为了安全起见,我们需要将FreeBSD字样及其它信息隐藏起来.操作如下:

在httpd.conf文件里添加以下两行

ServerTokens Prod
ServerSignature Off

重启apache即可.

如图所示:

您可能也喜欢：
Apache 的信息查看模块——Server-Status	查看Apache并发请求数及其TCP连接状态[原创]	怎么检查windows下apache加载的mpm模块是什么？	隐藏 Apache & PHP 的版本号
无觅

PHP:
隐藏 PHP 版本就是隐藏类似于 "X-Powered-By: PHP/5.1.2-1+b1" 这个，开启 php.ini，加入:

设置了expose_php=Off后,用phpinfo查看的时候,页面上原来正常显示的图片会消失隐藏的.

相关:http://blog.haohtml.com/archives/10761

您可能也喜欢：
Apache内存优化	Apache 的信息查看模块——Server-Status	查看Apache并发请求数及其TCP连接状态[原创]	apache你必须知道的一些知识
无觅

cat access.log |awk ‘{print $1}’|sort|uniq -c|sort -nr|head -100 > 37res.txt

来源:http://flychen.com/2011/06/statistics-apache-log-in-to-access-the-ip-to-access-the-daily-amount-of-up-to-100-ip

您可能也喜欢：
安装awstats来分析apache的访问日志	apache的日志级别和设置	查看Apache并发请求数及其TCP连接状态[原创]	Apache下实现隐藏服务器名称
无觅

Options Indexes

indexOptions FancyIndexing ScanHTMLTitles NameWidth=128 DescriptionWidth=256 HTMLTable VersionSort FoldersFirst

可用参数，含义如下：

#ScanHTMLTitles:搜索HTML标题
#NameWidth:文件命显示字节数
#DescriptionWidth:描述显示字节数
#HTMLTable:允许HTML格式
#FoldersFirst:目录优先

SuppressLastModified 在目录中禁止显示最近的修改时间

#索引排除语法

IndexIgnore header.html footer.html

header.html footer.html 这两个文件不会在索引（目录浏览）中出现。

#索引头部嵌入文件

HeaderName /data/index/header.html

#索引底部嵌入文件

ReadmeName /data/index/footer.html

ReadmeName： 指定该目录列表的footer模板，指定一个html文件后，Apache会在目录列表的底部加载这个网页。（注意：文件路径是相对于列表目录的根而言的，并不是相对于系统根或者网站根。）
HeaderName： 指定该目录列表的header模板，指定一个html文件后，Apache会用这个网页替换掉默认目录列表上面呆板的Index of …..。（注意：文件路径是相对于列表目录的根而言的，并不是相对于系统根或者网站根。）

#默认索引排序方式

IndexOrderDefault Ascending Date

#关闭服务器标志

ServerSignature Off

经过测试，如果目录中含有中文文件或者中文目录的时候，在IE下显示乱码，于是在浏览器中查看其编码发现它默认使用ISO-8859-1编码，手动选择GB2312后就能正常显示。看来是ApacheIndexes在处理中文的时候的编码不正确。

　　仔细研究其说明文档，其中介绍，可以在Apache配置文件中为Indexes指定特定的编码，我们能够修改配置文件让其支持中文。具体办法如下：

　　在配置文件中添加：

　　IndexOptions Charset=GB2312

　　这样这样就能解决Apache autoindex模块中文乱码问题了。

=========================================================

Apache一目录索引显示风格定制
在Apache中有目录索引是由mod_autoindex模块负责完成的。它把当前目录结果转换成html页面。在默认情况下，有很多地方让人感觉不爽，比如文件名宽度太窄（只有可怜的23字节），图标太大，有点傻傻的，好多文件类型没有关联。幸好Apache开发人员早就想到这一点，提供了让用户定制的命令。官方详细介绍可以去上面的超链去看看。

索引风格控制命令：

IndexOptions Directive //Dirctive 是命令选项，见下面实例

下面介绍常用的设置（都写在httpd.conf文件中）：
修改自动目录索引的宽度
缺省设置下，Apache默认每栏宽度是23字节，对于文件名来说，实在是太短了。一般要求60字节
IndexOptions NameWidth=60

修改图标尺寸
系统默认好像是24，经过试验，发现16的效果比较好。
IndexOptions IconHeight=16
IndexOptions IconWidth=16

