|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。4 X& a; ?) U; _
& a% Q! b# F3 s7 x0 e4 D" w# i
一.准备工作! | W) S5 E0 I) i0 L; P
; U, L: |" ]# ~( [
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
7 B5 A2 N+ s% `2 E; j1 x
6 ~/ ?. F; k+ W' l- stengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
" f! {! T: ?+ m
* u! ^- t" d8 T" X/ ymodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
. }+ E; o1 _) f! l; x3 W; g& J" x* u# w$ [7 I- O, e/ y- N/ i
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs( w2 u- K( L( B7 j, w" ]
- @: w$ M( E- N; c5 ~0 J1 Q
依赖关系:
, x: `6 o3 r0 D% v4 K# ltengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:6 ?" F- b( |! } Z8 O6 d# b: b0 T
/ B8 x8 k$ Y( r6 pyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
& s- }4 @' t0 O* C5 V+ cmodsecurty依赖的包:pcre httpd-devel libxml2 apr- [. H- v. A* i( ]( D5 {* R# e
9 e T& K' t. D, p% Z: u8 cyum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
( [( t8 N5 n% W7 B二.启用standalone模块并编译
2 {9 M! G- w: E3 Q+ Z+ e: \3 c% F- t- D9 A5 G
下载modsecurity for nginx 解压,进入解压后目录执行:8 S) U" A/ E6 a w
( V+ v! }6 X7 r# o7 F./autogen.sh
4 ?- W% d+ | O./configure --enable-standalone-module --disable-mlogc
5 y8 g- e4 Y. F& [make
4 h. ~6 g! f! e" a" `三.nginx添加modsecurity模块
6 ?7 J- P0 k; ~, ]; W4 q) i7 t/ n: w
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
7 r7 ^, y3 l3 M: d! @- c. r5 Y, v
7 K) Q Z9 R; v; J: Z: o/ ?& B B9 H./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
( c' n1 g1 I% ]# vmake && make install
3 e" K; C/ r* h' [, l3 Q6 ~四.添加规则
8 {7 T! P# l: \8 A* Y6 i: Z$ E |
5 _' o* K. Y8 R. Imodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
# S4 \' x% x+ \0 V2 d9 y) `+ y2 N
1.下载OWASP规则:/ ~( J5 l1 k- E6 L; C' Q" y
3 O9 M) U" w/ T3 xgit clone https://github.com/SpiderLabs/owasp-modsecurity-crs
: i" [* q$ i, O# }: g) w; `. X; D. G( o* s7 V
mv owasp-modsecurity-crs /opt/tengine/conf/
# m' v* ~* m' p1 _1 k
3 g5 h! e* S' S( W3 b1 fcd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf& |0 G6 @3 |, `0 @" b: v5 i; B
2.启用OWASP规则:$ A2 N, I& { p0 M/ R/ r
/ F" b: f% _8 j; y. a. N复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。) F7 I8 w) r. B
- N! e: ]! i2 X; {; U
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
" ^; |/ {4 I! z) R
+ q% Y- x# F1 L9 D' C0 nowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。* k1 Y7 \( S& _0 L/ Z& W8 w
% H9 r4 R2 j2 s6 N9 j# d0 o$ OInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
4 M4 S4 W8 a: u6 h0 K3 hInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
, {6 Z5 z4 ^, }1 e- L6 `Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
7 c/ _# Y4 r/ K4 H: ZInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
1 B; O7 `6 c ~9 YInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf8 @" J$ x$ t/ Q
