所有操作和安装包皆看自己喜欢安装目录
所需软件包百度链接
提取码:cr5h
安装前准备:
yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel libxml2 libxml2-dev libxslt-devel gd gd-devel perl-devel perl-ExtUtils-Embed gperftools
cd /usr/local/src/
下载luajit 2.1并安装:
wget http://luajit.org/download/LuaJIT-2.1.0-beta2.tar.gz
tar xf LuaJIT-2.1.0-beta2.tar.gz
cd LuaJIT-2.1.0-beta2
make && make install
下载 Nginx 开发套件 ngx_devel_kit
wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz
tar xf v0.3.0.tar.gz
安装nginx_lua_module:
wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
tar xf v0.10.13.tar.gz
设置环境变量!
echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile
echo "export LUAJIT_INC=/usr/local/include/luajit-2.1" >> /etc/profile
source /etc/profile
安装nginx:
编译安装nginx1.16.1:
tar -xvf nginx-1.16.1.tar.gz
cd nginx-1.16.1
useradd -s /sbin/nologin -M nginx
./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"
make -j2
make install
ln -s /usr/local/nginx-1.16.1 /usr/local/nginx
新建/usr/local/nginx/logs/hack/攻击日志目录,并赋予nginx用户对该目录的写入权限:
mkdir -p /usr/local/nginx/logs/hack/
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/
至此nginx支持WAF防护功能已经搭建完成!
使用说明:
nginx配置文件路径为:/usr/local/nginx/conf/
把ngx_lua_waf下载到conf目录下,解压命名为waf
wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf
在nginx.conf的http段添加下面这段:
sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf
//这一条命令执行完添加下方4条路径!
lua_package_path "/usr/local/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file /usr/local/nginx/conf/waf/init.lua;
access_by_lua_file /usr/local/nginx/conf/waf/waf.lua;
配置config.lua里的waf规则目录(一般在waf/conf/目录下):
RulePath = “/usr/local/nginx/conf/waf/wafconf/”
绝对路径如有变动,需对应修改
然后重启nginx即可
ln -s /usr/local/nginx/sbin/nginx /usr/sbin/
nginx #启动nginx
配置文件详细说明:
RulePath = "/usr/local/nginx/conf/waf/wafconf/"
--规则存放目录
attacklog = "off"
--是否开启攻击信息记录,需要配置logdir
logdir = "/usr/local/nginx/logs/hack/"
--log存储目录,该目录需要用户自己新建,切需要nginx用户的可写权限
UrlDeny="on"
--是否拦截url访问
Redirect="on"
--是否拦截后重定向
CookieMatch = "on"
--是否拦截cookie攻击
postMatch = "on"
--是否拦截post攻击
whiteModule = "on"
--是否开启URL白名单
black_fileExt={"php","jsp"}
--填写不允许上传文件后缀类型
ipWhitelist={"127.0.0.1"}
--ip白名单,多个ip用逗号分隔
ipBlocklist={"1.0.0.1"}
--ip黑名单,多个ip用逗号分隔
CCDeny="on"
--是否开启拦截cc攻击(需要nginx.conf的http段增加lua_shared_dict limit 10m;)
CCrate = "100/60"
--设置cc攻击频率,单位为秒.
--默认1分钟同一个IP只能请求同一个地址100次
html=[[Please go away~~]]
--警告内容,可在中括号内自定义
备注:不要乱动双引号,区分大小写
执行一键安装部署的脚本!
#!/bin/bash
#Author:Guo darling Lin
yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel libxml2 libxml2-dev libxslt-devel gd gd-devel perl-devel perl-ExtUtils-Embed gperftoolsl
cd /usr/local/src/
[ ! -f "LuaJIT-2.0.5.tar.gz" ] && wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
[ ! -f "nginx-1.16.1.tar.gz" ] && wget http://nginx.org/download/nginx-1.16.1.tar.gz &&
[ ! -f "v0.3.0.tar.gz" ] && wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz
[ ! -f "v0.10.13.tar.gz" ] && wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
[ ! -f "master.zip" ] && wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip --no-check-certificate
ls *.tar.gz | xargs -n 1 tar xf
cd LuaJIT-2.0.5 && make && make install
cd /usr/local/src
echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile && \
echo "export LUAJIT_INC=/usr/local/include/luajit-2.0" >> /etc/profile
source /etc/profile
useradd -s /sbin/nologin -M nginx
cd nginx-1.16.1
./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"
make -j8
make install
ln -s /usr/local/nginx-1.16.1 /usr/local/nginx
mkdir -p /usr/local/nginx/logs/hack/
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/
cd /usr/local/src
wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf
sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf
ln -s /usr/local/nginx/sbin/nginx /usr/sbin/
nginx