目录优先
系统默认是文件优先，和我们平时的习惯不一致。改过来。
IndexOptions FoldersFirst

版本排序
无须多说，加上吧。对于中文来说，是按照拼音顺序排序的。
IndexOptions VersionSort

图标优化
默认的图标有不少比较难看，而且还有很多文件类型就没有图标，由于Solaris不支持Microsoft定义的各种文档类型，显示这些文件时都用问号图标表达，或许代表Sun对Microsoft的态度，不过我可不这么认为，凡事还是清楚点好。
定制文件图标分两步，先用图标工具抓取常用图标，象Word，Excel，Powerpint，Rar，Pdf。另外，默认的目录图标看上去也不爽，干脆把 Window的那套东西都搬过来。完成后，把这些图标（格式为gif或png）全部存到/usr/local/apache2/icons目录下。对于目录图标，我直接用微软的图标替换了那个名字叫folder.gif的文件。
接下来，用AddIcon命令把图标和文件类型关联起来。
AddIcon /icons/word.gif .doc .DOC
AddIcon /icons/excel.gif .xls .XLS
AddIcon /icons/rar.gif .rar .RAR
AddIcon /icons/srm.gif .srm .SRM
AddIcon /icons/powerpoint.gif .ppt .PPT
AddIcon /icons/access.gif .mdb .MDB

上面是我喜欢的文件类型，注意可别忘了大小写都加上哦。
完成后，重新启动apache，哈哈，终于看到了。可是，有几个类型还是没有显示出来L，它们是：rar,srm,mdb。
又仔细分析了一下配置文件，发现可能和文件类型有关。
Apache有一个专门负责文件类型的文件：mime.types，里面为每个文件进行了详细分类。比如有：application,image,audio,video。在里面狂搜了一遍，没有上面的那三个类型，于是在前面增加如下定义：

# MIME type Extensions
application/winrar rar
application/srm srm
application/access mdb

重新启动apache，OK。

Apache目录索引的简易配置
使用Apache配置简易的目录索引，登录者可以方便浏览、下载目录之下的内容。

过程：(以下均为有root权限时的操作)

1.安装apache：pacman -S apache

2.配置apache：vi /etc/httpd/conf/httpd.conf

#管理员的E-mail，出错时发送错误的邮件地址

ServerAdmin [email]HeirJoe@gmail.com[/email]

#服务器名，没有域名就写IP

ServerName My IP:80

#主目录地址

DocumentRoot “/path/to/server”

#设置默认主目录的权限，下面需要用到

Order deny,allow

Allow from all

#使用别名，将系统绝对路径转换为相对于DocumentRoot的相对路径

Alias /home “/home/httpd”

#配置浏览目录的选项

#选项为索引方式

Options Indexes

#索引选项，目录优先

IndexOptions FancyIndexing FoldersFirst

#索引排除选项

IndexIgnore header.html footer.html

#索引头部嵌入文件(只可使用相对http主目录的相对路径，而不是系统的绝对路径)

HeaderName /home/html/header.html

#索引底部嵌入的文件(同上，”/home”使用了别名,同时要为那个目录设置权限)

ReadmeName /home/html/footer.html

#关闭服务器标志

ServerSignature Off

#使用.htaccess文件可以得到的控制水平

AllowOverride None

#控制访问权限

Order allow,deny

Allow from all

所作的修改就这么多，其它的都是系统默认，不考虑安全、性能等，基本能正常跑起来了。

3.运行apache：httpd -k start

简单的配置就这么多，Apache的配置和组合还有好多好多，以后再细细研究

个性化Apach2目录列表

个性化Apach2目录列表，主要取决于对modautoindex模块中的各种指令的使用和配合。可以去先阅读一下Apache2.0手册中的modautoindex模块文档。

文档地址： [url]http://httpd.apache.org/docs/2.0/mod/mod_autoindex.html[/url]

在开始之前，请看一个个性化目录列表的演示地址： [url]http://nanu.8866.org/download[/url]

下面，我们就开始动手：

一、修改httpd.conf文件

对需要个性化的目录进行定制：

<Directory “/www/download”>
Options Indexes FollowSymlinks
IndexOptions FancyIndexing ScanHTMLTitles NameWidth=25 DescriptionWidth=128 VersionSort FoldersFirst
IndexIgnore favicon.ico header.html footer.html images
HeaderName header.html
ReadmeName footer.html
AddDescription “Qmail安装包” qmail.tar.gz
AddDescription “Putty0.58” putty.exe
AddDescription “我的MSN头像:P” msn.gif
IndexOrderDefault Ascending Name
AllowOverride None
Order allow,deny
Allow from all
</Directory>

