找回密码
 立即注册

QQ登录

只需一步,快速开始

查看: 11656|回复: 0

nginx配合modsecurity实现WAF功能

[复制链接]
发表于 2017-10-19 16:53:31 | 显示全部楼层 |阅读模式
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。% W  m- \$ m1 b' N8 B& c
4 G! Y0 ?& _8 c) d$ J' S
一.准备工作4 |) x$ Q$ H& d, w0 L% L
" z8 S7 S9 C4 u$ [1 }
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.08 Y+ D1 K# G. H" G2 b
1 k- y6 l3 c/ i0 R
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
8 [4 O! b4 I2 D$ E  F5 D8 I* B9 R0 Q/ g9 m' Y, U
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
  k. p/ U' F% Q# x6 n( G0 @& P) c5 Q3 c# H! v- H) ]6 @
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
( V% v- w( Z0 N. U+ V% S( |0 o# ^# k6 D; w( ]$ Y
依赖关系:" \, L0 s3 s9 `- X+ c$ U
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
. M) o2 a( q% C" c, q, O" N* ~: ]( r; v& N8 m* g7 b
yum install zlib zlib-devel openssl openssl-devel  pcre pcre-devel
, f# z" r" _* `9 t, x6 |1 ^& w& I& O8 ymodsecurty依赖的包:pcre httpd-devel libxml2 apr
2 N/ J; G' ?% U9 U/ d6 w2 I. e6 o8 Q" c9 t9 P! ]6 ~5 V/ N- ]
yum install httpd-devel apr apr-util-devel apr-devel  pcre pcre-devel  libxml2 libxml2-devel
5 S) j( j: \8 ^: r) H' z二.启用standalone模块并编译
% x8 Y) J& J7 V
! H0 K* b, C1 K  x* M* ^# y下载modsecurity for nginx 解压,进入解压后目录执行:3 f( d- ]1 @* R3 b3 a# a5 T% [
! b) J6 Z1 E8 b
./autogen.sh# D5 W) i* U& G1 `* v% R, g5 H
./configure --enable-standalone-module --disable-mlogc6 Y1 J2 f+ ]8 M, x* B
make ; }! S$ ~" Z) l& L, ~! Z& k& n
三.nginx添加modsecurity模块
8 d: A& `3 a6 r  `" z5 C$ P% H' D" c2 R
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
- ?5 o: g, m  A" f: X. a6 p; L' z  b5 U5 q  G$ N
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/  --prefix=/opt/tengine
5 ~' a3 P/ W% u: @: Y4 U! K% k; }make && make install
7 u: d- m2 W9 u; O& c四.添加规则/ u2 P0 V, L6 u2 c$ [& u3 p

. ~! j5 v* V, G& m+ U" cmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。5 a) o( y% U0 Z

$ c2 V$ `% s" k1.下载OWASP规则:) j+ X9 A+ J1 \, S8 M0 {
9 M9 Q& ?8 l/ i# `( Y7 i
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs! n5 W) J( H# U0 m

, x! R$ Y8 w0 E6 d$ U% b" T, ~% }mv owasp-modsecurity-crs /opt/tengine/conf/
7 l% c. Q2 `) Z* h) ?! Q
- F, D7 D  @. s4 d- y" qcd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
/ q# g4 F- A% c$ n7 ~9 M. t2.启用OWASP规则:* z) B; \4 _4 Z1 N0 A
/ F# R$ o( A& b5 p
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。9 [( h) z. S9 K  B# T
& |! w9 B- y, g6 x
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on- F1 Q+ F( U3 l# t' F

