|
|
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。/ r1 r) [5 @5 T# ?$ W
2 r- [/ E5 i) l/ t# }; i一.准备工作 W: V' M% d9 G( i+ }6 h9 J
$ p4 H/ H W% O5 N系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
- ~( ` b; {/ @# W, A4 e" B" F) L3 r
0 W% t {' l6 X: {tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
% q2 A$ p$ n4 c; i% q; E" Z3 K2 y: Y& t0 ^
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
" \+ ~9 \! k0 L }) F! `6 {$ [( f+ P9 X- j
OWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs/ I8 U, ]( l+ {6 Y1 R9 u
9 y2 }" G$ D, {) X依赖关系:* i) j5 m% t* l: L) P
tengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
! {: Q$ b( g3 s0 N" m# g5 G
1 Z& `3 p! B7 P! C3 M& E! jyum install zlib zlib-devel openssl openssl-devel pcre pcre-devel
8 ]1 e) x8 U5 Q* {modsecurty依赖的包:pcre httpd-devel libxml2 apr
) V a( `6 n M0 t5 c1 S1 C+ f/ J9 i( J9 m$ l
yum install httpd-devel apr apr-util-devel apr-devel pcre pcre-devel libxml2 libxml2-devel- I V2 w! K% `2 B
二.启用standalone模块并编译
1 r% P B$ L6 [" P2 z
! h8 i7 R6 R& x$ Y下载modsecurity for nginx 解压,进入解压后目录执行:$ Z2 r M" [% C) g' a! S
9 T* L; E; c4 O n3 j% `' b./autogen.sh8 G3 ?) u0 s+ t& w
./configure --enable-standalone-module --disable-mlogc
: c, C& u: Z5 I ~0 @$ ^3 ^( e( Mmake
1 v3 e- u" g' F( l( ^" @三.nginx添加modsecurity模块 s; s3 y0 {( D3 h( Z2 K$ S# L
; T/ m% `* U1 [8 d8 \6 {* |# ^
在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:
9 z- V# R' v3 Y& V! K' ~+ @; {; O" D x* b( G' @4 s% X: ]
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/ --prefix=/opt/tengine
& H7 ^3 F# D* k! umake && make install
7 y' T5 S# _7 ~* p2 R5 h. s4 D四.添加规则0 q/ i/ y) N, \$ Y) W
0 v8 |. f! g8 @# N( s4 ymodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。% V7 e4 q7 x# i& l7 W3 d
# X& z4 T, p% J5 z$ ~1.下载OWASP规则:
: ]: Y) f% c6 Q& m
7 g# z: I# b/ z% Z0 @" _ S, u/ \git clone https://github.com/SpiderLabs/owasp-modsecurity-crs# y1 n6 i* Y* d9 }1 L: p
( L6 R4 K; l0 U( P4 ]6 N2 hmv owasp-modsecurity-crs /opt/tengine/conf/
$ b+ b( e* g0 d; q# Q5 S8 F0 l9 i% N& ^( G$ p# ?# X% x f" X7 v+ v
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
1 n' Z- \- x y5 T2.启用OWASP规则:
; T! V0 J+ }; z- R" T' K2 A, X/ W3 r' i: @5 x4 N. @- P
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
^: {( W9 ]. `2 ?! k2 t4 `0 ^! @& C+ x3 H4 I/ v* f
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on
' k3 s, M1 J J9 D
+ P% q( S7 w5 Y }owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。
5 s6 t' q) m L, X }: x: c4 h+ p- ^% g2 i+ k; e( ]
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
' I# [0 |3 P! k- T" A9 t; A' `/ @Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf; j8 Q$ U b8 d6 ^: G* _4 t! C
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
2 X4 d, P# O: j* z% SInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf' \. L# m e* L- k4 N! d+ x
