运维

运维

Products

当前位置:首页 > 运维 >

如何在Ubuntu上安全配置php-fpm,避免潜在风险?

96SEO 2025-08-27 18:36 2


如何在ubuntu上安全配置php-fpm

一、 安装PHP-FPM

在Ubuntu系统下安装和配置PHP-FPM是一个相对简单的过程。

  1. 更新包列表:
  2. sudo apt-get update
  3. 安装PHP-FPM:
  4. sudo apt-get install php-fpm

二、配置PHP-FPM

PHP-FPM的配置文件位于/etc/php/7.4/fpm/

  • usergroup将这两个选项设置为非root用户和组,以限制PHP-FPM进程的权限。
  • clear_env将此选项设置为no以防止PHP-FPM进程继承不必要的环境变量。
  • _extensions此选项允许您限制PHP-FPM处理的文件 名。这可以防止潜在的恶意文件上传。
  • chroot将此选项设置为yes 以实现Chroot环境,提高平安性。

配置示例

user = www-data
group = www-data
clear_env = no
_extensions = .php .html
chroot = yes

三、 配置Web服务器

根据您使用的Web服务器,您需要相应地配置它以使用PHP-FPM。

配置Nginx

在Nginx的配置文件中,您需要添加以下配置来启用PHP-FPM处理:


    SetHandler "proxy:unix:/run/php/php{version}-|fcgi://localhost"

配置Apache

LoadModule php7module /usr/lib/apache2/modules/libphp7.so
AddHandler application/x-httpd-php .php
Action application/x-httpd-php /usr/lib/cgi-bin/php
phpvalue enginevalue 1
phpvalue logerrorsvalue /var/log/apache2/error.log
phpvalue logerrorsmaxlenvalue 4096
phpvalue errorlogvalue /var/log/apache2/error.log
phpvalue logerrorsvalue on
phpvalue displayerrorsvalue off
phpvalue htmlerrorsvalue off
phpvalue uservalue www-data
phpvalue groupvalue www-data
phpvalue cgi.fixpathinfovalue 1
phpvalue date.timezone Europe/Berlin
phpvalue session.savepath /var/lib/php/session
phpvalue session.gcmaxlifetime 1440
phpvalue session.cookielifetime 0
phpvalue session.cookiepath /
phpvalue session.cookiedomain .
phpvalue session.cookiesecurevalue off
phpvalue session.cookiehttponlyvalue off
phpvalue session.usecookiesvalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpirevalue 1800
phpvalue session.usetranssidvalue 0
phpvalue session.cachesidvalue 0
phpvalue session.usestrictmodevalue 0
phpvalue session.useissetcookievalue 1
phpvalue session.useonlycookiesvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.gcmaxlifetimevalue 1440
phpvalue session.gcprobabilityvalue 1
phpvalue session.gcdivisorvalue 100
phpvalue session.savehandlervalue files
phpvalue session.savepath /var/lib/php/session
phpvalue session.cachelimitervalue no-cache
phpvalue session.cacheexpire_value 


标签: ubuntu

提交需求或反馈

Demand feedback