|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
7 p+ }( |- P: t. L8 K; P+ _
* C# z! m! d8 C' e' {0 w* u2 D, t一.准备工作
$ X+ a' T- P5 w& _0 I; }# f4 t; M* r1 ]! t
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
0 P& C8 n5 K% r; M
; h- |7 y \4 Z- _tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz, T6 ]* d' c( s' W
% D8 g; w5 T& j& n* k. @% ?: fmodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz: B M% f2 B! C, |" J
* O/ T9 H; l& p- c Q% q
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs4 c5 E; s) K/ e' {1 j X: K: C6 l
3 E4 q) e1 a- K5 p, f9 Q& r2 X
依赖关系:
9 _2 @4 N8 Q7 ~. b6 h* ^9 f3 Btengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
5 B. U6 R8 z3 m: n4 z8 h7 B- \, o; X. T. B# h$ A
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel; T& W6 c! s) }9 C% f
modsecurty依赖的包:pcre httpd-devel libxml2 apr
1 G4 U; S$ p$ E6 p7 }# F4 b& t1 m1 F' ]' ?
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel E, D+ N8 W# @) ?8 q( E
二.启用standalone模块并编译
7 J# L0 j* f# E; |
( h/ }8 B6 ]& B+ f下载modsecurity for nginx 解压,进入解压后目录执行:
* o. R2 E$ a, @/ ?1 u- ^2 O6 k. n9 B+ i$ s
./autogen.sh5 |& V3 o3 ]) D5 i8 @: c( l7 |
./configure --enable-standalone-module --disable-mlogc% P2 ]4 L6 E! T2 K8 {6 {: C
make
4 ~8 ~2 u7 |0 `. Z. n三.nginx添加modsecurity模块9 n) }* b: n/ y* t0 ]
7 o; ?) i2 X( S8 |在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
/ q4 x6 o' K4 ^' I% U8 d' F! m
6 g1 G }5 Q( y$ A" x- i& b! X./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine& \, l4 v7 J# B$ h
make && make install' T% s j: o! W4 k; q
四.添加规则
0 T; k, k. X- S5 |! b
! @7 E* }; ] S8 E, R1 xmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
' o& h9 @4 J- v' r0 R
* U B0 o: @ n+ L4 T0 c. H% C1.下载OWASP规则:0 i# e- s% ?' c4 r
$ e1 E4 c9 ]) Y3 n7 i7 ]7 \$ T
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs* R5 E O' s" I% L) `
- \1 \9 ]6 [8 h7 K- Xmv owasp-modsecurity-crs /opt/tengine/conf/: l$ \! b' h' ^4 s
- W& l7 L% H2 o" w7 ?. Scd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf1 Q: m: r$ G! l0 v/ c( d
2.启用OWASP规则:
. v/ l" z3 f) | ]
5 G) M5 B; F! X. B7 Y复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。2 {6 Q& q. ~3 O8 x. B) I) A& j
2 [" Y* F4 ?" z8 d
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
# w& J- u$ G2 x; S
# u9 Q) y1 [- z4 p# x: \# Howasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
0 z ?0 X) ?% J0 U7 H7 s4 F
2 k) w& c# I. ~8 y- B7 Z( iInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
! C9 c; F2 Q6 _9 o- E0 F% p4 @Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf! L2 G& W- ]* i) m( F
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
0 V& c$ U8 K, o: W) D6 [& X- Z/ ZInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf$ t+ V U, ~9 L. m" q
