|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。( O2 \9 r# b' c/ N4 t
# Y# Q4 o: K9 U% A9 e H0 \
一.准备工作0 o$ c% D; i3 U0 e4 q! o4 ~
: F2 S2 ~6 S8 i# i7 p5 @! H
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
6 O" [/ k% E4 d& X
5 a. S; a$ K8 c" [tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz! P2 C& C2 P9 \6 C" m
) f+ i" J0 ^) A6 O0 ^modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz* I2 z( R7 m" \* a3 ~1 h
3 _- M$ A' x4 a( K* ~1 ?
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs: I8 Z& |. D7 i, g, Y7 l
) K. g1 W1 |& }/ N依赖关系:
0 E7 f$ F+ ]- W0 E3 ktengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:8 W$ d* [& ]8 b8 g2 E* |
( \6 O! p+ ]2 {# ~" i* T9 k
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel% _7 H- V ]( G0 ]
modsecurty依赖的包:pcre httpd-devel libxml2 apr
$ y) \" {$ r- Q1 m0 R! d( V0 Z$ A5 U: F' s$ D8 u, D7 Z
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel4 a! K4 W m4 m! d9 n h2 W
二.启用standalone模块并编译 U4 Q$ n( _0 H. W( E) v! W
) ?6 o+ F. a; B& J% k( J3 A% x+ N下载modsecurity for nginx 解压,进入解压后目录执行:) }) t Z# [+ H6 g, K
1 j. v0 J1 M- K: {
./autogen.sh! o( A P5 A9 v1 d6 y) S. }( G
./configure --enable-standalone-module --disable-mlogc
+ R6 F2 A1 ]1 }- Z& [/ imake 5 j9 o! |1 M% R4 F0 [
三.nginx添加modsecurity模块8 D1 z+ F7 x/ A% \/ P8 Z& H
) Z8 C4 Y9 l9 t% Y2 E
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
) _. C( d. c# h; [( G( ^5 |* l$ n! z- K! Q8 r: q$ w; p: ?
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
) v( Z2 z6 q0 ^, a) ymake && make install- W( y2 H& a! b) F
四.添加规则& ~1 }" o" N* M5 r6 E4 `
: X7 {6 L$ R; N. ?8 W6 {
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
- X1 T* {3 W1 ~, o+ V) V# B; z ]7 o
1.下载OWASP规则:' W5 O2 W* X. M0 {8 w( }
4 A, b8 T7 D9 H1 O! {9 O2 ]git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
- e( {& `- T q/ y# W B8 p$ }- v1 \5 j9 C) J+ c3 w- P, t
mv owasp-modsecurity-crs /opt/tengine/conf/0 m! k) j. L6 Y) o; c
8 H B: n$ n+ ~# ycd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
. t* k' {* E* B2 V* L$ Z, P4 T( O/ w2.启用OWASP规则:. n, i- V1 L. @7 X7 m& u* n" m
( e. |$ b3 {& T& |7 Y& W! |
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
0 j* R* C9 ]3 _7 i- w" C `! I! P- g% ^ T+ d3 i- h5 C
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
. o# d6 M8 A+ Q* ]% t: v4 {
5 Q7 X# G4 t+ `) B9 Iowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。" h$ W* E4 L7 i p) {, r, j q
7 F0 g& U9 H8 U; V3 u# i6 DInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
9 V' _/ W! r5 e& w. k/ U3 bInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
5 n3 l* t, K! ]& y, N$ |* p: s$ nInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
( \ ]; e4 O8 Q2 |7 i @# S' i1 e$ {Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf3 _4 a' p4 _" @ k% U3 Z' d' T
