窮得只剩技術

之前有寫過如何自己Compile Nginx + Modsecurity

這次在官方網站上看到一篇

不需要重新compile nginx

只需要把 modsecurity compile 成 module 就可以用的方案

這對使用 yum 安裝 nginx 的人來說才是最好的方案

但安裝過程中

發現 yum 官方 repo 提供的 nginx 版本太低

不支援 –with-compat 的參數 (最低要求是1.11.5)

所以必須使用 nginx 官方 repo 來安裝 nginx

才會是最新的 stable 版本

安裝官方 nginx

先在/etc/yum.repos.d新增一個nginx.repo的檔案

並加入以下內容

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=0
enabled=1

這樣在 yum install nginx 的時候就會是最新的stable version

安裝依賴套件

yum install -y epel-release
yum groupinstall -y 'Development Tools' 

yum install -y git lmdb lmdb-devel libxml2 libxml2-devel pcre pcre-devel curl libcurl-devel GeoIP GeoIP-devel yajl yajl-devel

Compile Modsecurity Lib

先 clone

git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity

安裝

cd ModSecurity
git submodule init
git submodule update
./build.sh
./configure
make
make install

在 build.sh 的時候會出現像錯誤的訊息

fatal: No names found, cannot describe anything.

不用管他

下載 nginx 與 modsecurity-nginx connector

git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git

下載 nginx 的 source 之前要看自己的 nginx 版本

nginx -v

可以看到

目前stable版本是 1.12.1

所以就下載 1.12.1的source

wget https://nginx.org/download/nginx-1.12.1.tar.gz
tar zxvf nginx-1.12.1.tar.gz

進入source並compile mod security module

cd nginx-1.12.1
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
make modules
cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules

設定 modsecurity

在 /etc/nginx/nginx.conf 加入 load_module

load_module modules/ngx_http_modsecurity_module.so;

接下來就跟官方那邊教學會不一樣

我就按照之前我寫的那篇

把OWASP TOP 10的rule都加進去

Modsecurity 基本設定

cp ModSecurity/modsecurity.conf-recommended /etc/nginx/modsecurity.conf

sed -ie 's/SecRuleEngine DetectionOnly/SecRuleEngine On/g' /etc/nginx/modsecurity.conf
sed -ie 's/SecPcreMatchLimit .*$/SecPcreMatchLimit 150000/g' /etc/nginx/modsecurity.conf
sed -ie 's/SecPcreMatchLimitRecursion .*$/SecPcreMatchLimitRecursion 150000/g' /etc/nginx/modsecurity.conf
sed -ie 's/SecAuditLogType Serial/SecAuditLogType Concurrent/g' /etc/nginx/modsecurity.conf
sed -ie "/^SecAuditLogType Concurrent$/aSecAuditLogStorageDir \/var\/log\/nginx" /etc/nginx/modsecurity.conf

OWASP TOP 10

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
mv owasp-modsecurity-crs /etc/nginx
cd /etc/nginx/owasp-modsecurity-crs
cp crs-setup.conf.example crs-setup.conf
sed -ie 's/SecDefaultAction "phase:1,log,auditlog,pass"/#SecDefaultAction "phase:1,log,auditlog,pass"/g' crs-setup.conf
sed -ie 's/SecDefaultAction "phase:2,log,auditlog,pass"/#SecDefaultAction "phase:2,log,auditlog,pass"/g' crs-setup.conf
sed -ie 's/#.*SecDefaultAction "phase:1,log,auditlog,deny,status:403"/SecDefaultAction "phase:1,log,auditlog,deny,status:403"/g' crs-setup.conf
sed -ie 's/# SecDefaultAction "phase:2,log,auditlog,deny,status:403"/SecDefaultAction "phase:2,log,auditlog,deny,status:403"/g' crs-setup.conf
cat <<EOT >> /etc/nginx/modsecurity.conf
Include owasp-modsecurity-crs/crs-setup.conf
Include owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
Include owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
Include owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
Include owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
Include owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
Include owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
Include owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
Include owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
Include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
Include owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
Include owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
Include owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
Include owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
Include owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
EOT

開啟Modsecurity

在要啟動 Modsecurity 的 server 區塊內

加入以下設定

server {
    ....
    ....
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity.conf;
}

最後記得把 /var/log/nginx 資料夾 owner 改成nginx

這樣發生問題 modsecurity才能寫log進去喔