找回密码
 立即注册

QQ登录

只需一步,快速开始

查看: 12270|回复: 0

nginx配合modsecurity实现WAF功能

[复制链接]
发表于 2017-10-19 16:53:31 | 显示全部楼层 |阅读模式
modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。5 _+ i$ ]! u. z* o, z1 W. M7 r1 x
( N5 A) a! b4 i  \& r
一.准备工作
9 q* V( ?+ S. V
8 c  K5 H5 Y4 N* `系统:centos 6.5 64位、 tengine 2.1.0, modsecurity 2.8.0
6 U. y& a  ]! @% l/ l+ }2 Y) z, e' F5 a- r
tengine : http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
+ O4 t" s: ~8 a4 x' _, B2 l. \. z; w! ^& u& i+ r* ]- o
modsecurity for Nginx: https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz5 R; A( j; X" P- {7 b7 O) c

, G) m+ `& P3 ]6 q! rOWASP规则集: https://github.com/SpiderLabs/owasp-modsecurity-crs$ T/ @1 e% \7 m

! x# |8 U9 i$ Y! e5 F依赖关系:
8 A/ L3 N2 c% O$ ]* K4 s1 ktengine(nginx)依赖: pcre 、zlib、 openssl, 这三个包centos 6.5 系统源里都有:
1 i( B# p" q" v5 B3 v0 t4 o8 ]2 F3 E! G. P, ~" C
yum install zlib zlib-devel openssl openssl-devel  pcre pcre-devel
' l* A  t( Q' @' vmodsecurty依赖的包:pcre httpd-devel libxml2 apr
/ b! D  I( j5 A3 a* i
+ C! m# _( `. f# r0 G: Yyum install httpd-devel apr apr-util-devel apr-devel  pcre pcre-devel  libxml2 libxml2-devel6 B2 t- S  r( N0 L, V
二.启用standalone模块并编译
" J$ h5 \3 r5 ]# j) _1 m: k; R( Y* W" l4 P8 b% S9 j
下载modsecurity for nginx 解压,进入解压后目录执行:# R1 c9 u1 Y, J6 p- I

  X/ J% G$ c# S% n$ b, j9 C./autogen.sh" X! F( P9 S- V1 J# ~& ?5 v
./configure --enable-standalone-module --disable-mlogc
% `2 I0 D7 W: E! }# gmake
; p9 k5 K1 V4 S* w+ \三.nginx添加modsecurity模块) ]) x0 L& W% f# }! T2 j) n

; L# z5 G# {' Y9 w" t; n$ i在编译standalone后,nginx编译时可以通过"--add-module"添加modsecurity模块:! ~. k) ]- L5 [, h/ N7 j5 G% a. ^! Q
2 ^& g) y) k( C' z7 l4 L' `
./configure --add-module=/root/modsecurity-2.8.0/nginx/modsecurity/  --prefix=/opt/tengine
  E! F, w; t. }- Rmake && make install
  a( f. C, Y( \( e: B# \4 Z四.添加规则
+ M$ H! v( z" ~1 D" G( X( O9 W4 Q5 x
6 R8 x9 y2 s: T# t2 F* Jmodsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。& A5 d* A( E7 u! q4 k' A

5 G3 n/ x" R5 ?' r1.下载OWASP规则:
$ T6 F8 w" J, _. `" C# u
% W9 K% h  e& hgit clone https://github.com/SpiderLabs/owasp-modsecurity-crs. r. j* l( `4 b  O; H/ ]

& g( c  s3 X4 A! tmv owasp-modsecurity-crs /opt/tengine/conf/
" D& O; t" W: q  n! ~  a6 {% a# N9 r5 |1 T
cd /opt/tengine/conf/owasp-modsecurity-crs && mv modsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
. j' g3 T5 _2 X5 m- g# P. n2.启用OWASP规则:
+ T* L' m& C5 S/ {) D) h* w0 {3 Y: V1 B* W: t
复制modsecurity源码目录下的modsecurity.conf-recommended和unicode.mapping到nginx的conf目录下,并将modsecurity.conf-recommended重新命名为modsecurity.conf。
8 k) ~8 H, s$ P3 F/ ~7 l3 G* i) |( A; y/ i2 X" s% Z4 _
编辑modsecurity.conf 文件,将SecRuleEngine设置为 on8 e. X5 b# q, ~+ {* Y3 ]8 q
6 w3 a  m6 ]. w4 d( ~' t3 u
owasp-modsecurity-crs下有很多存放规则的文件夹,例如base_rules、experimental_rules、optional_rules、slr_rules,里面的规则按需要启用,需要启用的规则使用Include进来即可。! V  u9 c9 o5 f; K" y" j+ @/ J
- X0 S( w+ @, g
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf7 J1 z. `# M; \/ O# @
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
+ v1 c% @8 S  L* `4 a- eInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf9 |$ R$ z9 X+ e; y4 c
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
$ q# N% B4 f( S/ q) `Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf0 r4 w" {' \. x8 m3 W5 o
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf8 K( G; s! ~- E& l3 e& y
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
( r- A/ a+ G1 K* x五.配置nginx3 p9 j/ \# _  r' T3 `4 k
$ w4 q1 I1 U4 s# K7 X1 r8 a3 J) s$ t
在需要启用modsecurity的主机的location下面加入下面两行即可:
2 R. |/ u1 h2 t- \: Z* r( R
, o( a. S2 T, ^- x- H5 xModSecurityEnabled on;  : |  W) G4 B& W* x9 d1 t: V
ModSecurityConfig modsecurity.conf;2 c. q$ D7 o+ g# p
下面是两个示例配置,php虚拟主机:2 _$ o( q, F+ u9 j