部分指令说明：

ScanHTMLTitles：如果目录中含有HTML文件，则Apache会自动读取HTML文件的< title>……部分，用HTML文件的标题作为Description（描述）显示在列表目录中的 Description部分。。（注意：加载该指令会加大CPU的负荷！）

NameWidth=25 ：指定目录列表可以显示最长为25字节的文件/目录名,如果使用*来做值,会自适应到最长文件名。

DescriptionWidth=128：指定目录列表可以显示最长为128字节的文件/目录描述内容。

VersionSort：如果目录中含有同一文件的不同版本，则Apache会对该文件按照版本号自动排序。

FoldersFirst：最先列出文件夹会使显示效果更好看一些吧！

IndexIgnore：在它后面设定的文件/目录不会在目录列表中显示。

HeaderName：指定该目录列表的header模板，指定一个html文件后，Apache会用这个网页替换掉默认目录列表上面呆板的 Index of …..而显示出个性化的头网页。（注意：文件路径是相对于列表目录的根而言的，并不是相对于系统根或者网站根而言的！）

ReadmeName：指定该目录列表的footer模板，指定一个html文件后，Apache会在目录列表的底部加载这个网页。（注意：文件路径是相对于列表目录的根而言的，并不是相对于系统根或者网站根而言的！）

AddDescription：如果你想为某个文件设置一个Description（描述）的话，就使用这个指令，格式是AddDescription “描述” 文件名 。

IndexOrderDefault Ascending Name：指定目录列表的排序方式为按名称排序。

当然，还可以定制很多其他的内容，包括可以为每一个文件设定一个图标等等，去读文档吧。

二、建立header.html和footer.html

这两个文件是列表目录的头网页和尾网页，也是个性化的关键。其实这部分和Apache水平已经没有什么关系了，主要还是看你制作网页水平如何了，呵呵。

这里给出两个文件的格式：

header.html：

<!– 个性化内容开始 –>
可以在这里加入个性化内容，图片、FLASH、表格等等，随意啦！
<!– 个性化内容结束 –>
<!– 嵌入列表目录 –>
<table>
<tr><td>
footer.html：

</td></tr>
</table>
<!– 目录列表嵌入结束 –>
<!– 个性化内容开始 –>
可以在这里加入个性化内容，图片、FLASH、表格等等，随意啦！
<!– 个性化内容结束 –>

可以看出，其实个性化的原理就是把Apache的目录列表嵌在了header.htm的<\table>< \tr><\td>与footer.html的<\/td><\/tr><\/table>之间，两个文件的其他部分都可以自定义内容的。

建立好这两个文件后，就可以重启apache，看看自己的定制的目录有多漂亮吧！

您可能也喜欢：
Apache下实现隐藏服务器名称	查看Apache并发请求数及其TCP连接状态[原创]	Apache 的信息查看模块——Server-Status	Apache优化内存占用方法
无觅

主机配置为： CPU: 至强2.8G  内存： 1GB RAM

下载：

wget  http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE6.tar.bz2
tar jxvf squid-2.6.STABLE6.tar.bz2
./configure –prefix=/usr/local/squid --with-maxfd=65536

这个--with-maxfd参数是增大squid文件描述符到65536

安装完毕后开始配置/usr/local/squid/etc/squid.conf

CODE:

visible_hostname www.yoursite.com
http_port xx.xx.xx.xx:80 vhost vport

#xx.xx.xx.xx为这台服务器的IP地址

icp_port 0

cache_mem 400 MB

#设置Squid所能使用的内存共400MB，这个值因人而异

cache_swap_low 90
cache_swap_high 95

maximum_object_'size' 20000 KB

#最大缓存文件大小，超过这个值则不缓存，这个值因人而异

maximum_object_'size'_in_memory 4096 KB

#装入内存缓存的文件大小，这个值对Squid的性能影响比较大，因为默认值是8K,超过8K的文件都不装入内存，而实际应用中很多网页和图片等都超过8KB, 个人认为如果缓存不装入内存而存在磁盘上，性能和apache直接读取磁盘文件没什么区别，甚至不如直接访问apache，现在设置成小于4兆的文件通通装入内存缓存.

cache_dir ufs /tmp 10000 16 256

#磁盘缓存的类型和目录，大小，一二级目录的设置，这里磁盘缓存大小是10G

cache_store_log none

#这个设置是不记录store.log

emulate_httpd_log on

#打开emulate_httpd_log选项,将使Squid仿照Aapche的日志格式

logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

#日志格式combined的设置

pid_filename /var/log/squid/squid.pid
cache_log /var/log/squid/cache.log
access_log /var/log/squid/access.log combined

