|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。! p# f7 l6 I. g% B2 m1 y
( o# U9 ~) c8 K3 c! d9 z- d. [
一.准备工作
* L: k% a0 k9 j. |% m' W- e6 m
& n0 y, a- S5 a8 f# g系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.05 a! m1 v% H- a
# o6 B" M- O* I, ?- W
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
7 g) l+ Y( _4 d* d- y
6 d) W2 r5 K# a0 r h9 x- ?$ e' U- bmodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz- a6 ?) q# A. y6 d" a
- r! r% C5 B- p A2 a! `& g' ?OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
# c) |4 ~; O0 q2 `: O' b; R& s
6 @3 i+ G' R0 M0 G$ a依赖关系:
$ d4 S- X) \ \: G" s; y! ]9 F' etengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
1 Z" W0 a" ^/ V8 n
0 W1 |& E% t. o5 q3 A( _yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
# w5 D' d- r% _! T" @# qmodsecurty依赖的包:pcre httpd-devel libxml2 apr
( C6 j0 e5 L5 K0 q. c# M/ W @3 h5 ]9 r
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel+ O. ~3 m4 i8 n+ O o
二.启用standalone模块并编译2 Y: w' f5 J) ]4 u3 a% g4 _+ D
/ X3 X2 {5 z' H
下载modsecurity for nginx 解压,进入解压后目录执行:
b6 N$ M+ I' s5 [9 @% q( M/ I( ]6 Y j2 {; P
./autogen.sh7 _3 B1 v; @+ w9 b
./configure --enable-standalone-module --disable-mlogc
7 u: V' l7 y" k I& A7 u {- M+ G4 _make * H& S' t$ e1 x5 t) w3 _
三.nginx添加modsecurity模块
( [+ \% O: n* ^" p
$ P: |& [ T: s) ~% A7 A' ^在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
/ D# k: v3 P0 U! p2 s! {# P/ E
1 d' Y; B2 B1 G/ g$ s./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine( ^8 V1 p: P8 r4 U" X; u
make && make install
# s0 v* f( k+ ?9 l& r9 m! r四.添加规则* r( K# M( e1 D. O# D+ ?4 t4 ?
( h' O4 J. N2 d, cmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
! O( e3 n& [. S) O% `$ {8 F- ~- u( Y" g9 j0 z" c" F: _3 H
1.下载OWASP规则:
) R5 p8 `# H. U# e1 l0 z& w1 w: d: n; H9 A, x$ U
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
# l! x, |3 Y' n6 j& ^& S* S) a& {, r0 h3 s7 K: o. ?
mv owasp-modsecurity-crs /opt/tengine/conf/" o5 l, o" I7 l# a; ?0 B1 G
9 Z/ `- j8 |: b' v1 Y2 T
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
2 Z3 e" z! H# `+ b$ A, j- T2.启用OWASP规则:- x/ c* E6 v; o) k, V2 G8 O
7 G5 F& D6 {* F9 S
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。 A! y+ ]) D% g- U6 G& d
, D- w2 }4 Y4 l$ j* p4 ?+ h
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on* i* C3 F4 m/ Y* K8 M3 Z
9 a8 s6 ? t9 D- c [9 J ]. }
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。8 S! c) i9 q) `2 X1 u* _
+ m, M7 s6 F- c% _7 C T* R. T$ \0 rInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf9 z- m( }$ ]$ Y" D/ D
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf L* x$ w; U9 x4 v2 m6 q
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
+ ^: K0 ?7 Q9 ]% i; i" N) cInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
4 c' h" S" v W h( vInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf( ~9 b7 o# @ q+ H3 j1 w+ ?
