|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
3 [+ }# i* c. V1 d$ f: e3 s9 `2 p% R3 V: ?
一.准备工作
: E6 F4 [/ v0 K7 u8 s" J' I i3 Z S) L8 p
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.05 U& _: |) M/ {0 @2 W
3 N0 O' p) c- J5 P7 @
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz# u1 V) n( h5 A* Y; ]2 P
" m. b. q# ~& C4 }- S# [modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
( {( a4 I- U8 x! ~, i) Z( t# k9 N. h
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
2 t. Q8 o. Z& N8 `9 M& i: O1 I/ X4 G; F* O
依赖关系:- }4 ]# @7 i9 Y6 T% z1 h9 Y! x6 r
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
& o8 u4 o+ N) ]0 L9 M- q3 E. d
" f) f1 h4 a' C. w0 h1 c2 h( Fyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
. p" l1 G1 ?4 Fmodsecurty依赖的包:pcre httpd-devel libxml2 apr2 |" u( |) A& Z0 E
7 r! }8 C. O4 C2 f
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel% W$ Z8 w3 W4 @; k5 n
二.启用standalone模块并编译
" R- h! `' c4 X1 P; R: f
. }0 J+ r+ }4 p; R3 H# L$ o下载modsecurity for nginx 解压,进入解压后目录执行:* Y2 N& A, g4 J( S$ t# u. d
9 j3 O6 v% i' M4 W' |# C& m
./autogen.sh
+ l% q' j: N4 W; B3 M./configure --enable-standalone-module --disable-mlogc$ n/ }+ O) g( M/ @/ e/ T! K" c
make 0 k& j s% b8 y' P% w, A" h. i
三.nginx添加modsecurity模块8 K( u- Z6 S( t
& q, {: A; I3 t# ?: j; Y, M
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
' y% z! X% d7 U9 [9 m& V8 v W( e& s& F1 D
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine! v8 z' Y, a7 i2 ?5 J0 M
make && make install
/ y+ G; V& p& A( y6 ~8 ~ W四.添加规则
6 d, z# S: s5 P5 P, f% t0 q& ?% f
1 _' ^4 O6 K+ u. \9 \9 Gmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。) V. |5 J3 ~. `: w, G C
6 D! n$ p5 z% c [; Y$ _9 I2 f" F8 s
1.下载OWASP规则:* Y6 A; W! u( k: j
0 z8 t, C3 w* |7 c) K: Egit clone https://github.com/SpiderLabs/owasp-modsecurity-crs
& c0 I: |; g! y5 ~! D3 i4 s2 ?0 W+ l6 d
mv owasp-modsecurity-crs /opt/tengine/conf/* U; b/ T/ o- z4 ?! t) X+ e! j
/ Z/ `8 V# m; [1 n* M6 [- @cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
" G3 d7 ?+ b! n2 E( `& V5 u- }2 j2.启用OWASP规则:
& ], R0 z- b) Z/ @: c* C$ g: E0 \% \' s+ V2 O9 P: Z% J$ W- ]) C
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
# v1 v5 K' A& _. n$ i: n
# V: Z. z+ m4 o G* ~ H编辑modsecurity.conf 文件,将SecRuleEngine设置为 on: [1 |- D5 N9 i. @" f
6 p. s1 l5 q! _/ y/ C5 k7 j7 l
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
