site güvenliğinizi htaccess ile arttırın

çeşitli web tabanlı yazılımları kurup internet üzerinden yayına açtığınız zaman; yer yer zararlı ve/veya meraklı saldırılara maruz kalabilirsiniz.

Bu saldırıları engellemek çoğu zaman yazılımsal düzenlemeler gerektirdiği için yüksek maliyetli olabilir.

ancak htaccess dosyasında yapacağınız ufak tefek değişiklikler size büyük ölçekte fayda sağlayacaktır.





# Filter for most common exploits

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} libwww-perl [OR]
RewriteCond %{QUERY_STRING} tool25 [OR]
RewriteCond %{QUERY_STRING} cmd.txt [OR]
RewriteCond %{QUERY_STRING} cmd.gif [OR]
RewriteCond %{QUERY_STRING} r57shell [OR]
RewriteCond %{QUERY_STRING} c99 [OR]

# Anti XSS
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]

# Made redundant by Security Pro 2.0
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

# bad_conduct replaces index_error.php
# RewriteRule ^(.*)$ index_error.php [F,L]
RewriteRule ^(.*)$ bad_conduct/ban.php [L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

RewriteRule setup\.php$ bad_conduct/ban.php [NC,L]
RewriteRule file_manager\.php$ bad_conduct/ban.php [NC,L]
RewriteRule spaw2\.* bad_conduct/ban.php [NC,L]
RewriteRule \.php/login\.php bad_conduct/ban.php [NC,L]
RewriteRule \.php/login\.php$ bad_conduct/ban.php [NC,L]
RewriteRule images/.*\.php$ bad_conduct/ban.php [NC,L]


# Specify error documents
ErrorDocument 400 /store/catalog/http_error.php?error_id=400
ErrorDocument 401 /store/catalog/http_error.php?error_id=401
ErrorDocument 403 /store/catalog/http_error.php?error_id=403
ErrorDocument 404 /store/catalog/http_error.php?error_id=404
ErrorDocument 405 /store/catalog/http_error.php?error_id=405
ErrorDocument 408 /store/catalog/http_error.php?error_id=408
ErrorDocument 415 /store/catalog/http_error.php?error_id=415
ErrorDocument 500 /store/catalog/http_error.php?error_id=500
ErrorDocument 501 /store/catalog/http_error.php?error_id=501
ErrorDocument 502 /store/catalog/http_error.php?error_id=502
ErrorDocument 503 /store/catalog/http_error.php?error_id=503
ErrorDocument 505 /store/catalog/http_error.php?error_id=505
ErrorDocument 504 /store/catalog/http_error.php?error_id=504

# No directory browsing
Options -Indexes

# deny access to unused filetypes
<FilesMatch "\.(bak|inc|tpl|h|ihtml|sql|ini|conf|class|bin|spd|theme|module|exe|Gfr)$">
deny from all
</FilesMatch>

# no access to htaccess files
<Files ~ "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</Files>

# no access to config files
<Files ~ "\config.php$">
deny from all
</Files>

# Force type & prevent script execution
<Files site>
ForceType application/x-httpd-php
</Files>

########## start block copy-bots
SetEnvIfNoCase User-Agent "^Yandex*" bad_bot
SetEnvIfNoCase User-Agent "^HTTrack" bad_bot
SetEnvIfNoCase User-Agent "^WebCopier" bad_bot
SetEnvIfNoCase User-Agent "^SiteCopy" bad_bot
SetEnvIfNoCase User-Agent "ia_archiver" bad_bot
SetEnvIfNoCase User-Agent "^LinkWalker" bad_bot
SetEnvIfNoCase User-Agent "^Teleport" bad_bot
SetEnvIfNoCase User-Agent "^psycheclone" bad_bot
SetEnvIfNoCase User-Agent "^Web Downloader" bad_bot
SetEnvIfNoCase User-Agent "^libwww-perl" bad_bot

<Limit GET POST>
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</Limit>
########## end block

<Limit GET HEAD POST>
order allow,deny
deny from cnbaforo.com
deny from keywordspy.com
deny from keywordspypro.com
deny from spyfu.com
deny from spyfoo.com
deny from foospy.com
deny from fuspy.com
allow from all
</LIMIT>

# Block a specific referer
RewriteCond %{HTTP_REFERER} cnbaforo\.com [NC,OR]
RewriteCond %{HTTP_REFERER} keywordspy\.com [NC,OR]
RewriteCond %{HTTP_REFERER} keywordspypro\.com [NC,OR]
RewriteCond %{HTTP_REFERER} spyfu\.com [NC,OR]
RewriteCond %{HTTP_REFERER} foospy\.com [NC,OR]
RewriteCond %{HTTP_REFERER} fuspy\.com [NC,OR]
RewriteCond %{HTTP_REFERER} spyfoo\.com [NC]
RewriteRule .* - [F]
########## end block

########### BAD BEHAVIOR BLOCK rules to ban exploits
########### IMPORTANT This must be last in the .htaccess file!
########### Add one blank line at the very end of the .htaccess file
<Files 403.shtml>
order allow,deny
allow from all
</Files>

deny from 174.122.156.98
deny from 67.23.244.96
deny from 94.75.243.135
deny from 178.208.80.219
deny from 79.140.208.242
deny from 116.255.163.100
deny from 62.67.244.64
deny from 85.25.120.187
deny from 189.146.206.70
deny from 77.232.91.201
deny from 58.137.99.88
deny from 109.79.142.39
deny from 222.231.63.26
deny from 24.18.183.14
deny from 109.79.161.168
deny from 198.106.189.76
deny from 202.125.40.167