0 前言
ModSecurity是一個開源的跨平臺Web應用程式防火墻（WAF）引擎，用于Apache，IIS和Nginx，由Trustwave的SpiderLabs開發，作為WAF產品，ModSecurity專門關注HTTP流量，當發出HTTP請求時，ModSecurity檢查請求的所有部分，如果請求是惡意的，它會被阻止和記錄，
優勢
完美兼容nginx，是nginx官方推薦的WAF支持OWASP規則3.0版本比老版本更新更快，更加穩定，并且得到了nginx、Inc和Trustwave等團隊的積極支持免費
功能
SQL Injection (SQLi)：阻止SQL注入Cross Site Scripting (XSS)：阻止跨站腳本攻擊Local File Inclusion (LFI)：阻止利用本地檔案包含漏洞進行攻擊Remote File Inclusione(RFI)：阻止利用遠程檔案包含漏洞進行攻擊Remote Code Execution (RCE)：阻止利用遠程命令執行漏洞進行攻擊PHP Code Injectiod：阻止PHP代碼注入HTTP Protocol Violations：阻止違反HTTP協議的惡意訪問HTTPoxy：阻止利用遠程代理感染漏洞進行攻擊Shellshock：阻止利用Shellshock漏洞進行攻擊Session Fixation：阻止利用Session會話ID不變的漏洞進行攻擊Scanner Detection：阻止黑客掃描網站Metadata/Error Leakages：阻止源代碼/錯誤資訊泄露Project Honey Pot Blacklist：蜜罐專案黑名單GeoIP Country Blocking：根據判斷IP地址歸屬地來進行IP阻斷
劣勢
不支持檢查回應體的規則，如果配置中包含這些規則，則會被忽略，nginx的的sub_filter指令可以用來檢查狀語從句：重寫回應資料，OWASP中相關規則是95X，不支持OWASP核心規則集DDoS規則REQUEST-912-DOS- PROTECTION.conf,nginx本身支持配置DDoS限制不支持在審計日志中包含請求和回應主體
以上內容摘自：ModSecurity：一款優秀的開源WAF，
00 Preface
本篇介紹如何在CentOS7.6上安裝ModSecurity，上面的給出的鏈接內容比較雜亂，故重新整理以記錄，
安裝
安裝nginx
如果有nginx，可忽略；如果沒有請參考：RHEL/CentOS 安裝最新版Nginx，
安裝依賴
# yum install epel-release -y# yum install gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre pcre-devel libxml2 libxml2-devel autoconf automake lmdb-devel ssdeep-devel ssdeep-libs lua-devel libmaxminddb-devel git apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev ibpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev -y編譯ModSecurity
我們用的是v3版本，我們在/opt目錄下進行安裝，
# cd /opt/ # 切換到/opt# git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity # 下載# cd ModSecurity/# git submodule init # 初始化# git submodule update # 更新
# ./build.sh
# ./configure
# make
# make install
【注】在執行build.sh會出現如下錯誤，可忽略，
fatal: No names found, cannot describe anything
ModSecurity-nginx連接器
我們現在需要將ModSecurity-nginx編入，
# cd /opt/# git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
# nginx -v # 查看當前nginx版本nginx version: nginx/1.17.5# wget http://nginx.org/download/nginx-1.17.5.tar.gz# tar -xvf nginx-1.17.5.tar.gz# lsModSecurity ModSecurity-nginx nginx-1.17.5 nginx-1.17.5.tar.gz# cd nginx-1.17.5/# ./configure --with-compat --add-dynamic-module=../ModSecurity-nginx # 如果出現不兼容的問題，請去掉--with-compat引數# make modules # 會生成如下*.so# ls ./objs/ngx_http_modsecurity_module.so ./objs/ngx_http_modsecurity_module.so # 查看
# cp ./objs/ngx_http_modsecurity_module.so /etc/nginx/modules/ # 移動位置
# vim /etc/nginx/nginx.conf load_module /etc/nginx/modules/ngx_http_modsecurity_module.so; # 添加到組態檔首行# nginx -t # 測驗通過nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful
測驗
ECHO測驗
新增組態檔：/etc/nginx/conf.d/echo.conf ：
# service nginx start # 啟動nginxRedirecting to /bin/systemctl start nginx.service# vim /etc/nginx/conf.d/echo.conf server { listen localhost:8085; location / { default_type text/plain; return 200 "Thank you for requesting ${request_uri}\n"; }}# nginx -s reload # 多載配置# nginx -t # 檢測nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful
[root@localhost ~]# curl -D - http://localhost:8085HTTP/1.1 200 OKServer: nginx/1.17.5Date: Mon, 18 Nov 2019 05:35:40 GMTContent-Type: text/plainContent-Length: 27Connection: keep-aliveThank you for requesting /[root@localhost ~]# curl -D - http://localhost:8085/notexistHTTP/1.1 200 OKServer: nginx/1.17.5Date: Mon, 18 Nov 2019 05:35:49 GMTContent-Type: text/plainContent-Length: 35Connection: keep-aliveThank you for requesting /notexist
可以看到正常echo，
配置反向代理
新增組態檔：/etc/nginx/conf.d/proxy.conf ，內容如下：
[root@localhost ~]# cat /etc/nginx/conf.d/proxy.conf server { listen 80; location / { proxy_pass http://localhost:8085; proxy_set_header Host $host; }}
因為正常安裝后，nginx是有默認配置的：/etc/nginx/conf.d/default.conf，這個會影響到上面的正常生效，
[root@localhost ~]# mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak[root@localhost ~]# nginx -s reload[root@localhost ~]# nginx -tnginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful
[root@localhost ~]# curl -D - http://localhostHTTP/1.1 200 OKServer: nginx/1.17.5Date: Mon, 18 Nov 2019 05:43:05 GMTContent-Type: text/plainContent-Length: 27Connection: keep-aliveThank you for requesting /[root@localhost ~]# curl -D - http://localhost/noexistHTTP/1.1 200 OKServer: nginx/1.17.5Date: Mon, 18 Nov 2019 05:44:06 GMTContent-Type: text/plainContent-Length: 34Connection: keep-aliveThank you for requesting /noexist[root@localhost ~]#
可以看到訪問默認的80埠，會反向代理到8085埠，
啟用WAF
配置NGINX WAF以通過阻止某些請求來保護演示web應用程式，
[root@localhost ~]# mkdir /etc/nginx/modsec[root@localhost ~]# cd /etc/nginx/modsec[root@localhost modsec]# sudo wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended[root@localhost modsec]# sudo mv modsecurity.conf-recommended modsecurity.conf
修改modsecurity.conf組態檔
[root@localhost modsec]# vim modsecurity.conf # -- Rule engine initialization ----------------------------------------------
...SecRuleEngine On <== 設定為On
修改nginx waf組態檔：/etc/nginx/modsec/main.conf ，添加回應規則，
# cat /etc/nginx/modsec/main.conf # Include the recommended configurationInclude /etc/nginx/modsec/modsecurity.conf# A test ruleSecRule ARGS:testparam "@contains test" "id:1234,deny,log,status:403"
- Include：包括modsecurity.conf檔案中建議的配置，
- SecRule：創建一個規則，當查詢字串中的testparam引數包含字串test時，通過阻止請求并回傳狀態代碼403來保護應用程式，
修改nginx組態檔，來啟用WAF防護，
# cat /etc/nginx/conf.d/proxy.conf server { listen 80; modsecurity on; modsecurity_rules_file /etc/nginx/modsec/main.conf; location / { proxy_pass http://localhost:8085; proxy_set_header Host $host; }}
- modsecurity on：啟用Nginx WAF；
- modsecurity_rules_file：指定規則檔案路徑，
[root@localhost modsec]# cp /opt/ModSecurity/unicode.mapping /etc/nginx/modsec/ # 需要先拷貝下unicode.mapping檔案[root@localhost modsec]# nginx -s reload # 多載配置[root@localhost modsec]# nginx -t # 測驗nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful
測驗引數中帶有test，會被禁止，
[root@localhost modsec]# curl -D - http://localhost/foo?testparam=thisisatestofmodsecurityHTTP/1.1 403 ForbiddenServer: nginx/1.17.5Date: Mon, 18 Nov 2019 05:59:10 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-alive<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.17.5</center></body></html>
日志記錄功能
修改nginx組態檔：/etc/nginx/nginx.conf，
# vim /etc/nginx/nginx.conf load_module /opt/nginx-1.17.5/objs/ngx_http_modsecurity_module.so; # 加載模塊user nginx;worker_processes 1;error_log /var/log/nginx/error.log info; # 將錯誤日志設定為info級別
[root@localhost modsec]# nginx -s reload # 多載配置[root@localhost modsec]# nginx -t # 測驗nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful[root@localhost modsec]# curl -D - http://localhost/foo?testparam=thisisatestofmodsecurity # 再次訪問HTTP/1.1 403 ForbiddenServer: nginx/1.17.5Date: Mon, 18 Nov 2019 06:02:09 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-alive<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.17.5</center></body></html>[root@localhost modsec]# tail -5 /var/log/nginx/error.log # 查看錯誤日志檔案2019/11/18 14:01:57 [notice] 24845#24845: worker process 25847 exited with code 02019/11/18 14:01:57 [notice] 24845#24845: signal 29 (SIGIO) received2019/11/18 14:01:59 [notice] 25880#25880: ModSecurity-nginx v1.0.0 (rules loaded inline/local/remote: 0/7/0)2019/11/18 14:02:09 [error] 25879#25879: *11 [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `thisisatestofmodsecurity' ) [file "/etc/nginx/modsec/main.conf"] [line "4"] [id "1234"] [rev ""] [msg ""] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "127.0.0.1"] [uri "/foo"] [unique_id "157405692985.199277"] [ref "o7,4v19,24"], client: 127.0.0.1, server: , request: "GET /foo?testparam=thisisatestofmodsecurity HTTP/1.1", host: "localhost"2019/11/18 14:02:09 [info] 25879#25879: *11 client 127.0.0.1 closed keepalive connection
參考
ModSecurity：一款優秀的開源WAF
https://www.freebuf.com/sectool/211354.html
Installing NGINX WAF
https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging/#
轉載請註明出處，本文鏈接：https://www.uj5u.com/qiye/6943.html
標籤：訊息安全