|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。! Z# E0 N: q3 b, m& S" i/ \9 u
, c/ ~( A4 Y7 I' U# `
一.准备工作
0 |9 @& d8 Q) e- P& N$ V# v l- a$ U j i8 s/ n G1 A; i6 _
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
( r6 A! }' x: S/ ]
+ R1 x. Y* o6 y% O u& `tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
; N _7 ~+ F; R# q8 q( k! t, z" h- `& l9 E0 j
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
% s$ H) H3 G. p. x* R& ]% o0 m0 }3 i% M3 u% O, `
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs. o7 b5 W' ?5 Z7 H/ ]
, B4 o* `2 D( }- C. \+ S
依赖关系:8 V. D$ m; k3 D: M6 N) A) ^
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:6 o: B1 N7 y8 J7 p' l5 S
0 b+ k a: S+ Y$ a* myum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
" d: q' T2 o) }2 N* tmodsecurty依赖的包:pcre httpd-devel libxml2 apr4 F b2 H( x# M L% \( u
. E2 ~: B3 K' s, G; h8 U
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
0 S, l9 c6 |' s9 r3 i/ y二.启用standalone模块并编译
$ d- N) q0 ] `! q+ A& t
3 V3 C! ]# T4 f# v# ?% P; _下载modsecurity for nginx 解压,进入解压后目录执行:! L0 E: F( D& ?+ `
& X0 @" {2 {% ?./autogen.sh' ]$ b( ?; [* k0 b- K. l
./configure --enable-standalone-module --disable-mlogc
7 R; F4 M, Q0 K# \5 }make 9 V+ o# j& P, v- {3 A
三.nginx添加modsecurity模块, ~- U% [: R7 X) B d
5 U/ s# V! L! y在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
9 S5 b& a! x; x5 c
7 }2 c4 D& M( e3 B3 b./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine6 ^# h8 n3 a: ~, x% p
make && make install" L8 }- u, {, P
四.添加规则9 R7 F7 [( `/ ~+ t q
" T+ ~7 _9 N" Q6 A3 O0 z
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。3 m3 `% [# \) p$ `: \ M8 l
4 b+ h9 [6 g. W& \4 }+ J1.下载OWASP规则:; b" b+ N. | b
1 T* B s9 P6 ~# e/ }git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
1 l m; I) w* i$ d+ E7 g
7 n3 r/ v' `" y5 X3 pmv owasp-modsecurity-crs /opt/tengine/conf/
3 f( h5 B0 D6 @+ }
2 Z9 `9 g: G6 f3 @, Y/ s' w& Gcd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
; F1 Z6 h4 r R) w% W2.启用OWASP规则:/ @( M2 M1 @/ ^7 O: {6 o
% ^( _. P x7 z! h5 k/ A: N& h" I
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
7 J% Q2 M7 k9 o# A a2 \1 W
2 E, \& \8 N( \. k+ _编辑modsecurity.conf 文件,将SecRuleEngine设置为 on! {- q1 M& N! J. P" R( j* s4 s
4 y4 F7 K3 \) e N( _! d+ |7 bowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。* J b; I/ \5 N& H9 t1 _" ]
