【10.18】nginx 访问控制

4.43-4.47 nginx访问控制

1、限制 IP 访问

将需要限制的 ip 写成以下字段并加入虚拟主机配置文件 /etc/nginx/conf.d/blog.ars4life.com

• 白名单机制

    allow 127.0.0.1;
    allow 192.168.1.0/24;
    deny all;

[root@alexis-01 ~]# curl -x127.0.0.1:80 blog.ars4life.com -I 
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 02:52:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Link: <http://blog.ars4life.com/index.php?rest_route=/>; rel="https://api.w.org/"

[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I 
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 02:53:48 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

194网段的 ip 是无法访问的，
如果将白名单 allow 改为 194 网段，如下配置，那么 194 是可以访问的

    allow 127.0.0.1;
    allow 192.168.194.0/24;
    deny all;

[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I 
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:19:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Link: <http://blog.ars4life.com/index.php?rest_route=/>; rel="https://api.w.org/"

• 黑名单机制

    deny 127.0.0.1;
    deny 192.168.194.0/24;

不 deny 的就是 allow，所有 allow 不用写

将配置文件改为黑名单机制，再次访问

[root@alexis-01 ~]# curl -x192.168.194.128:80 blog.ars4life.com -I 
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:25:54 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

访问被拒绝。

2、限制目录

• 内部访问的资源目录，需要限制他人访问

• 虚拟主机配置文件中添加控制语句，白名单

    location ~ /admin.php
    {
        allow 127.0.0.1;
        allow 192.168.194.0/24;
        deny all;
        root           /data/wwwroot/blog.ars4life.com;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /data/wwwroot/blog.ars4life.com$fastcgi_script_name;
        include        fastcgi_params;
    }

root@alexis-01 ~]# curl -x192.168.194.128:80 bbs.ars4life.com/admin.php -I
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:45:32 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Set-Cookie: 94bw_2132_saltkey=bapqbsxZ; expires=Mon, 18-Nov-2019 03:45:32 GMT; Max-Age=2592000; path=/; HttpOnly
Set-Cookie: 94bw_2132_lastvisit=1571453132; expires=Mon, 18-Nov-2019 03:45:32 GMT; Max-Age=2592000; path=/
Set-Cookie: 94bw_2132_sid=aDQpIN; expires=Sun, 20-Oct-2019 03:45:32 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_lastact=1571456732%09admin.php%09; expires=Sun, 20-Oct-2019 03:45:32 GMT; Max-Age=86400; path=/
[root@alexis-01 ~]# curl -x192.168.194.128:80 bbs.ars4life.com/admin1.php -I
HTTP/1.1 404 Not Found
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:52:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0

• 限定目录

    location /abc
    {      
        allow 192.168.194.128;
        deny all;
    }

我们给白名单只写一个 ip，让他可以访问

[root@alexis-01 ~]# curl -x127.0.0.1:80 -I bbs.ars4life.com/abc/123
HTTP/1.1 404 Not Found
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 03:56:38 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

虽然文件404不存在，但是可以访问

[root@alexis-01 ~]# curl -x127.0.0.1:80 -I bbs.ars4life.com/abc/123
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 04:03:40 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

没加入白名单的则不可以访问

3、限制某个目录下的某类文件

被上传一句话木马，搞到 root 权限，不安全
针对可写目录下的 php 请求做限制

    location ~ .*(upload|image|attachment|cache)/.*\.php$
    {
    	deny all;
    }

将上述语句加入虚拟主机配置文件中，访问被阻

[root@alexis-01 ~]# curl -x127.0.0.1:80 bbs.ars4life.com/attachment/2344/2323.php -I 
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 05:57:53 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

如果不是attachment 目录就不会拒绝访问，404只是文件不存在而已

[root@alexis-01 ~]# curl -x127.0.0.1:80 bbs.ars4life.com/attaschment/2344/2323.php -I 
HTTP/1.1 404 Not Found
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 06:02:06 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0

4、限制 user-agent

如果不对访问来源做一些限制的话，会对服务器资源造成大量影响

• 以下是限制语句：

	if ( $http_user_agent ~ 'Spider/3.0|YoudaoBot|Tomato')
	{
		return 403;
	}

也就是说，只要 user_agent 中包含引号中的字段就返回 403
如果想要不区分大小写，可以将 ~ 换成 ~*，不过这样也会对 nginx 造成更大压力

• 测试
  curl -A 指定 agent

[root@alexis-01 ~]# curl -A 'aaaaaSpider/3.0' -x127.0.0.1:80 bbs.ars4life.com -I 
HTTP/1.1 403 Forbidden
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 06:25:02 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

[root@alexis-01 ~]# curl -A 'aaaaaspider/3.0' -x127.0.0.1:80 bbs.ars4life.com -I 
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Sat, 19 Oct 2019 06:25:09 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Set-Cookie: 94bw_2132_saltkey=p5Oldiol; expires=Mon, 18-Nov-2019 06:25:09 GMT; Max-Age=2592000; path=/; HttpOnly
Set-Cookie: 94bw_2132_lastvisit=1571462709; expires=Mon, 18-Nov-2019 06:25:09 GMT; Max-Age=2592000; path=/
Set-Cookie: 94bw_2132_sid=XQgp1g; expires=Sun, 20-Oct-2019 06:25:09 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_lastact=1571466309%09index.php%09; expires=Sun, 20-Oct-2019 06:25:09 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_sid=XQgp1g; expires=Sun, 20-Oct-2019 06:25:09 GMT; Max-Age=86400; path=/

