# /etc/apache2/conf-available/security.conf

# 隐藏 Apache 版本
ServerTokens Prod
ServerSignature Off

# 隐藏 PHP 版本
# php.ini 中设置：
# expose_php = Off

# 隐藏操作系统信息
ServerAdmin admin@example.com

# 根目录 - 拒绝所有访问
<Directory />
    Options -Indexes -FollowSymLinks -Includes
    AllowOverride None
    Require all denied
</Directory>

# 文档根目录 - 允许访问
<Directory "/var/www/html">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

# 禁止目录列表
Options -Indexes

# 禁止符号链接跟随
Options -FollowSymLinks

# 禁止 SSI
Options -Includes

# 保护隐藏文件（.htaccess, .git, .env 等）
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# 保护特定文件类型
<FilesMatch "\.(conf|log|bak|sql|sh|py|rb|env|git|htaccess|htpasswd)$">
    Require all denied
</FilesMatch>

# 保护特定文件
<Files "config.php">
    Require all denied
</Files>

# 保护包含敏感信息的目录
<DirectoryMatch "^/var/www/html/(config|logs|tmp|backup)">
    Require all denied
</DirectoryMatch>

<IfModule mod_headers.c>
    # HSTS（严格传输安全）
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
    # 防止 MIME 类型嗅探
    Header always set X-Content-Type-Options "nosniff"
    
    # 防止点击劫持
    Header always set X-Frame-Options "SAMEORIGIN"
    
    # XSS 保护
    Header always set X-XSS-Protection "1; mode=block"
    
    # 引用来源
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    
    # 权限策略
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    
    # CSP（内容安全策略）
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'"
    
    # 移除服务器头
    Header always unset Server
    Header always unset X-Powered-By
</IfModule>

# Apache 2.4+ 语法
<Directory "/var/www/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
    Require ip 172.16.0.0/12
</Directory>

# 拒绝特定 IP
<Directory "/var/www/html">
    Require all granted
    Require not ip 192.168.1.100
    Require not ip 10.0.0.50
</Directory>

# 复杂访问控制
<Directory "/var/www/admin">
    <RequireAny>
        Require ip 192.168.1.0/24
        Require ip 10.0.0.0/8
    </RequireAny>
</Directory>

# 同时满足多个条件
<Directory "/var/www/sensitive">
    <RequireAll>
        Require ip 192.168.1.0/24
        Require user admin
    </RequireAll>
</Directory>

# 创建密码文件
# htpasswd -c /etc/apache2/.htpasswd admin
# htpasswd /etc/apache2/.htpasswd user1

# 基本认证
<Directory "/var/www/admin">
    AuthType Basic
    AuthName "Admin Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

# 基于组的认证
# 创建组文件 /etc/apache2/.htgroup
# admins: admin superadmin
# users: user1 user2

<Directory "/var/www/admin">
    AuthType Basic
    AuthName "Admin Area"
    AuthUserFile /etc/apache2/.htpasswd
    AuthGroupFile /etc/apache2/.htgroup
    Require group admins
</Directory>

# 摘要认证（更安全）
<Directory "/var/www/secure">
    AuthType Digest
    AuthName "Secure Area"
    AuthUserFile /etc/apache2/.htdigest
    Require valid-user
</Directory>

# 创建摘要密码文件
# htdigest -c /etc/apache2/.htdigest "Secure Area" admin

# IP + 用户认证
<Directory "/var/www/admin">
    AuthType Basic
    AuthName "Admin Area"
    AuthUserFile /etc/apache2/.htpasswd
    
    <RequireAll>
        Require ip 192.168.1.0/24
        Require user admin
    </RequireAll>
</Directory>

# 条件访问
<Directory "/var/www/portal">
    <RequireAny>
        Require ip 192.168.1.0/24
        <RequireAll>
            AuthType Basic
            AuthName "Portal"
            AuthUserFile /etc/apache2/.htpasswd
            Require valid-user
        </RequireAll>
    </RequireAny>
</Directory>

# Debian/Ubuntu
sudo apt install libapache2-mod-security2
sudo a2enmod security2

# CentOS/RHEL
sudo yum install mod_security mod_security_crs

# 安装 OWASP CRS（核心规则集）
cd /etc/apache2/modsecurity
sudo git clone https://github.com/coreruleset/coreruleset.git
sudo cp coreruleset/crs-setup.conf.example coreruleset/crs-setup.conf

