|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
1 I! I6 S6 X+ h8 }* e
8 z/ w2 r- }$ j) v. ?% ~) Z一.准备工作
' z1 a2 R: O7 U1 x
! A3 C* o) P$ V, J1 a; |) T系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
1 K- M- ?9 |3 ` V+ `5 I- o- M
* D2 m" ~) a0 D7 A) A: P/ K- Itengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
4 P1 C$ V1 a7 M7 s9 y
, c9 `( @4 J6 Pmodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz, h) j2 g2 ]7 X, ^6 [7 J
7 \; y; ~" d$ b4 Q5 \8 q
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs8 Q+ I8 J' b. Y, i8 d5 O# N% d
* [( X3 Q8 W9 I8 {: U依赖关系:
, b- J+ |+ v. ~+ n: S; _* @0 Rtengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:% e& m" r. H; G* C* ^
$ F+ C# P2 K1 d
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel" [8 D( I0 h4 f9 |3 n9 Q2 m; d/ }
modsecurty依赖的包:pcre httpd-devel libxml2 apr
' Q" m! a$ \( b( q6 Y, [5 R6 ]/ j% C( N6 E$ i
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel$ o# a) j ]' n% d5 F+ e7 n
二.启用standalone模块并编译
; N$ V/ q( s8 ?6 Z# b# C2 N" _6 d: j2 H) F7 @2 n7 H
下载modsecurity for nginx 解压,进入解压后目录执行:& H: o9 Y- T& v8 w" j: w
5 ^, w, g- r- u/ U' O: Q! f& u5 M
./autogen.sh. ^6 m% P/ }7 k' |5 V
./configure --enable-standalone-module --disable-mlogc
6 O. G" _5 I# g3 A6 k8 L0 hmake
7 Q: U/ Y1 e0 P) w5 ?* `0 J, [* Z三.nginx添加modsecurity模块
# E# |" H6 z, {0 {; _% T# l/ g6 x" Z$ x
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:! Z5 `' m+ Z" c; a6 a' {
. W. r9 U4 ` _% m' ^7 Q7 @% ]$ ^9 S2 z./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
) Y9 L9 e5 ^( mmake && make install
; d1 {4 ?8 ^7 ]6 U" \$ E+ K四.添加规则+ l8 \& i3 m4 z/ J6 s; L
$ f, r, D4 q7 R6 g8 P0 [, Xmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
& |2 j. i# Y+ L
9 c& f, Q! K+ B* K: M6 g1.下载OWASP规则:# P" r9 P3 \: n1 K6 v
) @9 R! q( n( I4 A
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
6 X8 x ]0 T$ n0 j. e* @3 ~
0 n- W3 `- z( b& {mv owasp-modsecurity-crs /opt/tengine/conf/
3 N1 N; ^- d8 J5 [
8 y( m" H; z5 R% e1 N- [/ f+ ycd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
( X/ U; K; Q* K5 z2.启用OWASP规则:
/ ]8 F5 P7 Q% W0 E( E' c8 X/ \4 |& }% A# {2 H" M2 t# T% f
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
* }9 K2 v4 [% Q& [4 v3 T3 ~: i* [# t& E2 n3 w& T- Z
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on: X9 B* @, |$ w0 C& L/ A. d
: M8 B; a/ c6 z1 }& Y0 t
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
/ t+ c, k1 \+ d7 A/ C3 A6 U( }- O7 @; @' N" ~9 }
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
w1 Z' d0 [ d( q: dInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf- }6 C5 g( d( G" M" a3 o/ o9 _
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf7 F( D4 f1 f% f! D( A- v
