|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。$ Q3 I( n" E4 D# _! T0 ?+ m
/ U1 g' i( G& M0 Q6 _7 D X: n一.准备工作5 i% |$ H/ i( q f3 r6 A
+ J4 R8 ~: E8 r, p系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0' N' E& G# Y1 _
8 A5 R. ], \0 q/ m( }( f0 Ttengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
8 k# e$ S. U4 D3 R9 k/ p5 h
2 {% d: z9 N. v& f) mmodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
/ b' n2 p4 {: u6 F
/ }5 K* e& {4 h/ v. \OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs
& H4 `: s" G" w1 O/ ?1 ]
4 _' D$ t$ J( d2 M1 X依赖关系:
( ~2 @# U. J$ G: K! R1 z! {tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:- M! d$ x9 d& u/ j2 o# Y* D
9 C; e) I; c7 {
yum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
6 ^$ g' l2 }5 O) } G# emodsecurty依赖的包:pcre httpd-devel libxml2 apr! _$ M2 ?' d+ b7 T% H
1 y. G# @3 O( u" j8 D
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
! A4 Y) U& S1 s- [' H9 G* e( f( b二.启用standalone模块并编译2 C; m6 I$ D" \6 l- H
6 _2 e* ?5 k- T6 W! n下载modsecurity for nginx 解压,进入解压后目录执行:) ?! x& g* z7 _% a' p
& S- B% |! y7 @, Z S. E) e/ O./autogen.sh1 m/ b( i3 w; B% m5 E$ \1 M) V( U
./configure --enable-standalone-module --disable-mlogc1 g* }7 ]7 t* W- y8 z, i: x! B" _$ L8 V
make * |$ m9 `: N5 L ^+ @
三.nginx添加modsecurity模块
# K; W! v u$ E2 x1 g' z7 J3 a- V) l! r0 R3 ?( p& l: I/ n8 g, W
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
9 a* {$ W. o1 Q O/ }& L
7 ~6 [8 q0 a/ i- Q1 o% _3 u./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
& E5 ?2 O0 z) l; g7 ~- u) K' f9 }make && make install/ A. y. Z: V% w6 R* w
四.添加规则
2 y; R/ w; a: W! w8 k
5 |1 v# ]9 `4 h5 j2 n6 fmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
6 Y @- D0 a$ \: ?; U
/ p+ f4 c0 m9 `1.下载OWASP规则:2 Q) }" M7 O: U
) p3 P* |3 R$ W* F/ q" i, k: y+ p& r8 z. |
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
! H2 t# ?' B0 ^. C T' E4 Q* @/ O; b! {
mv owasp-modsecurity-crs /opt/tengine/conf/
+ [4 ?$ q3 `4 h7 s3 q# F f( c- G* [4 J- t P* k4 s1 B2 O! u$ h. ^
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
, H: t/ a) U9 l' n9 ~2.启用OWASP规则:% P( N% U5 ?! k
" ]. \# |2 Z8 z: r& j* r/ o* T ?& m复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。! |8 p" {' [, c9 n
( W+ M: R9 p c' @- ~, ^& C( ^6 X( o
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
, {5 o! z0 E+ U0 H6 }0 a2 F6 T' H$ P. S9 }- n% C$ r9 v8 y$ }& n+ s Q
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。$ T4 W: a. {6 V S# j* q. o# u# {
8 ~' Q+ `4 I7 [/ ]Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
! a E5 Y5 I8 A4 \9 a8 |0 Z9 V; hInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
* [4 e+ Q3 ]8 P; D% L% ?& ^7 lInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf+ Z) a% I2 O2 |, l- ^) v. {, u8 \2 v
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf* k2 c" o; A, _( r/ B
