoryIndex index.html
   ServerName www.domain1.com
   ServerAdmin root@domain1.com
   ErrorLog  logs/error_log
   CustomLog  logs/access_log common
</Virtualhost>
<Virtualhost 192.168.1.188>
   DocumentRoot /var/www/website2
   DirectoryIndex index.html
   ServerName www.domain2.com
   ServerAdmin root@domain2.com
   ErrorLog  logs/error_log
   CustomLog  logs/access_log common
</Virtualhost>

配置文件说明

# cat /etc/httpd/conf/httpd.conf

其中注释的部分为配置的详细说明（英文），官方说明最为准确。

#
# This is the main Apache HTTP server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
# In particular, see 
# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
# for a discussion of each configuration directive.
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  
#
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path.  If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so 'log/access_log'
# with ServerRoot set to '/www' will be interpreted by the
# server as '/www/log/access_log', where as '/log/access_log' will be
# interpreted as '/log/access_log'.

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# Do not add a slash at the end of the directory path.  If you point
# ServerRoot at a non-local disk, be sure to specify a local disk on the
# Mutex directive, if file-based mutexes are used.  If you wish to share the
# same ServerRoot for multiple httpd daemons, you will need to change at
# least PidFile.
#
ServerRoot "/etc/httpd"

#
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, instead of the default. See also the <VirtualHost>
# directive.
#
# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses.
#
#Listen 12.34.56.78:80
Listen 80

#
# Dynamic Shared Object (DSO) Support
#
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Statically compiled modules (those listed by `httpd -l') do not need
# to be loaded here.
#
# Example:
# LoadModule foo_module modules/mod_foo.so
#
Include conf.modules.d/*.conf

#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.  
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User apache
Group apache

# 'Main' server configuration
#
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition.  These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
#
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
#

#
# ServerAdmin: Your address, where problems with the server should be
# e-mailed.  This address appears on some server-generated pages, such
# as error documents.  e.g. admin@your-domain.com
#
ServerAdmin root@localhost

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80

#
# Deny access to the entirety of your server's filesystem. You must
# explicitly permit access to web content directories in other 
# <Directory> blocks below.
#
<Directory />
    AllowOverride none
    Require all denied
</Directory>

#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#

#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
DocumentRoot "/var/www/html"

#
# Relax access to content within /var/www.
#
<Directory "/var/www">
    AllowOverride None
    # Allow open access:
    Require all granted
</Directory>

# Further relax access to the default document root:
<Directory "/var/www/html">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #
    AllowOverride None

    #
    # Controls who can get stuff from this server.
    #
    Require all granted
</Directory>

#
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
#
<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<Files ".ht*">
    Require all denied
</Files>

#
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog "logs/error_log"

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "logs/access_log" common

    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
    #
    # Redirect: Allows you to tell clients about documents that used to 
    # exist in your server's namespace, but do not anymore. The client 
    # will make a new request for the document at its new location.
    # Example:
    # Redirect permanent /foo http://www.example.com/bar

    #
    # Alias: Maps web paths into filesystem paths and is used to
    # access content that does not live under the DocumentRoot.
    # Example:
    # Alias /webpath /full/filesystem/path
    #
    # If you include a trailing / on /webpath then the server will
    # require it to be present in the URL.  You will also likely
    # need to provide a <Directory> section to allow access to
    # the filesystem path.

    #
    # ScriptAlias: This controls which directories contain server scripts. 
    # ScriptAliases are essentially the same as Aliases, except that
    # documents in the target directory are treated as applications and
    # run by the server when requested rather than as documents sent to the
    # client.  The same rules about trailing "/" apply to ScriptAlias
    # directives as to Alias.
    #
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

</IfModule>

#
# "/var/www/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
#
<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    #
    # TypesConfig points to the file containing the list of mappings from
    # filename extension to MIME-type.
    #
    TypesConfig /etc/mime.types

    #
    # AddType allows you to add to or override the MIME configuration
    # file specified in TypesConfig for specific file types.
    #
    #AddType application/x-gzip .tgz
    #
    # AddEncoding allows you to have certain browsers uncompress
    # information on the fly. Note: Not all browsers support this.
    #
    #AddEncoding x-compress .Z
    #AddEncoding x-gzip .gz .tgz
    #
    # If the AddEncoding directives above are commented-out, then you
    # probably should define those extensions to indicate media types:
    #
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz

    #
    # AddHandler allows you to map certain file extensions to "handlers":
    # actions unrelated to filetype. These can be either built into the server
    # or added with the Action directive (see below)
    #
    # To use CGI scripts outside of ScriptAliased directories:
    # (You will also need to add "ExecCGI" to the "Options" directive.)
    #
    #AddHandler cgi-script .cgi

    # For type maps (negotiated resources):
    #AddHandler type-map var

    #
    # Filters allow you to process content before it is sent to the client.
    #
    # To parse .shtml files for server-side includes (SSI):
    # (You will also need to add "Includes" to the "Options" directive.)
    #
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

