|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。* E) O4 G6 I5 Q% b
* [! U- Q2 X0 D9 y- T$ d一.准备工作
& }# v- z% J) R8 s9 Z' U6 e3 h; ?! Q3 ~1 i! ?5 B
系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0. Y2 |* \4 ^3 C% _4 t
0 G9 k- c* M0 V2 B6 Q
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz; u# w' B8 M9 X9 ]* M. U) C
7 M$ f O4 ]$ H2 r, ?0 umodsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
1 Q P/ b: p' M: N/ S. L# P: K8 W; W Q* |
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs% l6 O7 b. v" [
+ U+ ], M9 t) U" H l. C8 y3 y依赖关系:
; A3 I' p' U3 e& k/ j9 atengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:5 r0 f% p. C% h; Q, C- b5 m
& r% N3 d# Z5 Cyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
: N, \1 R2 @! W7 m# m2 pmodsecurty依赖的包:pcre httpd-devel libxml2 apr6 m- R7 ?0 X6 i9 X2 M
6 K: V# b* _4 ~yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel
* U2 v4 B* H! L& [二.启用standalone模块并编译4 n7 y1 D. ?! v4 r2 Y' E) C
- s! g" R, V2 }/ J7 w, U. e" r下载modsecurity for nginx 解压,进入解压后目录执行:
* I* i5 R6 T" ?) N c2 A' K! g# v+ k. T6 |
./autogen.sh0 K- u9 ~. \; _
./configure --enable-standalone-module --disable-mlogc3 ]) t5 Q n+ ~
make
, d8 Y- B% e. O) n- a7 V7 P三.nginx添加modsecurity模块0 r+ I4 Q7 `# v8 E Q: a& `5 r$ I
5 q: Z5 m6 d6 }& l, b! X; i3 d在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
' N, F `8 |& S$ z4 R' H' n4 _$ ~. C0 Q& L& ?# Z, R9 G; s$ E
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
. n; T7 Y+ @4 B% Nmake && make install
! {- }( w \, t4 z四.添加规则7 I( Z. N" @$ x; y! ?' ?0 p
7 N0 i: ]6 c, \- s: h2 g
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。
* ]9 \8 @" [* @ g
' |+ p; `4 o9 w1.下载OWASP规则:- ^9 v1 X9 I* @ a
* g; @* w# \7 K% s; _. y }6 Tgit clone https://github.com/SpiderLabs/owasp-modsecurity-crs
l7 x4 Z$ D# t8 \$ T' M. K# {5 G0 n/ s. P+ z- |
mv owasp-modsecurity-crs /opt/tengine/conf/" M1 p- u7 {, l8 O! s
. ?. c7 C) J( G" ^, U7 h% A
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
9 e2 h; q/ E p; i0 B2 M2.启用OWASP规则:4 ]6 x2 a4 n7 s2 X
' s% M9 ?5 N5 B' u3 L& ~复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
% ]" M: |8 Q8 ~# Y0 q! ^& J4 h
& A' r, t, ?* I% B6 v编辑modsecurity.conf 文件,将SecRuleEngine设置为 on( p: h7 F& Y. W+ ^: B
& W, p3 `: ?' Xowasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
- }* X8 W# D2 {" t7 a+ A5 N P# r7 [* K2 \5 W
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf# m+ t1 w7 L6 z4 c, h$ ] h
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf S1 |6 @% F) m" C
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf0 i5 u6 B7 ]0 S! c+ u4 x
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
0 \2 J V; n+ M1 \) f& XInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf% e& \+ |3 B' f( I) _1 g
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf# M" S j Y1 H6 |7 B' o7 U
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf$ I; w/ p& d9 E$ u9 s) x8 X* I# e
五.配置nginx$ n) q* b, S/ w+ |9 c! ?0 Z9 }
