找回密码
 立即注册

QQ登录

只需一步,快速开始

查看: 12324|回复: 0

nginx配合modsecurity实现WAF功能

[复制链接]
发表于 2017-10-19 16:53:31 | 显示全部楼层 |阅读模式
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
* \1 H! N  s* @$ `& Q
( v- K& @0 X# v( Z6 I8 g4 i4 o一.准备工作
* a/ i; O( s# c$ X. R, H8 i7 W) J# ~- S$ h' d  S. _/ h" n- E
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0$ |) _# {$ z/ H. \! H7 U( Z1 F
4 S7 }5 g( G0 B3 ?1 n6 G, h
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
7 Y! z# B- F* e+ H% ?* z& D5 x
+ u  x7 d5 }8 ]/ F* X7 ^modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
' ~5 W( K8 b2 _; q: S+ J2 L  I, L
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
# i, z" s, b* Q# O% V+ M6 |" O; h$ R2 M3 U/ Q* ?" y
依赖关系:+ ?% p: M. y9 C8 C/ ?+ B) i
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:9 E. m1 \4 w. t& R1 _  u& x
; B1 q, T) f$ m- B4 [
yum install zlib zlib-devel openssl openssl-devel  pcre pcre-devel! i& W! C* ?7 Z
modsecurty依赖的包:pcre httpd-devel libxml2 apr. [4 \9 k% z. j5 {
  A5 H2 @( ?2 D& [) Z; [
yum install httpd-devel apr apr-util-devel apr-devel  pcre pcre-devel  libxml2 libxml2-devel) f3 @- w& w+ J# e) A) u6 C
二.启用standalone模块并编译
' Z( j, @! d4 Y# W! _) S9 D, r3 N6 B
下载modsecurity for nginx 解压,进入解压后目录执行:
$ Y: ~6 I  w, J0 u" l4 n8 O! r7 C5 S$ X
./autogen.sh! d; j0 D% I/ `2 a9 ?3 ?
./configure --enable-standalone-module --disable-mlogc
( A8 F( B- T8 m" |make
. S/ Y0 D6 j' g( g8 i三.nginx添加modsecurity模块
8 R+ s& ^1 v, w+ _7 [! s1 @. f8 t; T* N. s2 q
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
" Q# O  E$ U4 @5 {( |! U( ?% c2 [% _) O' C
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/  --prefix=/opt/tengine
! L% g; m. S* [. zmake && make install1 {+ [; V+ y3 }5 V
四.添加规则
7 h9 @, o$ f3 j. l: {  {; k6 W8 H! s
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。  S" U7 k) y: c' v* }

+ g# l! u+ \" A7 t- d1.下载OWASP规则:: z& n# |* K/ @% F  e  x- Q: v

. x# ^+ A) d! }8 p/ A/ C0 P9 mgit clone https://github.com/SpiderLabs/owasp-modsecurity-crs
+ \3 U4 |3 n' d. v3 G! m( g$ y- R8 c
6 d% P& ^: {; _0 smv owasp-modsecurity-crs /opt/tengine/conf/
* \5 V1 Y8 _" ^' Z& T( z" T  _' v
) L& U5 a; ]% C& S2 _) O, R+ {cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf" n% b) N' [! O' G# w
2.启用OWASP规则:1 Z5 o  X$ B$ B5 V  M% Y4 K

- _  b  B, m% P, f* K8 H0 |$ U复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
, z' ]1 `/ Z8 S2 o  c( A& A1 [! K( e0 Q: W
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on" Y$ w4 S! |# Y$ b, U6 J6 H

