Apache restrictions — различия между версиями
Материал из pNp Wiki
Andy (обсуждение | вклад) (Новая страница: «== Конфигурирование Apache. Ограничение доступа к директориям == ==== Предварительные требова…») |
Andy (обсуждение | вклад) (→Ограничение на основе хоста) |
||
| Строка 17: | Строка 17: | ||
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html | -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html | ||
[root@vm-01 ~]# | [root@vm-01 ~]# | ||
| + | </syntaxhighlight> | ||
| + | Для директории <code>/content/private</code> в конфигурационном файле <code>/etc/httpd/conf.d/vm-01.conf</code> укажем адрес с которого разрешено обращаться | ||
| + | к содержимому данной директории: | ||
| + | <syntaxhighlight lang="bash"> | ||
| + | # Virtual Hosts | ||
| + | # | ||
| + | # Required modules: mod_log_config | ||
| + | |||
| + | # If you want to maintain multiple domains/hostnames on your | ||
| + | # machine you can setup VirtualHost containers for them. Most configurations | ||
| + | # use only name-based virtual hosts so the server doesn't need to worry about | ||
| + | # IP addresses. This is indicated by the asterisks in the directives below. | ||
| + | # | ||
| + | # Please see the documentation at | ||
| + | # <URL:http://httpd.apache.org/docs/2.4/vhosts/> | ||
| + | # for further details before you try to setup virtual hosts. | ||
| + | # | ||
| + | # You may use the command line option '-S' to verify your virtual host | ||
| + | # configuration. | ||
| + | |||
| + | # | ||
| + | # VirtualHost example: | ||
| + | # Almost any Apache directive may go into a VirtualHost container. | ||
| + | # The first VirtualHost section is used for all requests that do not | ||
| + | # match a ServerName or ServerAlias in any <VirtualHost> block. | ||
| + | # | ||
| + | <VirtualHost *:80> | ||
| + | ServerAdmin webmaster@vm-01.example.com | ||
| + | DocumentRoot "/content" | ||
| + | ServerName vm-01.example.com | ||
| + | ServerAlias www.vm-01.example.com | ||
| + | ErrorLog "/var/log/httpd/vm-01.example.com-error_log" | ||
| + | CustomLog "/var/log/httpd/vm-01.example.com-access_log" common | ||
| + | <Directory "/content"> | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | Require all granted | ||
| + | </Directory> | ||
| + | <Directory "/content/private"> | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | Require ip 192.168.1.2 | ||
| + | </Directory> | ||
| + | |||
| + | </VirtualHost> | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Версия 16:43, 23 января 2018
Содержание
Конфигурирование Apache. Ограничение доступа к директориям
Предварительные требования
- Виртуальная машина с двумя сетевыми интерфейсами
- Установленные пакеты:
bash-completion,policycoreutils,policycoreutils-python,policycoreutils-devel,setroubleshoot-server,httpd,elinks,curl
Конфигурирование ограничений
Ограничение на основе хоста
Создадим директорию /content/private и в ней файл index.html:
[root@vm-01 ~]# mkdir /content/private
[root@vm-01 ~]# printf "This is private directory.\n$(date)\n" > /content/private/index.html
[root@vm-01 ~]# restorecon -vR /content/
[root@vm-01 ~]# ls -lahiZ /content/private/
drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 ..
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html
[root@vm-01 ~]#
Для директории /content/private в конфигурационном файле /etc/httpd/conf.d/vm-01.conf укажем адрес с которого разрешено обращаться
к содержимому данной директории:
# Virtual Hosts
#
# Required modules: mod_log_config
# If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn't need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
#
# Please see the documentation at
# <URL:http://httpd.apache.org/docs/2.4/vhosts/>
# for further details before you try to setup virtual hosts.
#
# You may use the command line option '-S' to verify your virtual host
# configuration.
#
# VirtualHost example:
# Almost any Apache directive may go into a VirtualHost container.
# The first VirtualHost section is used for all requests that do not
# match a ServerName or ServerAlias in any <VirtualHost> block.
#
<VirtualHost *:80>
ServerAdmin webmaster@vm-01.example.com
DocumentRoot "/content"
ServerName vm-01.example.com
ServerAlias www.vm-01.example.com
ErrorLog "/var/log/httpd/vm-01.example.com-error_log"
CustomLog "/var/log/httpd/vm-01.example.com-access_log" common
<Directory "/content">
AllowOverride None
# Allow open access:
Require all granted
</Directory>
<Directory "/content/private">
AllowOverride None
# Allow open access:
Require ip 192.168.1.2
</Directory>
</VirtualHost>