* i0 p; w5 S# s2 N在需要启用modsecurity的主机的location下面加入下面两行即可:
7 ^4 F5 H9 F/ y( f5 I: u7 n+ [/ i: d: |7 m+ R# W/ ~
ModSecurityEnabled on; 9 N: r' b/ s- M
ModSecurityConfig modsecurity.conf;
/ M- V9 F4 T1 x1 X {8 y下面是两个示例配置,php虚拟主机:
/ n( h8 N% `- G( b* `" q& K' \& m' u' ?5 x; l7 u" m
server {9 @8 r* a2 {3 g9 s, }, k' P5 }
listen 80;
3 g$ \8 [. ]/ Q9 M1 g4 g" D! L server_name 52os.net www.52os.net;/ O$ r" H! J6 u* @" y; t7 t2 R1 x
( R/ x9 L1 D0 A' \! h( e location ~ \.php$ {0 ?( e4 }, b- H0 @6 S% x
ModSecurityEnabled on; - H* Q2 g, ^% h
ModSecurityConfig modsecurity.conf;
& y/ r$ \0 v9 J7 U$ \
6 v4 A1 G5 I7 h; v" u7 f root /web/wordpress;
7 X- u' B% D& n2 |: {, w+ R. s index index.php index.html index.htm;3 S) R O6 ^( j6 I4 _
# Z/ i) Q6 I' r. G1 n fastcgi_pass 127.0.0.1:9000;1 Z6 f6 S5 R8 W
fastcgi_index index.php;+ D4 e6 v! u9 G% h
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
# L& u) \2 |7 m1 ^4 n" r include fastcgi_params;9 W" t; t8 d/ {7 w, w
}
* z7 P: M4 H+ \# P }
5 V4 W' Y2 @: }; n0 g6 I( Rupstream负载均衡:5 y3 J- e/ m9 V# C& b. v0 M8 _0 L
0 | c6 [9 _- W: C% ~9 G5 wupstream 52os.net {3 O& k# k; V6 k2 N
server 192.168.1.100:8080;
- z2 V8 _+ g9 \! d1 A server 192.168.1.101:8080 backup;
% g1 Z) S* S, i" p; n} x4 {2 N! u8 _
; O: m& K% `. R: ^. w/ u' @) ?4 k' kserver {
/ @/ I4 ^4 H# Z7 \2 ~8 K+ ]) Klisten 80;
7 \( S& l7 t3 ^9 r0 R& R Y& T4 Hserver_name 52os.net www.52os.net;# ^0 `1 p, {& |/ s
& {% j, l7 V7 e+ R3 k! S
location / {
- Z% S6 K* y. v+ M4 N( t9 t2 p% ~ ModSecurityEnabled on; 3 W" |7 Y2 R& ?4 _
ModSecurityConfig modsecurity.conf;
* Y$ k, H( \& B! R
* V9 w y5 k1 J proxy_pass http://online;
7 s; y( Z4 X) F proxy_redirect off;
; |1 w: n* u! d4 v proxy_set_header Host $host;7 a5 }, a. X2 O& Q# f
proxy_set_header X-Real-IP $remote_addr;- M ^5 b: s/ h! W( _' q% I
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;* Z# S- P7 c8 s! a; Q$ U2 l
}
9 t: }6 x( K2 R}' l1 G$ }. z6 V/ r! X
六.测试
5 n; }# P+ |( s2 R3 G/ [$ D$ X. y# }" _' M+ l- d' Q
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为: B# I+ Z5 Z ^2 h
' D/ M% i9 a: r. x: Y( d
<?php$ q3 ]) Q h# A r7 Y% r8 I
phpinfo(); * G; ]. E/ M$ z
?>8 b2 I8 C7 z" E6 s: ?# Q7 Q( m! f
在浏览器中访问:, v; f) |+ W0 c, M& _
, W0 w' O4 d, w1 m+ Xhttp://www.52os.net/phpinfo.php?id=1 正常显示。9 W( \# D, ~" A
http://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
) [0 X7 @4 t5 M3 W" Z" |- O8 Z( \http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
: L" v" W/ M% T% p说明sql注入和xss已经被过滤了
. `4 ]/ G7 W+ M, L) L/ |! L
& n+ x' v: F: C七、安装过程中排错, u2 Z, C0 ]; z% o
@+ A9 Q, c: v" Y- \1.缺少APXS会报错& i f1 `1 w' B) d9 b, F- v" g/ S$ U
& M) N3 z" n: P' Z5 N. @4 x. @- W. ~8 Z
configure: looking for Apache module support via DSO through APXS7 J; g( l9 c* V) n
configure: error: couldn't find APXS
3 c: P7 k# p N9 C; ^5 zapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。* D% N/ n& U2 M" V. [. T
解决方法:
; a' m4 K5 P" Z1 c7 [% g* f) d. F2 w% G" v8 p7 C, z t* I' ?
