Nginx+ModSecurity安全模块部署的实现

目录

一、下载二、部署

1.Nginx部署

2.ModSecurity部署

3.添加ModSecurity模块

4.配置Nginx虚拟主机

为演示已安装Nginx而未添加ModSecurity的情况，以下操作为先安装Nginx，后添加ModSecurity模块。

ModSecurity是一个开源的跨平台Web应用程序防火墙（WAF）引擎，，完美兼容nginx，是nginx官方推荐的WAF，并且支持支持OWASP规则。

中文网站：http://www.modsecurity.cn

应用实战可参考：http://www.modsecurity.cn/practice/

一、下载

1.Nginx下载

wget http://nginx.org/download/nginx-1.14.2.tar.gz2.ModSecurity下载

wget http://www.modsecurity.cn/download/modsecurity/modsecurity-v3.0.4.tar.gz

二、部署

1.Nginx部署

1.1安装依赖

yum  install  -y pcre* openssl* gcc c++ make

1.2 编译安装

解压文件

tar  -xvf nginx-1.14.2.tar.gz

cd nginx-1.14.2/

配置模块

./configure  –prefix=/usr/local/nginx  –sbin-path=/usr/local/nginx/sbin/nginx –conf-path=/usr/local/nginx/conf/nginx.conf –error-log-path=/var/log/nginx/error.log  –http-log-path=/var/log/nginx/access.log  –pid-path=/var/run/nginx/nginx.pid –lock-path=/var/lock/nginx.lock  –user=nginx –group=nginx –with-http_ssl_module –with-http_stub_status_module –with-http_gzip_static_module –http-client-body-temp-path=/var/tmp/nginx/client/ –http-proxy-temp-path=/var/tmp/nginx/proxy/ –http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ –http-uwsgi-temp-path=/var/tmp/nginx/uwsgi –http-scgi-temp-path=/var/tmp/nginx/scgi –with-pcre

执行编译

make

make install

创建账号和目录

useradd nginx -s /sbin/nologin

mkdir /var/tmp/nginx/

2.ModSecurity部署

2.1 安装依赖

yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake

2.2 编译安装

解压文件

tar -xvf modsecurity-v3.0.4.tar.gz

cd modsecurity-v3.0.4/

编译安装

./configure

make

make install

cp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.conf

cp unicode.mAPPing /usr/local/modsecurity/

3.添加ModSecurity模块

3.1查看Nginx编译参数

/usr/local/nginx/sbin/nginx -V

3.2下载ModSecurity模块

git clone https://github.com/SpiderLabs/ModSecurity-nginx.git

或至下载

https://github.com/SpiderLabs/ModSecurity-nginx

3.3重新编译Nginx

解压模块

unzip ModSecurity-nginx-master.zip

#仅在下载安装包情况下，如果是git clone 则不需要编译安装

./configure  –prefix=/usr/local/nginx –sbin-path=/usr/local/nginx/sbin/nginx –conf-path=/usr/local/nginx/conf/nginx.conf –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log –pid-path=/var/run/nginx/nginx.pid –lock-path=/var/lock/nginx.lock –user=nginx –group=nginx –with-http_ssl_module –with-http_stub_status_module –with-http_gzip_static_module –http-client-body-temp-path=/var/tmp/nginx/client/ –http-proxy-temp-path=/var/tmp/nginx/proxy/ –http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ –http-uwsgi-temp-path=/var/tmp/nginx/uwsgi –http-scgi-temp-path=/var/tmp/nginx/scgi –with-pcre –add-module=../ModSecurity-nginx

#此处需要注意/ModSecurity-nginx路径

make

make install

/usr/local/nginx/sbin/nginx -V #查看已经有了ModSecurity模块添加配置文件

mkdir /usr/local/nginx/conf/modsecurity

cp /usr/local/modsecurity/modsecurity.conf  /usr/local/nginx/conf/modsecurity/

cp /usr/local/modsecurity/unicode.mapping  /usr/local/nginx/conf/modsecurity/

4.配置Nginx虚拟主机

4.1虚拟主机配置

vim /usr/local/nginx/conf/nginx.conf

    modsecurity on;

    modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf;

#在http节点添加表示全局配置，在server节点添加表示为指定网站配置

4.2Modsecurity配置

vim /usr/local/nginx/conf/modsecurity/modsecurity.conf

#更改一下部分

SecRuleEngine On

SecAuditLogParts ABCDEFHZ

#追加到配置文件

Include /usr/local/nginx/conf/modsecurity/crs-setup.conf

Include /usr/local/nginx/conf/modsecurity/rules/*.conf4.3下载规则文件

wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip

#Modsecurity中文网下载

wget https://github.com/coreruleset/coreruleset

#github下载

4.4 配置规则

unzip owasp-modsecurity-crs-3.3-dev.zip

cd owasp-modsecurity-crs-3.3-dev/

cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.conf

cp -r rules /usr/local/nginx/conf/modsecurity/

cd /usr/local/nginx/conf/modsecurity/rules

mv REQUEST-900-EXCLUSION-RULЕS-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULЕS-BEFORE-CRS.conf

mv RESPONSE-999-EXCLUSION-RULЕS-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULЕS-AFTER-CRS.conf4.5测试

#浏览器 或 curl访问测试，返回403

curl -I ‘http://localhost/?id=1 AND 1=1’ 到此这篇关于Nginx+ModSecurity安全模块部署的实现的文章就介绍到这了,更多相关Nginx ModSecurity部署内容请搜索共生网络以前的文章或继续浏览下面的相关文章希望大家以后多多支持共生网络！