httpd.conf配置设置

1.启用虚拟主机、ssl、重写模块

LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule ssl_module modules/mod_ssl.so

2.禁用根目录访问

<Directory />
    AllowOverride None
    Require all denied
</Directory>

3.允许htdocs目录访问

DocumentRoot "/usr/local/httpd/htdocs"
<Directory "/usr/local/httpd/htdocs">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks
 
    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   AllowOverride FileInfo AuthConfig Limit
    #
 
    # cache 
       
 
    AllowOverride None
 
    #
    # Controls who can get stuff from this server.
    #
    Require all denied
</Directory>

httpd-vhosts.conf中配置

将所有未知的域名访问和直接的ip访问独立一个虚拟主机，并将该主机设置为拒绝访问。对于正式域名访问独立一个虚拟主机访问，并设置为允许访问。注意必须将拒绝的虚拟主机放在第一个。

<VirtualHost *:80>
    ServerAdmin unAllowedDomain
    DocumentRoot "/usr/local/httpd/htdocs"
    ErrorLog "/home/logs/apache/unAllowedDomain-error_log"
    CustomLog "/home/logs/apache/unAllowedDomain-access_log" common
    <Directory "/usr/local/httpd/htdocs">
        AllowOverride None
        Require all denied
    </Directory>
</VirtualHost>
 
<VirtualHost *:80>
    ServerAdmin xxxx.cn
    ServerName www.xxxx.cn
    ServerAlias xxxx.cn
    DocumentRoot "/usr/local/httpd/htdocs"
    ErrorLog "/home/logs/apache/xxxx-error_log"
    CustomLog "/home/logs/apache/xxxx-access_log" common
 
    <Directory "/usr/local/httpd/htdocs">
        AllowOverride all
        Require all granted
    </Directory>
</VirtualHost>

httpd-ssl.conf中配置

如果使用了ssl证书访问，这个时候像拒绝https://ip访问需要做如下操作。仍然需要创建一个不允许域名访问虚拟主机站点，并设置为拒绝状态，并且放在第一个。ssl虚拟主机需要注意以下两点：

***  serverName必须带上端口号，80端口是默认的因此不需要带端口号

***  xxxx.cn无法作为别名进行访问，ServerAlias xxxx.cn:443是无效的，因此需要单独一个虚拟主机站点访问

<VirtualHost *:443>
DocumentRoot "/usr/local/httpd/htdocs"
ServerAdmin unAllowedDomain
ErrorLog "/usr/local/httpd/logs/error_log"
TransferLog "/usr/local/httpd/logs/access_log"
 
SSLEngine on
 
SSLCertificateFile "/usr/local/httpd/conf/server.crt"
SSLCertificateKeyFile "/usr/local/httpd/conf/server.key"
SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt"
 
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
 
<Directory "/usr/local/httpd/htdocs">
    SSLOptions +StdEnvVars
    AllowOverride None
    Require all denied
</Directory>
 
<Directory "/usr/local/httpd/cgi-bin">
    SSLOptions +StdEnvVars
    AllowOverride None
            Require all denied
</Directory>
 
BrowserMatch "MSIE [2-5]" \
 nokeepalive ssl-unclean-shutdown \
 downgrade-1.0 force-response-1.0
 
CustomLog "/usr/local/httpd/logs/ssl_request_log" \
  "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>                                                                       
  
<VirtualHost *:443>
DocumentRoot "/usr/local/httpd/htdocs"
ServerName www.xxxx.cn:443
ServerAdmin you@example.com
ErrorLog "/usr/local/httpd/logs/error_log"
TransferLog "/usr/local/httpd/logs/access_log"
 
SSLEngine on
SSLCertificateFile "/usr/local/httpd/conf/server.crt"
SSLCertificateKeyFile "/usr/local/httpd/conf/server.key"
SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt"
 
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
 
        <Directory "/usr/local/httpd/htdocs">
            AllowOverride all
            Require all granted
        </Directory>
        <Directory "/usr/local/httpd/cgi-bin"> 
            SSLOptions +StdEnvVars
        </Directory>
 
        BrowserMatch "MSIE [2-5]" \ 
        nokeepalive ssl-unclean-shutdown \ 
        downgrade-1.0 force-response-1.0CustomLog "/usr/local/httpd/logs/ssl_request_log" \ 
        "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
<VirtualHost *:443>
    DocumentRoot "/usr/local/httpd/htdocs"
    ServerName xxxx.cn:443
    ServerAdmin you@example.com
    ErrorLog "/usr/local/httpd/logs/error_log"
    TransferLog "/usr/local/httpd/logs/access_log"
    SSLEngine onSSLCertificateFile "/usr/local/httpd/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/httpd/conf/server.key"
    SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt"
    <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars</FilesMatch>
    <Directory "/usr/local/httpd/htdocs">
<pre name="code" class="html">         AllowOverride all
         Require all granted
    </Directory>

<Directory "/usr/local/httpd/cgi-bin"> SSLOptions +StdEnvVars</Directory>

BrowserMatch "MSIE [2-5]" \ nokeepalive ssl-unclean-shutdown \ 

downgrade-1.0 force-response-1.0

CustomLog "/usr/local/httpd/logs/ssl_request_log" \ 

"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \

"%r\" %b"

</VirtualHost>