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
8 Y; D: J9 P+ S cInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
1 R. m5 W- [6 c$ S7 t3 r% r* k: K, PInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf" x& x& S4 Y M/ h8 z
五.配置nginx
+ ~7 ~8 @% u: t6 P1 T
' ~$ k2 K1 U" w4 a在需要启用modsecurity的主机的location下面加入下面两行即可:5 k$ l- z: f0 Z" Z+ L1 g
; ?$ u& \: [- m3 n4 w+ l7 g! c
ModSecurityEnabled on; ' W. T7 n/ R0 v# c: r8 w
ModSecurityConfig modsecurity.conf;/ _0 ? P h' U! k" e# {/ X# Y5 a) |/ v
下面是两个示例配置,php虚拟主机:7 T; T" k6 \4 v1 F, w
" H: `9 G; _: ]2 k" G: Z
server {
! o6 J' d9 V7 r2 ?6 X2 @ listen 80;/ ~% N! B/ M$ A+ ]3 H2 ]* Y
server_name 52os.net www.52os.net;8 ?/ @9 b$ n V4 o! `* h
) s' |4 m S; f+ K location ~ \.php$ {
- `) y" _: B7 Q0 D! p ModSecurityEnabled on; * L1 G, ^7 [' L/ Y
ModSecurityConfig modsecurity.conf;# ^- X w5 ]. x+ x- {5 e4 ?2 e ~
- L1 m' `* x3 R y g" f/ c
root /web/wordpress;
( ~! r8 J* V" y4 K: y index index.php index.html index.htm;% I6 s5 I7 g& Q/ {5 r6 `
# ^2 g7 H# A5 b; M1 r* U b fastcgi_pass 127.0.0.1:9000;! q, w$ }/ e' M( h3 M2 |# u/ C
fastcgi_index index.php;. b6 q9 ]. j( E' `" X8 R
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
! E4 c( ~; r# L; s include fastcgi_params;$ n* i6 W# \' u1 l
}
( F. Z/ i+ r# u7 H( T3 r }7 h# V; N! c$ y5 m6 E6 H* e1 Q
upstream负载均衡:! f2 u/ y: A( R+ b1 F; f
: B! b( g/ b- ~* u5 Z) {+ nupstream 52os.net {
# a j' Q3 V7 Z# d' | server 192.168.1.100:8080; O0 N% R6 R' M/ W- F! m! v
server 192.168.1.101:8080 backup;/ @- t) d% E, `3 @5 l" \% T
}3 D. `& k5 \" \) T
1 _/ ?2 M: J: d/ L; O8 ?, @server {2 G/ _. B8 q5 ]4 m
listen 80;
' y" o) o8 l/ iserver_name 52os.net www.52os.net; x3 b- M; R b( N
# ~( K: P7 H$ U) h3 W9 n1 [location / {: W8 i, u% I- d; I! N
ModSecurityEnabled on; % [ m7 ^, k8 k0 o
ModSecurityConfig modsecurity.conf;
, j7 c. W3 V% |5 B7 F( O% s- l# P2 p) ]9 o. G2 z. j" V' o
proxy_pass http://online;+ _) E: u1 y# g: J6 ]
proxy_redirect off;7 m) d3 z8 t$ {$ b0 N5 k; z
proxy_set_header Host $host;
2 q ~, v2 X) a) r- Q9 Z, r proxy_set_header X-Real-IP $remote_addr;, z; l' p5 g' B8 y
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;3 E3 m; b; G( G) A2 ^) t. `
}
1 B. P, k; T% W8 g" E2 R, \}
4 L( r" U$ T7 d- ]8 X) Y- q六.测试; s+ T. R3 C7 w: `& F" v9 y1 _$ k
1 g) y* K% A/ F U+ ^$ j. E我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:) t$ D! N0 h# o, [1 G' G
}, n, m: z, w" P' l- H. o2 j! w<?php
; L7 v' O7 {9 N$ f% ~, |7 [; r6 T( ~ phpinfo();
1 q( E2 x! \: z, Z7 I- Y2 h# k?>: [$ p; y5 {, `: Z+ M7 G
在浏览器中访问:
% b/ T/ ~$ z- }( q+ ^
+ a0 T& t u% L% _: }9 Ehttp://www.52os.net/phpinfo.php?id=1 正常显示。0 A q S; Q% }$ q/ J& s; d
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。: C* X1 I% H/ c' i6 d
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
- ]# v U. m2 \! a( ^5 z, l说明sql注入和xss已经被过滤了
