|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。6 n" ?. k7 [* W# u
7 m* ?& L) h, k# U: v' B
一.准备工作
3 y8 A; Y& Q+ c1 c" V( t* m& k
1 C* @: |6 I/ l, h3 y系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0- _2 H& b: |8 D' J/ z6 G" U1 b
* L* N6 g6 z" d8 |tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
9 D A2 `$ M7 i* g" S2 g7 @) _
6 _ V% M1 J* ?& V# t, }' t# _modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
2 S2 b, W* z c- D& H$ { p9 w" z, C" v/ W' o- D8 n
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs' O3 S! a) U- | f+ m- F9 `
$ {9 q2 @; S" |) b) v! k( M
依赖关系:1 g4 f1 t$ D8 _, {' k
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:% e* L+ z6 `$ x
( j4 a6 o9 w1 I7 ]* P
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
/ ~5 f( L/ R2 smodsecurty依赖的包:pcre httpd-devel libxml2 apr6 r' f, X1 g# _/ Y7 l
! ?5 n- f1 X! P8 I) y/ m6 r
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel( `' A1 o7 O6 {) A/ R0 @
二.启用standalone模块并编译
$ U# T ^/ g, W' q# ~& A, z: \) Q1 k- L0 u
下载modsecurity for nginx 解压,进入解压后目录执行:
; r f0 C- t! v D j) [+ @& i( }6 |& \
./autogen.sh; w. Q9 H8 l7 E% |" D7 |0 f6 ~
./configure --enable-standalone-module --disable-mlogc
5 I2 U/ W' V0 e) b* H( S d; ^make : j. z$ l, a, j, x& D6 l
三.nginx添加modsecurity模块" q+ ]8 v0 A. ]6 |, @
5 ?! i) n1 E" ]
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
6 N, {9 S% |& z3 v! Q8 R+ m, _, k
) t; @. N3 \4 l4 G./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine. A% I0 c2 b! v% y# N
make && make install' L B1 @# J- }) K7 Q; B
四.添加规则0 k; N& u3 t C6 M% j
$ ?4 m/ v: c3 w ?$ jmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。5 N, X8 C* m/ i' X
$ x$ f5 K/ a0 A. e: B
1.下载OWASP规则:3 Q8 M- [7 r( F2 d) y. W
+ S8 U9 j( C# f7 `% p+ q7 |git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
1 d% m! Z, \+ k5 G; ~, G! @6 H% D- F0 u' J& M5 q3 p7 v$ q
mv owasp-modsecurity-crs /opt/tengine/conf/
0 a4 C# M' d% g2 {1 V
; K3 h' O) @% tcd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
5 {' J/ z* G) j- C8 o) s2 O1 p: t2.启用OWASP规则:/ z, F& m }, \/ p4 M- X2 x
- A9 h5 Q6 T& Y$ y! o, W: c' l$ T
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
- e" m0 i) |5 o( b9 U6 n" g
" b$ Z4 Q; \2 Q# c编辑modsecurity.conf 文件,将SecRuleEngine设置为 on1 m, Y; I1 j5 F! \& N/ k4 N
9 ?6 |* F% z$ Y. V
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
. c8 g9 D- [/ w- U# J5 n) O" h/ a
1 P( O. b/ m, d( o6 W9 x" Q& {Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf5 j' {. b! C/ o, y( B
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
' q1 \% F. l2 ^& v; h8 mInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf" i$ f9 I! l, W/ K( d8 w
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf$ |& |6 i: Z! j' l, w: v% t5 `6 e* d
