|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
! n+ O J+ Y1 B9 U6 T! ^! V ^9 P# N" k' E- z
一.准备工作
8 s: k j" z" O [+ g% p9 _, s: Z
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
0 E+ h8 l0 G+ m
+ t6 L; P2 x3 \, {" {tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
7 Z+ ~# B4 W- P6 t7 f% G. l+ m. C2 I9 A+ h" b- @
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz: C) o& N/ @- R6 @: {+ Q
# e% @9 b$ ]0 r2 M0 \. \
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
- l4 k7 e I9 I4 H
% {5 L( I8 g- J( n, q依赖关系: l$ A& t- H1 a+ I( Z# n& l
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:0 ~! Z) |* t. s- r# \2 A* q
. D- N i- R; f5 L, Z
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
, H5 Q& t& p$ s$ W, q# Imodsecurty依赖的包:pcre httpd-devel libxml2 apr
4 b, t" y! M! J
, W2 Y- H- e- B; d6 A7 C8 Ryum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel: h, X' H6 J! o5 h
二.启用standalone模块并编译% G" v& R7 n8 {0 F% j: J
+ O6 U" @# g& C% @. r下载modsecurity for nginx 解压,进入解压后目录执行:
# W1 R0 l5 N9 w, C/ _
: a+ ]- M5 G+ x U( ]$ r./autogen.sh: J# k$ J9 I. z6 k6 ]- _1 l2 w
./configure --enable-standalone-module --disable-mlogc/ J! A O. M! W6 @' R# R7 X
make : B# C2 e4 J3 s# }2 h; m+ E
三.nginx添加modsecurity模块
6 y/ B5 G$ o* b2 W# p. M! H
! H/ {! I& U) x" U4 D8 y5 C- Q在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:2 D, E8 t4 k# h
, _1 q. C) Y9 S# y: j
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
, M9 ]. V' f( d1 y2 z3 T: d- Dmake && make install# G5 l2 f! i* L! F6 t4 E# H% I
四.添加规则( u" s& @8 Z. x5 K
% X% m$ b# m, ymodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。# o* W$ A6 d4 f! Y- o7 }
* Y; z; \% r# W& [) r5 N
1.下载OWASP规则:+ P0 ~' ]% n% f/ O$ Q
% W& ]9 _7 ?, r F
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs. k0 T4 p! p5 {" D
' P4 T% u# M, W7 ]- j* m# U
mv owasp-modsecurity-crs /opt/tengine/conf/
. N- Y! d0 g ]+ G' y
2 G, V! [* O) S$ ccd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
( s" V: J' L: S6 ` T& k3 R2.启用OWASP规则:
/ |% y* d3 `- `5 R; F
( a5 [4 p: \. {3 [ p) Y复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。* k8 E7 Z( ^+ k. V4 g8 }% K9 K/ [, j
4 A& y- t+ R6 f7 t" `) W+ ?1 ~3 e
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on$ [3 \, s" R2 B& k& O# g
. j% B9 c2 M/ Z! d( Qowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。5 S4 K4 f% |: z# j, U0 d; G% ~
: Q: b( q+ l8 @ d2 u
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
3 v3 w6 F$ L4 m8 n3 @2 ?$ O1 ^9 |Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf9 o8 ?( i0 s4 e. K, B6 o
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
