|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。5 g! i& u2 R0 q% H; w( d0 Y
# Q1 X" H7 N! Q4 t* g. i一.准备工作
" a% k4 K# _8 Y+ @
3 a/ z" _5 O4 y系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.02 r' ~; A" B2 E( s: I4 c
9 i% k6 J) @4 ` P+ G5 H# x
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz, e8 y! U2 t, K7 N9 l
( b. P2 x1 r# D: @* A: A$ Smodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
* T' y8 T; B# v' Q3 | @7 ]5 u
+ g4 P1 z+ b5 fOWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
8 T+ K5 }4 k: ]2 n7 C9 C! h0 e5 T9 Z9 `' J( R
依赖关系:' n8 E* ?2 u# K: {6 D
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:+ C) u& U8 W, {$ N, R0 ~+ b
/ @$ H7 G0 h* ?! q& i0 Y& \" }; d
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel' r& j" o5 t# u: }' ?1 u9 ?
modsecurty依赖的包:pcre httpd-devel libxml2 apr" ]* x0 D+ X6 U( k# \4 j
: F2 p0 P7 X& I; y4 ^- S' Yyum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel/ `& u% o) b% C9 B1 E5 G
二.启用standalone模块并编译0 p& m. o8 Z7 _; d
- G# i; j$ ~3 I( i+ f/ p; p! ]) K8 l下载modsecurity for nginx 解压,进入解压后目录执行:
0 d3 I6 t/ s/ @1 A
d) W5 ^+ p/ Q/ k1 U./autogen.sh
8 J; Q8 q' |3 E( @" `5 l( g& ^( Z' ^./configure --enable-standalone-module --disable-mlogc; j# z. c' |4 x# _/ D) _
make
5 `& h) b. a% g/ `/ A3 x5 V. ]三.nginx添加modsecurity模块
4 }2 d0 j2 n( A; @- b# [2 | Y$ x/ t) {
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
" R: N" _) Q1 b+ v, H9 j6 w
' A& s i% W, D8 d( j./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
( C o7 ]$ n$ x' {$ \: Kmake && make install
) H! t0 _2 W3 K" t8 ?四.添加规则
2 w+ D$ g! V0 w) j
0 w: G5 {0 n0 m D) ?modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
u! q9 l/ ^) r# {0 [+ ~
! a+ { n2 v5 X3 I1.下载OWASP规则:0 }6 ~4 U0 h; L# t) K
0 [( y% j) `6 _ |0 p1 s
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
6 i3 F& l8 d7 i4 n- Y* F) y8 }1 v u' `2 W( L
mv owasp-modsecurity-crs /opt/tengine/conf/
9 T/ L+ B+ I) }: c9 ^* |8 o6 w0 \4 x' {; j9 a; e" z
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf4 ?) r2 H0 C3 O5 Z
2.启用OWASP规则:9 A; F1 X* O- f
( o7 n8 a$ [4 r/ S8 K, s' R复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
( B' Y2 E8 F$ x- q) ^9 ~$ j. d6 H+ {& V+ \% I% v; i7 ?% {! z
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on! v- ~) ]3 W! C$ r- {3 k
2 M* Z7 N* q2 I6 [$ p+ }8 J
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。" f! j. X& Y* y" I, j
/ t7 ?2 ~0 y( H. S/ G/ |* ^# F) F
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf; h' M) N3 V- N% g( I1 Z
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
4 v! b8 K7 t2 b/ J7 r4 W- H8 FInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
( _/ o; b6 r3 G1 x0 W; NInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf; n9 I$ k$ {) y0 p; M) x, p7 n1 q