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf* X/ x+ Q. y! a, I
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf4 e8 ]1 x. R& f# {2 f2 \6 r' L
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf3 J5 _. y9 C7 a+ C
五.配置nginx# Q4 J( {5 A8 `
; y2 M3 O$ k7 L' Y: D6 t在需要启用modsecurity的主机的location下面加入下面两行即可:
1 ~ u7 q. s2 L& `' _3 Y, H/ {- r/ @4 C* \& k
ModSecurityEnabled on; & e# q v" w5 T
ModSecurityConfig modsecurity.conf; Q3 s0 u' M- ~' K2 g
下面是两个示例配置,php虚拟主机:
8 Z) G; B1 ? @! u( q. V# r% x9 X: W( N
server {
0 P8 V' s) [: Q; }7 ~ listen 80;
! q2 t8 [. ?0 Y server_name 52os.net www.52os.net;- X0 h. j3 B8 P6 Y z% E/ M, `
4 u( W4 ^, B) p8 m- x0 e
location ~ \.php$ {
' { y7 l( d6 z- b7 r ModSecurityEnabled on;
! ^! S8 z0 L, O) c) A1 ?& E% ` ModSecurityConfig modsecurity.conf;$ V6 n+ F) k; h! D; w A: @7 q
2 U7 V) t4 U2 \0 X root /web/wordpress;+ b1 a& M. Z; U& d, v/ u
index index.php index.html index.htm;
. v$ J) {& p, `. g8 M' p. l + }5 M n2 |( |7 y
fastcgi_pass 127.0.0.1:9000;. W" g: z f6 o% ~) H
fastcgi_index index.php;/ D+ N7 C3 p# ]8 L/ Y' j% |
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;9 O3 N, U7 I0 l" r- t4 g
include fastcgi_params;
( t: m" N# J4 ~. r }
9 i. G& v% s2 U1 X: ] }
- M$ T' c3 p7 |0 r7 j y6 I) Aupstream负载均衡:* M& q9 y+ k' V! o7 _" B' ]
) o5 L& _! h: n j1 R% l3 q' pupstream 52os.net {8 C# `" }# Q4 X2 v; Z
server 192.168.1.100:8080;6 w) ?) x' {, _
server 192.168.1.101:8080 backup;
4 \. A2 d3 s& f9 F3 c( G9 M( }}, D5 `! h% j6 z
: x. m @1 v; K T6 H1 ?
server {; C3 ]; r" Q8 L2 `' d- T+ L* F% k2 C
listen 80;
+ \ h7 o/ t0 G+ xserver_name 52os.net www.52os.net;/ H& L; {) F3 a+ P: u, }: T
5 l$ c; b) Y; a5 q7 n1 T0 m) W4 {location / {1 h5 L! w' f/ ]
ModSecurityEnabled on; 3 W. }) t( r% C9 n
ModSecurityConfig modsecurity.conf; $ d9 D( Y, M% W3 c% R3 V
$ G4 p7 |1 [4 O+ e! n; q! E
proxy_pass http://online;0 d1 Z1 `6 m4 \& ?4 D
proxy_redirect off;
# @5 h" A! K9 e; z: }2 J; b7 w8 @8 U proxy_set_header Host $host;
& S* O( }! R; I; h4 ?# E0 N( V. ? proxy_set_header X-Real-IP $remote_addr;
! B. D8 t) U1 u proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
* q& E6 Q) g! \& ^! `4 B" o }
h# M! Y. K) ~+ G}
) I$ k( z/ Q) j8 A% I2 e8 @六.测试
$ O9 K7 T: Z) T9 E9 l. H$ J* S+ B% ?0 e* u2 n3 y! z
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:& \3 t" a7 }7 o( W0 C0 R; d5 d
) a$ J1 ^1 m! x' Z
<?php
# ~- t% V8 h# c. R8 S p phpinfo();
) C. X; T6 p& ]$ Z* f?>) \( F. G6 Y' n; i) h
在浏览器中访问:* Y7 [, z$ s9 p; @4 E5 f I
2 M0 n8 g! w( S+ xhttp://www.52os.net/phpinfo.php?id=1 正常显示。) `0 J" D/ [7 }' R8 S0 |3 H! U
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
6 c( ~% L. F2 s, N. Vhttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。" Z( k2 h) t1 K5 M1 Q
