|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
9 t# @ v8 | U- _5 T' p- {+ m) m( s
一.准备工作
3 n* x; G. v1 W" {2 P" d: T5 c) b& Z
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0) @) _/ D8 W5 `: ?( u; r( V
) w+ ?! w1 P: y" I1 f4 v" \tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
2 F2 w1 E/ S8 X' c7 d! j5 C, h8 ^- o. u
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
7 D# p# U7 G7 [8 b+ e/ ~% j! W4 `0 |# r, e- U A
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs) e/ X8 O* d7 W# R
" s5 U7 O- |/ X依赖关系:0 r- K; z$ y2 j, U6 B" z
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
; h$ m, d2 p2 q% O
# {: j C( Z: Jyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
/ \! ]7 N% t+ z6 w: emodsecurty依赖的包:pcre httpd-devel libxml2 apr
6 E- x9 ]+ x6 S6 B% A, R6 A. J+ M+ a- r7 v" u* d: y' P* {8 Z
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
( Z, \! @1 Z6 _2 \+ I二.启用standalone模块并编译* G2 a M% ]0 e3 l1 j8 V8 y
. S( O9 d" p M& Z0 q
下载modsecurity for nginx 解压,进入解压后目录执行:" X. Y& I. X) a- g* R# o
6 B5 [2 n4 {/ n( }& \$ v* x./autogen.sh
5 L6 t# k- d" z; y, i9 Z- `9 B./configure --enable-standalone-module --disable-mlogc
) }7 P1 A4 F/ H2 Wmake
A& L7 _9 l# `6 ]三.nginx添加modsecurity模块$ r% @/ ~9 W; M* w9 W! L
( `$ C1 W, v" I" E在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
! V; e4 b# I9 r, A ~& B7 S: @& q1 c/ k) y D+ X J% w
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
+ P. D k: d2 [ M4 K. Pmake && make install% z8 C3 Q- d0 g3 |# Z( k
四.添加规则
7 [+ l+ J8 s& h9 Q/ K, A# P; J+ D. g' l, ^' ]9 f
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。- h/ c }3 C: P3 ~# Q8 Y
) V o: t# N$ i# E
1.下载OWASP规则:9 U3 n0 p) }0 y) ]
9 h: N+ E/ B/ ], L
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
, y! q1 T6 N& S4 p, u% [1 z5 Q }7 e% d1 j/ `
mv owasp-modsecurity-crs /opt/tengine/conf/4 T1 m2 n$ r- G. e1 Z% C9 [
, C6 l8 X# X8 y, z
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf, a8 Y. H0 \4 n# @ U9 m8 M
2.启用OWASP规则:: I$ R! D9 }0 l B$ e. X
. \; o( z- J4 Q$ o7 |& L [( F
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
. y+ r3 w8 q/ U% D
7 K; y& F0 l9 k4 u7 D- A编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
: u$ _* X: @9 Q# c, |$ e* e( s5 w% d9 F) N; v, W$ B: D9 Q+ |
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。, S- B0 }+ Q9 @( F* ~7 {) t. P" f% r
; c: Q$ l( m: D& v7 B6 BInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf+ N) h L. R0 U2 R- [
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf" h6 D& C2 a! ~7 Q' q* V
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf2 T I; Q8 Q. O% N" {
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
U& H2 z0 Y5 A7 tInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf u2 ~: V$ T) N: E
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf# A( Q! P, U% [1 I
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
# u% n* K0 y6 Q3 L; r8 o5 `. `五.配置nginx# d+ r. g) V1 _( K2 I$ |
; E" R- V0 O2 B% n0 ?# X在需要启用modsecurity的主机的location下面加入下面两行即可:/ |3 `' L& X- R& \4 Q: e
* s& A9 }+ y% k& AModSecurityEnabled on; 8 X0 Y( ]; C3 d; P5 O
ModSecurityConfig modsecurity.conf;( }1 i1 |& i% A
下面是两个示例配置,php虚拟主机:( t: L6 p# B! n: l
7 {% Y+ k0 Z6 T2 X" Yserver {
& G: u$ ^! d6 |; } G$ F listen 80;" U% A, u# ^+ a9 d$ U
server_name 52os.net www.52os.net;
9 X% v' S; g3 b+ I% F+ O' l
) }" t- b# L0 M& u. V) [4 ?/ x location ~ \.php$ {
1 a! j# ]6 v% Y f ModSecurityEnabled on; * B. u' v$ ^2 y: n* g- f
ModSecurityConfig modsecurity.conf;
0 Q( w# X p" i$ _
' p- l4 ]& G% | root /web/wordpress;
4 C" G1 C9 \. P* Y5 B- } index index.php index.html index.htm;% A* ^8 q3 l. z- G+ } S5 u) s
7 i/ m+ M4 n9 u# _. X7 m2 l) i fastcgi_pass 127.0.0.1:9000;
' p! f0 _0 n, o3 k fastcgi_index index.php;
/ f& F5 T" |, [1 s7 D fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;# w) f4 s2 {5 h
include fastcgi_params;6 ]& {2 F. q$ X
}9 v0 Q1 Y9 y# C& C' T* {0 J
}
; l6 |, P& |! Eupstream负载均衡:
2 |( A3 ]' b+ D( L7 I! _- j+ I# L0 C4 ], o( Z3 L
upstream 52os.net {
' R% k% {, m( ?! X7 ] server 192.168.1.100:8080;
