使用mod_proxy改进LAMP安全

# Stuff every Apache configuration needs
ServerType standalone
LockFile /var/lock/apache/accept.startup.lock
PidFile /var/run/apache.startup.pid
ServerName necessaryevil.startup.tld
DocumentRoot "/home/startup/web"
# Essential modules
LoadModule access_module /usr/lib/apache/1.3/mod_access.so
# Which user to run this Apache configuration as
User startup
Group startup
# This must be off else the host isn't passed correctly
UseCanonicalName Off
# The IP/port combination to listen on
Listen 127.0.0.2:10000
# Using name-based virtual hosting allows you to host multiple sites per IP/port combo
NameVirtualHost 127.0.0.2:10000
    ServerName www.startup.tld    

# You can add aliases so long as the facade server is aware of them!    

ServerAlias startup.tld    DocumentRoot "/home/startup/web/www.startup.tld"            

Options Indexes FollowSymLinks MultiViews ExecCGI Includes       

AllowOverride All        Order allow,deny        Allow from all    

# Stuff every Apache configuration needs
ServerType standalone
LockFile /var/lock/apache/accept.nimrod.lock
PidFile /var/run/apache.nimrod.pid
ServerName necessaryevil.nimrod.tld
DocumentRoot "/home/nimrod/web"
# Essential modules
LoadModule access_module /usr/lib/apache/1.3/mod_access.so
# Which user to run this Apache configuration as
User nimrod
Group nimrod
# This must be off else the host isn't passed correctly
UseCanonicalName Off
# The IP/port combination to listen on
Listen 127.0.0.2:10001
# Using name-based virtual hosting allows you to host multiple sites per IP/port combo
NameVirtualHost 127.0.0.2:10001
    ServerName www.reckless.tld   

# You can add aliases so long as the facade server is aware of them!   

ServerAlias reckless.tld    DocumentRoot "/home/nimrod/web/www.reckless.tld"         

Options Indexes FollowSymLinks MultiViews ExecCGI Includes       

AllowOverride All        Order allow,deny        Allow from all    

# Stuff every Apache configuration needs
LockFile /var/lock/apache/accept.www-data.lock
PidFile /var/run/apache.www-data.pid
ServerName necessaryevil.facade.server
DocumentRoot "/home/www-data"
# Essential modules
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so
# Which user to run this Apache configuration as
User www-data
Group www-data
# These must be set else the host isn't passed correctly
UseCanonicalName Off
ProxyVia On
ProxyRequests Off
# This must also be set, though it's only an option in Apache2
ProxyPreserveHost On
# The IP/port combination to listen on
Listen 9.20.1.1:80
# Using name-based virtual hosting allows you to host multiple sites per IP/port combo
NameVirtualHost 9.20.1.1:80
# Configuration to forward requests for startup.tld
    ServerName www.startup.tld    ServerAlias startup.tld    

ProxyPass / http://127.0.0.2:10000/    ProxyPassReverse / http://127.0.0.2:10000/   

ProxyPassReverse / http://www.startup.tld:10000/    ProxyPassReverse / http://startup.tld:10000/

# Configuration to forward requests for reckless.tld
    ServerName www.reckless.tld    ServerAlias reckless.tld    

ProxyPass / http://127.0.0.2:10001/    ProxyPassReverse / http://127.0.0.2:10001/  

ProxyPassReverse / http://www.reckless.tld:10001/    

ProxyPassReverse / http://reckless.tld:10001/