# /etc/apache2/mods-available/security2.conf

<IfModule mod_security2.c>
    # 启用 ModSecurity
    SecRuleEngine On
    
    # 请求体处理
    SecRequestBodyAccess On
    SecRequestBodyLimit 13107200
    SecRequestBodyNoFilesLimit 131072
    SecRequestBodyLimitAction Reject
    
    # 响应体处理
    SecResponseBodyAccess On
    SecResponseBodyMimeType text/plain text/html text/xml application/json
    SecResponseBodyLimit 524288
    SecResponseBodyLimitAction ProcessPartial
    
    # 临时文件
    SecTmpDir /tmp/modsecurity/tmp
    SecDataDir /tmp/modsecurity/data
    SecUploadDir /tmp/modsecurity/upload
    
    # 日志
    SecAuditEngine RelevantOnly
    SecAuditLogRelevantStatus "^(?:5|4(?!04))"
    SecAuditLogParts ABIJDEFHZ
    SecAuditLogType Serial
    SecAuditLog /var/log/apache2/modsec_audit.log
    
    # 调试日志
    # SecDebugLog /var/log/apache2/modsec_debug.log
    # SecDebugLogLevel 3
    
    # 规则集
    IncludeOptional /etc/apache2/modsecurity/coreruleset/crs-setup.conf
    IncludeOptional /etc/apache2/modsecurity/coreruleset/rules/*.conf
    
    # 排除规则
    # SecRuleRemoveById 942100
    # SecRuleRemoveByTag "attack-sqli"
</IfModule>

# /etc/apache2/modsecurity/custom-rules.conf

# 阻止特定 User-Agent
SecRule REQUEST_HEADERS:User-Agent "sqlmap" \
    "id:100001,phase:1,t:none,t:lowercase,deny,status:403,msg:'Blocked sqlmap User-Agent'"

# 阻止 SQL 注入
SecRule ARGS "@detectSQLi" \
    "id:100002,phase:2,t:none,t:urlDecodeUni,deny,status:403,msg:'SQL Injection Attack'"

# 阻止 XSS
SecRule ARGS "@detectXSS" \
    "id:100003,phase:2,t:none,t:urlDecodeUni,deny,status:403,msg:'XSS Attack'"

# 阻止目录遍历
SecRule REQUEST_URI "\.\./" \
    "id:100004,phase:1,t:none,t:urlDecodeUni,deny,status:403,msg:'Directory Traversal'"

# 限制请求方法
SecRule REQUEST_METHOD "!^GET|HEAD|POST|PUT|DELETE|PATCH|OPTIONS$" \
    "id:100005,phase:1,t:none,deny,status:405,msg:'Method Not Allowed'"

# 限制文件上传大小
SecRule FILES_SIZE "@gt 10485760" \
    "id:100006,phase:1,t:none,deny,status:413,msg:'File Too Large'"

# 保护 API 端点
SecRule REQUEST_URI "^/api/" \
    "id:100007,phase:1,t:none,pass,nolog,setvar:tx.paranoia_level=2"

# 排除特定规则
SecRuleRemoveById 942100  # 排除特定 ID
SecRuleRemoveByTag "attack-sqli"  # 排除特定标签

# 排除特定路径
<LocationMatch "^/api/upload">
    SecRuleEngine Off
</LocationMatch>

# 或仅排除特定规则
<LocationMatch "^/admin">
    SecRuleRemoveById 941100  # XSS 规则
    SecRuleRemoveById 942100  # SQL 注入规则
</LocationMatch>

# 使用 ctl 动作
SecRule REQUEST_URI "^/api/upload" \
    "id:100010,phase:1,t:none,pass,nolog,ctl:ruleEngine=Off"

# 查看审计日志
tail -f /var/log/apache2/modsec_audit.log

# 分析攻击类型
grep -oP 'msg ".*?"' /var/log/apache2/modsec_audit.log | sort | uniq -c | sort -rn

# 按 IP 统计
grep -oP 'client "\K[^"]+' /var/log/apache2/modsec_audit.log | sort | uniq -c | sort -rn

# 常见误报处理
# 1. 识别误报规则
# 2. 调整规则或添加排除
# 3. 测试验证

sudo a2enmod ratelimit
sudo systemctl reload apache2

# 限制带宽
<IfModule mod_ratelimit.c>
    <Location "/downloads">
        SetOutputFilter RATE_LIMIT
        SetEnv rate-limit 400  # KB/s
    </Location>
</IfModule>