#这里是设置pid和日志文件的位置，因人而异，同时日志格式是combined，awstats可以直接调用分析了

acl all src 0.0.0.0/0.0.0.0

acl QUERY urlpath_regex cgi-bin .php .cgi .avi .wmv .rm .ram .mpg .mpeg .zip .exe
cache deny QUERY

#设置不想缓存的目录或者文件类型

acl picurl url_regex -i \.bmp$ \.png$ \.jpg$ \.gif$ \.jpeg$
acl mystie1 referer_regex -i aaa
http_access allow mystie1 picurl
acl mystie2 referer_regex -i bbb
http_access allow mystie2 picurl

#设置防图片盗链的，其中aaa,和bbb分别是虚拟主机的域名，referer中必须包含有aaa或者bbb的域名才能访问图片

acl nullref referer_regex -i ^$
http_access allow nullref
acl hasref referer_regex -i .+
http_access deny hasref picurl

#设置允许直接访问图片和拒绝referer中没有包含aaa或着bbb的访问图片

cache_peer xx.xx.xx.xx parent 80 0 no-query originserver login=PASS

#xx.xx.xx.xx还是本机服务器的IP，80则是apache的端口，如果你的虚拟主机有用户名和密码保护起来的目录必须设置login=PASS，否则认证会失效

cache_effective_user nobody
cache_effective_group nobody

#squid使用的用户组和用户名
squid配置完成！

建立缓存和日志目录，并改变权限使squid能写入
mkdir /tmp
mkdir /var/log/squid
chown -R nobody:nobody /tmp
chmod 777 /tmp
chown -R nobody:nobody /var/log/squid
－－－－－－－－－－－－－－－－－－－－－－－
Apache需要改动的配置

CODE:

Port 80

#要把端口改为80

NameVirtualHost xx.xx.xx.xx:80
#本台主机IP和端口

虚拟主机配置
<VirtualHost xx.xx.xx.xx>
ServerAdmin xxx@yahoo.com
DocumentRoot /home/aaa/www
ServerName aaa.com
ServerAlias www.aaa.com
ScriptAlias /cgi-bin/ "/home/aaa/cgi-bin/"
<Directory />
Options Includes FollowSymLinks
AllowOverride All
</Directory>
</VirtualHost>

如果还有别的虚拟主机请参照上面设置
---------------------------------------------------------

重启apache : apachectl restart

----------------------------------------------------------
首次运行squid要先建立缓存

/usr/local/squid/sbin/squid -z

启动squid

echo "65535" > /proc/sys/fs/file-max
ulimit -HSn 65535
/usr/local/squid/sbin/squid

大家最好把这几句话放到squid启动脚本里面，这样才会获得65536文件描述符

最好还编辑/etc/hosts 文件
添加以下内容

xx.xx.xx.xx aaa.com www.aaa.com bbb.com www.bbb.com

这样免去查询DNS，速度也快一些

现在大家肯定急着要打开浏览器访问你的网站看看效果吧，其实没啥变化，要等到有流量访问，squid把文件都装到内存后，效果才明显。可以用top命令观察squid的内存使用情况或者用

cat /var/log/squid/access.log |grep TCP_MEM_HIT

如果看到很多的TCP_MEM_HIT ，这表明该文件是从内存缓存读取的，squid已经起作用了！你再用浏览器打开该文件，应该是快如闪电了。。呵呵，大功告成了！还有其他类型的HIT，如TCP_HIT等等，这些是从磁盘读取的，我觉得加速的意义不大，只不过缓解了apache的压力而已。

后记： 我的服务器因流量很大，大多都是静态的网页，日访问量常常上10W, apache常常不堪负重，苟延残存，任务数常到达300甚至400，后来安装squid2.6接管了大部分的apache，服务器如释重负，不但速度有提升，而且系统负载也低了很多，任务数稳定在100~120之间，任他流量波涛汹涌，服务器依然屹立不倒。

来源:http://blog.csdn.net/starxu85/archive/2008/11/02/3207586.aspx

您可能也喜欢：
freebsd7.0 apache php squid 反向代理	squid缓存动态连接	服务器的大用户量的承载方案 Nginx Squid Apache PHP MySQL	apache squid 配置反向代理服务相关文章
无觅

我个人试了一下启用了

EnableSendfile Off

暂时解决了，

下面我们针对几种错误信息进行分析并给出解决的方法：

1. Apache与WinSock v2相冲突
Apache官方提供的手册中提到，在Windows系统下Apache2.x为了提高性能而使用了Microsoft WinSock v2 API，但是一些常见的防火墙软件会破坏他的正确性，从而使得Apache出现死循环操作造成CPU100％。

其错误提示如下所示：

[error] (730038)An operation was attempted on something that is not a socket.: winnt_accept: AcceptEx failed. Attempting to recover.

