|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。" c( u! }' Q" ~
+ _( _: O2 @- z4 ~& |- B% O一.准备工作
, w+ G" i1 l& p" j1 K9 W8 J1 v y: @
' M4 k/ ^" l5 E8 R1 \系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
0 K/ L9 I8 C+ T$ f; p; }8 R5 E1 Q, {' n8 K, R7 [$ _+ c" e6 ^ x
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
4 o7 J. m( a/ {/ R2 E
. }' _! O8 C5 ^9 `modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
( Z* n. @& A) W+ Q7 X7 L/ Y; T$ v
' d6 \1 s6 j Q2 l9 COWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
/ y/ I) U! `, B
2 }/ ~8 l4 k; K. D: g# ?依赖关系:1 |. E- q1 L1 Z
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
I) E5 g" L0 M- ^ A+ T; o& ]* F6 g* j9 g3 l2 a7 e$ ?& I* {* H
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel N9 F" C I& g. t- S( D
modsecurty依赖的包:pcre httpd-devel libxml2 apr
m2 N9 m+ E R9 h4 e: d
; O; N5 |) `$ Z* K& q; x7 Z4 byum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
$ e, n: [! Z% Y/ K4 _二.启用standalone模块并编译
+ h. y/ v5 J3 O3 D
; S' n8 Z j6 M+ B3 X, F下载modsecurity for nginx 解压,进入解压后目录执行:
8 f7 M% f* i+ F9 H3 P0 J! {: M m& x, E* P9 R) r
./autogen.sh
& O( Q: q1 F8 r1 r./configure --enable-standalone-module --disable-mlogc
5 V3 }. s" S- r' @make ! N1 k3 ^7 `6 r9 r% ^: `/ G
三.nginx添加modsecurity模块* q; [, H- ~1 e/ u4 c3 {* e
$ ^7 ~0 X- h; L5 _, ]9 C7 J在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
1 Q5 j% I, Z. X4 T% `" I/ J, u e) j/ T+ p! Z( U* ^
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
( T& c& c2 G; S+ j8 Dmake && make install
% v$ L( l+ b# o* X四.添加规则
3 q4 C3 p" w& J+ Q% N( v# t" d
' g: Z$ R y4 Y9 o: Cmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。9 Q8 a) D( o0 E F* Q
0 I, S5 P4 y+ s8 Q1.下载OWASP规则:- t o! Q6 Z& e* k6 g; r
& f% |( f7 N- T& K3 K( egit clone https://github.com/SpiderLabs/owasp-modsecurity-crs- G) i- u9 ]- g0 E% @! C' K' P% v) \0 x" B
) j9 |4 R+ |3 @ W8 s$ Mmv owasp-modsecurity-crs /opt/tengine/conf/
; N) J; X/ x9 C, E0 ^
7 x/ D+ i: ^/ K0 ?5 Mcd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
% }* `6 q9 a" m% X! d* }* R2.启用OWASP规则:
7 q( _( V. w; y3 l; L/ v; C. Z8 A# V" K* ^& z, {
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
0 o# t" {, w9 p3 }& I
* h1 \* G' Y; X% j, W编辑modsecurity.conf 文件,将SecRuleEngine设置为 on0 ^6 y; [* Y, ]3 N0 @& ]
' j ^" e8 u& W
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。0 Y! [' t [# t) g% N( F2 V
1 N& h# U/ R. ^. {8 Z' DInclude owasp-modsecurity-crs/modsecurity_crs_10_setup.conf8 v: e9 k q, A& n) ]
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf* A9 p; f i' y! W. H
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf4 N; p( g( i9 [
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf3 x9 `( o* N" l+ p/ ^ Q
