|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
( e8 [$ O. U+ N2 o
. \& D5 F4 Z8 ]1 C$ M/ X \+ M( n一.准备工作
( ?. N3 ?7 o7 X4 R
* v2 u7 P% N& b2 v8 v/ f l系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0$ [" I u, T- D) O2 ]
4 P% x8 e& O7 r- B+ I. }
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
% A/ f) A& c6 R( J. {1 B, s, P8 s! j; m
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz! _% i! Y; n7 V8 y/ b
) C0 N9 C, [* E- D a: [ NOWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
' z$ n; M+ \* f8 C9 R3 h7 g C; T8 U0 x; ~( \0 W
依赖关系:+ U0 J& E) q- |
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
H# v0 S5 ^& F+ M1 Y; {+ ^
0 r3 U6 H( J) P& r$ `7 Yyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel+ o: f% |) \) m2 L$ R! {
modsecurty依赖的包:pcre httpd-devel libxml2 apr& F+ c6 j. { h0 z2 g5 {* n
1 m# L: u- G$ l8 ]' P
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel/ j! \* c7 e$ g2 M) [' K- t& P. X; k
二.启用standalone模块并编译
" G! J+ R2 X) }4 ^
z I. t2 \& V7 A下载modsecurity for nginx 解压,进入解压后目录执行:* z' R2 ~) t8 F) t
1 [8 \: j7 [: y" N) a/ \1 o6 K$ M
./autogen.sh
- t( e, _/ P0 l./configure --enable-standalone-module --disable-mlogc; f$ B+ f: V- Z. ]
make ; p3 `' n. t3 a' _
三.nginx添加modsecurity模块
- S6 {* v0 a6 ~1 t9 f
, ~- u4 o2 `5 d, F/ f: [在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
" V! C0 c0 }1 Y7 s7 L/ @2 ? L
$ Q* B( d/ F2 m% [./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine' Y* G- J6 {7 |. O" @- t; w8 v
make && make install+ j, X p; S4 J8 F; D- U
四.添加规则
! Z. ?2 D$ O* E
: u# i; u, E; _modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
" F* [+ t7 C3 C3 n! t2 B
. u0 t0 _' P6 X* R) ^% Y* I1.下载OWASP规则:
+ b1 Q. Y0 V/ `* f r! ~1 Z
r( n# t! f$ L* x% A% {' A4 _0 @git clone https://github.com/SpiderLabs/owasp-modsecurity-crs$ C3 V6 O* {! ]" W* v( w' U
6 F, a# o! a5 [6 f& |% s
mv owasp-modsecurity-crs /opt/tengine/conf/& [9 O7 }4 X2 Z' N3 P& e0 c9 g
2 E) T! `! a, R) |$ k% L
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
5 \7 o+ U( j7 V+ M7 |3 R `" D2.启用OWASP规则:
: U5 G. E5 C9 H" n w7 o% {
# w% `; I7 O: o复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。) g9 b& U. Y& P1 f! Q; Z1 Y
6 j5 ~3 e, q2 c' J& E, ]3 A G编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
7 O1 L. o* r! Y. j/ f
9 L6 e) n% H- q1 K/ }; z ^owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。4 h: X9 w( l+ Q# d. Y0 B( {
2 s# Z1 |) G5 Y; }, K* @% [
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
. R) t9 _! u' J3 h9 O! | ]Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf4 \( w1 j; D' ~2 Z& l- U9 G
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf, F I! h, k# k5 }
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf8 N9 T% e8 l7 D P1 Y+ U
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf, y9 I* W5 `* Z: U
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
" D* G3 J* q" c @+ WInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf3 m" C; C' ]$ v
五.配置nginx5 Q, T' Z( B8 d, Z+ [6 o
0 x/ {# a( {: a3 y6 _( C