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf+ i- f$ I" F7 {8 c% _8 e4 {
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
- R# L5 S1 d5 N" d( i五.配置nginx b: J7 s' ?% d0 b2 Y6 R
+ l& Q! Z2 k ^1 `在需要启用modsecurity的主机的location下面加入下面两行即可:
3 A+ I$ N9 ]( p/ h& _8 a
6 F; b G/ @9 G+ Y, k( H/ g& R2 d. zModSecurityEnabled on;
9 b* k5 }( s3 O5 m0 cModSecurityConfig modsecurity.conf;
7 n8 I9 Y8 L6 D) R: Z& i下面是两个示例配置,php虚拟主机:
( t4 E0 \$ s4 Q! p
* W' u% h3 K- }$ ^; N7 o7 u1 [server {
) p% J! i Y$ Z8 L$ Z0 S0 o' ] listen 80;
- T" F3 @( d1 x server_name 52os.net www.52os.net;
' p0 N1 `9 s; A4 s O* X Y : G) [6 v- A* o& p
location ~ \.php$ { p$ l* I" g4 |' J
ModSecurityEnabled on; : y y* b' T! B
ModSecurityConfig modsecurity.conf;
& o; t# _( ^8 ] k1 n" l5 m. F0 n' O1 E: w. E, u9 A- i P
root /web/wordpress;/ Y# b% d1 X9 X
index index.php index.html index.htm;
/ h% d8 W! c! k8 ^7 f- n 0 N$ A! d* i$ G
fastcgi_pass 127.0.0.1:9000;
4 G0 v! Y1 c/ [" I7 |9 m fastcgi_index index.php;+ i5 h' ~3 V- I6 e1 B
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;3 O6 ^2 G) P% [ w1 L% {
include fastcgi_params;
6 k0 Q' l, {3 F, u7 u- f }
G4 L8 p8 P6 a, j3 ^ }
6 E# T3 a1 X) J4 N1 bupstream负载均衡:
5 y2 q% g$ w4 q( Y* [6 j4 o/ V, Q a
upstream 52os.net {
, [* Q Z) J' p1 } server 192.168.1.100:8080;! Y8 ?. r& W" U3 W$ d4 {1 f/ Y
server 192.168.1.101:8080 backup;
5 A. V, [1 a I}
0 Z8 [; `- p; o
- L( e8 Y% M/ W- G Hserver {: ^2 A0 [/ k/ f5 V4 X! V4 ]
listen 80;
5 B U% s! q7 k# N! X- Iserver_name 52os.net www.52os.net;
! [. M7 ]% n4 p! T) L$ x7 R6 C! l/ ~8 r# O, N# A# C
location / {
' i; V0 q. l/ D6 D# ]& u Q, m" F ModSecurityEnabled on;
$ _: Z/ J* [9 F1 y; k ModSecurityConfig modsecurity.conf; 3 [* X. ^! [ o7 F8 x2 l
0 ?4 ~5 w: x# I. y% p proxy_pass http://online;+ A7 Z: @5 g3 M8 o. ]
proxy_redirect off;) a. v. |0 J$ J
proxy_set_header Host $host;
' ^0 l+ y3 I- F9 t8 r# v) [ proxy_set_header X-Real-IP $remote_addr;
/ }! r- b2 e4 r/ h3 j proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
2 Z7 r) [% r% d# F3 E }
, t6 k6 N& W; K7 M: r}& N: i% @8 u3 x( [( ~
六.测试
2 G2 C. z: B' F$ s+ g2 x, Z3 n1 \7 v$ t! i* x; Y
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
+ l: R z% D3 s" W0 B) h+ o
/ e0 v' c4 Z% e& f<?php
0 l" Q" B2 V, B2 b* m1 b; w; q phpinfo(); $ x" d! w3 A: V9 ^0 ]
?>. h2 `0 p! t- p" E, m
在浏览器中访问:
' R( r( b/ y. U" ]
! S; ?7 B- B+ J# Y o$ ]0 H& o; Ihttp://www.52os.net/phpinfo.php?id=1 正常显示。
8 K( b! ~, {9 N" s/ T6 E Bhttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。# R6 a0 r, h& L' c# b5 I
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
& v! N @) l5 e: l$ A- B4 f1 e说明sql注入和xss已经被过滤了7 X4 _2 f2 |) C1 Z
$ b: l' [+ Q# Y, b2 |七、安装过程中排错
' _, @: x' ~/ M1 Z- O7 t' q8 F8 d0 m1 h x9 F/ y