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf4 \7 U0 G- B9 |/ m y4 c1 N; h
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf) \% T, e, l1 ~) i
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf: i+ J" |9 [5 O6 H
五.配置nginx
4 r) f( C! O( p8 d! P9 b- Y; E O! I; ]; @$ z, P- J+ ^
在需要启用modsecurity的主机的location下面加入下面两行即可:
3 T. l7 |8 y' u* J" |. Q+ b2 ^" z9 l2 }0 P
ModSecurityEnabled on;
; e! h# {0 i) C' B8 eModSecurityConfig modsecurity.conf;
, o3 w* L5 ~/ a/ X- H; j3 Y9 V下面是两个示例配置,php虚拟主机:
& r7 l0 J/ x: g+ o! J7 ^
, ?2 d$ ]! V. z# \* Cserver {/ A% T% y4 K% S) ?& T
listen 80;; W8 L* L9 l, r9 [& u$ O0 Y* ]
server_name 52os.net www.52os.net;" q2 K5 q8 B2 d5 b( m# B/ X3 E
X" K6 n+ ^- L' j9 v. y' F V location ~ \.php$ {2 v: M m6 Z: c) y/ s
ModSecurityEnabled on; * b* }" P8 _' ~. _+ R
ModSecurityConfig modsecurity.conf;
6 h9 t. i+ e8 u! u) j- O
) g, m2 n6 @6 ?7 {5 @/ ^ root /web/wordpress;* Z" |) Q4 k6 k/ w5 x) E/ S
index index.php index.html index.htm;
" V, A! r# B9 ~! n + n9 o" [; b* j( c& j" `
fastcgi_pass 127.0.0.1:9000;' x* _$ I7 T* f- O
fastcgi_index index.php;
" ^1 p/ H& Q: [% n fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;; p% o" c! Q3 U; H9 b( }
include fastcgi_params;
6 E& u3 `4 k( A! p, R) F }
7 Q$ D- Y9 ~3 M3 ]8 n7 h9 \6 u }
2 a9 p& t4 @ F$ r: u6 Nupstream负载均衡:
; \) o, B6 J2 N7 }, W7 G& J3 l% f6 w
upstream 52os.net {
& B; E( g2 z$ H4 J$ @% S4 `( o server 192.168.1.100:8080;2 L |* f% g$ U6 w5 @: j, U2 s
server 192.168.1.101:8080 backup;
/ c( o( M* ^% }' [' X: u}: U& I7 f( U4 i7 k' z
# D' U- g: Q- w
server {
8 C; n5 @; `% q' ]) N) Z3 Z% H+ wlisten 80;
+ T! ]0 b" w4 q( w* Xserver_name 52os.net www.52os.net;
% L6 ]9 K1 i. ~6 Y6 U! o
/ ]4 u ]8 O4 R* G& i3 w/ U+ p% @location / {8 c$ G# P4 {6 n A" U5 N8 B @4 s
ModSecurityEnabled on;
$ W0 T0 {* ~# ^ ModSecurityConfig modsecurity.conf;
* ~* j" _$ ?, s. I2 N8 I& z6 Y Z4 u+ R
proxy_pass http://online;4 x' r# P) j$ K) e. m# R
proxy_redirect off;; D1 X, e( c! o9 G g
proxy_set_header Host $host;
4 i1 E. J4 H! m1 `; h# G proxy_set_header X-Real-IP $remote_addr;
1 C- @% f! ?) z- N* v' |+ ~$ u c proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;3 ^) y P1 }/ J: x" v
}" q) h( ~3 {6 ]6 D
}' [$ E) i& {" N6 j+ e' d
六.测试
9 | m+ {' f' C3 p5 D5 m8 B) p" S' y$ C
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
# w$ y1 l6 ^# n- b- S6 `
, p$ d0 k2 @ X" u<?php
! D' y; S( F+ u! E( A phpinfo(); 0 z! y; }1 Q/ \# K; M
?>
* S; Z5 p1 ^2 O. F8 V在浏览器中访问: a6 |# n* N1 N' T9 c% Q, o
, k0 E" L- M, K3 U2 i4 x
http://www.52os.net/phpinfo.php?id=1 正常显示。5 M* P* [ d% b/ R- i! N4 e
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。" Z' J! D g$ @/ ]% B
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。+ c' w; `* ~0 L6 a
说明sql注入和xss已经被过滤了