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf& s4 w4 `3 Z4 [2 {4 O4 T$ W3 u/ C
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf6 l# H" v4 _6 L+ D( @
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
$ h8 |$ x& g# ?* r五.配置nginx9 O4 @: ?& @% D! `* o+ [
+ ~: {% ]9 q6 @; I* h
在需要启用modsecurity的主机的location下面加入下面两行即可:
! \0 u8 p, s& E6 q7 M$ w, p! p
& O2 P" v) U+ p- `ModSecurityEnabled on; 3 x% L- `2 G! `% f) @6 k- e
ModSecurityConfig modsecurity.conf;
/ g! P( D+ ?) J4 S' N下面是两个示例配置,php虚拟主机:
8 M# S; q: D$ ?+ K! M9 Z5 ]/ u( p- D' W9 i3 F6 j9 f2 y
server {
. i0 A* U- t0 e. B listen 80;
2 j8 u3 [6 D% M2 F) y4 } server_name 52os.net www.52os.net;
+ q* h" j, ^6 X, P: J) _' R
+ e A* b3 ~# U location ~ \.php$ {
' ~+ H6 e$ @4 K N+ I: X" `+ b9 d ModSecurityEnabled on; & _0 l1 I# F- Z1 r9 s x r z' O
ModSecurityConfig modsecurity.conf;
4 m/ ]. o0 u* x: }* A1 P# P8 ]: z) z. m! ` M
root /web/wordpress;' W) j+ B6 C* w4 R. q, G
index index.php index.html index.htm;
, O d1 ~- f6 d1 ^4 E! Q n / M P" @! ?$ z- ~
fastcgi_pass 127.0.0.1:9000;
4 e$ Z) U4 Y. ^$ d% k; l: h0 e fastcgi_index index.php;5 s5 X! U6 j9 E |$ x
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name; v! z5 b$ R/ Q" w ?! ~
include fastcgi_params;
4 F4 d& O4 y {3 e) y2 b }1 P4 ]8 d0 q0 N6 c- B; c
}3 S' j- M! t4 l$ H* n* J
upstream负载均衡:
5 d3 Y+ A+ H k1 s& g) r% }0 v' G" D& `
upstream 52os.net {$ ^. Q+ G y8 F/ [0 M0 ]
server 192.168.1.100:8080;+ B8 V3 ~. P, ?9 V9 x
server 192.168.1.101:8080 backup;) ~* P* K) b. O+ a9 w6 u
}
% N. D7 c* c* x( U- I1 S9 A& x* X9 r* x5 b6 O
server {
. x. B# h+ q& p W+ z) Zlisten 80;1 p, y) K# R: s, n& n
server_name 52os.net www.52os.net;9 `7 R- Q2 v( N7 O' |* Y% s: c$ }
- ^, w( ?- r& N8 Dlocation / {0 P; [. F" k3 ^$ c& p: E. \
ModSecurityEnabled on; + L( O* k0 t4 n, B9 l
ModSecurityConfig modsecurity.conf;
% p [5 d" Y# T7 k3 z. Y, k2 R5 H( n8 N
proxy_pass http://online;& n3 M/ ~$ Q: z) [; y, O7 E! R3 N
proxy_redirect off;- E) H5 N+ S% O% q {8 i2 B7 @
proxy_set_header Host $host;1 k4 T; f: q& O
proxy_set_header X-Real-IP $remote_addr;
" \* t+ c; G% O/ [3 `# C: c% H proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
$ W9 G9 `, X& C7 \+ T9 \% t# f }
( J' v1 D! S W8 ~8 Z}
C5 a" F6 X& M. G9 M+ t六.测试
8 v: r: c& i2 c0 O D8 T! u! _& C* M
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
- U" q W( x1 ]5 b
- X- Y- J' r& T9 \<?php
* c# d$ c6 ?) F( } phpinfo();
1 J, W& A! P. l5 a$ a3 R6 D2 O2 l8 s?>
7 `& M9 t$ G& ~0 Y, Z' w在浏览器中访问:( a3 @/ s4 E2 O* t, `& U* }
4 Z/ B7 _# ?! D. |& Ihttp://www.52os.net/phpinfo.php?id=1 正常显示。, S( M* Q) x4 j7 U$ {7 D' A+ n
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
* N! Q t% U5 }8 }2 }2 Yhttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
0 Q" E( g. ^/ w- @. h说明sql注入和xss已经被过滤了3 d# X3 X! l; P1 u9 ^- N; L