1.缺少APXS会报错
G, V/ g* [$ }5 E! O5 W$ ~3 R( \* k) S3 H$ Q3 ?9 Y% [
configure: looking for Apache module support via DSO through APXS
* [7 x3 E* W+ Z) ^: g& L: @configure: error: couldn't find APXS
9 `' ^7 t& F8 T+ _apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。. h. E9 I/ J! m6 }& |, z
解决方法:
, h1 p( G; g6 O3 [7 r# j/ [4 q# J( Y; Z x/ P1 Y# }) D3 Z
yum install httpd-devel
, ]8 {$ B- x3 k/ E2.没有pcre# @, d/ u: P: R; S2 X. U7 @
% {+ F8 D! q& `, Q
configure: *** pcre library not found.! Z: H. z# |. G, t/ G" u3 G7 E
configure: error: pcre library is required
# [% }: r j$ \解决方法:
: j' j8 W; D3 o9 l5 p1 j( j9 ~
" W+ s/ C t, Byum install pcre pcre-devel; e8 W3 P' }; K1 l
3.没有libxml2
* g/ W d2 M7 z K6 z* o+ @, f% d6 i. \$ p
5 `1 Z/ l" R+ m" Q: \& Z7 xconfigure: *** xml library not found.
% _7 G8 _3 D& w% {1 Z/ xconfigure: error: libxml2 is required
7 w3 \* R/ _7 C' L; K- f解决方法:1 r, `- g7 \- e' q ^
2 m0 J$ t% j: |, w
yum install libxml2 libxml2-devel5 h* l. a9 b) w: j
4.执行 /opt/tengine/sbin/nginx -m 时有警告: A( x* d# _- r
7 F/ U# K0 U- ]Tengine version: Tengine/2.1.0 (nginx/1.6.2)
8 Z5 Q6 M1 L+ Y, x" B8 {( pnginx: [warn] ModSecurity: Loaded APR do not match with compiled!$ {* Z7 _3 v, ?5 r& V. v3 N& x$ z
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log4 q9 t( [4 S6 {& I! Z
0 J" z4 Z+ |) R6 f. V3 n2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
; t5 N: N' b. k6 j6 f4 t3 m2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9" h* I5 p8 Z/ [9 _# W% ]/ m2 k
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
5 x' t) c# H4 B. X; c3 I2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
$ Y! y9 B$ k% K, y# `2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
; ?6 Q, l9 z; Q2 x* Y5 J3 _9 p2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.& D) x" G' l i4 f/ x* m
解决方法,移除低版本的APR (1.3.9)
8 C; E1 m; K/ X6 M* P4 m' M
- |+ B+ z, `7 k1 c: H8 f$ Byum remove apr
/ U4 p, u8 n2 b, n2 j- }: H; S5.Error.log中有: Audit log: Failed to lock global mutex
. x/ O1 k2 H& S" |+ U+ N* }0 J, U6 H N8 a7 s1 K( D0 d, N, A* Q
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock 4 H" c3 z1 ?$ @3 |. E6 {0 F% g
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
# O5 k% G ~( ^0 z# @8 f解决方法:) M- n( L3 w% f$ V1 n
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:1 F8 `7 D" R: Z1 z4 @2 \
; M- A" s9 P Q5 u, k- h7 w `+ B$ OSecAuditLogDirMode 0777
: N2 V- E" Z7 h% k! G( U6 D. vSecAuditLogFileMode 05501 Z& M+ @; U( Y/ B0 C) m4 f
SecAuditLogStorageDir /var/log/modsecurity
, s4 o) [8 o0 t, MSecAuditLogType Concurrent8 Y! K8 e* G- h* U. |
参考文章:
5 t) o* \: L( d% h% q m6 Ihttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
# ]5 F \. d4 V' b) ^5 Thttp://drops.wooyun.org/tips/2614 |
|