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf. c f7 D a/ G5 L" g
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
8 q, X( C4 I7 i( E, A2 @Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf) E. ?% k4 [ W+ ]' x
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf" u" ]8 H* ^: u# d: ]* L) W( n4 f2 M% H, K+ ]
五.配置nginx- u2 `5 ^: W) P- E% R2 S) E. s( e
9 b \! [% v1 R$ h, v: R, b! g# w0 Z
在需要启用modsecurity的主机的location下面加入下面两行即可:' G/ r/ v) ]4 h7 u- |& z1 Y
: i. a2 F& k: ~% k7 v1 i0 @' E
ModSecurityEnabled on;
* l7 h% N( f) Z' ^2 B8 U! `ModSecurityConfig modsecurity.conf;( f7 @ f* W" Q( u; Z) t; T$ O
下面是两个示例配置,php虚拟主机: ]0 m' E* B" o7 V# C2 o
, b' ^* {( s" t3 `' f/ m' qserver {
) m/ D, Y0 N1 E% O3 \* y& U listen 80;" N( T Z$ _% \3 C( Z6 @
server_name 52os.net www.52os.net;) A7 E# n& r4 a$ u9 p7 q
: B$ b% F) n$ @& q& I# W location ~ \.php$ {
* a2 t. v; u% Z! X3 f6 M$ [1 U% h ModSecurityEnabled on;
; K2 [3 \0 A1 h5 X' C2 [ ModSecurityConfig modsecurity.conf;1 N) a' C$ s- F) M: t3 v; D
. M7 T) e4 `% w% l root /web/wordpress;- p. J3 Q3 W6 y5 C( ~
index index.php index.html index.htm;
, A: w( x' ?! G ; P) | j4 o# h+ h+ y
fastcgi_pass 127.0.0.1:9000;/ x2 C3 C/ p- T& o
fastcgi_index index.php;; ~) T3 l/ e0 b/ K4 }- y
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;4 A: ?4 ~$ G2 z3 j
include fastcgi_params;% Z# f+ g7 W9 e! [
}6 i& i2 c: F$ o- H5 o3 J, p! T
}( h# z2 z/ s% E) _& n& p9 y
upstream负载均衡:3 g0 i7 A7 n" b& z: y3 U- B
3 M& I9 |9 S0 {) Y8 Rupstream 52os.net {) s& C$ ^5 D# _. K! R4 J
server 192.168.1.100:8080;, c4 p* _( n' q! E0 K
server 192.168.1.101:8080 backup;
- c% s+ T0 Q0 A" O$ c6 a8 h3 y0 n}
6 {: e6 E2 C2 }( Y' s( S+ T P. V% _" C a
server {+ |' F$ P2 D A
listen 80;
3 C+ N, U! i* z$ ]! i6 {server_name 52os.net www.52os.net;
( F" Y- c6 f: \7 D2 E1 j
0 B( \" n, `5 E. _$ jlocation / {3 h9 ?+ f8 w4 F! f% g
ModSecurityEnabled on; 8 ` R! U- ?) T( ?1 F" g4 b5 r
ModSecurityConfig modsecurity.conf;
9 j( U9 ?: [0 i6 y9 r3 B2 k6 p
8 X2 W/ k r! N* n: h; K5 s4 s proxy_pass http://online; }* R) |" e. [5 t
proxy_redirect off;
' k% }3 ^- Z) P: s# o# K2 ~ proxy_set_header Host $host;
0 x, ~$ I, V; O' O- {9 M1 n( M0 @" O proxy_set_header X-Real-IP $remote_addr;
3 w+ p* Q( s( D) `& i proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;; W% L7 m' d+ K3 J- J4 `9 |: p
}! P, ?( o7 ~& K
}
' G% z7 B: d3 d3 D1 ^) `1 q六.测试! c w N8 d* v/ n6 W
: `# O' F" k. L8 K; g% k
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
$ ?* `8 E$ M% h' k+ z
. \. u/ \8 L* }$ r* s W<?php) L, X) s8 `0 a
phpinfo(); # m7 { g( j8 ]( \
?>
0 y. q% [4 E& ?5 j, _0 W6 V, R在浏览器中访问:2 f8 Q+ d4 I$ U7 c& t5 Z2 h9 a! ?