以上两次访问只对 agent 的大小写进行了变更，一个匹配了访问限制，就显示 403 禁止访问；另一个没有匹配，就显示 200 可以访问

• curl -v 可以显示通信过程，如下

[root@alexis-01 ~]# curl -v -A 'aaaaaspider/3.0' -x127.0.0.1:80 bbs.ars4life.com -I 
* About to connect() to proxy 127.0.0.1 port 80 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)
> HEAD HTTP://bbs.ars4life.com/ HTTP/1.1
> User-Agent: aaaaaspider/3.0
> Host: bbs.ars4life.com
> Accept: */*
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.16.1
Server: nginx/1.16.1
< Date: Sat, 19 Oct 2019 06:29:00 GMT
Date: Sat, 19 Oct 2019 06:29:00 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Connection: keep-alive
Connection: keep-alive
< X-Powered-By: PHP/7.3.0
X-Powered-By: PHP/7.3.0
< Set-Cookie: 94bw_2132_saltkey=wi77q0G1; expires=Mon, 18-Nov-2019 06:29:00 GMT; Max-Age=2592000; path=/; HttpOnly
Set-Cookie: 94bw_2132_saltkey=wi77q0G1; expires=Mon, 18-Nov-2019 06:29:00 GMT; Max-Age=2592000; path=/; HttpOnly
< Set-Cookie: 94bw_2132_lastvisit=1571462940; expires=Mon, 18-Nov-2019 06:29:00 GMT; Max-Age=2592000; path=/
Set-Cookie: 94bw_2132_lastvisit=1571462940; expires=Mon, 18-Nov-2019 06:29:00 GMT; Max-Age=2592000; path=/
< Set-Cookie: 94bw_2132_sid=KQ5a5E; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_sid=KQ5a5E; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/
< Set-Cookie: 94bw_2132_lastact=1571466540%09index.php%09; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_lastact=1571466540%09index.php%09; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/
< Set-Cookie: 94bw_2132_sid=KQ5a5E; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_sid=KQ5a5E; expires=Sun, 20-Oct-2019 06:29:00 GMT; Max-Age=86400; path=/

< 
* Connection #0 to host 127.0.0.1 left intact

• curl -e 设置 referer，访问来源

[root@alexis-01 ~]# curl -v -A 'aaaaaspider/3.0' -e "1111" -x127.0.0.1:80 bbs.ars4life.com -I 
* About to connect() to proxy 127.0.0.1 port 80 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)
> HEAD HTTP://bbs.ars4life.com/ HTTP/1.1
> User-Agent: aaaaaspider/3.0
> Host: bbs.ars4life.com
> Accept: */*
> Referer: 1111
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.16.1
Server: nginx/1.16.1
< Date: Sat, 19 Oct 2019 06:32:45 GMT
Date: Sat, 19 Oct 2019 06:32:45 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Connection: keep-alive
Connection: keep-alive
< X-Powered-By: PHP/7.3.0
X-Powered-By: PHP/7.3.0
< Set-Cookie: 94bw_2132_saltkey=ax0a0YYG; expires=Mon, 18-Nov-2019 06:32:45 GMT; Max-Age=2592000; path=/; HttpOnly
Set-Cookie: 94bw_2132_saltkey=ax0a0YYG; expires=Mon, 18-Nov-2019 06:32:45 GMT; Max-Age=2592000; path=/; HttpOnly
< Set-Cookie: 94bw_2132_lastvisit=1571463165; expires=Mon, 18-Nov-2019 06:32:45 GMT; Max-Age=2592000; path=/
Set-Cookie: 94bw_2132_lastvisit=1571463165; expires=Mon, 18-Nov-2019 06:32:45 GMT; Max-Age=2592000; path=/
< Set-Cookie: 94bw_2132_sid=p8vrHb; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_sid=p8vrHb; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/
< Set-Cookie: 94bw_2132_lastact=1571466765%09index.php%09; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_lastact=1571466765%09index.php%09; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/
< Set-Cookie: 94bw_2132_sid=p8vrHb; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/
Set-Cookie: 94bw_2132_sid=p8vrHb; expires=Sun, 20-Oct-2019 06:32:45 GMT; Max-Age=86400; path=/

< 
* Connection #0 to host 127.0.0.1 left intact

• 补充 curl 的用法：

curl 命令选项	含义
-A	指定 user_agent
-e	指定 referer
-x	指定访问目标服务器的ip和port
-I	只显示 header 信息，不显示具体网页内容
-v	显示详细的通信过程

5、限制 uri

• $request_uri 包含 $document_uri 和 $args
• $document_uri 就是当前请求中不包含指令的 URI，如 www.123.com/1.php?a=1&b=2 的 $document_uri 就是 1.php，不包含后面参数
• $args 就是请求参数中，a=1&b=2

---

• 以下是控制语句：

	if ( $request_uri ~ (abc|123))
	{
		return 404;
	}

• 测试
  1、先打开论坛中之前发的一篇帖子
  链接是 http://bbs.ars4life.com/forum.php?mod=viewthread&tid=2&extra=page%3D1
  
  2、在虚拟主机配置文件中关键字限制
  将 $request_rui 的 、$args 中的 viewthread 作为关键字进行限制，语句如下（其他关键词我们暂时不添加）

if ( $request_uri ~ (viewthread))
{
    return 403
}

if 语法里只能写 return 返回值

3、将该限制语句加入虚拟主机配置文件中
4、刷新网页，查看结果

5、已经被成功限制