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
) K% @- x" u) [2 F0 v5 pInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
& m9 q" c& y; T$ jInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf3 K( S4 u/ ?$ O! q% U$ d
五.配置nginx' ~5 G/ A# e3 U$ s1 K" {% K4 @
% m. k/ u/ f1 j/ E3 D2 l! ]7 H: x
在需要启用modsecurity的主机的location下面加入下面两行即可:" `7 ^0 L: m# l0 G, i
9 J2 g) w' J7 G/ _ModSecurityEnabled on; 6 }" r8 S7 A$ x
ModSecurityConfig modsecurity.conf;! B" T( [# @" {& }
下面是两个示例配置,php虚拟主机:# e! _5 D8 E% L1 n$ U9 u8 e
5 K# q) R! g) T8 h& P1 Hserver {
$ m3 h4 l B. t9 Q5 m4 G; F listen 80;
5 ^+ z+ z1 O+ r0 B9 C1 h server_name 52os.net www.52os.net;
% G, F' i1 F$ l- v- l
- K4 K* J( A* O' E location ~ \.php$ {
7 }: }: Q1 S, T ModSecurityEnabled on; ; p6 c% F) i: p0 u o P. {1 T
ModSecurityConfig modsecurity.conf;1 n. w; w$ {' `+ G2 \" Q
& q1 F! N3 |; E9 ?5 u/ C$ R
root /web/wordpress;; Y G* v8 T& e$ {
index index.php index.html index.htm;6 G7 c! A( ?2 r$ z9 O% O$ G
k, X3 S- @9 {- J% B fastcgi_pass 127.0.0.1:9000;& d) `! Z9 C$ N; w5 L% i9 ` A. P
fastcgi_index index.php;/ @, y- Y( o4 C4 w8 N) U2 F! L
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;1 R! R6 y: ^8 w/ T2 z4 F7 |
include fastcgi_params;* D& E1 i1 Z! F& ]4 ^
}
3 L2 A I' W3 u/ ~1 H9 X6 | }6 G2 Y, O: _1 E7 y! y. g
upstream负载均衡:+ e, f: S" N$ o0 u, L/ ~
; q! R2 {$ {' U9 n6 Mupstream 52os.net {
, E) M7 O& {* U( O server 192.168.1.100:8080;! E2 w4 w' e0 n
server 192.168.1.101:8080 backup;- p* _& Q5 ^) N; ^+ r% W& ^
}
& r7 K5 @3 K3 w8 U3 u
+ Y! j" ?$ q' ]+ ?: }: h; F( {, z/ j7 V" wserver {
/ c/ x; _2 _) `% d- h1 Xlisten 80;
0 S4 e, q: e; S" Fserver_name 52os.net www.52os.net;
8 ? n H4 d: X. ^% d# Q, {/ k6 [1 K/ f
location / {
% p' s" ^; V% e7 X: O# A ModSecurityEnabled on; 8 P6 Q- L9 |, i( Q7 }+ k9 s
ModSecurityConfig modsecurity.conf; 2 P: }- Z8 c8 H* q
9 t8 b4 ?' t, F1 t# @: a$ U$ F proxy_pass http://online;) W+ K' F1 l* Y+ F$ C B4 `
proxy_redirect off;
% ~7 b w2 @. _. P e( E: c proxy_set_header Host $host; x! i! D9 _6 c- U- P) a3 f
proxy_set_header X-Real-IP $remote_addr;) r8 x- Z. B# t8 z$ U$ S$ u
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;4 X6 U0 n* T' l6 y
}
% W. Q( M) i" O* _}, x! O& {* t$ j+ H- x6 v* [, d" Z
六.测试
4 E6 h( H. B s s" h4 F* C9 v6 _* L8 C5 H5 K* j% f; m, j
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:) O3 O U; T0 L# g" r9 {0 l
F, Z: q- ]! \0 h/ i9 z0 Q
<?php* n2 s+ z @# q, J* u
phpinfo(); & w! L' f, e$ u) x3 b! l5 e
?>
; F4 q/ t: m; [7 @在浏览器中访问:
3 G& {; L; m8 z6 ?# A& c
& A/ x( S S/ v5 G- Q) t9 d5 whttp://www.52os.net/phpinfo.php?id=1 正常显示。. T5 t" z* I% k
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。% G& _) P3 n: _$ o0 `. ^5 |
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