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf( q# u# G2 D. X `$ D
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf, w r3 q# y* c3 n X# W
五.配置nginx
$ b6 b3 b* K% P0 R9 `# }- t2 m7 d7 Q
在需要启用modsecurity的主机的location下面加入下面两行即可:
+ Y1 K6 p$ h' b6 S3 T& p0 c5 }1 o8 z
ModSecurityEnabled on; 1 W* ~% B J) J% u, J& R
ModSecurityConfig modsecurity.conf;- j. J+ p. e* z) s8 h
下面是两个示例配置,php虚拟主机:- {, f& Z( H+ b- q& i5 ^3 C
2 G% }- M/ l' o$ I3 U% T
server {
& L1 ~! G D3 _4 W V4 v listen 80;0 o( c1 h* j+ Q. H6 O& T
server_name 52os.net www.52os.net;
) t& p4 N9 |# K1 _
$ ~$ V! Z- ^" O% N# X1 A location ~ \.php$ {" F4 N8 u& o- d6 V+ |3 \$ G
ModSecurityEnabled on;
9 A0 j7 V2 [$ O' p( M ModSecurityConfig modsecurity.conf;
! o7 l$ z/ s& n( o
7 _4 z$ l: v. N1 n! \: C! T$ `& X root /web/wordpress;
2 P) d9 r8 O# p1 T$ _1 w9 f index index.php index.html index.htm;! O/ l& h" |! ^. c3 ?$ a
3 b9 Z# f& @ X+ y4 c
fastcgi_pass 127.0.0.1:9000;
. A7 V7 O- U$ E* |# J& I fastcgi_index index.php;
" ?% H* r* E. _! p* N) P8 d ?" s8 ?' R fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
0 t, p" u3 E" J* T5 @( S4 m include fastcgi_params;
+ l B5 ~* K- t- \! X0 \: q$ s3 N7 I }
' B6 f9 R' W% F }/ S+ X3 h3 I8 @' R+ n" S, q
upstream负载均衡:
! r) J# Z, k! K! H8 s
6 Q% g4 s, |/ E- a7 rupstream 52os.net {
# R- x. q4 f1 f$ u5 D% h% M server 192.168.1.100:8080;/ L& c, M3 I" k
server 192.168.1.101:8080 backup;* S$ D" E. J3 z( K* C! @; R; ?3 M7 B
}. {, g0 L7 ?( J6 a$ M; v4 X- }
1 |$ d5 P* \8 {! w0 G* tserver {" b" ]# ^2 \& H. C) x( {( I+ o
listen 80;1 T3 J( W$ D( i/ M0 s( h
server_name 52os.net www.52os.net;/ V# B# ?1 ^* x: O
) ^% Q1 R& K9 plocation / {
! s+ l# ~# [- [% U3 s2 S ModSecurityEnabled on;
6 y9 v+ G0 J' S7 w ModSecurityConfig modsecurity.conf; % n- C: i$ D+ p) F$ ]
. O4 f6 M, x) N$ D4 U
proxy_pass http://online;/ d: U. `; K( o5 i/ b. o4 z. [* a- l
proxy_redirect off;
7 H# T3 { r7 h$ V& p" L proxy_set_header Host $host;
( w. A3 Q8 Y, R! D! ]+ E! `% o proxy_set_header X-Real-IP $remote_addr;
0 T8 X$ Z6 A7 b8 b# Q# H. ^ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
, e8 T+ z( N# v5 [5 R: I: P }8 ^* v1 }4 G. G* L
}, a7 k2 J7 v: N7 N3 y
六.测试
% k7 h4 L' o7 z* a! o( h/ \9 a* u+ k8 y
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:8 ~0 l* X1 w- k9 h( p" |
1 l5 A4 h6 ^& h; ^* t
<?php6 w' D5 b% i8 |7 C- o1 e
phpinfo();
3 f0 X7 d3 Q1 t4 j, K+ q?>
7 Z4 a8 @5 z% c$ L& |; x. |在浏览器中访问:' Y! o) m- h( i# q5 }& \7 z0 Y
+ a6 a; J7 c: L
http://www.52os.net/phpinfo.php?id=1 正常显示。
( D8 z8 i: A0 Q9 r9 w1 Z/ n+ D! thttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
8 B! ]% m& i( z" ~ V1 V2 Khttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。! y" p# Q! U' B* l# f. [- _4 f
说明sql注入和xss已经被过滤了0 I: f d6 ?! q
