Implementation of Nginx+ModSecurity security module deployment
|
To demonstrate the situation where Nginx is installed but ModSecurity is not added, the following operations are to install Nginx first and then add the ModSecurity module. ModSecurity is an open source cross-platform Web Application Firewall (WAF) engine that is perfectly compatible with nginx. It is the WAF officially recommended by nginx and supports OWASP rules. Chinese website: http://www.modsecurity.cn For practical application, please refer to: http://www.modsecurity.cn/practice/ 1. Download 1. Download Nginx wget http://nginx.org/download/nginx-1.14.2.tar.gz 2. ModSecurity Download wget http://www.modsecurity.cn/download/modsecurity/modsecurity-v3.0.4.tar.gz 2. Deployment 1.Nginx deployment 1.1 Installation Dependencies yum install -y pcre* openssl* gcc c++ make 1.2 Compile and install the decompressed files tar -xvf nginx-1.14.2.tar.gz cd nginx-1.14.2/ Configuration Module ./configure --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre Execute Compilation make make install Create an account and directory useradd nginx -s /sbin/nologin mkdir /var/tmp/nginx/ 2. ModSecurity deployment 2.1 Installation Dependencies yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake 2.2 Compile and install the decompressed files tar -xvf modsecurity-v3.0.4.tar.gz cd modsecurity-v3.0.4/ Compile and install ./configure make make install cp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.conf cp unicode.mapping /usr/local/modsecurity/ 3. Add ModSecurity module 3.1 View Nginx compilation parameters /usr/local/nginx/sbin/nginx -V 3.2 Download ModSecurity module git clone https://github.com/SpiderLabs/ModSecurity-nginx.git Or download from https://github.com/SpiderLabs/ModSecurity-nginx 3.3 Recompile Nginx Decompression module unzip ModSecurity-nginx-master.zip #Only when downloading the installation package, not required if it is git clone Compile and install ./configure --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre --add-module=../ModSecurity-nginx #Note here/ModSecurity-nginx path make make install /usr/local/nginx/sbin/nginx -V #Check that the ModSecurity module is already available Add a profile mkdir /usr/local/nginx/conf/modsecurity cp /usr/local/modsecurity/modsecurity.conf /usr/local/nginx/conf/modsecurity/ cp /usr/local/modsecurity/unicode.mapping /usr/local/nginx/conf/modsecurity/ 4. Configure Nginx virtual host 4.1 Virtual Host Configuration
vim /usr/local/nginx/conf/nginx.conf
modsecurity on;
modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf;
#Adding to the http node indicates global configuration, and adding to the server node indicates configuration for a specific website 4.2Modsecurity Configuration vim /usr/local/nginx/conf/modsecurity/modsecurity.conf #Change the following part SecRuleEngine On SecAuditLogParts ABCDEFHZ #Append to the configuration file Include /usr/local/nginx/conf/modsecurity/crs-setup.conf Include /usr/local/nginx/conf/modsecurity/rules/*.conf 4.3 Download rule files wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip #ModsecurityChinese website download wget https://github.com/coreruleset/coreruleset #github download 4.4 Configuration Rules unzip owasp-modsecurity-crs-3.3-dev.zip cd owasp-modsecurity-crs-3.3-dev/ cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.conf cp -r rules /usr/local/nginx/conf/modsecurity/ cd /usr/local/nginx/conf/modsecurity/rules mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf 4.5 Testing #Browser or curl access test, return 403 curl -I 'http://localhost/?id=1 AND 1=1' This is the end of this article about the implementation of Nginx+ModSecurity security module deployment. For more relevant Nginx ModSecurity deployment content, please search for previous articles on 123WORDPRESS.COM or continue to browse the following related articles. I hope everyone will support 123WORDPRESS.COM in the future! You may also be interested in:
|
<<: How to handle super large form examples with Vue+ElementUI
>>: MySQL Series 13 MySQL Replication
Recommend
Detailed explanation of the idea of implementing dynamic columns in angularjs loop object properties
Angularjs loop object properties to achieve dynam...
Best way to replace the key in json object
JSON (JavaScript Object Notation, JS Object Notat...
Vue implements tree table through element tree control
Table of contents Implementation effect diagram I...
Detailed explanation of data types and schema optimization in MySQL
I'm currently learning about MySQL optimizati...
H tags should be used reasonably in web page production
HTML tags have special tags to handle the title of...
Learn more about using regular expressions in JavaScript
Table of contents 1. What is a regular expression...
Is a design that complies with design specifications a good design?
In the past few years of my career, I have writte...
In-depth analysis of MySQL 8.0 redo log
Table of contents Preface Generation of redo log ...
How to update v-for in Vue
Tips: Array change method will cause v-for to upd...
Detailed discussion of MySQL stored procedures and stored functions
1 Stored Procedure 1.1 What is a stored procedure...
Detailed explanation of the usage of the ESCAPE keyword in MySQL
MySQL escape Escape means the original semantics ...
How to implement Hover drop-down menu with CSS
As usual, today I will talk about a very practica...
Simple summary of tomcat performance optimization methods
Tomcat itself optimization Tomcat Memory Optimiza...
CSS3 realizes the childhood paper airplane
Today we are going to make origami airplanes (the...
How to implement load balancing in MySQL
Preface MySQL is a high-speed, high-performance, ...