我嘗試了多種方法來停用 Apache Web 伺服器上的 TRACE 方法,但由於某種原因,它對連接埠 443 已停用,但對連接埠 80 停用。
我已將以下指令新增至設定檔的頂部:
TraceEnable off
然後將以下內容加入 :80 和 :443 VirtualHost 區塊中:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|DELETE)
RewriteRule .* - [F]
curl --insecure -v -X TRACE
當我在網路伺服器上運行 a 時,我正確地得到了403 Forbidden
https 的 a ,但200 OK
http 的 a 。值得注意的是,我確實對所有 http 連接到 https 都有永久重定向。此網頁伺服器也作為反向代理運作。編輯:我嘗試將重定向永久更改為規則mod_rewrite
,但測試仍然失敗curl TRACE
。
設定檔:
NameVirtualHost XX.XX.XX.XX:80
NameVirtualHost XX.XX.XX.XX:443
SSLSessionCache "shm:logs/ssl_scache(512000)"
Timeout 2400
ProxyTimeout 2400
ProxyBadHeader Ignore
FileETag None
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always append X-Frame-Options SAMEORIGIN
Header set X-XSS-Protection "1; mode=block"
TraceEnable off
<VirtualHost XX.XX.XX.XX:80>
ServerName www.xxxxxxx.com:80
ServerAlias www.xxxxxx.com
ServerAdmin localhost@root
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|DELETE)
RewriteRule .* - [F]
ErrorLog "|/usr/sbin/rotatelogs /etc/httpd/logs/error.%Y-%m-%d.log 86400"
CustomLog "|/usr/sbin/rotatelogs /etc/httpd/logs/access.%Y-%m-%d.log 86400" common
#Redirect permanent / https://www.xxxxxxx.com:443/
</VirtualHost>
<VirtualHost XX.XX.XX.XX:443>
Options Includes FollowSymLinks MultiViews
ServerName www.xxxxxxxx.com:443
ServerAlias www.xxxxxxxx.com
ServerAdmin localhost@root
SSLProxyEngine On
SSLEngine On
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
"/etc/httpd/ssl_certs/hdsisd/Apache_Plesk_Install.txt"
SSLCertificateFile "/etc/httpd/ssl_certs/xxxxx.crt"
SSLCertificateKeyFile "/etc/httpd/ssl_certs/server.key"
SSLCertificateChainFile "/etc/httpd/ssl_certs/Apache_Plesk_Install.txt"
ErrorLog "|/usr/sbin/rotatelogs /etc/httpd/logs/error.%Y-%m-%d.log 86400"
CustomLog "|/usr/sbin/rotatelogs /etc/httpd/logs/access.%Y-%m-%d.log 86400" common
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1.1$
RewriteRule .* - [F]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|DELETE)
RewriteRule .* - [F]
ProxyPreserveHost On
<Location />
ProxyPass https://XX.XX.XX.XX/ Keepalive=On
ProxyPassReverse https://XX.XX.XX.XX/
Order allow,deny
Allow from all
</Location>
</VirtualHost>
答案1
我知道我在這方面已經很晚了。但這是為將來可能需要這個的人提供的答案。問題是由於設定檔引起的,如果您注意到提問者正在使用以下重定向條件:
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
將 HTTP 流量重新導向到 HTTPS,這會強制伺服器重新導向到 HTTPS 協定並忽略這些行下面的所有內容。因此,他無法停用 HTTP 請求上的追蹤方法。因此,修復方法是將追蹤註解移至重定向上方,如下所示:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|DELETE)
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
RewriteRule .* - [F]