如何限制mod_proxy_connect的主机？

发布于 2025-01-08 17:38:06 字数 230 浏览 2 评论 0原文

我想通过端口 80（由 apache 监听）建立 ssh 隧道。 mod_proxy & mod_proxy_connect 为我提供了 AllowCONNECT 指令，允许我使用 CONNECT host:22 HTTP/1.1 连接到我的 ssh 主机。但是CONNECT之后的主机不受限制，有解决办法吗？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

雪化雨蝶 2025-01-15 17:38:06

有一个解决方案不需要更改 Apache 源代码。将以下内容放入您的 httpd.conf 文件中：

   # By default, deny everyone. If you don't,
   # others will be able to connect to port 22 on any host.
   <Proxy *>
       Order deny,allow
       Deny from all
   </Proxy>

  # Only allow CONNECT to specific hosts;
  <ProxyMatch (^(host1\.com|host2|host3):22$)>
      Order allow,deny
      Allow from all
  </ProxyMatch>

更改 Apache 源代码会造成维护负担，因为您必须将补丁重新应用到每个新的 Apache 版本。

There is a solution that does not require changing Apache source code. Put the following in your httpd.conf file:

   # By default, deny everyone. If you don't,
   # others will be able to connect to port 22 on any host.
   <Proxy *>
       Order deny,allow
       Deny from all
   </Proxy>

  # Only allow CONNECT to specific hosts;
  <ProxyMatch (^(host1\.com|host2|host3):22$)>
      Order allow,deny
      Allow from all
  </ProxyMatch>

Changing Apache source code creates a maintenance burden, since you'll have to reapply your patch to every new Apache version.

回复收藏 0 原文

辞取 2025-01-15 17:38:06

我自己想出来了。中添加几行

只需在apache2.2/modules/proxy/mod_proxy_connect.c +123

char *allowed_hosts[] = { 
    "your host",
    "127.0.0.1",
    "localhost"
};  
int hosts_num = sizeof(allowed_hosts) / sizeof(allowed_hosts[0]);
int k;
for (k = 0; k < hosts_num; k++) {
    if (strncmp(uri.hostname, allowed_hosts[k], strlen(allowed_hosts[k])) == 0) {
        break;
    }
}
if (k == hosts_num) {
    return ap_proxyerror(r, HTTP_BAD_GATEWAY,
                         apr_pstrcat(p, "host not allowed for: ",
                                     uri.hostname, NULL));
}

I figured it out myself. Just to add a few lines in the

apache2.2/modules/proxy/mod_proxy_connect.c +123

char *allowed_hosts[] = { 
    "your host",
    "127.0.0.1",
    "localhost"
};  
int hosts_num = sizeof(allowed_hosts) / sizeof(allowed_hosts[0]);
int k;
for (k = 0; k < hosts_num; k++) {
    if (strncmp(uri.hostname, allowed_hosts[k], strlen(allowed_hosts[k])) == 0) {
        break;
    }
}
if (k == hosts_num) {
    return ap_proxyerror(r, HTTP_BAD_GATEWAY,
                         apr_pstrcat(p, "host not allowed for: ",
                                     uri.hostname, NULL));
}

回复收藏 0 原文

~没有更多了~