51工具盒子phpMyAdmin是一个以PHP为基础，以Web-Base方式架构在网站主机上的MySQL的数据库管理工具，让管理者可用Web接口管理MySQL数据库。由于phpMyAdmin漏洞比较多，所以我们除了要更改默认路径外还要设置401验证，提高安全性，不过还是不建议安装phpMyAdmin，毕竟漏洞确实多。
安装apache htpasswd命令
yum -y install httpd-tools
|---|----------------------------| | 1 | yum -y install httpd-tools |
首先通过htpasswd生成401的帐号和密码，此处采用SHA加密
htpasswd -cs /usr/local/nginx/conf/401htpasswd whsir #whsir为401用户名
|---|--------------------------------------------------------------------| | 1 | htpasswd -cs /usr/local/nginx/conf/401htpasswd whsir #whsir为401用户名 |
将401添加到php的location中
location ~ \.php$ { auth_basic "this is 401whsir"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi.conf; }
|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 | location ~ \.php$ { auth_basic "this is 401whsir"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi.conf; } |
检查配置
nginx -t
|---|----------| | 1 | nginx -t |
重启nginx
service nginx restart
|---|-----------------------| | 1 | service nginx restart |
假设phpmyadmin地址是http://10.10.10:888/phpmyadmin/
此时访问http://10.10.10:888/phpmyadmin/就会跳出401了
如果按下面这种方法配置的话，使用绝对路径是可以绕过401的
location / { auth_basic "this is 401whsir"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; }
|-----------|-------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 | location / { auth_basic "this is 401whsir"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; } |
举例：正常访问http://10.10.10:888/phpmyadmin/跳出401
如果访问http://10.10.10:888/phpmyadmin/index.php，取消多次是可以绕过401的，这里假设目录下有index.php文件
给帝国后台增加401认证，示例如下：
location /e/admin/ { auth_basic "401"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; } location ~ /e/admin/.*\.php$ { auth_basic "401"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; try_files $uri =404; fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_index index.php; include fastcgi.conf; }
|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | location /e/admin/ { auth_basic "401"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; } location ~ /e/admin/.*\.php$ { auth_basic "401"; auth_basic_user_file /usr/local/nginx/conf/401htpasswd; try_files $uri =404; fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_index index.php; include fastcgi.conf; } |
注意：上面配置要放在location ~ [^/]\.php(/|$)的前面
htpasswd命令常用的几个选项：
-c：创建一个加密文件
-p：不对密码进行进行加密，即明文密码
-m：采用MD5算法对密码进行加密
htpasswd -c -s /usr/local/nginx/conf/401 whsir
-d：采用CRYPT算法对密码进行加密
htpasswd -c -s /usr/local/nginx/conf/401 whsir
-s：采用SHA算法对密码进行加密
htpasswd -c -s /usr/local/nginx/conf/401 whsir #用户名whsir
-b：在命令行中一并输入用户名和密码而不是根据提示输入密码
htpasswd -c -b /usr/local/nginx/conf/401 whsir 123 #用户名whsir，密码123