: ~. v2 x( E# `/ f8 yowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
- c2 v7 q) r! ~& z7 d8 x/ f1 i4 y8 R+ l/ j! C& G0 Q
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf' Z0 s" i. i' }+ g( o, I) Y
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
9 Q4 Z* W3 n3 U2 hInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf% ^, u+ b- q$ ^) K7 l& e
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf$ x! {, `  g* s  A) B
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
$ S$ f! Y+ @# u! Z8 _' `Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
- l8 \8 n+ k4 Q! Z" `# jInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf3 N& C% s7 k. Q* K0 Z* x. j
五.配置nginx
( V* N) d. f$ p3 S/ e9 b5 }0 H0 ]& X' Y7 f( t
在需要启用modsecurity的主机的location下面加入下面两行即可:
, v# c" s1 ^, L- X' j  {* f
; f1 @9 v  ^$ W- s4 Z$ I2 `ModSecurityEnabled on;  6 q( W, a2 N4 Z& Y
ModSecurityConfig modsecurity.conf;2 ]" k( b* j* k) c! |, ~4 N9 ^
下面是两个示例配置,php虚拟主机:
/ i) d9 H7 O- H* g5 V
, q) O7 u4 c2 J, W1 \server {$ n0 p/ w6 g& m' k
      listen      80;
& Z+ B9 T  b# m5 E) a      server_name 52os.net www.52os.net;* k) R: B. B) p! P; }/ ^
     # m6 B1 H3 B1 G) @
      location ~ \.php$ {
% z- L! Z" w+ o( c+ m) r, |/ v/ |$ b5 V      ModSecurityEnabled on;  0 K" ?9 u1 f- v4 C: W  D$ E6 e1 b
      ModSecurityConfig modsecurity.conf;
6 M2 j0 {# \- R, @- v  N
  v" Q& c" a, ~" I      root /web/wordpress;  n. J0 V- }6 F3 C5 q' `7 u
      index index.php index.html index.htm;
8 ?, L. p# w6 y& L7 X: T0 J, [8 e% Y! T  
6 E" u( x0 l$ S; t6 z% M9 N+ H3 W      fastcgi_pass   127.0.0.1:9000;
3 `  u8 D8 F9 a- [/ F. B      fastcgi_index  index.php;
5 W' u7 l6 {. P' `7 d  P2 V      fastcgi_param  SCRIPT_FILENAME  $Document_root$fastcgi_script_name;- g$ C1 y. j& ~' o3 X- z8 f, }
      include        fastcgi_params;! H. P7 K7 C" e( z  V4 M" H) v! J! ~
      }! c8 u+ d" O  B* z' W6 V8 l
  }0 U: c. `5 h; G' U4 J& S
upstream负载均衡:
2 e3 m* [$ b0 R- b5 X8 f0 n8 ^+ ?+ o. m7 Z, ~2 P
upstream 52os.net {
: X9 V+ {' x" P7 t$ `2 t2 X, T6 |3 j, ~    server 192.168.1.100:8080;% K% H! H; t, l' v2 t
    server 192.168.1.101:8080 backup;
, K# G7 \' H5 P8 p, L/ w, a  Y}6 ]! `/ w( |) j3 ^7 X2 V( K0 R: T
' m/ F; `/ H& a, }
server {+ U2 j. p3 P) `' o- p( I& {! I- S
listen 80;
% w9 u/ B# M+ i4 pserver_name 52os.net www.52os.net;8 l! c; ~8 c9 U) p" `
- _; q# b" M  b, `- ^
location / {
% ]; x  B1 }2 w3 I6 f% E. F3 p    ModSecurityEnabled on;  ; t% v0 _1 z: V4 v
    ModSecurityConfig modsecurity.conf;  
# I5 e& G4 f  x. S! [/ f* l, ]5 f
        proxy_pass http://online;
7 c' ]7 J& A+ {9 H& j" z- Z4 y        proxy_redirect         off;
5 g% F( _, b" @# K; Q        proxy_set_header Host $host;0 S# x/ B4 p4 W7 v3 s. x# [! U
        proxy_set_header X-Real-IP $remote_addr;; h  [5 N% {( `% p1 A* R
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
) E% g2 W6 R4 Y1 e    }
+ H! Q. b& a0 m2 t- ]* f}
$ J' }4 E6 p3 h六.测试6 t2 v/ B8 |; V7 o5 X8 x! Z

: t* E0 v5 Q2 A% L. w我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:' C  {- K0 j  A* e- p2 p4 J9 `0 E
. g1 f5 C8 P0 {; ]& ]1 h
<?php6 ^7 K% D% s9 D; U
    phpinfo();   
- i! C+ R! b6 J, {?>
, g' j3 Z( p  J: N) P在浏览器中访问:% l; F7 \9 ~0 A" o5 d: @