yum install httpd-devel
5 n, Q6 g. F" s' A* T2.没有pcre5 p. u: k# A1 q( Z
( k. v7 L* C0 X# Y* c
configure: *** pcre library not found.$ ?4 U1 V$ Y6 `4 l- z/ {
configure: error: pcre library is required, t2 G4 H: K( G
解决方法:9 d0 U- s4 j- e. z& ?: l3 i7 f
( m" {. H* b, s1 }5 T- @5 Iyum install pcre pcre-devel( H4 M) t: H) I: h: d+ k% C
3.没有libxml2
, M$ l5 Y4 u2 `# i6 H: o- |4 q# i" I M
% M/ H8 J e- T
configure: *** xml library not found.. m; Q9 p9 i1 @4 j- o, l; R. q0 I
configure: error: libxml2 is required: _. w; |- [* q) D! F S
解决方法:, Q" l" a2 C1 l3 }$ I
8 @2 Y- D0 ?- _( O& Hyum install libxml2 libxml2-devel
0 {0 M+ p; E4 Y- m4 S4.执行 /opt/tengine/sbin/nginx -m 时有警告6 p8 u; y3 ?$ w' i3 S
) K3 E; ~5 [+ ~( ~& j
Tengine version: Tengine/2.1.0 (nginx/1.6.2)
) f R0 O& E: Y3 s8 | Bnginx: [warn] ModSecurity: Loaded APR do not match with compiled!3 g/ _+ j m2 c' f2 k
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
: u; X5 @) P; V& M. m6 t0 T) c F% H! q
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.9 h! l% e1 n- u6 I, f
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"; |; I! |, I( c# ^+ N- O6 @
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!# l0 w4 }& E9 b# ~
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
' l$ P7 g/ d3 F# a: F- ?2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"! s: U- T4 {3 E/ g
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
3 A% Q5 y5 W @& q% T5 e! X( W* i8 I解决方法,移除低版本的APR (1.3.9)
' h' ~& f* ]. \8 x- X$ c0 e/ V; P$ {
yum remove apr8 v w$ n B0 |" j+ H
5.Error.log中有: Audit log: Failed to lock global mutex
9 _6 N% J6 }; K4 O; u A4 Z- b% Y4 d5 O! T1 j5 L; D% X
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock # i9 z- f" r ]% K
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
5 e9 A! Q- ?/ {+ p: h0 B解决方法:
9 o, a, ]1 X/ f( t0 E编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:9 `# L6 Z% R D4 c- C
# {. X' A7 a: v! k, e9 a. A
SecAuditLogDirMode 0777
/ a: `5 G' v/ u+ `' L* M9 MSecAuditLogFileMode 0550# Q% G' H6 ]$ R8 C' _
SecAuditLogStorageDir /var/log/modsecurity$ z9 e' q9 ?. a/ x' E! i" R
SecAuditLogType Concurrent5 ~ `1 Z6 F- M$ i6 L4 P% ^1 d
参考文章:
1 z7 x) M& l" h: Thttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
9 f& Y( `+ I8 b y& Bhttp://drops.wooyun.org/tips/2614 |
|