0 x+ v, {; U9 M- r: U6 f6 K9 nInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
& D I! [9 z5 Y2 _+ OInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
( W6 q% y J# h: h5 s8 bInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
1 l. u6 D! Y2 e' |. A* w* iInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf7 W3 L0 Y: v/ m v2 [' K8 Z* `% T
五.配置nginx0 A) D8 L9 ~% L9 a3 H' t) Y6 _
* f+ v' L" R% q3 K8 Z( o ~在需要启用modsecurity的主机的location下面加入下面两行即可:
% U2 z2 f, h4 ]- q" A: J+ B9 E! z$ I/ |) B5 s& n' M
ModSecurityEnabled on; " Y8 ]! l c4 b
ModSecurityConfig modsecurity.conf;: M' l0 j$ a& ~& B$ _
下面是两个示例配置,php虚拟主机:
4 H0 w7 \9 `. W. j! _/ u B, ]. q. m$ s8 u6 e
server {
& t+ A2 n/ x' t1 D! W listen 80;
. d& F1 O7 ^- z6 c server_name 52os.net www.52os.net;
J" Y+ O1 f- G3 ?' V% V! [ 4 F8 a$ i1 u4 } \# v
location ~ \.php$ {: {! \9 I9 p- r4 g' E' w7 v6 k8 X
ModSecurityEnabled on; 9 \4 [4 G- \( [. e
ModSecurityConfig modsecurity.conf;
" c+ L& y+ `6 ?. i) }% R- x9 G; m3 P8 G8 R* J5 \
root /web/wordpress;! Z: S% {; l# d# @+ G7 t0 ~6 [* O
index index.php index.html index.htm;' h7 ]( D: a: l6 n
5 x: ^3 d7 k' C- g( t6 R! l
fastcgi_pass 127.0.0.1:9000;
- E; t- H; |. s8 ~) g) F! n4 b; f. d fastcgi_index index.php;& r# L- w: I, B$ d
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
: d2 A: x( G) e5 n! R include fastcgi_params;# N' N2 z# L5 i
}! a2 \7 d1 o. ?! `1 Z
}7 r3 }! W% P( ?3 u" Z- k
upstream负载均衡:
, b! q0 Z5 K ]) D' N; c. i$ ?! Y" V; o" r. I+ R
upstream 52os.net {$ e# }9 ~; S- {5 j0 l
server 192.168.1.100:8080;
/ S$ r: A o' k; n. |' h6 Z- J$ [ server 192.168.1.101:8080 backup;
' R! {1 Z8 O2 v+ P; u0 _# y9 j4 h% V}8 f5 a3 |8 @& a a# g- O
0 w; q; S. q- s$ |# Bserver {3 Y9 G6 }4 e9 m1 |7 r% R
listen 80;0 [5 ^+ s: d4 L. y0 J _- I6 K, j
server_name 52os.net www.52os.net;1 x2 X7 |/ {% U& j z ?2 c$ F0 z
1 O9 }4 x. `2 J1 _, P* S( q& qlocation / {
! M/ R& L- o. S ModSecurityEnabled on;
( Z3 I& _8 P2 W ModSecurityConfig modsecurity.conf; i- n0 a' Y" \6 ^& e5 y& d
. \) |( r0 Q2 W' P( J( P
proxy_pass http://online;# |, L7 o% p: {' M1 O
proxy_redirect off;
' Y% K9 a T+ t# `) Z9 k proxy_set_header Host $host;
" U" f6 c- l3 K6 ]/ l3 p1 }) s% @ proxy_set_header X-Real-IP $remote_addr;% _, V \! J, c6 E+ l4 ?5 P" n
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
, `3 `" n. E- ?5 w }! E) O) i7 s) e# u- d+ c
}8 E! ~# a& e6 X* T% m! D
六.测试
$ W. K- Z" d2 h* y! N) `) x/ b4 u3 m; p
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
: z, _* W! \- a# C, L$ X# w5 E/ ?( l( A2 E6 y/ P
<?php
( L& h4 @' |0 q, P0 g" H/ x2 I, N1 a. q phpinfo(); X) m4 k: {3 U" P7 [ }
?>
- x: o. U5 }3 ~2 |( w5 B/ s% j' A在浏览器中访问:+ w# C V% f1 [! ?; m4 H5 ?