0 g3 n3 b: n, B; D5 \. z6 B7 [. ^说明sql注入和xss已经被过滤了/ ^/ G8 `5 v1 Q0 x+ m1 E
3 Y2 L) u8 E' }$ ~) X, g
七、安装过程中排错
( n: Q; T- Q7 v! u! a/ R- D$ b- o+ [; I: v9 h) E+ ~( g4 k
1.缺少APXS会报错 h! E7 \9 O% k X3 ]2 y+ I5 H
& o2 l5 p& u8 a' i& b7 q( q
configure: looking for Apache module support via DSO through APXS- k/ t$ p+ R2 I2 O+ F
configure: error: couldn't find APXS
2 C( R6 U$ T/ v5 ^apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。: ]$ ?1 ]4 T% k, m
解决方法: v+ U* C) A" s1 H1 a8 g* P
+ z' O' y9 J7 C$ D
yum install httpd-devel4 p# D4 H) e; ?& i
2.没有pcre
4 \( K/ p% Y! @9 q
% F7 F! T7 B# ]3 Fconfigure: *** pcre library not found.& [3 s1 U- X4 W. w3 E
configure: error: pcre library is required
1 t8 _. E. t' \) H解决方法:8 n$ F! C$ B# e. v& L2 E- \3 ~5 t
( C- W2 \- q: M. W# \# }yum install pcre pcre-devel
8 h! K+ `5 Y, M. o5 j3.没有libxml2
7 Y( W! ^4 W( h
, C* M @5 j6 ~( p1 }
5 {# U& a5 X' X/ S4 p0 R- Econfigure: *** xml library not found.
& H+ ]) e$ n h) {configure: error: libxml2 is required
$ R5 E* z/ Q! W3 s4 M% @) N解决方法:- Z9 E' K4 O+ l
. T; Y+ G) P# I5 Z1 o, `2 Syum install libxml2 libxml2-devel a; b5 g! _. J7 s1 x( i- \" x
4.执行 /opt/tengine/sbin/nginx -m 时有警告7 a% L7 g5 L+ [6 A( h
5 J9 H, A" G& Q: ]2 KTengine version: Tengine/2.1.0 (nginx/1.6.2)
+ [$ m( I) x- x5 B* w" @nginx: [warn] ModSecurity: Loaded APR do not match with compiled!6 y5 p) q" _) F" J8 @# j5 V
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log8 D7 a1 D0 T# e. v4 [3 }, @* |, s/ \
% l9 |* _* P6 Q
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.# K* x+ D& n5 q5 M+ F. D
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"! t( ~4 j( V, y) L9 F: b1 x$ P
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!3 y3 {5 ]/ x3 X( E
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
7 V, W+ e/ P4 @1 W2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
$ T0 C& ?# W) `4 q* ]. R2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.' Y9 M7 m: @2 I( h, U f. c" f; n
解决方法,移除低版本的APR (1.3.9)9 ~- y9 a5 O2 P
: i" A' r% x& U* O' [1 kyum remove apr
' [* k- ?. R! {5.Error.log中有: Audit log: Failed to lock global mutex
6 }! J: Q7 r% \1 \$ q
" w+ P- ]% N9 w) P0 T. `2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock ' Q1 q* o( [. w1 b8 l
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
3 ~( V( @) `+ i$ s' g解决方法:$ y) Y1 t2 h2 t) @& a) @
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
* W: C' E. T0 W |7 |) A) b* B+ S
SecAuditLogDirMode 0777) [6 S# _( x6 ^
SecAuditLogFileMode 0550
( @1 A' N: v' Q0 y g% r6 lSecAuditLogStorageDir /var/log/modsecurity
3 N3 s0 M7 x3 T& GSecAuditLogType Concurrent
8 x+ O7 y) k* f9 s. I参考文章:$ x. L# O( i. N' t8 ^7 ]
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX; }) X* G7 K# m4 L. `1 N2 t
http://drops.wooyun.org/tips/2614 |
|