+ n) ?0 g3 X+ G, ^5 D& J3 K' K, Y
http://www.52os.net/phpinfo.php?id=1 正常显示。
+ y" P' m2 Q1 d+ ^# ]. rhttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。; Z9 S' d1 V& P' r% b9 H: I7 i# l
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。0 s: z! \+ K) \/ e: E. y( {
说明sql注入和xss已经被过滤了
. r4 o2 u' p/ J; Y9 x: s
+ S4 d6 t/ u2 \- o; r3 ]7 g七、安装过程中排错
# z' K1 j$ y/ K, c( r# {, q' u2 [
1.缺少APXS会报错
1 G P# \9 o' o" h: F% K4 I$ R! M! R- ]( v) |# c/ Q
configure: looking for Apache module support via DSO through APXS! \9 M8 P8 @4 M4 x+ ^% J
configure: error: couldn't find APXS6 _, ^. D; U0 F7 o; g3 X
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。
0 [, y; s K& ?解决方法:
" T3 f; O( Z/ h( z! P& X
! P1 s( g6 K4 O3 \' Qyum install httpd-devel
, V( _: [7 k& @$ ^/ o: e2.没有pcre0 l6 t' h, D! N7 G! n5 |
' S/ ~* `: X% u( l( |# L% f# T
configure: *** pcre library not found.
* y# l. G4 z. o' @7 W0 Pconfigure: error: pcre library is required
+ o8 L+ o4 S$ _. a* k- {* G' U解决方法:
& f; c; r. t$ G% \5 `
! d3 ], Y* Y. M$ d' n. J0 k) [) G5 Pyum install pcre pcre-devel
: |$ a3 I0 g" _) J H# @# b/ e3.没有libxml2
+ w6 M9 V8 |- E7 T% T7 j+ v% ~- ?7 O( K2 K
; b; t5 O) a: e4 O' X" x: |% d5 Xconfigure: *** xml library not found.2 F- {0 C" v& h" z- y
configure: error: libxml2 is required0 ]1 J1 o8 h8 a7 r9 E
解决方法:7 A2 R7 X$ K6 I6 i
6 f. i# k0 `: y9 y. n/ P
yum install libxml2 libxml2-devel' P" ?( n' \/ ]6 j
4.执行 /opt/tengine/sbin/nginx -m 时有警告: o+ B x" H. k! ~7 I6 ^# `
2 n* Q2 r* i U8 Q
Tengine version: Tengine/2.1.0 (nginx/1.6.2)
4 K& S9 l& l/ N3 {- v1 cnginx: [warn] ModSecurity: Loaded APR do not match with compiled!
2 q7 T* g) |, c m5 T- S) l2 }原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
* y+ E5 ?, t6 B+ }; B* b$ L# J' o6 ~
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
7 M2 M! _' f) N3 k/ F \2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"6 u+ S9 @9 T0 F) D# F% U; I
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
" W% T* N ~2 t' t2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
- W, L0 b R0 }0 f" E3 \$ ?2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
8 \! u* Y" s& D( r1 P8 P2 G. g2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
- l! b0 ]% {* T) P" ~' ^4 s$ X解决方法,移除低版本的APR (1.3.9)
+ Z2 a- @% b. g8 d" F- m! d- h, j
yum remove apr5 o$ C- a) v7 E. P( V- \' P
5.Error.log中有: Audit log: Failed to lock global mutex
" m# W3 |/ E2 f- M+ \0 H! ~% v0 Y& c& h& s% {( [
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock 7 ?7 c6 ]5 `7 C
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]& y: J9 }' E1 F1 `! U, D
解决方法:( U' r" P3 r* J: v) Y' [5 o) B
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:& w4 P1 g& y( p. R n
, x7 P! y# x. T) [, Z
SecAuditLogDirMode 0777
7 |% M* H2 W' z, p1 N6 QSecAuditLogFileMode 0550
2 w6 U0 h# O9 `( KSecAuditLogStorageDir /var/log/modsecurity0 }8 t% N; Z6 J3 }* `$ N; X
SecAuditLogType Concurrent. y/ p" n7 f, B
参考文章:
. ?9 N- H! s8 \/ ?% rhttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX8 d( M, J K. H" w( C) e
http://drops.wooyun.org/tips/2614 |
|