在需要启用modsecurity的主机的location下面加入下面两行即可:
# j' L; ?% D$ ^; h& r$ X) H! D* Q; a
ModSecurityEnabled on; * k' X$ ~; r) s( p {$ o
ModSecurityConfig modsecurity.conf;
* e: C* c G; l- G9 R; A2 H- v下面是两个示例配置,php虚拟主机:
! S. R' k& d( D. m, u4 \ E2 d$ z; J/ E- S
server {
: X8 U$ {) O# k; F( Q( j: G listen 80;
& ?! T7 y% e$ \. Y' d server_name 52os.net www.52os.net;
/ g* `; H4 S P% g2 T* [% i ) l7 B/ r" b2 m; d0 h
location ~ \.php$ {
3 F6 d4 ^+ R4 {# X ModSecurityEnabled on; 1 a }* f* E( r7 p" \
ModSecurityConfig modsecurity.conf;& e4 ~, B2 A, _1 w, R8 F) u
% ~5 H7 | { f9 O! r
root /web/wordpress; u$ {4 T9 ]" _! p0 ?9 |+ y
index index.php index.html index.htm;
" N1 S0 u+ S2 U* \" e
" i3 k% g. a8 ], v4 b fastcgi_pass 127.0.0.1:9000;7 Y1 T2 l+ m; M: K3 x$ h3 M
fastcgi_index index.php;
/ \& _. {, E& K9 b fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
/ f+ ?' ~) d* c+ `% V include fastcgi_params;
2 W2 a+ m$ q5 D) l& V }
8 I+ d% J* {/ s' l, m1 X }! \% p" A1 j: M5 | ]' H$ I5 \
upstream负载均衡:
/ p6 d7 I7 W3 C: q7 M/ Z% v
$ t3 @. y* [9 u+ I8 d( vupstream 52os.net {* P! Q! G) v! y6 r
server 192.168.1.100:8080;% E+ b1 I* k: b1 \" c$ R# s
server 192.168.1.101:8080 backup;& J1 H$ v9 s. E6 J" N
}
/ W/ h2 X( [$ X% ]2 |' ?4 d5 M* ^3 O
server {% G0 ] `8 [& b
listen 80;" P8 i8 X9 `4 r# t
server_name 52os.net www.52os.net;
0 H a/ q$ r0 w$ y' y0 c
, Y7 ]- p8 r6 ]location / {1 i( U! j! K: b% k5 j. L: q6 n
ModSecurityEnabled on;
k( t5 n" G2 ^! z" k+ U& d/ f& ~6 _2 o9 [ ModSecurityConfig modsecurity.conf; ! S" T; w L. d: O+ `
" g! H7 j9 X, C |1 v; l3 w* C proxy_pass http://online;9 v' C. ~2 O) x3 z8 m* m
proxy_redirect off;* `0 x3 u d) Z2 K( x' H4 H/ U# M
proxy_set_header Host $host;4 H B- T0 K* R: y8 l; ]3 b" o/ H
proxy_set_header X-Real-IP $remote_addr;. @+ D; n% J( @+ [/ G5 v
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- g M1 |$ |: T1 W5 q& K2 F6 s }
8 y$ t% d7 U0 @* U" O9 x- }}7 b4 f/ ?" @* B: J
六.测试
/ V A$ a; e% L' W" x( f# \. l* l" E4 |
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:( Z' ?6 ]( Q! z9 @
8 U( c0 ]1 l8 L0 _" s
<?php
5 E& N( ]* C+ T8 O phpinfo();
1 f" d3 |* P0 X; O+ Z. t2 o% o?>$ h; z3 [0 ~; \% O6 H8 O J3 R
在浏览器中访问:
6 Z% L( o& B* E+ I1 `, N+ q! u; e/ `
http://www.52os.net/phpinfo.php?id=1 正常显示。+ ]0 v9 K9 ^" h f K1 l2 ^5 C
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
" a' N0 [+ M: `9 w9 Jhttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。9 q6 g- k6 U; R8 k2 S ] v" K
说明sql注入和xss已经被过滤了" l2 j) k( C& o( c' m
0 o1 P4 W$ B( \7 k6 |
七、安装过程中排错* S3 [: Z7 Y- _
8 q8 A0 ?! v# f' u1.缺少APXS会报错
6 B6 ?: }* `8 M; ?# J) r8 `" h+ C1 z9 D; y J& ^
configure: looking for Apache module support via DSO through APXS8 A p; [/ c6 ~) @
configure: error: couldn't find APXS# t5 m5 F$ C' R1 M% D! ]! \% D
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。
+ a' t' p5 t$ P解决方法:6 X! J' A: N* ~
8 q) W; q$ l. D5 G5 Y+ r; Gyum install httpd-devel* Q" `4 ?3 ]4 P$ y) \; T0 B5 }$ G( w: P
2.没有pcre5 y1 Q$ J: G3 u* j# ` d) E: n: c
' ?+ m' \ v$ I( d# n3 P5 { ?0 pconfigure: *** pcre library not found.