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf7 }+ A9 B6 G* E& ~: X- e
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
- O! S; ^& W8 O n! dInclude owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf; u" H- e. j0 |6 L, o
五.配置nginx- m" u( z* v& O" C5 q
3 [9 { r% M' C3 E# b在需要启用modsecurity的主机的location下面加入下面两行即可:- }+ ?9 r# X9 `8 Z$ A% d+ C2 v, u
; p) r$ z& B3 V B3 M, lModSecurityEnabled on; 6 v3 @8 x% {4 O2 d- h* u6 z
ModSecurityConfig modsecurity.conf;$ _3 G; x3 n4 w, o! W& r
下面是两个示例配置,php虚拟主机:. c' ^0 Z! C' q1 V$ w7 O9 k
8 n5 w* _/ q* }9 C7 `% h2 g, lserver {
5 w6 c. e3 C7 U* Z. Q3 D4 W; g) f listen 80;, m+ V2 T. T x; Y1 P
server_name 52os.net www.52os.net;, j; [4 g: G2 O
# G8 r- c2 h) C' U location ~ \.php$ {
2 p# V' N% ?6 P: R" P ModSecurityEnabled on; ) X! R1 \1 _5 Q- ^
ModSecurityConfig modsecurity.conf;& d3 \1 o9 ]* o! o0 M/ l- q
, L3 ]$ I" c, ^3 g' ?9 Q5 V
root /web/wordpress;/ [, o; O- g/ A+ c# Y7 C4 I5 y
index index.php index.html index.htm;
/ h, x/ \# _6 J/ G. n! p " O" }3 ]# ^6 j$ n+ C6 v) N+ V9 v
fastcgi_pass 127.0.0.1:9000;
- I: t6 F( R: s5 p0 H fastcgi_index index.php;
; T- v0 R* I% h fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;: M* n2 ?; Y' T$ k8 w% a7 @
include fastcgi_params;9 ~) v% ~9 C! d
}
" w! K7 }: ]' r r. l. ]$ G7 Q }* X- D* ]7 ^% r# W- _$ W1 e( Q
upstream负载均衡:
8 K1 j( o3 e3 R+ k) }$ z- w* H' y( @2 b
upstream 52os.net {. t* U* q# X# x
server 192.168.1.100:8080;
3 y; x+ H; [8 ~ H4 _' R server 192.168.1.101:8080 backup;
9 E# W1 T S/ U/ i% J2 r$ m}
2 r: W7 U8 s; G
: t- Z% s0 g( y; jserver {
4 Z1 \9 }- M/ [5 \listen 80;
/ e0 |9 K; d9 h2 yserver_name 52os.net www.52os.net;5 @! `; x; U) D2 j$ C# I1 V; H! N; o
' K$ F, X4 H5 t5 G- C6 F klocation / {7 o8 O/ j( a6 X+ U8 c6 ^- K9 ]
ModSecurityEnabled on; & @+ \ ~* z- ?& I! v5 \1 f; D
ModSecurityConfig modsecurity.conf;
* Y' q. L) V" f/ B/ ?) i" }& V! i: c- L( z6 N) C# V) M7 F* B% o
proxy_pass http://online;
" S: S/ d4 C3 g& e' R$ s proxy_redirect off;7 s* k/ {. w9 J- Q) }
proxy_set_header Host $host;
1 u; {# V2 @9 w$ m' g9 S proxy_set_header X-Real-IP $remote_addr;+ }" n0 d$ ~" @8 T- j7 f" Q) l
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;* H! v7 G, \$ I: Y- \# M
}1 p& U- }" K" F7 @4 M) U
}1 M- R" @0 t7 {" i( l/ D) Z
六.测试' R! \$ m) Z# Y4 `8 D: o+ ^
1 N9 b; V( e/ E$ u
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:) L7 O( A8 E( n, W/ g
" P; P1 \; \. c: u- J9 t4 r N# ?7 w
<?php+ e+ r0 i" s4 H- D Z% y: T
phpinfo();
2 ?0 M) H+ d$ d4 I! U?>
" B9 G$ W4 Y! m/ a- j8 i( P在浏览器中访问:' K% D9 w7 w( ^
; j+ N2 T0 O0 m9 ?http://www.52os.net/phpinfo.php?id=1 正常显示。
/ \) k6 R" |1 {+ [) v, x3 T' Ihttp://www.52os.net/phpinfo.php?id=1 and 1=1 返回403。
% T z2 [- J5 |- I: B0 Rhttp://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script> 返回403。
) @2 e0 D7 l5 R说明sql注入和xss已经被过滤了- C9 D6 f. b- |& m* e. O' H
6 ~0 g/ E+ c( C9 L! ?