7 m* G' w1 {# {5 Zserver {
& u1 C: W) P+ v! V1 b      listen      80;0 P# r9 k: J3 T$ _
      server_name 52os.net www.52os.net;
9 O9 A1 k* T3 Z  S8 d" m5 b     " r1 b6 g  ^( `) `& c# A
      location ~ \.php$ {
) d2 O4 {0 ^' }) Q% F      ModSecurityEnabled on;  
3 ~6 ]6 Z/ \7 d, f. h% t( p: ?8 n      ModSecurityConfig modsecurity.conf;6 g  R+ c9 n/ e# T5 }
- v8 ?* I. t3 w: Q4 b+ a
      root /web/wordpress;7 t6 X& \$ O, {  M  e
      index index.php index.html index.htm;: e! M+ w. v8 l2 K; }- Y; ^9 V
  
1 V8 o2 z$ u7 o+ G      fastcgi_pass   127.0.0.1:9000;, v, s  Z7 l$ _9 `- `
      fastcgi_index  index.php;
8 V5 ?) S2 s! w# O2 _4 }( k3 e* w      fastcgi_param  SCRIPT_FILENAME  $Document_root$fastcgi_script_name;
4 Y/ W% L0 H5 r      include        fastcgi_params;
2 m# O6 k( s% J# g      }0 E5 T7 r5 y" J/ S
  }7 `9 r$ K" ^/ ~+ {8 N
upstream负载均衡:
1 ]3 h' Y& l9 \" H, D6 g$ u. R" G2 J" k
upstream 52os.net {0 U( k) v% X2 P2 f, w
    server 192.168.1.100:8080;  S) ~6 @: K0 k5 _
    server 192.168.1.101:8080 backup;4 \/ k# J  Q* q
}
8 v; e5 D; x/ g  j  C, A  y6 g% q
2 K7 t, N. ^: `) f' H7 M6 P$ ]server {6 `1 w" O  |, h" l* X
listen 80;
: h' {5 a, O; l7 N+ |6 rserver_name 52os.net www.52os.net;- s% `2 M1 `9 A. T, Y! V9 ~
- g( U6 o% b8 S4 k1 H0 V
location / {2 ?& F( g  R; B4 ~% k: H
    ModSecurityEnabled on;  + ^; i# c2 r: \" \
    ModSecurityConfig modsecurity.conf;  + o" r5 }3 E, E( C! Q, C$ n

* t/ m3 J# ^2 J( U7 I        proxy_pass http://online;
/ y) L. {; y* N( @- s        proxy_redirect         off;* Q- M4 E. y# M% z9 A$ i
        proxy_set_header Host $host;
) x/ n9 H+ f8 F/ S- [        proxy_set_header X-Real-IP $remote_addr;" z0 R/ d- [; b) A; ~7 o; `
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
; S0 d- U) O$ d, m! @    }0 A! f- l/ m1 v! i
}1 `" L2 j6 U+ T+ n2 _
六.测试# T- E8 L9 u6 _* M4 R7 i) f9 y
. Y6 z$ Q4 E4 ]( B
我们启用了xss和sql注入的过滤,不正常的请求会直接返回403。以php环境为例,新建一个phpinfo.php内容为:
4 N& @1 @/ g% ~- R; S) g* U
3 u2 g, v/ O3 Q8 @<?php$ q  Q. c( C0 ?  C* [. E
    phpinfo();    0 j, d; N9 Q% J# g7 I% k, Y
?># y7 T) x- D: L- W9 ]
在浏览器中访问:
! @+ P& E- Z, _0 \
* |% B  {6 p, x. n% ?. ~http://www.52os.net/phpinfo.php?id=1 正常显示。4 Q, V$ E! g1 p; [5 t: C
http://www.52os.net/phpinfo.php?id=1 and 1=1  返回403。5 Q( M: j" h2 }" n2 l
http://www.52os.net/phpinfo.php?search=<scritp>alert('xss');</script>  返回403。. l: ?3 T. h! o4 ?* l0 S- x
说明sql注入和xss已经被过滤了
$ w7 q% c0 M- k8 Z8 z
- R: H' q3 @/ p七、安装过程中排错
7 T0 L& J; x, D6 V( U4 L% S0 x
6 P, @0 r& U3 o1.缺少APXS会报错
) Y- F2 Z2 K* o, T: l9 X0 {# Z. g8 e9 r5 }/ Y$ {/ x# z& u! k
configure: looking for Apache module support via DSO through APXS
" f; |4 p: w: o. E4 ]6 `) Aconfigure: error: couldn't find APXS
6 N+ x* D8 x7 o9 D  C9 i$ @* }apxs是一个为Apache HTTP服务器编译和安装扩展模块的工具,用于编译一个或多个源程序或目标代码文件为动态共享对象。* e: r  R" ~: c* r( V  `; i. x' ]8 v
解决方法:: e. W6 R/ h) j( ]) d- r, b
1 L$ {* y  k  [, W4 f9 b6 c
yum install httpd-devel* z6 m7 w' J( a
2.没有pcre% [5 s, }  W& _5 s; O& N
4 I$ Q+ @+ K2 [% c) |4 y3 d
configure: *** pcre library not found.5 L3 U* s; g8 Y1 J% o5 o! ^, g
configure: error: pcre library is required! V/ W( C" r# A. \' r4 [
解决方法:
* V- r2 E' \' o" T) O: @# k' o5 S! Y2 o3 p) j
yum install pcre pcre-devel
8 h! Z6 [8 F4 C5 j1 ~3 L3.没有libxml2
; T  M0 `* j  y) k6 v# [& G/ {' A3 H. _# @1 \! a