[error] (OS 10038) : Child 3356: Encountered too many errors accepting client connections. Possible causes: dynamic address renewal, or incompatible VPN or firewall software. Try using the Win32DisableAcceptEx directive.

[warn] (OS 121)信号灯超时时间已到。 : winnt_accept: Asynchronous AcceptEx failed.

[warn] (OS 64)指定的网络名不再可用。 : winnt_accept: Asynchronous AcceptEx failed.

可以依次采用下面的方法来解决上面的问题，如果进行了一步还有问题就继续下一步：

1) 在httpd.conf文件中使用 Win32DisableAcceptEx 禁止Apache使用 Microsoft WinSock v2 API ：

2) 使用System Repair Engineer(SREng)查看WinSocket供应者，如果出现非MS的陌生项则将其删除，并使用软件的“重置WinSocket”按钮进行重置。

3) 卸载与Apache相冲突的杀毒软件或防火墙软件。

如果进行上面的三个步骤之后还有问题，那应该看看是不是还有下面的错误。

2. “Terminating 1 threads that failed to exit”错误
上面错误中的数字1有可能是其他数字，造成这个错误的原因是Apache在退出并发线程的时候出现线程溢出，从而造成内存泄露，表现出来的就是Apache所占用的系统资源持续增长。

解决的方法也很简单，将最大请求线程的值降低一些，但是也不能太低，太低的话会产生大量的请求队列从而造成站点访问缓慢。如果之前为0则将其设置为一个最大值。

3. “file .\\server\\mpm\\winnt\\child.c, line 1078, assertion “(rv >= 0) && (rv < threads_created)” failed” 错误

这个错误是Apache的一个bug(#11997)，可以通过 Win32DisableAcceptEx 禁止Apache使用WinSocket v2来避免此bug，具体设置见前述。

4. PHP5.2.1以上版本的libmysql.dll与MySQL5不兼容
PHP5.2.1以后的新版本(截止目前最新版本为5.2.5)中用于连接MySQL的libmysql.dll组件与MySQL5不兼容，在Apache中运行PHP的时候会造成Apache产生CPU100%的问题。

解决的方法就是从http://www.php.net/releases/下载5.2.1版本，将压缩包中的libmysql.dll文件覆盖现在的文件，然后重启Apache就可以了。

5. 病毒或木马程序命名为Apache.exe
有的时候病毒或木马程序会将其名称命名为Apache.exe文件达到一种掩饰的目的，这个时候使用第三方进程分析器查看进程的路径然后将其删除或使用杀毒软件清除就可以了。

6. 程序编写不严谨造成死循环等错误
如果上面的问题都不存在Apache依然产生CPU100%的问题的话，通常来说就应该是Web程序自身的问题了，例如死循环等等。这个时候需要在日志中设置HTTP请求的文件及执行的时间，然后查找出执行时间比较长的地址进行分析排查。

日志格式设置如下：

LogFormat “%v %h %l %u %t [%Ts] \”%r\” %>s %b” vhost_common #设置程序执行时间

<VirtualHost xxx.xxx.xx.xx:80>
ServerName xxx.xxx.com
DirectoryIndex index.php index.html index.htm
DocumentRoot “xxx”
# cronolog.exe是Apache自带的用于将日志文件进行分割的应用程序
CustomLog “|bin/cronolog.exe e:/%Y%m%d.log” vhost_common
</VirtualHost>

参考资料：
apache 遇到[error] (OS 10038) 错误
Error in my_thread_global_end(): 1 threads didn’t exit
查看Apache并发请求数及其TCP连接状态
Apache Bug 11997
关于apache.exe开机占用cpu100%的终极解决方法
apache cpu占用100%的问题。
空间持续CPU100%时间过长，如何优化程序

您可能也喜欢：
怎么检查windows下apache加载的mpm模块是什么？	查看Apache并发请求数及其TCP连接状态[原创]	Apache 的信息查看模块——Server-Status	Apache内存优化
无觅