2 ]0 i5 T. U) x$ Z SInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf+ {; n" T7 M) h
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
+ p# c" @. Z) rInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf" z8 v8 o$ Y3 [* t0 K( u
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
) N4 O! y. L" r7 \! B& G! bInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf4 K0 N1 R8 n2 _6 ~( ^# d
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf, n7 ?9 O$ j6 {: ~+ |0 Z3 B
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf9 h& f* N& U5 ?8 p( f- f) K
五.配置nginx# z. P7 y) a5 \7 |4 \# l
2 ?/ m5 _/ m* ]7 o+ n$ b1 i: t9 u在需要启用modsecurity的主机的location下面加入下面两行即可:% x0 t( K5 z$ x3 M$ T1 f. X* A
( d0 w( E& y. j* E3 J+ Y! V- oModSecurityEnabled on;
- P9 Z ]1 {; j7 a2 P4 J6 [ bModSecurityConfig modsecurity.conf; B- H8 @( m& @
下面是两个示例配置,php虚拟主机:# ?, e) R; j# r6 V& o
. k& j7 G7 n2 i6 h! g$ E
server {. b3 v( I1 }/ u; }
listen 80;
9 P( o R9 l; H1 ` server_name 52os.net www.52os.net;
. N6 i0 G2 w k8 g5 p9 N
4 r; V9 b& p$ h, Y location ~ \.php$ {
, e. U0 _* h1 B S# v: n8 o# N: s ModSecurityEnabled on;
! U3 `9 x" ?5 D8 B, ]1 a9 X6 l3 ] ModSecurityConfig modsecurity.conf;
5 ^) L; N G% g z3 H% Y0 a
$ n- I; `& b+ y/ s, Q4 m" J root /web/wordpress;
! b( Q) f( e8 E9 v index index.php index.html index.htm;
$ {5 [3 V1 p3 r5 M
, B1 g/ ^1 }( A) s fastcgi_pass 127.0.0.1:9000;& m7 m$ g. c0 i" H9 a9 m2 b8 p
fastcgi_index index.php;0 _3 u" E* o7 I2 m1 M0 L2 Q" w
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
B( j3 y- w! o/ S include fastcgi_params;
7 Q$ B+ |* N8 j* M/ s }
4 y9 r: N( G7 [2 U9 Y, C }
* k0 y) U% l! |. Z3 S0 ~1 Oupstream负载均衡:
6 D& G; k G* W7 ]6 F; \/ a
4 ~6 W. y9 }" E& x: N; E) ^8 qupstream 52os.net {
2 Y1 y6 F) B9 {. T) o& U m/ I% I server 192.168.1.100:8080;
6 q. F( S# ~, e4 I5 q c2 j- N% j+ a server 192.168.1.101:8080 backup;8 k+ r3 M* j0 V S' f. t6 [2 I
}% `0 q# Q- y# A) W- a
/ H; |4 \0 C" j9 ?* P4 C2 _
server {- t/ i2 L+ u; b4 E) p
listen 80;
+ V7 u8 V+ s t/ Q( ^server_name 52os.net www.52os.net;
; S0 ?% \1 g! Z; |# G. H
4 Z/ z! N4 b* w2 O: n5 hlocation / {" Q( [9 ?0 S1 r/ s+ j+ h
ModSecurityEnabled on;
Y3 ~, [+ N4 z2 { ModSecurityConfig modsecurity.conf;
5 } ~9 z1 y' f' q& x( R0 D1 z) F( u
proxy_pass http://online; ^9 ]% u- A! j9 H& g5 _+ n a! t
proxy_redirect off;
* [" f/ `3 |4 V5 K proxy_set_header Host $host;" i' Q9 x# }+ L% K2 E- ?