# e9 c/ B+ S' t) ^5 [; f) P8 s7 A
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
1 z% y: W$ e* F/ \Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf8 j, ?5 l! I6 @" I+ T) g O' G2 B$ a+ [
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
* F5 Z& c) w( d* K: g( IInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
- S0 z0 t0 H$ pInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf9 x- f% x" m- t4 ^/ E+ y/ x
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
6 }3 X6 r- ?) L* R4 xInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf6 p4 n2 B6 o q( h+ r
五.配置nginx
* F5 M T+ r9 g* O) k
4 ^: [3 J$ [, I7 {' m7 B# p* ]在需要启用modsecurity的主机的location下面加入下面两行即可:
2 H# |6 f$ W# p' L9 k! p9 P
9 E# T+ v/ e; M1 eModSecurityEnabled on;
6 t1 d5 q5 C/ Q, Y& w0 DModSecurityConfig modsecurity.conf;
1 P x6 q' {# S5 G: E下面是两个示例配置,php虚拟主机:' e8 n& h, s% a9 G
5 Q; L! A6 A( s, W& j( oserver {) X2 a, B9 G/ A {3 @# ]' {
listen 80;
5 Y! R# i* N( N4 J; J( A, s s server_name 52os.net www.52os.net;- N6 f- {* z; y" Z+ |7 J
% {$ T" |4 l8 e+ \
location ~ \.php$ {! `% ?5 a& r" }; q; D
ModSecurityEnabled on;
5 o4 @% A2 r+ s7 q: m ModSecurityConfig modsecurity.conf;& R# L& L6 l( x& d. J/ n
9 Z/ I, N5 @* A a root /web/wordpress;! d& |9 }( X% G5 v! H* y3 a
index index.php index.html index.htm;! O3 ?" t3 R/ E8 m
P. n7 j# Y$ ?6 K fastcgi_pass 127.0.0.1:9000;
, g$ H7 U$ n, b' g; q- ]2 m6 ` fastcgi_index index.php;
5 ?. |& O4 B- @. I% e. [ fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
& I8 r' b0 l$ z4 B! y6 a include fastcgi_params;8 ?0 f* Z9 N" R9 n' l' X+ o3 M
}
* {# ^* t* D3 X6 n }% A! ^& K+ E- e5 F/ M1 J; }5 J& s; p8 K
upstream负载均衡:7 x2 o) q( n6 j! w6 l
6 a! ?2 @9 ?, v. e6 s: R, E
upstream 52os.net {
/ i5 v9 \" I( J( ]" V- ~% L server 192.168.1.100:8080;- c) u7 W4 ]+ z- t6 Y1 T: f
server 192.168.1.101:8080 backup;) @' K- k' A5 S: f/ r
}
- K0 o# K* @- M1 N: J% L' L5 w7 P t- _0 D/ A) ]0 Q y
server {* G- y8 q8 q: A) H
listen 80;1 Y9 e8 {: } [6 n
server_name 52os.net www.52os.net;5 [3 O1 j' V$ P4 x( Z A" o/ p
: S) |. p; p" t# M8 T( j
location / {
' P% i9 ^* T& J; B( g( f ModSecurityEnabled on;
0 k& M; p, q: T& {( G- M ModSecurityConfig modsecurity.conf; + q5 [4 Z( B6 Y3 _: `/ ]# @0 v
& H b+ H7 }) P- D
proxy_pass http://online;# b, R1 _- H ^
proxy_redirect off;' T# w6 C# i1 J7 h1 u+ h3 D
proxy_set_header Host $host;
- F/ W9 k3 l- |. o o9 x/ s proxy_set_header X-Real-IP $remote_addr;0 ^ Q* I( t5 _9 }: {1 F% ?