+ B5 E5 m* @- D4 n/ Pconfigure: error: pcre library is required% Z1 \# L8 U9 n$ }8 n2 \7 L* L
解决方法:6 Y8 O: m; D7 ~. u1 v# W" j; N8 E2 Y
. l; ? d. c; L, N8 H/ e. N% w
yum install pcre pcre-devel- a3 V t% `$ s. |2 g' P
3.没有libxml25 E1 J( {! z8 p& K- G& a
3 B' c0 Z4 r1 [# I2 U1 y. _
& B' A- K3 M& B- N1 [$ H6 [9 u# Q
configure: *** xml library not found./ {# g! w) [! c6 B
configure: error: libxml2 is required$ H F; l8 u0 l" _1 N' E2 a
解决方法:
+ \1 P5 y, ]* ^1 |3 Y3 m0 E+ A; t8 M0 C# j7 x, [7 y6 W/ d; p
yum install libxml2 libxml2-devel0 @: e# K8 A! a* A# }
4.执行 /opt/tengine/sbin/nginx -m 时有警告: x6 C8 d9 \+ Q* j) y1 \
) S6 q7 C9 P, w( c6 }: z
Tengine version: Tengine/2.1.0 (nginx/1.6.2); S* a! t7 @/ C- e6 p n
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
5 u& z B$ D2 R) ]- n Z, T7 f原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log8 I5 V* v# L% b# u
9 [* S" r8 @4 F0 V. k0 I( z9 B. {5 M2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
2 s- }; u& q- l/ n2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
* c8 j3 S( V/ o% ]2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!3 j8 q% G( T2 ^7 A& ~3 J" V
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"3 a# z9 B9 t) g+ [( T$ {
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"6 X0 w9 Q3 Y3 z, A2 ?7 g8 Q4 d
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.4 e" `/ f) G- U6 M
解决方法,移除低版本的APR (1.3.9)6 u' h. ^1 f; F9 Z2 j
' J( I! F; }* B3 J
yum remove apr8 ?& A1 y2 O9 e: j, h) p( `+ w$ x4 |
5.Error.log中有: Audit log: Failed to lock global mutex$ {% l7 i7 b3 O' M" G
7 M, x! ]6 a" d2 `; H- b2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock * C1 e. X3 s h6 V& l7 W- Z8 I
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
' w' d- f; `6 x/ F! L+ W7 m r解决方法:
6 d# ^/ G L& d3 \% S编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
, d% v; Z# [3 V! H0 C9 ]8 S& Z7 d# r7 B/ T& M0 Y, W2 [1 G
SecAuditLogDirMode 0777+ D$ }' q) I% u$ ]6 a' u2 h
SecAuditLogFileMode 0550- Y( u$ B/ @# b6 `( V: ^
SecAuditLogStorageDir /var/log/modsecurity/ x1 X# T; ^ M
SecAuditLogType Concurrent( U$ L! [( W0 _' V8 Y2 n2 Y( M
参考文章:
7 a! z+ J9 I6 n, shttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX) I+ u" g& q# Y+ A5 Z% u) J/ ^' B
http://drops.wooyun.org/tips/2614 |
|