一、 使用 rewrite 技术实现 Apache 防盗链

Apache 防盗链的第一种实现方法，可以用 rewrite 实现。首先要确认 Apache 的 rewrite module 可用：能够控制 Apache httpd.conf 文件的，打开 httpd.conf，确保有这么一行配置:

LoadModule rewrite_module modules/mod_rewrite.so

然后在找到自己网站对应的 配置的地方，加入下列代码：

ServerName haohtml.com

# 防盗链配置
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://haohtml.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://haohtml.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.haohtml.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.haohtml.com$ [NC]
RewriteRule .*\.(gif|jpg|swf)$ http://www.haohtml.com/about/nolink.png [R,NC]

防盗链配置的说明：

1. 红色部分: 表示自己的信任站点。对我的站点来说，设置为 http://www.haohtml.com 和 http://haohtml.com
2. 绿色部分: 要保护文件的扩展名(以|分开)。以这些为扩展名的文件，必须通过红色标注的网址引用，才可以访问。
3. 蓝色部分: 盗链后的重定向页面。用以输出警示信息，这张图片应该尽可能的小。例如我的警示图片是 http://www.haohtml.com/about/nolink.png。为了简单处理的原因，我的绿色字体部分，要保护的图片扩展中，没有 .png 的图片，而警示图片是 .png的。（我站内没有 .png的其他图片）

然后重新启动 apache 服务器即可。

有些用户使用的是虚拟主机，没有服务器的控制权，无法修改 httpd.conf 文件和重启服务器。那么请确认你的虚拟主机支持 .htaccess，将上面的配置写入 .htaccess 文件，放入根目录或图片所在的目录即可：

htaccess 文件的内容：

# 防盗链配置
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://haohtml.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://haohtml.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.haohtml.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.haohtml.com$ [NC]
RewriteRule .*\.(gif|jpg|swf)$ http://www.haohtml.com/about/nolink.png [R,NC]

注意:

1. httpd.conf 文件里的配置，是在 apache 启动时一次读取，效率很高
2. .htaccess 文件里的配置，每次访问都需要读取分析，效率很低。

二、 使用 SetEnvIfNoCase 和 access 技术实现 Apache 防盗链

另一种方式是利用 SetEnvIfNoCase 和 access。具体的代码如下：

SetEnvIfNoCase Referer "^http://haohtml.com" local_ref=1
SetEnvIfNoCase Referer "^http://www.haohtml.com" local_ref=1

Order Allow,Deny
Allow from env=local_ref

将上述代码，放入前面所讲的 httpd.conf 或 .htaccess 文件即可。

三、Apache 防盗链技术小结

通过判断 referer 变量的值，判断图片或资源的引用是否合法，只有在设定范围内的 referer，才能访问指定的资源，从而实现了防盗链(Anti-Leech)的目的。需要指出的是：不是所有的用户代理（浏览器）都会设置 referer 变量，而且有的还可以手工修改 referer，也就是说，referer 是可以被伪造的。本文所讲的，只是一种简单的防护手段。当然，应付一般的盗链也足够了。

四、参考资料

Apache Documentation: Authentication, Authorization and Access Control (v2.2)
Apache Documentation: htaccess files (V2.2)
来源：http://server.it168.com/server/2008-01-11/200801100802859_1.shtml

您可能也喜欢：
Apache实现图片防盗链	Apache图片防盗链	APACHE优化之apache的内存使用	Apache内存优化
无觅

SetEnvIfNoCase Referer "chinaunix.net" local_ref=1

Order Allow,Deny
Allow from env=local_ref

外部网站调用论坛的图片会跳转到另一张图：
ErrorDocument 403 http://www.chinaunix.net/error.gif

下边转贴一篇老外写的文章，有时间再翻译

Preventing Image 'Theft'

By: Ken Coar
Copyright © 2000 by Ken Coar. All rights reserved. Limited rights granted to Internet.Com.
Keeping Your Images from Adorning Other Sites

Webmasters are ever searching for ways to make their sites look cool and attractive. One way is to dress it up with images, logos, and other graphics -- sometimes referred to as 'eye candy.' Of course, if you happen to be in the forefront of this in any way, you run the risk of having others cadge your art in order to dress up their sites. And they probably won't even ask permission nor pay you a royalty, either.

This article shows how you can use Apache configuration directives to limit access to your art so that it's more difficult to use elsewhere.
The Problem

Simply put, there are two types of 'infringement' involved here:

Someone uses an IMG tag on its site to refer to a graphic on yours
Someone downloads an image from your site and makes a copy on its

The first type not only causes your images to prettify someone else's site, but hurts you more directly because visitors to their site are hammering yours to get the images. Your log files get filled with access request entries, your bandwidth gets used -- and you're getting no benefit from it. This type of theft is almost completely preventable.