#
# Specify a default charset for all content served; this enables
# interpretation of all content as UTF-8 by default.  To use the 
# default browser choice (ISO-8859-1), or to allow the META tags
# in HTML content to override this choice, comment out this
# directive:
#
AddDefaultCharset UTF-8

<IfModule mime_magic_module>
    #
    # The mod_mime_magic module allows the server to use various hints from the
    # contents of the file itself to determine its type.  The MIMEMagicFile
    # directive tells the module where the hint definitions are located.
    #
    MIMEMagicFile conf/magic
</IfModule>

#
# Customizable error responses come in three flavors:
# 1) plain text 2) local redirects 3) external redirects
#
# Some examples:
#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html
#

#
# EnableMMAP and EnableSendfile: On systems that support it, 
# memory-mapping or the sendfile syscall may be used to deliver
# files.  This usually improves server performance, but must
# be turned off when serving from networked-mounted 
# filesystems or if support for these functions is otherwise
# broken on your system.
# Defaults if commented: EnableMMAP On, EnableSendfile Off
#
#EnableMMAP off
EnableSendfile on

# Supplemental configuration
#
# Load config files in the "/etc/httpd/conf.d" directory, if any.
IncludeOptional conf.d/*.conf

隐藏版本号

隐藏服务版本号，与 NGINX 相似，安全漏洞与版本号挂钩，因此隐藏版本号很重要。

在配置文件的最后（include 语句前）加入以下两行即可。

ServerTokens ProductOnly
ServerSignature Off

用户认证

为网站添加用户认证步骤

在所需加密的页面所在虚拟主机的配置文件中修改

<VirtualHost *:80>
    DocumentRoot "/var/www/html"
ServerName www.domain.com
ServerAlias www.abc.com
    <Directory /var/www/html/admin.php>
        AllowOverride AuthConfig
        AuthName "Please input you acount."
        AuthType Basic
        AuthUserFile /var/www/html/.htpasswd
        require valid-user
    </Directory>
</VirtualHost>

创建认证文件

# htpasswd -c /var/www/html/.htpasswd admin
# htpasswd -m /var/www/html/.htpasswd kane

小贴士：-c 选项首次创建文件，-m 选项添加用户。

重启服务

# apachectl -t
# apachectl graceful

小贴士：apachectl graceful 与 reload 功能一致。

域名重写

配置域名跳转

# cat /etc/httpd/conf.d/vvave.net.conf

单域名跳转

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_HOST} ^www.vvave.net$
    RewriteRule ^/(.*)$ http://www.123.com/$1 [R=301,L]
</IfModule>

最终效果：当访问 www.vvave.net 时，跳转到 www.123.com 。

多域名跳转

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_HOST} ^www.vvave.net$ [OR]
    RewriteCond %{HTTP_HOST} ^www.wave.red$
    RewriteRule ^/(.*)$ http://www.123.com/$1 [R=301,L]
</IfModule>

日志切割

每当有访客访问网站，就会记录日志。当然前提是已经设置了日志，日志不去管理，时间长了日志文件会越来越大，如何避免产生巨型日志文件。实际上阿帕奇自带日志切割功能，不需要系统相关组件。使日志按照需求进行归档，比如每天一个新日志，或者每小时一个新的日志。

设置日志的路径名称

# cat /etc/httpd/conf.d/vvave.net.conf

添加以下内容

ErrorLog "logs/error.log"
CustomLog "logs/access.log" combined

指定了日志存放在 logs/ 目录下分别为 error.log 和 access.log，combined 为日志显示的格式，日志格式可以参考配置文件 httpd.conf 中格式的指定。

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common

设置日志分割

ErrorLog "|/usr/sbin/rotatelogs -l /var/log/httpd/www-error_%Y%m%d.log 86400"
CustomLog "|/usr/sbin/rotatelogs -l /var/log/httpd/www-access_%Y%m%d.log 86400" combined

小贴士：ErrorLog 是错误日志，CustomLog 是访问日志。| 就是管道符，意思是把产生的日志交给阿帕奇内置切割日志工具。-l 的作用是校准时区为 UTC，也就是北京时间。86400，单位是秒，正好是一天，那么日志会每天切割一次。而最后面的 combined 为日志的格式。

指定文件类型的日志

如果一个网站访问量特别大，那么访问日志就会很多，但有一些访问日志我们其实是可以忽略掉的，比如网站的一些图片，还有js、css等静态对象。而这些文件的访问往往是巨量的，而且即使记录这些日志也没有什么用，那么如何忽略不记录这些日志呢？

1、配置日志不记录图片的访问

SetEnvIf Request_URI ".*\.gif$" image-request
SetEnvIf Request_URI ".*\.jpg$" image-request
SetEnvIf Request_URI ".*\.png$" image-request
SetEnvIf Request_URI ".*\.bmp$" image-request
SetEnvIf Request_URI ".*\.swf$" image-request
SetEnvIf Request_URI ".*\.js$"  image-request
SetEnvIf Request_URI ".*\.css$" image-request
CustomLog "|/usr/local ... _%Y%m%d.log 86400" combined env=!image-request

