|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
8 d3 _# s& Z- }, h% v. Y1 f8 S2 |5 J' `# G, E5 }
一.准备工作
1 |1 x5 i" e8 n" e+ F; a2 `! ~! F4 W; @% p
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0: w$ S; A) G0 ~5 \" O0 W( I
* |7 G* F, u5 Y/ F& o( Q
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
& W* L. D3 O; t4 Y6 w8 L) C; Z/ g% c- e( \0 H: D. L: Q9 N
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz# i% z. ]8 N7 \
" g( H/ M: v8 O) A5 g0 QOWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
+ ?# O2 ^1 o! P- H- w! ~( g j
, B, O1 {4 i$ i, c) Y; ~5 J( z9 D依赖关系:8 M3 q0 d4 S$ Z2 [
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
0 @! U [4 w/ X N2 ^7 Y$ [- T+ q( Q, X3 [# x) p# s: s
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
* c" Y9 q8 R4 n- n/ Y; cmodsecurty依赖的包:pcre httpd-devel libxml2 apr
T4 h. F; A2 Y; h+ G2 _# r! x4 S. W
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
# z- [+ x7 N8 l. ]二.启用standalone模块并编译3 x1 F- k) R0 p' G9 H" I. G: d8 @8 H
) [: u( a# ^+ ^- E
下载modsecurity for nginx 解压,进入解压后目录执行:
! ~5 Q# V+ L L1 t
. @4 O! M4 C% G* }./autogen.sh
6 I* N, Y) Y8 A- e./configure --enable-standalone-module --disable-mlogc
9 K' S5 }9 a, T) o1 zmake
/ H/ c+ k# B2 G. T) Z三.nginx添加modsecurity模块0 e& H% S' n' k+ K
4 b, a' N, j, x7 {( ?
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:8 X. s& S) A; N# E9 c
, b& \# Z6 |& y- r% Y+ R% s: ?./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine1 p/ b% C& M, ~+ r- o7 Y
make && make install
" X7 ^- B: k$ {4 F9 Y' L6 V9 W四.添加规则
: v. ~7 y3 b. R
1 D( M9 P T; _$ I- X5 ^modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。& B! Q% w! W2 m* V5 U6 M
0 @; p& R, Q# X8 p
1.下载OWASP规则:& A# q" ?. H( K! k" t0 d: x, G
* Z2 T: z f4 d) H4 ~" P1 D+ zgit clone https://github.com/SpiderLabs/owasp-modsecurity-crs
; j! T" w1 }$ w+ h+ i. V p
+ Z& d% o% H( c+ Q% x5 e9 `, fmv owasp-modsecurity-crs /opt/tengine/conf/
: X; s5 Z* W! c; x, j$ b9 V# Z& h
$ B; H* Y, p$ M+ z0 a4 e* o: `cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
% M0 u9 M: a6 [# F$ b2.启用OWASP规则:
( t+ a& ^4 @$ n- O! {+ U$ l' g! z6 I
% u+ }3 y) D( {" \, [7 R' x复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。- q3 z% T, Y% S$ l! ?" d1 A
7 ~# [' s' Z& x9 ~编辑modsecurity.conf 文件,将SecRuleEngine设置为 on* F- G9 y B! `: f7 \, A
" K# n! e- N; n& \. G
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
e- L% m9 G& h% l7 L! A, o* |8 p: m6 H
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf7 K& L" n) O- L$ }' _
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
: V/ \7 j$ ~% g# @Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf0 A! g8 H* K: K* E. v. ]
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
2 Y, @: F" x0 Z: LInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf" n! _8 D4 }# i( c( K% u
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
( O# v. k2 X1 w: _+ |0 o: Z' e) g+ x1 hInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
1 n) @$ f( p: `7 j ^, {, B5 i! h五.配置nginx i( D- K z' ]
+ }0 O! K* ]7 Q( ]# C, i1 R
