nginx-整合modsecurity做waf
下面以 CentOS 7、Nginx 1.16.1（Yum 安装版）为例，完整演示如何安装 ModSecurity 3（libmodsecurity + nginx connector）并以动态模块方式加载到 Nginx。
包地址
规则地址：Release v4.14.0 · coreruleset/coreruleset · GitHub
包地址：GitHub - owasp-modsecurity/ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. - owasp-modsecurity/ModSecurity
https://github.com/owasp-modsecurity/ModSecurity
NGINX地址：https://github.com/owasp-modsecurity/ModSecurity-nginx
一、安装编译依赖
sudo yum groupinstall -y "Development Tools"
sudo yum install -y \
pcre-devel \
yajl-devel \
curl-devel \
zlib-devel \
openssl-devel \
wget \
git \
libtool \
autoconf \
automake
二、编译并安装 libmodsecurity (ModSecurity 3)
-
克隆源码
cd /usr/local/src git clone --depth 1 -b v3/master https://github.com/SpiderLabs/ModSecurity cd ModSecurity -
生成构建脚本
git submodule init git submodule update ./build.sh ./configure -
编译并安装
make sudo make install默认会把库安装到
/usr/local/modsecurity，并在/usr/local/lib放libmodsecurity.so。
三、下载 ModSecurity-nginx Connector
cd /usr/local/src
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
四、下载 Nginx 1.16.1 源码并解压（本机已经yum安装了NGINX）
cd /usr/local/src
wget http://nginx.org/download/nginx-1.16.1.tar.gz
tar zxvf nginx-1.16.1.tar.gz
五、编译 nginx 动态模块
-
进入源码目录：
cd nginx-1.16.1 -
提取当前编译参数（可从
nginx -V手动拷贝，这里假设你已经记录）：# 下面示例仅为定位，实际请替换成你自己的 configure args CONFIG_ARGS="\ --prefix=/etc/nginx \ --sbin-path=/usr/sbin/nginx \ --modules-path=/usr/lib64/nginx/modules \ --conf-path=/etc/nginx/nginx.conf \ --with-compat \ --with-http_ssl_module \ --with-http_stub_status_module \ --with-http_v2_module \ --with-threads \ --with-stream \ --with-stream_realip_module \ --with-http_realip_module \ --with-file-aio \ --with-http_slice_module \ --with-http_gzip_static_module \ --with-http_auth_request_module \ --with-http_sub_module \ --with-mail \ --with-mail_ssl_module \ --with-stream_ssl_module \ --with-stream_ssl_preread_module \ --with-http_addition_module \ --with-http_auth_request_module \ --with-http_dav_module \ --with-http_flv_module \ --with-http_gunzip_module \ --with-http_mp4_module \ --with-http_random_index_module \ --with-http_secure_link_module \ --with-stream \ --with-cc-opt='-O2 -g -pipe -Wall' \ --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'" -
配置编译，指定 ModSecurity-nginx 目录作为动态模块：
./configure $CONFIG_ARGS \ --add-dynamic-module=/usr/local/src/ModSecurity-nginx -
仅编译模块
make编译完成后，模块文件在
objs/ngx_http_modsecurity_module.so。 -
安装模块
sudo cp objs/ngx_http_modsecurity_module.so /usr/lib64/nginx/modules/ cp objs/nginx /usr/sbin/nginx ###检查yum安装NGINX是否已经编译了动态包 nginx -V nginx version: nginx/1.16.1 built by gcc 8.3.1 20190311 (Red Hat 8.3.1-3) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie' --add-dynamic-module=/usr/local/src/ModSecurity-nginx
六、加载 ModSecurity 模块并配置
-
在
/etc/nginx/nginx.conf顶部（worker_processes之前）加入：load_module modules/ngx_http_modsecurity_module.so; -
在
http {}块里添加：modsecurity on; modsecurity_rules_file /etc/nginx/modsec/main.conf; -
