php实现Linux服务器木马排查及加固功能(2)-木庄网络博客

执行后能看到最近被修改的文件，具有参加价值

3.修改php.ini，限制以下函数

代码如下:

disable_functions = phpinfo,passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocke,popen,proc_close,curl_exec,curl_multi_exec,parse_ini_file,show_source,dl,escapeshellarg,escapeshellcmd

4.修改nginx.conf ,限制一些目录执行php文件

代码如下:

server
{
    listen       80;
    server_name www.***.com;
    index   index.htm index.html index.php;
    root /wwwroot/;



    rewrite ^([^\.]*)/topic-(.+)\.html$ $1/portal.php?mod=topic&topic=$2 last;
    rewrite ^([^\.]*)/article-([0-9]+)-([0-9]+)\.html$ $1/portal.php?mod=view&aid=$2&page=$3 last;
    rewrite ^([^\.]*)/forum-(\w+)-([0-9]+)\.html$ $1/forum.php?mod=forumdisplay&fid=$2&page=$3 last;
    rewrite ^([^\.]*)/thread-([0-9]+)-([0-9]+)-([0-9]+)\.html$ $1/forum.php?mod=viewthread&tid=$2&extra=page%3D$4&page=$3 last;
    rewrite ^([^\.]*)/group-([0-9]+)-([0-9]+)\.html$ $1/forum.php?mod=group&fid=$2&page=$3 last;
    rewrite ^([^\.]*)/space-(username|uid)-(.+)\.html$ $1/home.php?mod=space&$2=$3 last;
    rewrite ^([^\.]*)/([a-z]+)-(.+)\.html$ $1/$2.php?rewrite=$3 last;
    rewrite ^([^\.]*)/topic-(.+)\.html$ $1/portal.php?mod=topic&topic=$2 last;


        location ~ ^/images/.*\.(php|php5)$
                {
              deny all;
                }

        location ~ ^/static/.*\.(php|php5)$
                {
               deny all;
                }

        location ~* ^/data/(attachment|avatar)/.*\.(php|php5)$
            {
                deny all;
            }

    location ~ .*\.(php|php5)?$
    {
      fastcgi_pass 127.0.0.1:9000;
      fastcgi_index index.php;
      include fcgi.conf;
    }



error_page 400 /404.html;
error_page 403 /404.html;
error_page 404 /404.html;
error_page 405 /404.html;
error_page 408 /404.html;
error_page 410 /404.html;
error_page 411 /404.html;
error_page 412 /404.html;
error_page 413 /404.html;
error_page 414 /404.html;
error_page 415 /404.html;
error_page 500 /404.html;
error_page 501 /404.html;
error_page 502 /404.html;
error_page 503 /404.html;
error_page 506 /404.html;

log_format acclog    "$remote_addr $request_time $http_x_readtime [$time_local] \"$request_method http://$host$request_uri\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"";
        access_log /logs/access.log acclog;
}

此处需要注意的是

代码如下:

location ~ ^/images/.*\.(php|php5)$
{
deny all;
}

这些目录的限制必须写在

代码如下:

location ~ .*\.(php|php5)?$
{
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fcgi.conf;
}

的前面，否则限制不生效。

更多相关Discuz论坛的内容来自木庄网络博客

标签：Discuz论坛

返回前面的内容