七、安装过程中排错
4 r1 Y& E% \5 ]& j! N" j! u9 [; c, m) G0 Y2 B
1.缺少APXS会报错8 b A( j0 X' S& d( z
5 X( E z) Y8 B' x4 w5 f+ kconfigure: looking for Apache module support via DSO through APXS2 H8 D7 V1 w6 W# P, s5 Y; c, b
configure: error: couldn't find APXS
1 }1 `6 h- M1 M0 Q$ vapxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。4 Q$ H/ q5 c9 b7 W, o; \
解决方法:
* e) l; N. x( D2 J1 e6 g- m2 }# A: a) a/ B
yum install httpd-devel9 H- ^/ d* K4 g8 U1 ~6 D8 D
2.没有pcre9 D' R4 @* D W) J
8 U! T- r, W+ P$ e
configure: *** pcre library not found.
! w5 ?5 n4 Y& a2 `$ K. Yconfigure: error: pcre library is required
$ M" {) P) i( L* i4 F解决方法:
- y+ b U, A) _& }
2 R, ~# ?2 ^' A. c8 ryum install pcre pcre-devel3 @0 x" [2 H4 z) T. ~8 E' T
3.没有libxml2, W; r! X2 a9 G1 F4 ~+ t0 n
; h" O/ H a0 V' D/ ?) y) F8 i
6 [1 O# _6 k" p7 ]configure: *** xml library not found.1 V5 q. G9 A a7 c
configure: error: libxml2 is required
' u E1 h3 ~2 R解决方法:; a% T& G; h( o' [6 }" ]# n3 H
+ |( t; M2 _+ o: v, P) uyum install libxml2 libxml2-devel
" ?+ B5 n$ i( R4.执行 /opt/tengine/sbin/nginx -m 时有警告
& \3 v6 }$ y' v* L6 f! D5 F0 n1 n6 E7 u T( U7 ^% V0 z; ]
Tengine version: Tengine/2.1.0 (nginx/1.6.2)
& h& b4 V- Z+ Rnginx: [warn] ModSecurity: Loaded APR do not match with compiled!
3 p; Q2 Q+ t! @8 l7 u原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
: E6 B+ L: v- t: U! t3 f
5 e# F6 ]0 p p; F2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
5 t. @3 Z( [1 A' d% s2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded version="1.3.9"
6 F) g! p/ p: t* b6 O. F7 t) D1 ]) v, g2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!
9 R, y; X, A8 D. |9 {. {2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
8 _3 O9 h2 I) {7 S, s5 u2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"9 j8 M& e' m8 O% g2 K
2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.% x+ F6 s1 J1 S7 g
解决方法,移除低版本的APR (1.3.9)
9 i, v/ W7 L% T, l8 w D+ F6 h' G$ z( g
yum remove apr* H) u- }# f/ c/ Q/ o' O+ J# ?- \
5.Error.log中有: Audit log: Failed to lock global mutex3 {; J1 ^! _. ]) c9 a# s
3 i% s v; K$ `3 h& ]
2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock 7 G9 X3 W! \) ]7 L; l
global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]
2 x* @: Y7 Z! `$ a9 D2 z9 K6 V解决方法:9 T) n, p+ N( ] K9 w c9 Y Z3 E8 B
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
8 _: f% d3 U9 W9 h3 A) }4 w7 M( ^' i j$ o
SecAuditLogDirMode 0777+ V4 x' E: D/ Q% J) B% b: x
SecAuditLogFileMode 0550
8 m6 L O: d- Z5 D, hSecAuditLogStorageDir /var/log/modsecurity
c4 z" w# j% ^: k" ~SecAuditLogType Concurrent
- t; n4 r3 S+ {( ]' L: J0 {参考文章:
* S( q8 A/ S, q: ihttps://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX8 C3 f9 l, \* w) y& R! S; ]
http://drops.wooyun.org/tips/2614 |
|