一、安装相关工具
yum install -y wget epel-release
yum install -y httpd httpd-devel pcre pcre-devel libxml2-devel gcc lua-devel yajl-devel ssdeep-devel curl-devel
二、编译ModSecurity
下载ModSecurity.
将modsecurity安装包上传至/usr/local目录下
cd /usr/local
tar -zxvf modsecurity-2.9.3.tar.gz
cd modsecurity-2.9.3
./configure --enable-standalone-module --disable-mlogc
make
三、安装nginx
cd /usr/local
wget http://nginx.org/download/nginx-1.18.0.tar.gz
tar -xvzf nginx-1.18.0.tar.gz
cd /usr/local/nginx-1.18.0
./configure --add-module=/usr/local/modsecurity-2.9.3/nginx/modsecurity/ --with-http_ssl_module --with-stream --prefix=/usr/local/nginx
make
make install
四、测试效果
启动nginx
/usr/local/nginx/sbin/nginx
模拟攻击,测试未启动ModSecurity时的访问效果,访问URL为:http://服务器IP/?param=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
效果如下:
五、最后配置
1、创建用于存在配置文件的文件夹,并复制相关配置文件到目录中
mkdir -p /usr/local/nginx/conf/modsecurity/
cp /usr/local/modsecurity-2.9.3/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity/modsecurity.conf
cp /usr/local/modsecurity-2.9.3/unicode.mapping /usr/local/nginx/conf/modsecurity/unicode.mapping
2、下载规则文件压缩包: owasp-modsecurity-crs-3.3-dev.
将owasp-modsecurity-crs-3.3-dev压缩包上传至/usr/local目录下并解压
unzip owasp-modsecurity-crs-3.3-dev.zip
复制crs-setup.conf.example到/usr/local/nginx/conf/modsecurity/下并重命名为crs-setup.conf
cp /usr/local/owasp-modsecurity-crs-3.3-dev/crs-setup.conf.example /usr/local/nginx/conf/modsecurity/
cd /usr/local/nginx/conf/modsecurity/
mv crs-setup.conf.example crs-setup.conf
3、复制rules文件夹到/usr/local/nginx/conf/modsecurity/下,同时修改REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example与RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example两个文件的文件名,将".example"删除,可将自己写的规则放置于此两个文件中;
cp -rp /usr/local/owasp-modsecurity-crs-3.3-dev/rules/ /usr/local/nginx/conf/modsecurity/
cd /usr/local/nginx/conf/modsecurity/rules/
mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
4、编辑nginx.conf
在http或server节点中添加以下内容(在http节点添加表示全局配置,在server节点添加表示为指定网站配置)
ModSecurityEnabled on;
ModSecurityConfig modsecurity/modsecurity.conf;
5、编辑modsecurity.conf
SecRuleEngine DetectionOnly改为SecRuleEngine On
同时在文件末尾添加以下内容:
Include crs-setup.conf
Include rules/*.conf
六、重新加载Nginx测试效果
/usr/local/nginx/sbin/nginx -s reload