WAF防火墙

//添加依赖，一下看情况而添加，不确定需不需要
apt-get install gcc libpcre3 libpcre3-dev zlib1g-dev
//tengine依赖
sudo apt-get install openssl libssl-dev libssl0.9.8 libpcre3 libpcre3-dev

sudo apt-get install libxml2 libxml2-dev libxml2-utils
sudo apt-get install libaprutil1 libaprutil1-dev
sudo apt-get install apache2-dev

1.配置
./configure
make
make install

//添加依赖，此处可能报错
apt-get install libtool
apt-get install autoconf
2.//进入modSercurity
cd ModSecurity/
./autogen.sh
./configure–enable-standalone-module –disable-mlogc
make
3.nginx添加modsecurity模块
cd tengine/
./configure –add-module=/opt/modsecurity/nginx/modsecurity/ –prefix=/usr/local/nginx
make && make install
make
4.启动OWASP规则
cp -R owasp-modsecurity-crs /local/nginx
cp /usr/local/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf.example /usr/local/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
cd ModSecurity/
cp modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf
cp unicode.mapping /usr/local/nginx/conf
5.修改配置
gedit modsecurity.conf
SecRuleEngine on
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf
6.配置nginx
在需要启用modsecurity的主机的location下面加入下面两行即可:
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
下面事例配置：
server {
listen 88;
server_name localhost;

    location / { 
        ModSecurityEnabled on; 
         ModSecurityConfig modsecurity.conf;

        root   html;
        index  index.html index.htm;
    }   
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }  

}
/usr/local/nginx/sbin/nginx 启动
/usr/local/nginx/sbin/nginx -s reload 重启
/usr/local/nginx/sbin/nginx -s stop 关闭

文章参考
http://www.52os.net/articles/nginx-use-modsecurity-module-as-waf.html
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Installation_for_NGINX
http://drops.wooyun.org/tips/2614
http://drops.wooyun.org/tips/3804
http://drops.wooyun.org/tips/734
http://www.freebuf.com/articles/web/18084.html
http://www.freebuf.com/articles/web/16806.html