在需要启用modsecurity的主机的location下面加入下面两行即可:
. U" \5 @. O% n3 I( F8 O$ ^' d( N6 [: n* B3 A2 `4 @* p
ModSecurityEnabled on;
* X" E+ V+ B. ^: M% I3 QModSecurityConfig modsecurity.conf;) g4 j1 P$ u% A4 E1 D7 B
下面是两个示例配置,php虚拟主机:9 ? A: {3 L0 n: \9 N
! D+ b) y: p [) B ]- _; l5 z
server {. H# H4 u& n+ R
listen 80;
H7 l- v7 V/ \ B server_name 52os.net www.52os.net;* m: @4 D# @) \$ s n+ ^; F
- ?" e8 }! |* d5 G% m. L5 M8 b4 c location ~ \.php$ {) o/ \ R+ j- B7 ` S
ModSecurityEnabled on; 4 [+ h# n3 h% J: F5 q+ r6 b
ModSecurityConfig modsecurity.conf;6 d$ K1 K% r0 a3 y
, X' k' Q$ k/ s% g( d9 e root /web/wordpress;
t7 L$ L2 ^+ x4 T, q/ X8 } index index.php index.html index.htm;+ l" D$ |2 Z2 w8 r/ i
2 P: E) B# b9 r# I( H9 v fastcgi_pass 127.0.0.1:9000;$ h1 e1 f g8 @
fastcgi_index index.php;8 L$ W" X+ k! L) x2 D
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
# O# i) S. ]& g) Q% D$ Z _ include fastcgi_params;
7 `; ? t* Y- W1 @+ D( ?1 X }( s! E# G0 W2 b" t& X- u0 d
}
2 ~9 F, ]! A$ l0 p% w' qupstream负载均衡:
/ z3 f* i0 y/ X' V9 p! G! l# X F/ B" S
upstream 52os.net {
: b0 C5 v$ n4 m: t* t6 E server 192.168.1.100:8080;4 }% x1 B+ P i3 k: [. L/ a
server 192.168.1.101:8080 backup;# I8 L; U; \1 p, ]3 [
}
8 f7 g5 B1 R) A' n% V! Y& K" e1 `6 p& g6 K) K& g$ X8 i
server {, z: e: [# @0 Z$ u
listen 80;, s5 q3 w2 u$ U
server_name 52os.net www.52os.net;
) y/ b+ K! {0 g/ I* A- |
1 C0 A# K5 R2 elocation / {
/ l4 h e6 k! K; s& a: ^9 }6 t ModSecurityEnabled on; 5 N# l+ W2 Y' Q6 w u" q0 ^
ModSecurityConfig modsecurity.conf;
9 L% j) M+ C$ l$ _9 q. d2 D! W$ e6 F) K% y% U
proxy_pass http://online;
" T1 B9 ~' }8 M6 R proxy_redirect off;
& q9 j- ~, G5 ? proxy_set_header Host $host;. {+ R/ I2 q! G ^5 I
proxy_set_header X-Real-IP $remote_addr;
1 r. f- p+ F5 ?/ y+ B8 v proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
" I7 C- A6 G) D; m }5 G% f) ?% X8 G- y3 F
}# t& \. o2 m$ _. v; N
六.测试6 @% t1 q( _' a o7 J+ H; @/ h
/ I: l2 ~1 ^9 e( n3 b' b9 X. K- a
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:& O7 {( P- G# n, E
7 @8 n, P4 v$ `, Y* j! V<?php
4 ~. B5 P: D* L; _0 z5 i1 p' [ phpinfo(); ( ]8 Z9 I7 v f0 C, U, I: Q5 h! `
?>
' }$ V1 e! V6 y0 I在浏览器中访问:4 g" G s' }5 z! n* B; W9 Q2 c
# u% n) |8 f% g3 s. C9 N5 u
http://www.52os.net/phpinfo.php?id=1 正常显示。0 X8 E/ `; _+ [: H3 ], G
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。$ f9 B+ C9 D( U/ ^; P6 h
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。' j' d' F7 e0 D' K9 j9 N
说明sql注入和xss已经被过滤了7 B5 [" j/ c% Y
; V. T6 O0 e2 D$ X3 h5 M6 G9 \# X
七、安装过程中排错1 A/ N% c2 F8 l W7 [# k
6 ^( b( h- L# m* G
1.缺少APXS会报错, w5 L k: ?: F# @1 r( I# q1 O5 C1 ]( Z
# u1 ?& {3 l- {
configure: looking for Apache module support via DSO through APXS
2 ~/ P% T( K! Y7 L, P% hconfigure: error: couldn't find APXS/ ?- u) s! C! L5 b
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。
, i A4 g0 V) s4 i( b6 T4 ]解决方法:( G! i3 e) v3 k( P7 b
6 v: J" Z& p* \" r; T/ m9 B7 J, `
yum install httpd-devel5 m" l0 s& ]5 t: p: V o
2.没有pcre
. m* P, V6 J9 R* s; I+ E7 F' x) o/ b" q
configure: *** pcre library not found.
