☰

版本：

tag-icon • tag-icon apache-2.4 openvpn centos7
版本：

我想限制对 Apache 服务器上管理页面的访问。这是我的解决方案。我在同一台服务器上设置了一个 openvpn 服务器。我使用 openvpn 从客户端连接到服务器。服务器状态页面按预期工作。但是，即使我连接到 vpn，/admin 页面的位置也会显示 403 禁止。我检查了客户端的外部和内部 IP。外部 IP 正是服务器的 IP，内部 IP 是 10.8.0.0/24。为什么服务器状态正常时会出现 403？我遗漏了什么？

版本：

阿帕奇：httpd-2.4.6-67.el7.centos.6.x86_64

操作系统：CentOS Linux 版本 7.4.1708（核心）

OpenVPN：openvpn-2.4.4-1.el7.x86_64

这是配置文件。

Openvpn服务器.conf

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0

/etc/httpd/conf.d/project.tld.conf

<VirtualHost 10.8.0.1:8081>
  ServerName aaa.bbb.ccc.ddd # server's external ip
  ServerAdmin [email protected] 

  <Location /server-status>
    SetHandler server-status
    Require ip 10.8.0.0/24
  </Location>
 </VirtualHost>

<VirtualHost 10.8.0.1 aaa.bbb.ccc.ddd:80>
  ServerName aaa.bbb.ccc.ddd
  ServerAdmin [email protected]
  Redirect permanent / https://aaa.bbb.ccc.ddd
</VirtualHost>

<VirtualHost 10.8.0.1 aaa.bbb.ccc.ddd:443>
  ServerName aaa.bbb.ccc.ddd
  ServerAdmin [email protected]

  Header always set Strict-Transport-Security "max-age=31536000;"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set X-Content-Type-Options nosniff

  LoadModule wsgi_module modules/mod_wsgi.so

  # Here is the problem
  <Location /admin>
    Require ip 10.8.0.0/24
    Require ip aaa.bbb.ccc.ddd/32
  </Location>

  # Aliases
  Alias /robots.txt /home/user/www/project.tld/statics/robots.txt
  Alias /statics /home/user/www/project.tld/statics
  <Directory /home/user/www/project.tld/statics>
    Require all granted
  </Directory>

  <Directory /home/user/www/project.tld/project>
    <Files wsgi.py>
      Require all granted
    </Files>
  </Directory>

  WSGIDaemonProcess project.tld python-path=/home/user/www/project.tld/venv/bin:/home/user/www/project.tld/venv/lib64/python3.6/site-packages
  WSGIProcessGroup project.tld
  WSGIScriptAlias / /home/user/www/project.tld/project/wsgi.py

  SSLEngine on
  SSLCertificateFile /etc/ssl/certs/self_signed.crt
  SSLCertificateKeyFile /etc/ssl/private/self_signed.key

  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/xml
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE application/xml
  AddOutputFilterByType DEFLATE application/xhtml+xml
  AddOutputFilterByType DEFLATE application/rss+xml
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/x-javascript
  AddOutputFilterByType DEFLATE application/json
</VirtualHost>

/etc/httpd/conf/httpd.conf

Listen 80
Listen 8081

ServerName aaa.bbb.ccc.ddd # server’s external ip
ServerSignature Off
ServerTokens Prod

DocumentRoot "/var/www/html"

日志条目：

从/var/log/httpd/access_log

10.8.0.6 - - [11/Jan/2018:14:49:08 +0200] "GET /server-status HTTP/1.1" 200 4800 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"

来自/var/log/httpd/error_log客户端 ip 是 ISP 为我提供的外部 ip

[Thu Jan 11 14:49:15.085377 2018] [authz_core:error] [pid 28161] [client aaa.bbb.ccc.xxx:59536] AH01630: client denied by server configuration: /home/user/www/project.tld/project/wsgi.py

答案1

让我回答我自己的问题，具有类似配置的人也可以解决他的问题。根据我的研究；如果 apache 和 open VPN 服务器在同一台机器上。客户端连接到 VPN 并尝试使用服务器的公共 IP 访问 Web 服务器，则流量不会通过 VPN 发送，这就是为什么我在日志文件中看到我的 ISP 的公共 IP。为了通过 VPN 隧道访问 Web 服务器，应该通过服务器的内部 IP 进行访问。为了解决我的问题，我刚刚分离了第二个虚拟主机，该主机通过公共 IP 将 http 流量重定向到 https，问题就解决了。

相关内容