使用Nginx ModSecurity WAF-Gaoyufu 's blog

ModSecurity是一个开源的跨平台Web应用程序防火墙（WAF）引擎，，完美兼容nginx，是nginx官方推荐的WAF，并且支持支持OWASP规则。NGINX ModSecurity WAF 作为下载的动态模块提供给 NGINX Plus 客户，需要额外付费。这里我们使用开源项目ModSecurity-nginx

nginx部署略

1、ModSecurity部署

yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake
wget http://www.modsecurity.cn/download/modsecurity/modsecurity-v3.0.4.tar.gz

解压文件编译安装

tar -xvf modsecurity-v3.0.4.tar.gz
cd modsecurity-v3.0.4/
./configure
make
make install
cp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.conf
cp unicode.mapping /usr/local/modsecurity/

2、添加ModSecurity模块

查看Nginx编译参数

nginx -V

下载ModSecurity模块

git clone https://github.com/SpiderLabs/ModSecurity-nginx.git

重新编译Nginx

./configure --add-module=../ModSecurity-nginx
#此处需要注意/ModSecurity-nginx路径
make
make install
nginx -V #查看已经有了ModSecurity模块

添加配置文件

mkdir /usr/local/nginx/conf/modsecurity
cp /usr/local/modsecurity/modsecurity.conf  /usr/local/nginx/conf/modsecurity/
cp /usr/local/modsecurity/unicode.mapping  /usr/local/nginx/conf/modsecurity/

3、配置Nginx

vim /usr/local/nginx/conf/nginx.conf
    modsecurity on;
    modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf;
    
 #在http节点添加表示全局配置，在server节点添加表示为指定网站配置

1、Modsecurity配置

vim /usr/local/nginx/conf/modsecurity/modsecurity.conf
#更改一下部分
SecRuleEngine On
SecAuditLogParts ABCDEFHZ

#追加到配置文件
Include /usr/local/nginx/conf/modsecurity/crs-setup.conf
Include /usr/local/nginx/conf/modsecurity/rules/*.conf

2、下载规则文件

wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip
#Modsecurity中文网下载
# wget https://github.com/coreruleset/coreruleset
# 或者github下载

3、配置规则

unzip owasp-modsecurity-crs-3.3-dev.zip 
cd owasp-modsecurity-crs-3.3-dev/

cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.conf
cp -r rules /usr/local/nginx/conf/modsecurity/

cd /usr/local/nginx/conf/modsecurity/rules
mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

目录CONTENT

使用Nginx ModSecurity WAF