( i% A  i6 a" G0 |% I1 g1 a& Aowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。* N, c% o: O, K7 P* V1 o  N# T$ n
; J" q( {* l1 P3 A% l: [3 Q
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf- a* L; D0 a9 `$ P! P: }
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf$ g5 Z( e. i% d
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf0 T  x& `- o  D$ ?& B' R4 e
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf! T8 Y9 O$ N$ {
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
! A: }) y5 L8 g, d4 q, X* I5 _Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
) P& ^( O4 \- e4 W4 R6 lInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf% v2 E" k4 K' v3 S5 r! n1 k
五.配置nginx
& K5 {$ ?  |5 m+ a- e  {% `% ]
, z/ ~8 I, D1 r8 x1 F: @在需要启用modsecurity的主机的location下面加入下面两行即可:
5 R3 O$ X' f. Y8 J" S: A, y1 B7 `5 A  ]: \3 v7 l
ModSecurityEnabled on;  $ t& S6 N* u+ R, u) _( \9 Y
ModSecurityConfig modsecurity.conf;; d2 [+ @8 P4 x* P! p$ f! Y* C
下面是两个示例配置,php虚拟主机:
5 _) f$ C- q( ^( w
. ?# @6 Y" h  A1 y& B! @6 ?server {" \4 b* E7 `! A
      listen      80;, w( u2 Q, r2 B
      server_name 52os.net www.52os.net;3 \  G; ~- ?$ q" X. P$ H  ^
     % i! G/ m+ p* L: z  j
      location ~ \.php$ {( D- j5 y) W/ p- P! a5 t
      ModSecurityEnabled on;  
0 M* \4 @3 c. B! A      ModSecurityConfig modsecurity.conf;
, R$ m% b/ T: b, D7 ?4 _& R2 X; \# {  d. j2 [
      root /web/wordpress;
) V6 a2 M) A" |8 v5 J4 Q: n! ]      index index.php index.html index.htm;
6 M( R2 Y- O% h  
/ Q% z- `6 K' m& u. o      fastcgi_pass   127.0.0.1:9000;( q* o( G& @2 x# M, \
      fastcgi_index  index.php;
* a% A: r, t! R3 O. c; U3 s* Q      fastcgi_param  SCRIPT_FILENAME  $Document_root$fastcgi_script_name;* {  w0 z# n$ |. u! H
      include        fastcgi_params;
& q" h5 t. H4 g# L0 Z      }: ?4 Z* W5 h# J5 T6 G8 r- O# L* X
  }4 c$ ^  G) C( j! V8 o2 v7 m
upstream负载均衡:. r; E) A# E* q; n4 g: l/ y

5 P. @; i8 r! E: mupstream 52os.net {2 h. m9 w7 I: f# b+ C' T  G
    server 192.168.1.100:8080;& D  K! f& p  j+ v! Z1 _
    server 192.168.1.101:8080 backup;
! d& d2 W5 e4 E* v}, m5 L% v* @7 V% n- T: Z4 f

! q2 @( M+ G7 w6 Wserver {# S5 i! h: b' @3 M) F# T
listen 80;4 J' J3 f/ A. ?8 Z3 e. r
server_name 52os.net www.52os.net;( H( y+ l; M% T) `

, ]0 \/ S- c& ~- T2 M  tlocation / {
$ U' A1 p7 [9 t9 {3 l    ModSecurityEnabled on;  
1 I* g$ V# n  r% u& X! {    ModSecurityConfig modsecurity.conf;  6 F: i" Q  ?  x; z$ E3 T
2 B. s3 d$ t- {' ^  H$ T
        proxy_pass http://online;8 ~# A; H' }: t, V. S. K% i
        proxy_redirect         off;
: k$ v# k! W" e4 S        proxy_set_header Host $host;7 J$ B+ F7 G) G( u' A
        proxy_set_header X-Real-IP $remote_addr;7 T0 ~/ x% X3 f* v
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;  @/ O3 Y9 C' M* U) G
    }
4 v+ H. M* H3 e/ \# {}
8 F% u$ v! j2 o1 T. C: A% y9 f( P六.测试
+ K( x) b/ Z: g/ Q6 V& H+ e( a$ b
; P. `! s2 K6 g5 i; h我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
+ X& h# r6 X5 |8 B3 b2 ~7 H2 }- M. f' Q% S9 z, i  O4 D  R
<?php
7 g2 D: q; \. y! D    phpinfo();    , W5 i2 u+ N# N# E
?>' P: p! S9 E: n3 F( j3 P
在浏览器中访问:! |* j& `7 R1 J6 L. S/ i# L
# [1 m4 G( v5 l1 Y- c' Y1 _, E# x  Z8 ^% @
http://www.52os.net/phpinfo.php?id=1 正常显示。
0 u7 {% ]$ m" ]1 Y& Vhttp://www.52os.net/phpinfo.php?id=1 and 1=1  返回403。) M8 y! c/ \' B& t' K* k) W: y
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script>  返回403。
$ S6 i/ ^* l  t9 r0 ]* n7 M3 u- z% }说明sql注入和xss已经被过滤了8 U) m, o( r/ Z8 a5 r
/ H+ @9 U# O- C
七、安装过程中排错
2 F, [  h" o3 Z- g% [' H
7 |: w" L% ]1 K( J& z/ `6 q1 [7 ]1.缺少APXS会报错1 M2 D* [; t, v, y: V) j8 u  T
! r8 ^  _& ?9 s+ L5 L8 [
configure: looking for Apache module support via DSO through APXS
1 q' O  m$ ~" {. {" u2 c1 Cconfigure: error: couldn't find APXS, P: t! P; Q# j. Q& O0 T3 Z
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。( H7 {/ {$ Z8 H
解决方法:
; z0 q  A; |9 X) _, D, p5 x3 [
# B% C( P2 v. gyum install httpd-devel7 t* K8 Q% d& \. R8 `# a: J8 e
2.没有pcre) T) Z  k; L4 |1 C2 Y  C
: c2 W# t# i0 v: J+ D4 W% h
configure: *** pcre library not found.2 a' L7 d; c; X( j: F# ?, _
configure: error: pcre library is required1 i# d$ L. _6 G$ L7 o
解决方法:
; I2 C/ y7 ^5 k* [+ g) U% o. P# ]
yum install pcre pcre-devel
2 K: R  k. u" D1 z* c3.没有libxml2
  l, B% R; S5 K7 {  s: F, P1 F! g6 }7 X
0 D0 a% w  m* I7 t; D1 Q2 J: u: G
configure: *** xml library not found.
0 \# }9 j' u. X% ~" ], Mconfigure: error: libxml2 is required2 S# y% n5 ]7 `. ?% ]  V- n
解决方法:! K- {) f0 g+ p3 g( n# k/ s