5 {% H1 ^% a" k: _1 R" L [
http://www.52os.net/phpinfo.php?id=1 正常显示。
9 ]5 @& D$ O& y4 C( ahttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。% I- ?& Y9 Z7 {4 b: a) V
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
" V) ~9 f+ L) T说明sql注入和xss已经被过滤了: P) _) \* c! p! K2 F
! a! U ]" K- V$ h% z
七、安装过程中排错
. u9 l8 |6 e' P. I
5 N9 M2 A- c$ G) z, X6 i1.缺少APXS会报错
- q$ G3 E7 g7 K3 I( f% z
! P2 Z: R0 P) z1 Rconfigure: looking for Apache module support via DSO through APXS
$ R) H+ c, e- N1 I9 l8 z$ Q* R* lconfigure: error: couldn't find APXS
7 x4 [ ^! D0 s/ r. ~' oapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。5 w* x9 ]! h- n
解决方法:
1 g" N4 e. o9 p! d; n; T% s. [2 m
4 d c1 V( Y) ]0 t( ]yum install httpd-devel
2 U) u+ O4 x5 _# B f' h2.没有pcre
5 s7 F* x! l- C( p# ]
) z" n- H# z. _ v1 n7 D/ Q4 m1 jconfigure: *** pcre library not found.
* \( Z. u; w/ N. t# Lconfigure: error: pcre library is required/ Y$ D: w9 p8 O3 [: b
解决方法:8 `' X( W" [) }2 h
1 x, m2 c% |( l- [: K, N8 xyum install pcre pcre-devel
2 k1 k( i' O0 v/ L$ y0 ^3.没有libxml2
& }( `4 a4 `! x5 v6 m, M3 b6 R# e
+ a% n, N# @# g" l6 n8 }( P5 Y/ rconfigure: *** xml library not found.
6 x- t5 M2 r. I5 C% Q2 Y9 j0 \4 rconfigure: error: libxml2 is required
( a; `: q, d' P+ l9 ~解决方法:
+ ?# o" I# O* G* R1 V
" q- N; d' A( g! ^% L7 Oyum install libxml2 libxml2-devel
2 d) k( v* B. [( J4.执行 /opt/tengine/sbin/nginx -m 时有警告
p; A" z7 |- ?6 V+ t1 Q( A p `" h( Z4 }7 I7 b8 K2 F# f
Tengine version: Tengine/2.1.0 (nginx/1.6.2)3 V( o! X, H8 W0 F8 g7 K @
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
% |3 s+ c( Z6 m7 ~0 g原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
# p- c- p/ n9 p: l X" `# G" @0 n" r
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
4 h7 L0 ^7 L+ J& @2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
8 ~" h3 [7 {9 ~/ q* X1 K$ [9 V9 q2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!+ A: g$ |; B. W, l& ?! W* R9 X
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05" G1 d9 Y7 @* F* w
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"5 ?2 `- B% F: N) Q7 M
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
+ R* W4 {" t+ d& |/ R3 z, ^解决方法,移除低版本的APR (1.3.9); y6 Z& N$ o0 f/ b1 B
2 [+ m3 t! Q3 S+ Lyum remove apr
) n- s. F+ _ o7 A1 d, ?5.Error.log中有: Audit log: Failed to lock global mutex6 d* f9 |$ q9 ^( c6 C' {
* C+ ^5 @, F2 @
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
9 I+ g5 Y0 f# a& W7 Zglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]6 R: i0 D9 @" n0 c4 j: |- a
解决方法:6 D w) s% ^7 R( C3 }
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:) u, f% b+ O1 v2 V. X; u2 [6 C
# I, @8 k5 D& L1 W) Z/ ~. i
SecAuditLogDirMode 0777
3 S" e* `0 L5 ?& ?( O1 Z+ U* ^SecAuditLogFileMode 0550; Q x3 @, Y( a1 d3 y
SecAuditLogStorageDir /var/log/modsecurity% M [$ r7 X2 X& ^
SecAuditLogType Concurrent
7 n! a. r- Q, S4 T( h. N3 }参考文章:9 d9 Q. A5 i8 N" y# `3 b, O
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX, `3 {! W# v+ Q- N
http://drops.wooyun.org/tips/2614 |
|