The second type of theft is more insidious. The 'borrower' doesn't cause your site to get pounded on for access to the images, since they've been copied to the borrower's site, but you probably weren't given any credit for the artwork -- and you probably don't even know the theft happened. Because of the way the Web works, this type of theft can't really be prevented, but you can at least make it a little more difficult.

You can't completely prevent either of these, of course, but you can make them more difficult to do.
Identifying the Files to Protect

You're probably not going to want to protect every document on your site. Even if you do, for the sake of this article I'm assuming you only want to protect your artwork. So how do you indicate that the rules only apply to them? With directives such as the following in your server config files:
[limiting directives will go here]

You can put a container such as this inside a container, or inside a container, or outside any containers at all (in which case it applies to all such files on your server), or even inside .htaccess files. Put it wherever it makes sense to protect what you want protected.
The Key: the Referer Header Field

Down on the wire, where the browsers, spiders, and servers live, every request for a Web page includes a component called the HTTP request header. This contains information about the request, such as the user's preferred languages, the types of documents the client is able to handle -- and not least, the name of the item being requested. This information is conveyed in a series of name/value pairs called header fields.

One of these header fields is of particular importance to what we want to do. It's called the Referer field (yes, I know, it's misspelt -- but that's how it's misspelt in the definition, too), and it indicates the URL of the client's last page if and only if the client is following a link. That is, if you're viewing page A, and click on a link to page B, the request for page B will include a Referer field that says "I'm following a link on page A." If no link is being followed, such as if the user just typed B's URL into the Location field of his browser, there will be no Referer field in the request header.

How does this help? Well, it gives us a way to tell whether an image is being requested because it was linked to by one of our pages -- or by someone else's.
Using SetEnvIf to 'Tag' Images

For a simple case, suppose our Web site's main page is . In this case, we want to restrict any artwork requests that don't originate on our site (i.e., only allow them if the image was linked to by one of our pages). We can do this by using an environment variable (also called an envariable) as a flag, and setting it if the conditions are right. Something like the following ought to do it:

SetEnvIfNoCase Referer "^http://my\.apache\.org/" local_ref=1

When Apache processes a request, it will examine the Referer field in the header, and set the environment variable local_ref to "1" if the value starts with our site address -- i.e., is one of our pages.

The string inside the quotation marks is a regular expression pattern that the value must match in order for the environment variable to be set. Describing how to use regular expressions (REs) is far beyond the scope of this article; for now, just be aware that the SetEnvIf* directives use them.

The "NoCase" portion of the directive name means, "do this whether the Referer is 'http://my.apache.org/', or 'http://My.Apache.Org/', or 'http://MY.APACHE.ORG/' -- in other words, ignore the upper/lower caseness of the value.
Using Envariables in Access Control

The Order, Allow, and Deny directives allow us to control access to documents based upon the setting (or unset-ness) of an envariable. The first thing to do is to indicate the order in which Apache will process Allow and Deny directives; you do with the Order directive as follows:

Order Allow,Deny

This means that Apache will go through any list of Allow directives it has that apply to the current request, and then repeat the process with any Deny directives. With this ordering, the default condition is 'denied;' that is, no-one will be able to access anything unless there's an applicable Allow directive.

All right, so let's add the directive that will let local references work:

Order Allow,Deny
Allow from env=local_ref

This will let a request proceed if the local_ref envariable is set (with any value whatsoever). Any and all other requests will be denied because they don't meet the Allow conditions and the default is to deny access.

Note:
Please don't fall into the trap of sprinkling your .htaccess and server config files with containers. You almost certainly don't need them, and they'll just confuse the issue. Don't use them unless you really want to have GET requests treated differently from POST requests, for instance.

Putting It All Together

Putting all these pieces together, we end up with a stanza of directives that looks something like this:

SetEnvIfNoCase Referer "^http://my\.apache\.org/" local_ref=1

Order Allow,Deny
Allow from env=local_ref

These may all appear in your server-wide configuration files (e.g., httpd.conf), or you can put the container in one or more .htaccess files. The effect is the same: Within the scope of these directives, images can only be fetched if they were linked to from one of your pages.

Note:
As of Apache 1.3.12 and earlier, the SetEnvIf* directives are only allowed in the server-wide configuration files. In later versions, they can be used inside containers and in .htaccess files.