; L4 U2 {: C: n" Q( M' Vyum install  libxml2 libxml2-devel
5 \. k$ N# m( B$ T% a% l) w5 m4.执行 /opt/tengine/sbin/nginx -m 时有警告  D. I( m: J, M  _) v

  i6 k- ]; B# C3 PTengine version: Tengine/2.1.0 (nginx/1.6.2)
  V( H& R3 Q; ~2 n, ~1 snginx: [warn] ModSecurity: Loaded APR do not match with compiled!8 H0 Z+ K# x9 J3 B
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log1 X; D% l/ v& A! w+ k% @7 _

+ s6 i# q% @. J3 U0 \& y& _2 P2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.$ D- z! U9 K, @6 X- k- z: T9 m9 P
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded     version="1.3.9"8 Y2 G7 P! G$ y. R
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
) z" J' k7 }5 V) z  p! Y) ]+ `5 c2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
5 B4 f7 M- E- P- h2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6", X$ d8 \7 p/ V5 M5 J
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
/ `; f+ j5 N/ L+ c# `解决方法,移除低版本的APR (1.3.9)
( ?: n9 b* q* m, y+ l3 [3 I5 G
9 o$ P; @9 _7 {9 R. k9 t' ~( O1 Iyum remove apr
& B: S, l3 t- w) B6 m* B+ O, R5.Error.log中有: Audit log: Failed to lock global mutex
7 }" W+ D0 S; T7 z1 e( H3 k
( v& Y+ L9 g  S' y! o! v2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock     + P/ H% z5 V! Y$ d# ~
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]6 S8 j. x& K  i, W( b) P5 b! d
解决方法:
- c0 H2 ?9 s3 V编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
5 f# K' M3 p" f* u! P7 j8 m5 V2 Y+ O+ X% D* C" S. D* }) [: Y
SecAuditLogDirMode 0777
0 {) j: q( J: o! }SecAuditLogFileMode 0550
: a' R- n# o7 `: Y4 kSecAuditLogStorageDir /var/log/modsecurity
& O7 T# w& Z% }( I0 TSecAuditLogType Concurrent7 F6 Q+ w' \" L* C! M7 n7 v3 O
参考文章:' Y+ Z) u: u  X% v
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX" e' ?" m4 n( v7 y
http://drops.wooyun.org/tips/2614
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

QQ|Archiver|手机版|小黑屋|第一站论坛 ( 蜀ICP备06004864号-6 )

GMT+8, 2026-7-3 23:58 , Processed in 0.091206 second(s), 19 queries .

Powered by Discuz! X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表