8 ^" H4 S; S- x7 h  @. Uhttp://www.52os.net/phpinfo.php?id=1 正常显示。5 `8 H2 L; Z1 @; v! {4 }
http://www.52os.net/phpinfo.php?id=1 and 1=1  返回403。0 m& N% A# M) W: A; u+ [! M8 R
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script>  返回403。2 g: V- @. j" S9 a  e8 G
说明sql注入和xss已经被过滤了
6 F" ~2 |: N2 I! W; C4 d4 L( t! D3 }, X5 {
七、安装过程中排错
( Q& j. y9 R3 {) x: a. R2 _
' G6 p* E8 ?# {. M1.缺少APXS会报错
6 X6 B- c, ~6 E5 t9 Y: B/ O$ h5 n6 J9 C3 ]  _" U
configure: looking for Apache module support via DSO through APXS
' u- |) f& T4 g3 _" Yconfigure: error: couldn't find APXS
- `9 W* h4 N! K5 _6 l9 H% zapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。! q' }" z5 h8 |& \; |/ B0 @( Q
解决方法:/ y6 I2 w% C# y2 A+ I
; D; k" _/ R' R. C+ R
yum install httpd-devel
6 O) _, }! i1 u- i7 P# `2.没有pcre& F: U$ p& n' ?: ~: r8 H3 B( ~

6 p6 W- D0 R* g# K" U4 ^$ kconfigure: *** pcre library not found.; z, y- Y4 m7 Q4 _& Z, k! v) H" w
configure: error: pcre library is required
1 Q+ a1 Z: M! m- ^7 f- ~解决方法:
) i- A+ ~, ~3 q! ^5 L5 O1 C. h& u( [0 {( ~, K6 h7 P- \
yum install pcre pcre-devel
4 A3 \) g; o0 ?: G" ]0 j3.没有libxml2
2 q$ m$ N! S; k& Q5 B
2 N1 D) |6 B6 t9 R4 ~  {; k4 t1 `7 Q! k. |5 I- f# [- K; W
configure: *** xml library not found.
/ P$ x! |( {. k' Dconfigure: error: libxml2 is required) t0 Y6 F1 a; r; a1 N7 n
解决方法:
8 q/ Z. B, T# i  R
! _$ ~+ q# r2 N/ u9 `9 gyum install  libxml2 libxml2-devel
. U) {- z' U" L7 o( h4.执行 /opt/tengine/sbin/nginx -m 时有警告$ _# H7 D0 O& s# k/ W0 M: ~  I- ^9 ~1 x
* D0 a0 E& b  n5 F" u
Tengine version: Tengine/2.1.0 (nginx/1.6.2)- ]9 s# x7 x  B: R. l/ w) l7 |
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!# Z# h' c& B3 y3 d
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
) `& R* |- ~4 I' U$ q& @
* y# q8 Q, J# U$ e2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
, \: }% a8 z5 I; u# c% c0 ]! h0 c! |2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded     version="1.3.9"
" Q; |8 \. l1 L& T2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!& _  |: h; t9 D+ n1 @+ d. z6 t
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"6 h; g2 A' s; l" ]. b. _0 n
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"( u* E5 C0 g# J& Z7 V& V# M2 U* P6 n
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
$ I9 Q. \4 K/ Z  Z3 j' b7 Z" j解决方法,移除低版本的APR (1.3.9)
5 j) z- T1 \7 \$ k5 @! u
2 n" A6 R" j1 }9 Q3 c3 h: m6 eyum remove apr
4 m. s: ?9 w+ x: w2 ^( K. P5.Error.log中有: Audit log: Failed to lock global mutex7 ^7 `: S% T8 a! l5 ]

  v1 o, r; Q& [- z8 `; J2 S5 I- o2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock     ; G! \. R9 J$ Q( w. d* L
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]/ H9 s" V$ M, _7 N7 E" H- W
解决方法:" O) Q9 m* M$ o& o0 O
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
) Y) E! Y% T1 {* \5 l* G* ~( ]8 _3 n, D
SecAuditLogDirMode 0777
% z7 h( b* I# G, d1 R6 B5 R3 Q! {/ @SecAuditLogFileMode 0550
6 \3 L2 F( p  g5 s& k! I3 ~4 USecAuditLogStorageDir /var/log/modsecurity
  i% q( C3 G4 q' W  g- K/ r0 CSecAuditLogType Concurrent7 d* |6 V/ e- w  S
参考文章:
, \$ p5 J' z# v" C# xhttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX8 t9 }# u9 U. \: N0 x1 K6 Z
http://drops.wooyun.org/tips/2614
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

QQ|Archiver|手机版|小黑屋|第一站论坛 ( 蜀ICP备06004864号-6 )

GMT+8, 2026-8-26 22:54 , Processed in 0.099663 second(s), 19 queries .

Powered by Discuz! X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表