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf% a+ S2 b- Q4 H2 N% F9 E# }7 X
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
8 T+ W n2 j" k0 oInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf1 s3 O& C+ b6 ?# [: V2 G* j6 y/ r
五.配置nginx8 h/ _! Y9 A: V5 P' G a
/ `$ N$ {6 U$ g; o& o5 e在需要启用modsecurity的主机的location下面加入下面两行即可:
8 i4 M4 a9 H& [% j( `1 }9 F! t$ y, O" z/ P! D" v e
ModSecurityEnabled on; , g! R9 k, ]4 x; d8 @
ModSecurityConfig modsecurity.conf;
8 {5 y0 M! e# D+ [8 |; g4 v下面是两个示例配置,php虚拟主机:; K& d2 |& N' ?/ r
5 P K# @4 }+ n4 C+ ?/ `* s) q. o
server {
, o( J7 e1 s, i listen 80;
- d* t6 x' d q; F+ i server_name 52os.net www.52os.net;
. B9 s. s0 j- j: G* J: T ( D- R5 a- F- N+ c( I3 ^7 k; W F
location ~ \.php$ {
( _9 |5 v5 { s, t0 F ModSecurityEnabled on;
) \% c S0 s) J+ N5 [( n4 A! n2 ^6 Z ModSecurityConfig modsecurity.conf;
$ }- {, v. s/ ]3 q, k8 w5 i' `- ^% Y+ h; V+ P4 F3 a0 A+ n( T" J
root /web/wordpress;/ Q+ m; d( ^- M
index index.php index.html index.htm;
' B3 O2 ]8 S9 }) g( l. [ |; b6 y
* G. Q$ D0 i& v: ^, b6 @7 N fastcgi_pass 127.0.0.1:9000;# s4 ?0 p& L4 P$ I4 [& H; f( L
fastcgi_index index.php;* \& a. E' l% M/ d+ h$ K. m
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
! \& f& x5 O @4 V6 V( `1 Q include fastcgi_params;
% P* z5 b- ?6 h: \7 A' |3 ` }6 q! J2 i$ p3 q
}
: X3 {. k; b$ W5 H* E, kupstream负载均衡:
' B' o1 {) f/ I) Y- Z- z' @" r6 W4 t: l) G
upstream 52os.net {& _2 J+ C& c+ x4 Q, l$ o
server 192.168.1.100:8080;
7 P7 x& Q D% V* `6 t server 192.168.1.101:8080 backup;$ Z! {% r9 K; R6 i
}
3 m' N, F7 ~1 \* V4 H, t- M6 v: n5 Y4 A6 s' a
server {
/ E: I# A) X5 p6 K" g: C6 I0 i0 hlisten 80;0 |4 i$ L( w0 d) T" z7 ?% e
server_name 52os.net www.52os.net;9 ]. }6 d& C/ Y9 k9 i9 W; W
# |- U% z6 M. x1 a9 s& ]location / {3 I0 C) w4 b( u- w% l
ModSecurityEnabled on;
0 z3 Y9 e* B! H ModSecurityConfig modsecurity.conf; 5 t% x( L0 k" `& Z
- K' h! C8 R$ f proxy_pass http://online;
/ q* \7 u1 ]- x; ? proxy_redirect off;# B4 S6 O0 Z, u
proxy_set_header Host $host;4 j) _7 P; X$ i- W
proxy_set_header X-Real-IP $remote_addr;
' n# D; D- N9 U7 C0 Z! j proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
8 [" V! j$ Y- P! E }
# k; k/ }! w. c7 q% O# K}# P$ `; C o1 T4 A' e
六.测试, E, O- m0 l, C$ N5 L6 {0 M ]+ j
5 o! z! ^$ q h* c我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
( O! X4 i! p7 H8 A! A" f0 P
8 X. H+ _! g9 @3 q, u" m<?php
7 }1 J$ I9 a# Y$ {1 C) | phpinfo(); 6 U4 o0 N3 c, C# Q
?>+ X8 I5 `7 M5 E' w
在浏览器中访问:
" j9 p' z8 z/ X/ ?* B4 s. ]" E. f1 u) d2 S4 A
http://www.52os.net/phpinfo.php?id=1 正常显示。
: f7 D; @- v+ b1 P' yhttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。 m/ o+ n! Y3 s
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。% L: v! ?' U$ f6 [) C! E- M* I. u/ X
说明sql注入和xss已经被过滤了6 V- ]- q; @* j1 N- t0 Q2 y