+ c' T- }4 a/ g8 l' Fconfigure: error: pcre library is required
* c% P% [4 @0 `% S$ \解决方法:7 ^$ ^/ w7 {) v
( I/ Y8 }+ n0 A- A' |+ s7 ]% ?yum install pcre pcre-devel
7 W( x: b6 V( r; _9 g3.没有libxml2' J5 g3 z0 q9 f# G: `6 B
0 {- ?0 H/ e8 c; [0 q6 x4 [/ _/ L5 v& `
configure: *** xml library not found.! a+ D# r4 ^1 h/ Z. M! s0 X
configure: error: libxml2 is required
! T, Z( _4 c3 N- n6 y解决方法:
6 o; |" W# V! v+ |3 X- P0 u9 o1 a8 A0 q" I
yum install libxml2 libxml2-devel7 G( p- f2 D$ Y! x/ h5 Q' L) u
4.执行 /opt/tengine/sbin/nginx -m 时有警告
2 |+ K% |, T8 p2 Y" o8 ~4 V0 r) D0 c4 |2 z' R
Tengine version: Tengine/2.1.0 (nginx/1.6.2) S0 \$ z O* |5 Y
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
, l8 Q. o5 Y5 M0 S2 B0 j原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
; ]8 ~& g$ S7 X# B% V8 S" a6 a
6 z+ b( Q9 M" d% `- R+ o2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
Y% z5 O7 ?( p- H9 s% |2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
. z1 t8 t: A5 A( z9 p, }2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
3 {6 z. G2 f- J" F, C' ?: v2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
B; w+ |. T$ A# c2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"9 i; r$ Z3 E$ Z0 }: Y
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On., Q$ V" O0 D7 I1 R
解决方法,移除低版本的APR (1.3.9)
1 k1 l" Y* a" W" E# K9 z a7 D* N3 A& v" e% k# M2 T
yum remove apr
2 a& q" R# w& G6 ^% f- \' ?1 r5.Error.log中有: Audit log: Failed to lock global mutex3 |- q$ n9 }5 T$ N: f. L* ?, o
' Q4 g- [9 V. E) B9 E6 k
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
4 o! Z0 T2 J0 [0 R$ T; Eglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]4 f7 n f6 s5 x9 ^
解决方法:
1 {& y j# R: o' ], O& i- [: Z; _编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
( s; r) D8 S* B, ?* q& u& U5 i6 }+ Q& L
SecAuditLogDirMode 0777
9 ]* {: t( l' v6 Y% pSecAuditLogFileMode 0550
$ }( f# ]) j) B! mSecAuditLogStorageDir /var/log/modsecurity
, i8 {- t4 G9 ~SecAuditLogType Concurrent6 O u4 C2 X# p5 _7 G% W. H
参考文章:/ X& D* j& N9 ~$ G; @: ~* S
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
0 g: n3 q9 _# k) h' G' k$ Bhttp://drops.wooyun.org/tips/2614 |
|