8 Z; m! D* R2 B1 Yconfigure: *** xml library not found.8 Q: n5 o* h/ G$ C1 _
configure: error: libxml2 is required
, f1 M& a/ v7 Z. s- j( n  \5 f5 ~解决方法:; ^# Z. \% r# C; M0 _) W; g
) p" O1 p, @% L* [
yum install  libxml2 libxml2-devel8 w8 `9 }5 Q: i, n- L1 N
4.执行 /opt/tengine/sbin/nginx -m 时有警告
/ R8 r7 i6 |! |, X4 m8 J- K
+ V/ P! k0 S  P% QTengine version: Tengine/2.1.0 (nginx/1.6.2)9 @( b( W: s) u/ S4 H, Y3 ~' P7 `; s
nginx: [warn] ModSecurity: Loaded APR do not match with compiled!) y# @. a8 t2 ~7 J9 ~. [) f7 v
原因:modsecurity编译时和加载时的apr版本不一致造成的,并且会有以下error.log
: K( C- `6 L/ ^$ e, ?% O$ L8 m
. i: N  \! t  |- ]2015/01/26 02:04:18 [notice] 29036#0: ModSecurity for nginx (STABLE)/2.8.0 () configured.
& ?& d# e2 T$ n' e2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: APR compiled version="1.5.0"; loaded     version="1.3.9"% K' U( d) O: X! z7 \# r
2015/01/26 02:04:18 [warn] 29036#0: ModSecurity: Loaded APR do not match with compiled!# T! W. M) {$ E3 c
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"( d% L( [( Q' S, }
2015/01/26 02:04:18 [notice] 29036#0: ModSecurity: LIBXML compiled version="2.7.6"
3 {: N) Z, {/ t9 D( e2015/01/26 02:04:18 [notice] 29036#0: Status engine is currently disabled, enable it by set SecStatusEngine to On.
8 x' C4 q$ b0 X+ ?5 P3 X解决方法,移除低版本的APR (1.3.9)! c% k# s0 w; |$ n

# x, G/ T1 D/ T- j2 q/ o, xyum remove apr
7 a# a5 G& D6 ^& a! E* M5.Error.log中有: Audit log: Failed to lock global mutex
4 _* Y6 c2 f  i* M0 i5 v
, T3 R( z$ O  U2 Q2015/01/26 04:15:42 [error] 61610#0: [client 10.11.15.161] ModSecurity: Audit log: Failed to lock     
  [$ x& S4 I1 |global mutex: Permission denied [hostname ""] [uri "/i.php"] [unique_id "AcAcAcAcAcAcAcA4DcA7AcAc"]* a1 X# A0 V! R7 V# b9 u2 v
解决方法:5 ~  u2 Q. u! @4 E3 t! b
编辑modsecurity.conf,注释掉默认的SecAuditLogType和SecAuditLog,添加以下内容:
  W# |) G! ]9 }% ~6 _9 H; Q
- M( Y5 @1 p! Z; E! s+ X: W. VSecAuditLogDirMode 0777
' ~% R. j' I6 A( J/ {SecAuditLogFileMode 0550  V$ s2 z+ m/ D5 y; ]8 U* m3 x
SecAuditLogStorageDir /var/log/modsecurity; i& @+ l7 ^+ A
SecAuditLogType Concurrent  C8 q) ?& e4 ]' u5 z
参考文章:7 ]3 Y$ ?3 Y- o
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX& B+ z5 `8 Z' V4 V8 |: L  e
http://drops.wooyun.org/tips/2614
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

QQ|Archiver|手机版|小黑屋|第一站论坛 ( 蜀ICP备06004864号-6 )

GMT+8, 2026-8-21 07:17 , Processed in 0.055785 second(s), 19 queries .

Powered by Discuz! X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表