nginx增加modsecurity模块

 modsecurity原本是Apache上的一款开源waf,可以有效的增强web安全性,目前已经支持nginx和IIS,配合nginx的灵活和高效,可以打造成生产级的WAF,是保护和审核web安全的利器。
 

git clone https://github.com/SpiderLabs/ModSecurity.git
cd ModSecurity/
./autogen.sh
./configure --enable-standalone-module --disable-mlogc
make
cd tengine/
./configure --prefix=/usr/local/nginx
 --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid 
--error-log-path=/var/log/nginx/nginx.log --http-log-path=/var/log/nginx/nginx-http.log --add-module=/root/ngx_devel_kit-0.2.19/ --add-module=/root/lua-nginx-module-0.9.13/ --add-module=/root/ModSecurity/nginx/modsecurity/
 --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"
make

这里写图片描述
modsecurity倾向于过滤和阻止web危险,之所以强大就在于规则,OWASP提供的规则是于社区志愿者维护的,被称为核心规则CRS(corerules),规则可靠强大,当然也可以自定义规则来满足各种需求。

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs
cp -R owasp-modsecurity-crs /etc/nginx/
cp
 /etc/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf.example 
/etc/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
cd ModSecurity/
cp modsecurity.conf-recommended /etc/nginx/modsecurity.conf
cp unicode.mapping /etc/nginx
vim modsecurity.conf
SecRuleEngine on
Include owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Includeowasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf
Include owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.conf
Include owasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf

在需要启用modsecurity的主机的location下面加入下面两行即可:

ModSecurityEnabled on;  
ModSecurityConfig modsecurity.conf;

post bug report:https://github.com/SpiderLabs/ModSecurity/issues/748
solution:https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring

发布了71 篇原创文章 · 获赞 68 · 访问量 121万+
展开阅读全文

没有更多推荐了,返回首页

©️2019 CSDN 皮肤主题: 大白 设计师: CSDN官方博客

分享到微信朋友圈

×

扫一扫,手机浏览