# 请求超时设置（防慢速攻击）
<IfModule mod_reqtimeout.c>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

# 安装 mod_evasive
sudo apt install libapache2-mod-evasive
sudo a2enmod evasive

<IfModule mod_evasive20.c>
    DOSHashTableSize 3097
    DOSPageCount 2
    DOSSiteCount 50
    DOSPageInterval 1
    DOSSiteInterval 1
    DOSBlockingPeriod 10
    
    # 邮件通知
    DOSEmailNotify admin@example.com
    
    # 日志
    DOSLogDir /var/log/mod_evasive
    
    # 白名单
    DOSWhitelist 127.0.0.1
    DOSWhitelist 192.168.1.*
</IfModule>

# 限制并发连接
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # 基于 IP 的访问控制（简易版）
    RewriteMap hosts-iplist txt:/etc/apache2/iplist.txt
    RewriteCond %{REMOTE_ADDR} ^(.*)$
    RewriteCond ${hosts-iplist:%1|BLOCK} ^BLOCK$ [NC]
    RewriteRule .* - [F]
</IfModule>

# 限制连接速率
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 -j DROP

# 限制每个 IP 的连接数
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP

# /etc/fail2ban/jail.local
[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3
bantime = 3600

[apache-botsearch]
enabled = true
port = http,https
filter = apache-botsearch
logpath = /var/log/apache2/access.log
maxretry = 2
bantime = 86400

[apache-noscript]
enabled = true
port = http,https
filter = apache-noscript
logpath = /var/log/apache2/error.log
maxretry = 6
bantime = 86400

# 强制 HTTPS
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

# HSTS
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

# 安全协议
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLProtocol TLSv1.2 TLSv1.3

# 强密码套件
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder on
SSLCompression off

#!/bin/bash
# apache-security-audit.sh

echo "=== Apache 安全审计 ==="

# 检查版本
echo "1. Apache 版本："
apachectl -v

# 检查模块
echo "2. 已加载模块："
apachectl -M | wc -l

# 检查配置
echo "3. 配置语法检查："
apachectl configtest

# 检查监听端口
echo "4. 监听端口："
ss -tlnp | grep apache

# 检查权限
echo "5. 文档根目录权限："
ls -la /var/www/

# 检查敏感文件
echo "6. 检查敏感文件暴露："
for ext in .env .git .htaccess .bak .sql .log; do
    curl -s -o /dev/null -w "%{http_code}" "http://localhost$ext"
    echo " - $ext"
done

# 检查 SSL
echo "7. SSL 配置检查："
if apachectl -M | grep -q ssl; then
    echo "  SSL 模块已启用"
else
    echo "  SSL 模块未启用"
fi

echo "=== 审计完成 ==="

<VirtualHost *:443>
    ServerName shop.example.com
    
    # SSL 配置
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/shop.crt
    SSLCertificateKeyFile /etc/ssl/private/shop.key
    
    # 安全头
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set Content-Security-Policy "upgrade-insecure-requests"
    
    # 支付页面特殊保护
    <Location "/checkout/payment">
        <RequireAll>
            Require ip 10.0.0.0/8
            AuthType Basic
            AuthName "Payment Area"
            AuthUserFile /etc/apache2/.htpasswd
            Require user payment_user
        </RequireAll>
    </Location>
    
    # ModSecurity 规则加强
    <IfModule mod_security2.c>
        SecRuleEngine On
        SecAuditEngine On
    </IfModule>
</VirtualHost>

<VirtualHost *:443>
    ServerName api.example.com
    
    # API 限流
    <IfModule mod_ratelimit.c>
        <Location "/api">
            SetOutputFilter RATE_LIMIT
            SetEnv rate-limit 1024
        </Location>
    </IfModule>
    
    # API 认证
    <Location "/api/v1">
        AuthType Basic
        AuthName "API"
        AuthUserFile /etc/apache2/.htpasswd-api
        Require valid-user
    </Location>
    
    # CORS 配置
    <IfModule mod_headers.c>
        Header always set Access-Control-Allow-Origin "https://www.example.com"
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Authorization, Content-Type"
    </IfModule>
</VirtualHost>