Going Further

I mentioned earlier that you can't fully prevent image theft. That's because of two things, which apply pretty much to the two different types of poaching respectively:

Someone who really wants your artwork can always request it using a faked-up Referer value that happens to meet your criteria. In other words, by jiggering up the request so it looks like it's a reference from your site.
If someone legitimately views your artwork by going through your pages, the image files are almost certainly in his client's cache somewhere. So he can pull it out of a cached valid request rather than making another one just to pick up the image.

Though it's essentially impossible to foil someone who's really desperate to snitch your artwork, the steps described in this article should make it too difficult for the casual poacher.

Another thing you can do, depending upon how protective you are of your art, is to watermark the images. Watermarking a digital image consists of encoding a special 'signature' into the graphic so that it can be detected later. Digital watermarking doesn't degrade the quality of the image, and can be done in such a way that even a cropped subsection of the image contains the mark, and it's detectable even if the image has been otherwise edited since the mark was inserted. It's even possible to detect a watermark in an image that was printed and then scanned in, having left the digital realm altogether! If you watermark your images, there's an excellent chance you'll be able to prove snitching if you ever find a suspicious image on another site somewhere.
Logging Snitch-Attempt Requests

If you're not sure whether anyone is really after your artwork, you can use the same detection mechanism and envariable to log suspicious requests. For instance, if you add the following directives to your httpd.conf file, an entry will be made in the /usr/local/web/apache/logs/poachers_log file any time someone accesses one of your images without a valid Referer:

SetEnvIfNoCase Referer "!^http://my\.apache\.org/" not_local_ref=1
SetEnvIfNoCase Request_URI "\.(gif|jpg)" is_image=1
RewriteEngine On
RewriteCond ${ENV:not_local_ref} =1
RewriteCond ${ENV:is_image} =1
RewriteRule .* - [Last,Env=poach_attempt:1]
CustomLog logs/poachers_log CLF env=poach_attempt

This should have the effect of logging all attempts to access your images using one of the potential 'snitching' techniques described in this article. The first two lines set flags for the conditions (that it's an image, and that it wasn't referred by a local document), the RewriteCond lines check to see if the flags are set, the RewriteRule line sets a third flag combining the two, and the last line causes the logging of the request in a special file if that last flag is set. The log entry is written in the pre-defined 'CLF' format ('Common Log Format'), but you could put together your own format just as easily.
Other Resources

The techniques described in this article are geared toward a single purpose, but illustrate some of the capabilities of the Apache server. Here are some pointers to resources for further investigation:

The HTTP/1.1 definition document:
The main Apache Web site, of course:
The documentation for Apache and its modules:
The canonical email response page:
(This page is normally used to respond to email requests for support, but there are lots of good resources listed on it.)

Then there are the specific pieces of the Apache documentation that are directly related to the directives and commands described in this article:

The documentation for documentation:
The mod_setenvif documentation:
The mod_access documentation:
The mod_rewrite documentation:
The documentation on the CustomLog directive:

Conclusion

Custom artwork can result from someone's effort, and taking without permission something that another has created is generally accepted as theft. This article has described a basic way to put your works of art behind a velvet rope -- if you're so inclined. It won't stop determined thieves, but it should hopefully stymy or dissuade the more casual ones.
Got a Topic You Want Covered?

If you have a particular Apache-related topic that you'd like covered in a future article in this column, please let me know; drop me an email at . I do read and answer my email, usually within a few hours (although a few days may pass if I'm travelling or my mail volume is 'way up). If I don't respond within what seems to be a reasonable amount of time, feel free to ping me again.
About the Author

Ken Coar is a member of the Apache Group and a director and vice president of the Apache Software Foundation. He is also a core member of the Jikes open-source Java compiler project, a contributor to the PHP project, the author of Apache Server for Dummies, and a contributing author to Apache Server Unleashed. He can be reached via email at .

您可能也喜欢：
apache内存报死	apache你必须知道的一些知识	apache工作方式	怎么检查windows下apache加载的mpm模块是什么？
无觅

这样不用每次都把php.ini拷贝到C:\Windows下

2、set Path=D:\PHP5;D:\PHP5\ext;%Path%

这样不用每次把那些dll拷贝到C:\Windows\system32下

您可能也喜欢：
windows下apache+php平台，虚拟主机安全设置	[精典教程]freebsd下安装mysql,apache,php,phpmyadmin记录	apache 中控制虚拟主机的php功能	Apache+php+mysql在windows下安装与简单配置
无觅