' k- O: R1 F6 T4 q七、安装过程中排错# O9 C" }- u6 B# l' {: o; H- ~# i
! n' }. _4 i3 C% j' v1.缺少APXS会报错: @/ b' s! C- W9 l
: V; i9 U* o" D) c: rconfigure: looking for Apache module support via DSO through APXS
# k0 \+ \$ Y* f, B4 E' @; B6 ~configure: error: couldn't find APXS( h+ t; d5 t$ K/ G4 b
apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。3 z: x1 f1 A0 y7 g. M7 c
解决方法:
0 G0 n2 H: C, T9 t. B' h) [
; x2 w3 ~% Y6 `) E2 _yum install httpd-devel
9 t4 A! f% K4 n3 }9 f1 f2.没有pcre8 w; j" g! n0 C n: n
( e& I: W/ K( L5 i }0 n
configure: *** pcre library not found.0 s& @! |2 ^% T' t! V' i
configure: error: pcre library is required" ^7 F7 Q0 n- d% Y, I0 q3 I. F; @1 p) R& R
解决方法:' z O4 I" O) o# S2 J3 h- A
' ~7 \) ~% I) ~: n T. `
yum install pcre pcre-devel
4 v% s, C# ~( h1 B. h. C+ T) D( L3.没有libxml2# _3 F8 [1 m1 z. b1 _4 y
# G! ]5 e* E* x
4 m) | r% M8 r. ~( pconfigure: *** xml library not found.; \3 j7 d& F B7 z; o! z8 Z, v
configure: error: libxml2 is required) Z( ?* u7 g" B# @
解决方法:2 x1 W0 `9 u- y, W% E) Z
3 p4 e9 s6 p. X' R$ a
yum install libxml2 libxml2-devel
3 n, g: q* s$ B8 V F' q, [5 s% x4.执行 /opt/tengine/sbin/nginx -m 时有警告
6 D' f" g' z( | w2 X* d3 f
( b9 B6 _4 Q/ b8 W) O& l3 [Tengine version: Tengine/2.1.0 (nginx/1.6.2)
^. B) I7 U/ \/ M. }: E: a knginx: [warn] ModSecurity: Loaded APR do not match with compiled!
4 ?- H( E. L& B6 v原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
; _3 J7 l3 J3 Z- Q3 b
3 y, ~* w. c# w* i2 f; N2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured." s9 t) N- o; b7 `
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"5 e3 n& b; n ~% B. ]" ]
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
* m6 z% \" b; H- f, k+ k# o Q8 q2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
" O0 i, ` i3 s5 x+ h% ?2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6") a9 f- ]* `5 i% Q: ]
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.9 P/ |8 _) N& X7 D' d# p
解决方法,移除低版本的APR (1.3.9)* @' c3 T. ?2 l3 k( l9 I
6 ~" f: K' Y2 \5 D
yum remove apr
! j4 r, U) s% |0 U: E/ f/ }5.Error.log中有: Audit log: Failed to lock global mutex$ v/ W* G H& L* `
: X( b/ i1 D4 ^4 C; q, k( E; m2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock
, m2 L- A+ S3 c9 D* Jglobal mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]2 ^' Q J- b" a7 t
解决方法:
1 e! k7 u+ B, _4 h5 c编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:% K' ?3 D. e2 H1 j( c) Z
0 y# D4 }- E7 K* ^, {6 [' Q$ G+ \6 bSecAuditLogDirMode 0777) R" z7 B5 G6 j/ s
SecAuditLogFileMode 0550: _. T8 e9 j8 p2 u5 @. B
SecAuditLogStorageDir /var/log/modsecurity
, q) ~) C7 N+ u" Z+ }7 XSecAuditLogType Concurrent
& ^! k. [! t, w参考文章:
0 ], J3 }, R6 X0 H' v+ v: ~https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
( ]: e2 u* m) V2 _5 ^0 q7 A- B8 ghttp://drops.wooyun.org/tips/2614 |
|