1 q1 v, Z( X% ?5 [* Q& r& K七、安装过程中排错1 R* r0 F0 q5 `" ]6 F3 o: u+ B
% e! s2 G8 W |; L$ C, T: T0 m
1.缺少APXS会报错
& z2 c* S6 Q) W; U
+ v+ m, J; N5 l! P; u6 P% {% Vconfigure: looking for Apache module support via DSO through APXS4 Z5 ^5 r! M/ e. K7 Y7 Q5 m
configure: error: couldn't find APXS
) L5 U: X' P9 C. [" u: c! Tapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。: U- n* c# ?, z1 h+ \0 R
解决方法:$ j7 G# _6 g5 Q1 M1 w8 J+ c+ K
, K, k- k$ [+ n' ` nyum install httpd-devel5 @$ H( R9 D1 s
2.没有pcre
8 K- E& y1 V& _1 n% D9 \- v5 m1 a7 t' Y7 `2 b a
configure: *** pcre library not found.3 u/ }( c, m% n) U: p5 M
configure: error: pcre library is required# \* J" Y1 A1 J4 z6 _4 _
解决方法:3 x! h3 ?) f0 `8 ]# a, {
) U" M+ E/ k# C* @' s/ [0 b: p Myum install pcre pcre-devel% ~, u- ~9 A0 T9 K
3.没有libxml2) ~3 `1 d6 t0 E+ W0 ]- e- C# h# E. s
( L6 Y5 a$ y; ?! B" Y4 b1 ~& {
3 w+ M5 G: }- T5 Iconfigure: *** xml library not found." S' J, Q& Y8 C" L0 ~ L9 Z
configure: error: libxml2 is required2 x! u1 {/ R6 I ^8 K
解决方法:# [% B3 f; r$ p4 y: W# p/ ~5 P7 n$ P
b4 _1 Y/ c- Q; B+ k0 oyum install libxml2 libxml2-devel2 Y$ ? L0 ~+ a, |/ [; p
4.执行 /opt/tengine/sbin/nginx -m 时有警告
+ ?1 M9 C4 ]% G) k$ r: d, d* i8 t0 `2 ?; u K; q
Tengine version: Tengine/2.1.0 (nginx/1.6.2)8 @ K/ M% B( V& t
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!: x' I. W/ W8 z8 w
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log+ J( k, t \" B% g- O3 b& B
3 i4 R; N; E/ {9 S; h1 p2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.9 T$ ~& \' u" t5 H0 `
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"/ @+ l) ~! ?! E$ b4 E- L. e
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
% z& f9 C4 o& {8 O8 k7 q2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"$ ^( q" h3 O+ }' G. U) X
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
+ c! r a2 a k# G0 m7 T2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
: r$ F' l1 c" b& G* _: D) J解决方法,移除低版本的APR (1.3.9)
" J3 N$ N' h. u
8 \: X5 |& \: f! ~+ n8 j0 Xyum remove apr4 J' R4 }; Y- B; c: c
5.Error.log中有: Audit log: Failed to lock global mutex3 S$ C- ?# }. f/ ~
$ B- m! ?& x) a4 E
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
% h3 |- S/ H& Q) _5 K1 J( X( F5 f, Qglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]+ O2 ^3 X) q7 G% M7 S! L- [
解决方法:
- R A' I0 ?5 ~/ B% g+ [编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:6 p1 T5 @& M R
R! k6 R+ C1 k1 d# CSecAuditLogDirMode 0777
9 p$ V' D- Y' W! D& }2 d9 gSecAuditLogFileMode 0550. u+ r* v2 h6 W4 R% X) i S+ X6 k
SecAuditLogStorageDir /var/log/modsecurity
- B+ Z3 ^, k2 r7 b3 g) Q2 nSecAuditLogType Concurrent
+ F/ J0 h0 a: g, E% d c& b) ]! m参考文章: b4 u, _ z6 b+ q0 m7 b- q Y
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
* T0 s7 I3 F% H% C5 whttp://drops.wooyun.org/tips/2614 |
|