O3 p( {7 |! ?$ T5 T6 N
@% O4 a4 P# {' I4 |七、安装过程中排错8 k( S$ g' X/ V5 x1 E8 d
! W1 \( Y# K* T
1.缺少APXS会报错4 B* Z7 y; _' X& ]3 \, H( O
- m# ^5 H$ h0 U$ j" Wconfigure: looking for Apache module support via DSO through APXS8 k" R( \$ m. U; P7 E8 a9 `$ K3 h
configure: error: couldn't find APXS, N; E/ S9 _0 F6 m- [
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。' t* M4 ?3 V( n) M7 z8 u g: W
解决方法:/ \( v' j8 X: }8 y: i% D6 U
. N8 I! w! A2 ]3 ]) V: v; Byum install httpd-devel- j& E: u3 H" s% d {5 k, I
2.没有pcre
# N6 ^: H- P9 a% V8 x' e7 T/ I X6 C
configure: *** pcre library not found.# J2 v+ D+ @' ]& Y
configure: error: pcre library is required, W7 o+ j) F; L% ]
解决方法:
* u8 e. M+ M) K. A' k& _
/ W T# ?8 p6 C D8 n( R1 [yum install pcre pcre-devel
2 G8 m. k2 Q) q; @3.没有libxml2
" u$ B$ L- a# T4 B. R0 O7 d! D' a# o5 A
! I9 x/ U9 r4 J/ I
configure: *** xml library not found.7 K8 d5 P6 H+ b. V
configure: error: libxml2 is required
0 v- K( O% `3 A1 M( Q0 p& B解决方法:
j: Q, \5 C" X* S5 A% L! u! s2 R6 s
yum install libxml2 libxml2-devel H, F! L5 ?. @; W2 N8 C5 k
4.执行 /opt/tengine/sbin/nginx -m 时有警告
Y0 E8 E% G9 x1 A; Y+ F9 o& M7 }; T/ W# q. B" h. l
Tengine version: Tengine/2.1.0 (nginx/1.6.2)7 Y; n1 }) L* {# ?/ P$ T" k
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!
' M7 M& R8 N9 a' j+ W- k: R/ S原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log5 q/ k$ Q9 Q- a: n& ?( C7 d& n
( I/ { X* O* N
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.5 X) z4 F- `3 `% n( J7 B* [3 `# P
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9" y+ ]3 ]7 ~, l K
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
# L+ O. r' \' ?( ^2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
2 v2 v5 L5 P7 p1 |# A2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
( _9 D! _9 A; Q- C+ k1 w2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
; `4 |$ T: @: F8 j: V9 B: i3 w解决方法,移除低版本的APR (1.3.9)
" ^3 H+ O: a s5 O* x: {
" `3 P# _) i. ^+ O; u Jyum remove apr, Z3 m% M y5 x# I
5.Error.log中有: Audit log: Failed to lock global mutex
8 x7 U. m( }+ e1 W+ U, c
& N- Q7 u4 G+ S( a9 P8 Q N2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock % X a6 q. `' d8 t" V2 q
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"] S$ C4 }7 P+ G: D7 `6 e7 y
解决方法:
: @, ~1 U: M6 b编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
' K) B8 I5 p! w, ~ E& Y: L* h V2 A+ F7 V7 F' d
SecAuditLogDirMode 07773 f: p$ O* s5 v2 L$ T" d' S
SecAuditLogFileMode 0550
4 H5 B6 B& |/ N1 m0 PSecAuditLogStorageDir /var/log/modsecurity
+ q0 n$ u( P3 GSecAuditLogType Concurrent+ e6 Q- k8 K# ^# ]$ N
参考文章:! b- x, I0 {8 T& S5 k/ X
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX, b& }( D3 }7 _/ ~
http://drops.wooyun.org/tips/2614 |
|