proxy_set_header X-Real-IP $remote_addr;3 Q, f$ F; s+ p- r# j% q! A
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
2 M% V u5 M7 x2 @" |3 E& v }3 u$ n: i- m9 r
}
3 B1 a% Q: t6 X$ n1 E* t, }六.测试, a+ n/ C; @1 j) f! `3 A
1 q% o) x B% j4 M我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
4 c' i( H3 q8 p
/ ]- W3 d M8 x4 Z7 @& o( B<?php
, A3 w: m- R6 R! B. u5 I phpinfo(); ! O- Y/ f) q8 S) @+ J# n# u: N
?>* y3 F- ]4 `/ ^9 z# u6 ]
在浏览器中访问:
. I; n4 ?$ o* p) w* O4 f
! _3 g1 x3 z6 z* \http://www.52os.net/phpinfo.php?id=1 正常显示。3 }8 b! X2 Z& d! Q, ~6 `
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
$ d+ Q: w/ T2 U7 t# whttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
8 v2 Z1 X; Y6 P! K: }说明sql注入和xss已经被过滤了
' S* B# l1 ?) u# n3 D: |5 @
& M ?. x6 ^9 F$ H七、安装过程中排错
( ]; b8 S! {) P y- n W; s9 H
/ O" o) P0 O5 I, d) f& C1.缺少APXS会报错
2 A) U" I: E3 t1 O1 J2 Q/ {
s+ E8 q: P: [configure: looking for Apache module support via DSO through APXS
, ?9 R# C5 t6 }configure: error: couldn't find APXS& E& j& u K9 r- g6 H4 U$ K
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。1 p- S g. M) B( K4 k1 F
解决方法:0 e/ \# E% y# }4 ^' J; R) t/ [
3 K: \9 t0 T/ n7 {4 u# _yum install httpd-devel' e4 c0 ~' E( H- V
2.没有pcre
7 A+ r" A$ ?) f9 `# x3 ^" t, ` I8 X
4 {4 R+ B! E' n# }& {% O, ~$ Jconfigure: *** pcre library not found.1 W6 |0 o! K7 U% X! f2 \
configure: error: pcre library is required, J) {+ v8 L1 M7 D- u
解决方法:0 w7 z4 C# P: d8 e W4 R5 b
; C8 Z; f. A1 f9 g' C
yum install pcre pcre-devel" ]( T5 Q7 R* A3 o
3.没有libxml2 O% p" _. g, H
+ }# M- V: K! T7 W! x4 F5 E
( H& x% n% h7 Y$ A8 Z1 yconfigure: *** xml library not found.
2 w0 t6 f" Y" k, Uconfigure: error: libxml2 is required! `( |2 A3 l7 t4 |! Z
解决方法:, g. o: {5 X( ?" y2 h5 H
: l# R; U+ I/ ?$ N) b3 d
yum install libxml2 libxml2-devel7 f# n% d5 P+ x, |; E6 A5 t/ b2 k7 S
4.执行 /opt/tengine/sbin/nginx -m 时有警告 A- H+ E: f/ e
- [4 K, `5 r7 \& u! K2 ^
Tengine version: Tengine/2.1.0 (nginx/1.6.2)
1 L4 N v9 b6 f5 j6 O: _- `nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
9 _/ P4 a3 Z4 w* d; ]$ s" v- B7 ~! ^原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log# f. s8 Z; l2 e3 e c7 Y- p0 |
7 y& D% S7 J0 O. R- k6 _ Y
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured., G1 C: n1 X+ J" Q# Q
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"1 m1 Z! o1 @7 Q! N' d4 D7 [: [
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!6 D' a; E v' K, E
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"8 g! n& \% `+ X( s* h8 W e2 t
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6": [+ \# o, ~8 g6 `# i' q) y# s: t
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.8 Z0 ` x6 S* |4 x2 j8 ?
解决方法,移除低版本的APR (1.3.9)
, b6 E% P! k5 J, N6 p4 P' n& o
1 V3 v3 ^0 q2 ^0 ]% F& ~' f, ]- r( [yum remove apr6 G; b7 |4 G; |$ ~
5.Error.log中有: Audit log: Failed to lock global mutex
! \5 v) |# m- V; x
, n& d! A k: R0 [* _7 @+ E& ^2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
- _+ Z6 f Q/ p9 ]1 ]4 L% Wglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]( C$ a2 m$ e! P8 `" d+ z& s2 F
解决方法:: R8 F$ _; D& S! {& ?& r9 ]
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:. h- i" c5 S( b; W" U; O: @
: i& G: E: t6 @
SecAuditLogDirMode 0777
6 J. n! S7 J* C- O# _SecAuditLogFileMode 0550
! d1 ^% l& Q- Q; h8 CSecAuditLogStorageDir /var/log/modsecurity4 U y: V7 s& a2 R, Z
SecAuditLogType Concurrent+ b1 p- y3 U1 E8 W5 p
参考文章:7 s: V6 ^8 i s5 N7 s
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
# g3 K) _5 E3 ?! bhttp://drops.wooyun.org/tips/2614 |
|