说明sql注入和xss已经被过滤了
* d. Z$ ^' L% o5 c! w/ M9 w8 ^8 k3 F3 Q a' p# q$ X
七、安装过程中排错
5 r; B: }( C1 r6 `5 |) U* ?8 ]8 w
1.缺少APXS会报错
, [3 y/ l3 b. |1 A; K; N
5 t: D7 A' }7 h! d+ Vconfigure: looking for Apache module support via DSO through APXS& ^' ~0 t5 v: G/ T; q5 _
configure: error: couldn't find APXS v/ n3 X7 O, w- a; f6 w
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。* ?: U8 Q" \1 B5 k$ ^9 ]5 _
解决方法:
# N9 \- m7 R) L6 l3 J2 s) b+ w. {% ~% m# o
yum install httpd-devel
7 I R* b# j: d+ W2 V2.没有pcre
2 |# T' d7 h2 J( H R( A+ z
& a5 y" N8 l, S! z# [configure: *** pcre library not found.: l; J* G9 |7 ?. T! W( M
configure: error: pcre library is required' s3 m3 m$ }; @% Q) A+ {: r
解决方法:4 x2 T2 ~6 g% L; s. [, \! I
8 `8 k" k- Y- H& I
yum install pcre pcre-devel- C4 Q p7 ^5 n( O. O9 x
3.没有libxml2& ^2 G. I/ C. N2 `
* A5 u- T/ {$ m8 \
9 ?1 H( @! J# S9 Z: f7 S' ]configure: *** xml library not found.2 W' F5 e! z* {% [) e6 a) R
configure: error: libxml2 is required
- a1 r5 n2 W$ H0 f5 j9 c8 N! B解决方法:
$ W6 g, w9 @4 \' S
9 K: O4 l! T! D7 L1 H5 ?% r, ayum install libxml2 libxml2-devel* [$ H; C5 Y4 ? e
4.执行 /opt/tengine/sbin/nginx -m 时有警告
1 o1 J7 ]! ?: |" D1 V; D% s L
) D: R# C9 u) q. L. hTengine version: Tengine/2.1.0 (nginx/1.6.2)7 v7 ?. F! ^4 G6 Z' C
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!; R1 S' b6 d; ?: _8 t1 W
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log/ f+ p# R9 o$ y
1 H8 }! a$ y. t8 S2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured., [; p( ~8 K0 N" Z! N/ ^# s, e
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
5 d# i% A2 d2 y2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
8 Y7 |& j1 n9 x; k3 _/ G4 A m2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"5 D$ x. s0 {6 e! w* r
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
" A, y' ^/ Q$ a( @: O2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
7 g& ~- }1 i7 P4 T6 l解决方法,移除低版本的APR (1.3.9)1 r& V4 ~. N* q6 d# m
$ h, H5 Q, f" o! syum remove apr6 p, u1 j( N& E3 t3 s, T
5.Error.log中有: Audit log: Failed to lock global mutex
( V0 s! a$ e: `3 V: K5 t, R2 G2 w# B
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
+ h( i' [. [1 O1 P$ D) pglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
6 j0 C# x1 a. i6 k: ]0 u( \解决方法:/ m; t* d: q% Z
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:1 a* b, j5 }) b: g P! R q
- c/ x6 M7 W! \8 L
SecAuditLogDirMode 0777; v: d% ]$ ]5 ?* v' d
SecAuditLogFileMode 0550! A; y& Q) @4 D7 o! ?
SecAuditLogStorageDir /var/log/modsecurity+ v$ H2 x- R3 G
SecAuditLogType Concurrent
0 `* n+ T% ?! K! {参考文章:* S# x3 P3 i9 Y2 p& G
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX/ A) A9 F9 b% {: }
http://drops.wooyun.org/tips/2614 |
|