防范WEBSHELL方法之一：用PHP-CGI端口锁定网站目录

　　现在网站的动态程序越来越多，从一方面来说，程序为我们工作的自动化提供了方便，但简便是需要代价的。网站上的动态程序多了，便容易给入侵者利用，通过WEBSHELL控制网站。

　　如果网站动态程序主要是用PHP语言编写的，我们可以通过设置php-cgi锁定某个目录，这样，PHP-CGI便只能在这个目录下运行，就算网站被入侵者用webshell控制了，也无法跳转出这个目录。

　　假设网站目录为/home/www/，进入/usr/local/php/etc，增加一个文件

vi ，输入如下代码：

All relative paths in this config are relative to php's install prefix



Pid file
/usr/local/php/logs/php-fpm.pid

Error log file
/usr/local/php/logs/php-fpm.log

Log level
notice

When this amount of php processes exited with SIGSEGV or SIGBUS ...
10

... in a less than this interval of time, a graceful restart will be initiated.
Useful to work around accidental curruptions in accelerator's shared memory.
1m

Time limit on waiting child's reaction on signals from master
5s

Set to 'no' to debug fpm
yes







Name of pool. Used in logs and stats.
default

Address to accept fastcgi requests on.
Valid syntax is 'ip.ad.re.ss:port' or just 'port' or '/path/to/unix/socket'
127.0.0.1:9000



Set listen(2) backlog
-1

Set permissions for unix socket, if one used.
In Linux read/write permissions must be set in order to allow connections from web server.
Many BSD-derrived systems allow connections regardless of permissions.


0644


Additional php.ini defines, specific to this pool of workers.



/home/www/:/tmp/:/var/tmp/



Unix user of processes
www

Unix group of processes
www

Process manager settings


Sets style of controling worker process count.
Valid values are 'static' and 'apache-like'
apache-like

Sets the limit on the number of simultaneous requests that will be served.
Equivalent to Apache MaxClients directive.
Equivalent to PHP_FCGI_CHILDREN environment in original php.fcgi
Used with any pm_style.
32

Settings group for 'apache-like' pm style


Sets the number of server processes created on startup.
Used only when 'apache-like' pm_style is selected
20

Sets the desired minimum number of idle server processes.
Used only when 'apache-like' pm_style is selected
5

Sets the desired maximum number of idle server processes.
Used only when 'apache-like' pm_style is selected
35





The timeout (in seconds) for serving a single request after which the worker process will be terminated
Should be used when 'max_execution_time' ini option does not stop script execution for some reason
'0s' means 'off'
30s

The timeout (in seconds) for serving of single request after which a php backtrace will be dumped to slow.log file
'0s' means 'off'
0s

The log file for slow requests
logs/slow.log

Set open file desc rlimit
1024

Set max core size rlimit
0

Chroot to this directory at the start, absolute path


Chdir to this directory at the start, absolute path


Redirect workers' stdout and stderr into main error log.
If not set, they will be redirected to /dev/null, according to FastCGI specs
yes

How much requests each process should execute before respawn.
Useful to work around memory leaks in 3rd party libraries.
For endless request processing please specify 0
Equivalent to PHP_FCGI_MAX_REQUESTS
1024

Comma separated list of ipv4 addresses of FastCGI clients that allowed to connect.
Equivalent to FCGI_WEB_SERVER_ADDRS environment in original php.fcgi (5.2.2+)
Makes sense only with AF_INET listening socket.
127.0.0.1

Pass environment variables like LD_LIBRARY_PATH
All $VARIABLEs are taken from current environment

$HOSTNAME
/usr/local/bin:/usr/bin:/bin
/tmp
/tmp
/tmp
$OSTYPE
$MACHTYPE
2

其中“127.0.0.1:9000”表示给这个php-cgi进程指定的端口，“/home/www/:/tmp/:/var/tmp/”表示这个端口的php-cgi进程只运行这几个目录以下的PHP程序。然后在/usr/local/php/sbin/php-fpm文件中加入一行代码"$php_fpm_BIN --fpm --fpm-config /usr/local/php/etc/"，如下

#! /bin/sh

php_fpm_BIN=/usr/local/php/bin/php-cgi
php_fpm_PID=/usr/local/php/logs/php-fpm.pid

$php_fpm_BIN --fpm --fpm-config /usr/local/php/etc/
......

　　重启php-cgi进程，然后再在nginx.conf中配置这个网站对应的php-cig端口9000,即完成了这个php-cgi进程只运行指定目录下的PHP程序。