" h8 l5 @% T" |3 w& C, S
( e! q2 S6 N8 `8 r& H2 o* }七、安装过程中排错
; z- D. S' Y" Y- _' f: W d* h
4 G& i+ }! T) ?+ b) g1.缺少APXS会报错
& P+ ~$ }( q) i: R b/ E; z$ `. w; z( t
configure: looking for Apache module support via DSO through APXS
& x$ F% A' J8 \* \& B; @. Kconfigure: error: couldn't find APXS% G1 |8 z: `7 o- o e/ H
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。* V/ M% H3 p: i; ^
解决方法:. Z& e% ~3 E0 Y Y# L) J, A
5 `% A' s6 q) \. x7 `; P; J
yum install httpd-devel; F3 G7 ?% m' Q9 B
2.没有pcre
& L7 c/ O- z! \4 P
$ \' Y3 a" m! J% v A0 J$ s, lconfigure: *** pcre library not found." O7 G2 Y1 I8 A6 W
configure: error: pcre library is required$ f1 r& g( Z4 Z1 z. {
解决方法:3 M% E; X/ v) G t& K ] W
/ Y$ H+ x8 a9 o) |+ p4 t" e6 }
yum install pcre pcre-devel# c0 P: |5 c1 @+ C7 O
3.没有libxml2+ D' T1 T/ X- A" t5 [1 O
5 {0 Q" A1 b( S+ L; |9 |" y. T+ U+ g1 [/ Y
configure: *** xml library not found.
; n& d/ B5 {7 t0 I9 Yconfigure: error: libxml2 is required
9 T7 B$ X0 m9 e6 D解决方法:( g# G3 N7 X8 K8 w; d
' F; b+ i+ _6 k' G% M% T9 n4 Jyum install libxml2 libxml2-devel
2 h) e8 P8 i1 r" }$ C* V3 Q8 f) O" u; S4.执行 /opt/tengine/sbin/nginx -m 时有警告
2 @) p# h. N% N
. S5 |+ \& w& {6 @; [Tengine version: Tengine/2.1.0 (nginx/1.6.2)4 U( H5 m; r5 M- w
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
' t! ?$ j2 n# r% x: e原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log9 }: m5 R' c6 l% h6 D! `" g N9 \
, t6 d6 X* N% H- r3 Q4 Q8 Q8 v
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
- h8 h, L; M+ ~. [& L# y3 M9 `5 c2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
" a) n6 ?6 h% W1 [# ?# `4 \. x2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
; `1 m4 e7 h4 T. ~& {8 F2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"1 ?3 L6 n M$ i' q* `! _" g8 Y2 x& |
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
" i5 z4 K& Y! H# `9 [: z4 B2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
3 x" {3 G' c0 M S1 @2 l( ^解决方法,移除低版本的APR (1.3.9)
: V t; V. j8 Z7 @5 w- d5 j7 z* a& ~: } ]3 I$ B1 Q, j
yum remove apr
( n/ f, j+ P% V) E& T& u5.Error.log中有: Audit log: Failed to lock global mutex1 W z1 \+ Q" X. G
, G4 [% R: R2 r0 ]9 m2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
6 C. [- A2 U$ lglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
" G1 D0 b3 i: W% r$ y解决方法:* B# _) v4 c3 D) [! Z
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
o0 n' K3 i& `) ]* O* u. [& b- G( e( n F
SecAuditLogDirMode 0777
% J0 W2 a; z' E- SSecAuditLogFileMode 0550
2 d: N- h. _) K# g1 w5 n2 V ?SecAuditLogStorageDir /var/log/modsecurity
1 u# g; A1 ~9 N+ i0 ^SecAuditLogType Concurrent
, v: c3 y! j+ d1 G+ G参考文章:
8 C! W$ J/ D: d; V6 W% O1 Phttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX2 ~' S! V- U$ s3 V
http://drops.wooyun.org/tips/2614 |
|