, N1 {. q2 x c/ H8 G server 192.168.1.101:8080 backup;; K8 c$ X/ e: i$ u
}
2 _/ [" r; [! O! `* U, M6 p8 G: p
server {
3 s Y; i' a6 J4 H; ^listen 80;8 j0 K6 ]/ b; M1 W/ T
server_name 52os.net www.52os.net;' C( m r; u7 }) g
0 c6 z$ C$ s6 K& B0 m8 c( m* G. B* Klocation / {' J1 ?4 a* q' M8 Z) c- x
ModSecurityEnabled on;
: `1 L/ f8 S u l) y7 n' [& @ C ModSecurityConfig modsecurity.conf; - t% q9 a6 o7 }1 A$ e% P
$ g* O9 D: y! D( C$ V( } proxy_pass http://online;
7 ?8 |+ W% s5 h) d2 C proxy_redirect off;& }9 X* W/ e1 U& Q+ l2 W7 x8 y
proxy_set_header Host $host;: C Q$ r; E& M# s1 Y
proxy_set_header X-Real-IP $remote_addr;
" I* a* @1 ]6 x' a, c6 O proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;0 T+ n# ~9 F6 E& \" @
}6 s" F9 C$ X; I
}
( o; d& v; V, x8 j4 ]六.测试
2 Z( p' H* z+ S4 Q- S8 U% M! Y/ ?8 A( F% T
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:9 @, n8 X/ _) n
! q2 p# d# w& \2 \& j6 j
<?php
) a- h( r) x: X N' Z phpinfo(); ' q! S0 o& E7 ?9 n" c x
?>* q/ L8 L k0 k7 _
在浏览器中访问:
' B! x' x D* w' S3 A
; Q, {) Y$ U* j- Thttp://www.52os.net/phpinfo.php?id=1 正常显示。$ ~2 j$ D& z5 k0 }0 t) B
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
( f6 V8 _. f+ [( S+ F) D% |$ |http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。/ p4 y) D7 B: `2 _: l) R6 U7 n
说明sql注入和xss已经被过滤了3 P/ s; T7 w8 {5 k' A. ?- n
: A' H+ k4 H- _ T( R& J9 d七、安装过程中排错
0 `. W' M8 L2 a3 a* h
1 C5 {+ P2 ~% n2 W6 y1.缺少APXS会报错
! n2 I1 P/ g4 _) ?+ T
$ W Q0 r: _0 n6 |1 Kconfigure: looking for Apache module support via DSO through APXS
/ w3 J3 V |& k+ d0 X2 |7 c, fconfigure: error: couldn't find APXS
9 X6 z" a4 p3 K( b! f9 d9 sapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。$ J, t7 T5 }- N
解决方法:
2 j( y, `) u2 Z5 W3 Z# q1 X6 a6 V, G/ U- H3 \$ j: N
yum install httpd-devel. O( J. {/ d9 m0 J% T; u0 Z
2.没有pcre4 x5 w' B7 P% T* T2 A. A. a
( L3 B# T6 A1 H' w$ [
configure: *** pcre library not found.
9 o: G- B% I m2 ? cconfigure: error: pcre library is required
* D- W9 J& s. A解决方法:* J+ w+ ~2 o" h: M
& @# B! C4 _ R, i! a: e" oyum install pcre pcre-devel
% f, v" b9 U+ N8 T3.没有libxml2
2 D# U& r! |: o5 m; n( V. \
8 p: X4 F1 L3 m1 R2 l& ]
; I* V7 t2 S9 I2 u! p/ Vconfigure: *** xml library not found.
, u2 f; C: H4 w! j3 o& uconfigure: error: libxml2 is required
- \6 j& q, {+ j解决方法:" U$ Q c' K$ d- c
- N/ c( z& e+ g" Byum install libxml2 libxml2-devel
* ], k! c6 D- z8 e8 {4.执行 /opt/tengine/sbin/nginx -m 时有警告
9 K; R( Y% b# M \4 F6 }, | J* U8 o( L: ]! K& u" G
Tengine version: Tengine/2.1.0 (nginx/1.6.2)/ T, T1 p$ j6 o! S0 Z1 a. a3 Y
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
& V) l" q; y O/ h9 x) I7 n$ W原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
+ l" A7 G: X/ @4 B# F
. Q, _$ E0 y7 U @1 H$ A: {& C2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
+ w* w7 l5 t3 {2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
( T) j1 \' c0 g: h0 T2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!5 |0 {$ G& H( V8 s: } T
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
& M. r p5 k8 G' M9 q- R2 z9 n2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
& |9 n. Z# o x9 d+ g6 S2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
7 ^7 _+ ]0 r, G& _: |* a解决方法,移除低版本的APR (1.3.9)/ n* B7 e9 g8 v( S6 f- k9 S* I2 N+ I* B
2 ^0 B$ k! y# v3 m& Kyum remove apr- s3 l& [7 y5 `$ k
5.Error.log中有: Audit log: Failed to lock global mutex
3 R: T- H% c0 X' r; n5 r9 H$ } C( [1 p
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
7 W7 j8 Z! r+ uglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
! B3 r1 F3 G6 f! M% m解决方法:
) S3 `, ~7 Z2 x7 P( J9 F5 {8 D编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:8 F) c3 u: z5 x
9 B( x2 ~; | t6 R6 m& B1 G
SecAuditLogDirMode 0777% A L1 Z8 O4 K% G
SecAuditLogFileMode 0550
4 G! U2 W) H; ?; Q% d5 y% bSecAuditLogStorageDir /var/log/modsecurity3 {% N$ X$ _: l! ]
SecAuditLogType Concurrent
. _; U( u& E4 X& j& c$ x/ K参考文章:5 ]0 z, u4 }+ Q& B$ M
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX8 F; z( ?6 `. C+ l; e1 ?
http://drops.wooyun.org/tips/2614 |
|