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;, b1 D1 z; ^& x! R" G
}
: m, b5 J& k5 G}4 V# \9 }( f! E6 v7 g, L6 q
六.测试
# J& V3 P5 @ T# z E8 P* i
0 h( Z! Z0 d% y! K& a我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:( ]# x! [' h' K% E; R
3 I( q3 I. j) i# ?# ?* B1 h
<?php
% [7 R, R6 X' K/ P phpinfo();
8 t8 {6 b. p* T* M( y?>
+ L& k& C I0 @/ m' D% ~) O在浏览器中访问:- G: G1 [' _; S6 w8 Y. ^
& [8 }8 e- @+ m: i
http://www.52os.net/phpinfo.php?id=1 正常显示。
, m& H8 F' H0 g- t2 a; whttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
2 f3 ?. Q4 L$ s! Jhttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
1 h: J; n( x# @6 e说明sql注入和xss已经被过滤了
) X% u6 K. }; c7 p7 N
# s) a" h0 `8 E8 ?0 A' y, S" q5 f七、安装过程中排错
8 e$ w! `5 }# n2 F! l9 @' ^2 D+ U- Z" a: l& @0 T* y
1.缺少APXS会报错$ a/ S4 C8 a. u0 H8 v# c( @! W
0 H, @+ k' u6 k" d, _8 @
configure: looking for Apache module support via DSO through APXS8 X' H N+ @1 [1 \0 a
configure: error: couldn't find APXS/ v- L. d9 e- X) m: i: G S# z
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。
1 T/ s! n B/ W6 A' e; p) |; P解决方法:# j5 ~: B: m1 l, f0 p& C2 q/ q
" C- R; b5 A; o; V5 p( L, Dyum install httpd-devel/ d1 \0 w! E/ K
2.没有pcre2 L* {0 y5 W" C# |# s
/ F) S% S: p9 ]/ _
configure: *** pcre library not found.
) |" _: K( R, J# T0 ]- z* k$ gconfigure: error: pcre library is required
1 n! @" B1 h- {) `解决方法:* T w+ r& L, B: z% ]4 v" ?" p& o
+ g2 H+ X) F' e: a6 B9 K B3 I
yum install pcre pcre-devel
; y" E2 g3 S9 Y( k! v3.没有libxml25 S5 d3 K: H7 A$ B
* q1 n9 }: y* F0 d& {5 Z
' A0 b' L8 ~7 E0 Xconfigure: *** xml library not found.1 d8 d3 [+ q* D0 ?( J- Y9 W
configure: error: libxml2 is required
% {( c7 e, l! w% |7 Y' H解决方法:
/ v7 {- [# a6 ?9 R8 h/ J( C2 O0 e# M( H. D
yum install libxml2 libxml2-devel- J, U; q8 C9 T4 _3 @
4.执行 /opt/tengine/sbin/nginx -m 时有警告5 k) H' E9 I. x/ A$ D
# q! R( d% b. y* eTengine version: Tengine/2.1.0 (nginx/1.6.2)
- Y$ N' h/ F6 S( X; Cnginx: [warn] ModSecurity: Loaded APR do not match with compiled!& g2 l- E) a& g$ a) r! }
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
- S/ }% O, J- d6 V! B7 Y, ^, ~# u1 {4 \. }
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.+ R" }# a2 z' z, b. J
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
) A* O5 t: r. G4 y2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
0 v1 g+ \- d& q' ?2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
: j/ S# Z7 w+ J( f& k* V2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
' x$ q% a; ^* Y2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On." V9 C5 H$ H# f3 t+ W6 d
解决方法,移除低版本的APR (1.3.9)/ n$ x7 K$ e( \
, O' H. _ t+ e
yum remove apr) E/ a/ T. Y) f4 `
5.Error.log中有: Audit log: Failed to lock global mutex5 ^% r& Y5 }: G0 G1 ^
, D7 B" o6 h* C
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
; V/ F, a6 B3 C) e Zglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]- C8 F0 W) x. }/ h
解决方法:
& R3 m9 g- Z5 p编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:# B: H! @7 P* K8 @" S) P
) [# n0 C. |' BSecAuditLogDirMode 0777
- L. a+ H/ i5 y7 O3 l9 v; F8 {) tSecAuditLogFileMode 0550
' w l( e+ e, X7 o$ zSecAuditLogStorageDir /var/log/modsecurity) X! ]( ~/ C# ?6 N
SecAuditLogType Concurrent
I- T. X! e5 f$ k& w6 S参考文章:4 a$ ?' g$ j* {8 {2 Q) R! D
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
5 H8 z: ]/ k- v' } |" dhttp://drops.wooyun.org/tips/2614 |
|