小贴士：在原来日志配置基础上，增加了一些image-request的定义，比如把gif、jpg、bmp、swf、js、css等结尾的全标记为image-request，然后在配置日志后加一个标记env=!image-request，表示取反，即不记录日志。

配置静态缓存

所说的静态文件指的是图片、js、css等文件，用户访问一个站点，其实大多数元素都是图片、js、css等，这些静态文件其实是会被客户端的浏览器缓存到本地电脑上的，目的就是为了下次再请求时不再去服务器上下载，这样就加快了速度，提高了用户体验。但这些静态文件总不能一直缓存，它总有一些时效性，那么就得设置这个过期时间。

配置静态缓存

<IfModule mod_expires.c>
    ExpiresActive on
    ExpiresByType image/gif "access plus 1 days"
    ExpiresByType image/jpeg "access plus 24 hours"
    ExpiresByType image/png "access plus 24 hours"
    ExpiresByType text/css "now plus 2 hour"
    ExpiresByType application/x-javascript "now plus 2 hours"
    ExpiresByType application/javascript "now plus 2 hours"
    ExpiresByType application/x-shockwave-flash "now plus 2 hours"
    ExpiresDefault "now plus 0 min"
</IfModule>

也可使用 mod_headers 模块实现：

<IfModule mod_headers.c>
    # htm,html,txt 类的文件缓存一个小时
    <filesmatch "\.(html|htm|txt)$">
        header set cache-control "max-age=3600"
    </filesmatch>
    
    # css, js, swf 类的文件缓存一个星期
    <filesmatch "\.(css|js|swf)$">
        header set cache-control "max-age=604800"
    </filesmatch>
    
    # jpg,gif,jpeg,png,ico,flv,pdf 等文件缓存一年
    <filesmatch "\.(ico|gif|jpg|jpeg|png|flv|pdf)$">
        header set cache-control "max-age=29030400"
    </filesmatch>
</IfModule>

小贴士：这里的时间单位可以 days、 hours 甚至是 min，两种不同的方法，上面使用的是mod_expires，而下面用的是 mod_headers，要想使用这些模块，必须要事先已经支持。

配置防盗链

配置防盗链

SetEnvIfNoCase Referer "^http://.*\.123\.com" local_ref
SetEnvIfNoCase Referer ".*\.abc\.com" local_ref
SetEnvIfNoCase Referer "^$" local_ref
<filesmatch "\.(txt|doc|mp3|zip|rar|jpg|gif)">
    Order Allow,Deny
    Allow from env=local_ref
</filesmatch>

小贴士：在这段配置中涉及到一个名词 referer，其实就是上次访问的网站链接。配置referer是根据来源链接做限制的，如果来源链接不是想要的，就直接拒绝，这就是防盗链的原理。当然不止是图片，mp3、rar、zip等文件同样支持。上述配置中默认是除了定义的列表中的referer，其它都拒绝。

禁止解析动态文件

某个目录下禁止解析PHP，这个很有作用，比如某些目录可以上传文件，为了避免上传的文件有木马，所以禁止这个目录下面的访问解析PHP。

<Directory /var/www/html/domain>
    php_admin_flag engine off 
    <filesmatch "(.*)php">
        Order deny,allow
        Deny from all 
    </filesmatch>
</Directory>

小贴士：php_admin_flag engine off 这个语句就是禁止解析控制语句。

禁止指定 UA

可避免一些无用的搜索引擎或爬虫之类引起的带宽的无辜消耗。

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{HTTP_HOST} ^www.abc.com$ [OR]
    RewriteCond %{HTTP_HOST} ^www.abcd.com$
    RewriteRule ^/(.*)$ http://www.123.com/$1 [R=301,L]

    RewriteCond %{HTTP_USER_AGENT} ".*Firefox.*" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} ".*Tomato Bot.*" [NC]
    RewriteRule .* - [F] 
</IfModule>

小贴士：同样是使用重写模块来实现限制指定 UA。本例中，RewriteRule .* - [F]可以直接禁止访问，rewritecond用user_agent来匹配，NC表示不区分大小写，OR表示或者，连接下一个条件。

假如要把百度的搜索引擎限制掉，可以加一条这样的规则：

RewriteCond %{HTTP_USER_AGENT} ^.*Baiduspider/2.0.* [NC]
RewriteRule .* - [F]

限制某个目录

可以allow和deny去现在网站根目录下的某个子目录，当然这个rewrite也可以实现，配置如下：

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^.*/tmp/* [NC]
    RewriteRule .* - [F]
</IfModule>

小贴士：这段配置会把只要是包含 /tmp/ 字样的请求都限制了。

参考链接

本文由柒创作，采用知识共享署名4.0 国际许可协议进行许可。
转载本站文章前请注明出处，文章作者保留所有权限。
最后编辑时间： 2018-08-05 00:20 AM