2 X( H9 J! c. S; ?( ?; y6 a) x% i
七、安装过程中排错
' Z4 |# X; c% a4 J( x {% _
1 _- }% x( V8 ?: A1.缺少APXS会报错5 f2 _4 Q4 s& ~% z1 B9 ~( z
1 O$ g" |( x2 O8 q: ^configure: looking for Apache module support via DSO through APXS
8 {( ?$ [& e8 k! _configure: error: couldn't find APXS
" {5 u3 m+ u% y% D0 Lapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。
2 T- M3 D; N) U' ~6 a5 d! F解决方法:5 |$ R3 F: e. \; n+ q
+ I* R. |# h7 a/ `yum install httpd-devel
+ \0 b, z# H- v. _3 z+ a2.没有pcre. {+ U2 ?5 P ^: o" m7 G
/ ?8 G' o! p' r: t3 m+ c0 l3 f ]* bconfigure: *** pcre library not found.- P2 v: e" E' o+ G0 \3 p1 d. ]! V- z
configure: error: pcre library is required
4 _) t7 ] L" X& G解决方法:
, A9 N( r" Y& x1 }, O* I
, z% }+ w! i/ Wyum install pcre pcre-devel
' E! d0 {) [( m) Q; S3.没有libxml2
: `4 [4 n& x4 z( z+ O9 r
, C- P/ ?& ]* s" J. b: g( L5 A2 V! A% L% l8 g, p' P- h
configure: *** xml library not found.
8 C/ D8 {- b l$ iconfigure: error: libxml2 is required
! l6 p2 p% t& C6 \" X/ ^5 p解决方法:
% _8 r9 R5 Z2 ]' Q; ]# D9 h6 Y! U) j: v. V& y
yum install libxml2 libxml2-devel
! g1 v; h' Z3 E3 e# X: ~4.执行 /opt/tengine/sbin/nginx -m 时有警告3 {; j) ^0 |$ o0 N* i1 N1 }
! R2 c# |" W- [' n* b0 c2 N. wTengine version: Tengine/2.1.0 (nginx/1.6.2)' V5 b* P4 t! w, m
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!7 Q" {6 q( j0 U4 I4 Z& ?
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
: G L; e6 R5 d+ K$ r4 p: ~* W ^, g
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
2 q- D( A) I- Z( q+ l' o2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"* u7 ~9 ~5 V2 o* H n% o# I0 }; w
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!- ]# S2 [ @' z6 F8 n7 J1 e- p
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
! S5 V9 Y8 x( x0 |6 E3 |& n2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
/ \+ ]/ f) v- Y! C, f2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.; h: ?; H; ]( t) D$ c& X, V
解决方法,移除低版本的APR (1.3.9)$ v& m1 | T& E: F3 i
7 {- n! v; v' r Y% @yum remove apr
) o: t, a$ q/ Q5.Error.log中有: Audit log: Failed to lock global mutex
* m e' c. x3 R3 V% U+ ?# j- m' }6 ?$ v) x* U- K! X4 e/ P, \
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
( z9 s* A8 D; D0 d5 @/ |global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
7 W. ]1 |; v9 F( Y: f. ]) g6 a解决方法:
; c6 w0 k8 G: R# u: M. b编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:. [% s, m) X# ~3 C2 p
% v7 m/ z8 W& Y5 _/ k1 H7 w
SecAuditLogDirMode 0777
% R0 m0 ?8 n E/ L" S' }( KSecAuditLogFileMode 0550
% Y: E. y5 S) N1 U$ vSecAuditLogStorageDir /var/log/modsecurity
1 Y3 E3 w( ]& U2 r" o2 k; RSecAuditLogType Concurrent
) [$ [" a: W" h) F2 t( F2 T参考文章:0 S3 }" n L& k' B# D$ y
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
1 U0 b* P! T" W0 `$ G- zhttp://drops.wooyun.org/tips/2614 |
|