创建 ModSecurity 主配置
/etc/nginx/modsec/main.conf，可先复制示例：sudo mkdir -p /etc/nginx/modsec sudo cp /usr/local/src/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf sudo cp /usr/local/src/ModSecurity/unicode.mapping /etc/nginx/modsec/ -
在
main.conf（或一个单独的 rules 文件）里，打开检测并加载你需要的规则，例如：Include /etc/nginx/modsec/modsecurity.conf # /etc/nginx/modsec/main.conf # 2. 为每个 IP 初始化持久化集合 （Phase 1） SecAction \ "id:1000001,\ phase:1,\ nolog,\ pass,\ initcol:ip=%{REMOTE_ADDR}" # 3. 对已封禁 IP 立即拒绝连接 （Phase 1） SecRule IP:cc_block "@eq 1" \ "id:1000002,\ phase:1,\ log,\ msg:'CC drop: %{REMOTE_ADDR} in block period',\ deny,\ status:444" # 4. 只对目标 URI 计数 （Phase 2） SecRule REQUEST_URI "@streq /w/ww" \ "id:1000003,\ phase:2,\ nolog,\ pass,\ setvar:ip.cc_counter=+1,\ expirevar:ip.cc_counter=60" # 5. 超出阈值则封禁并拒绝本次请求 （Phase 2） SecRule IP:cc_counter "@gt 30" \ "id:1000004,\ phase:2,\ log,\ msg:'CC threshold exceeded for %{REMOTE_ADDR}',\ setvar:ip.cc_block=1,\ expirevar:ip.cc_block=600,\ deny,\ status:444"
5.将防火墙配置文件加载到nginx中
#打开配置：
vim /etc/nginx/modsec/modsecurity.conf
注释：#SecRuleEngine DetectionOnly
添加：SecRuleEngine On
注释：#SecAuditLogParts ABIJDEFHZ
添加：SecAuditLogParts ABCDEFHZ
七、启动并验证
sudo nginx -t
sudo systemctl enable --now nginx
-
检查模块加载：
nginx -V 2>&1 | grep modsecurity -
模拟 CC 攻击，查看第 31 次后连接被直接丢弃且不返回响应。
-
for i in {1..40}; do curl -s -o /dev/null -w "%{http_code}\n" http://ip/w/ww; done
检查日志/var/log/modsec_audit.log:
ModSecurity: Access denied with code 444 (phase 1). Matched "Operator `Eq' with parameter
这样就防御成功。
八、消除NGINX日志记录和加载默认规则
看着NGINX的日志还是记录444，这样看着不舒服
http {
# … 你原有的 modsecurity 配置 …
# 1. 把 444 的响应标记为不写日志
map $status $loggable {
default 1;
444 0;
}
# 2. 把 access_log 加上 if 条件
access_log /var/log/nginx/access.log main if=$loggable;
# 后面不变
server {
listen 8080;
location = /w/ww/ {
# 不需要再 if($modsec_forbidden)，
# 只要返回 444，就不记录日志，ModSecurity 已经 drop 了
proxy_pass http://backend;
}
# 其它 location …
}
}
使用默认规则拦截：
wget https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.14.0.zip
unzip v4.14.0.zip
cd coreruleset-4.14.0/
cp crs-setup.conf.example /etc/nginx/modsec/
cp -r rules/ /etc/nginx/modsec/
cd /etc/nginx/modsec/
mv crs-setup.conf.example crs-setup.conf
vim main.conf
加入：Include /etc/nginx/modsec/crs-setup.conf
Include /etc/nginx/modsec/rules/*.conf
重启NGINX就可以使用默认规则拦截
最终配置/etc/nginx：
####cat nginx.conf
user nginx;
load_module modules/ngx_http_modsecurity_module.so;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
map $status $loggable {
default 1;
444 0;
}
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
######cat modsec/main.conf
Include /etc/nginx/modsec/modsecurity.conf
Include /etc/nginx/modsec/crs-setup.conf
Include /etc/nginx/modsec/rules/*.conf
# 1. 为每个 IP 初始化持久化集合 （Phase 1）
SecAction \
"id:1000001,\
phase:1,\
nolog,\
pass,\
initcol:ip=%{REMOTE_ADDR},\
initcol:global=global"
# 2. 对已封禁 IP 立即拒绝连接 （Phase 1）
SecRule IP:cc_block "@eq 1" \
"id:1000002,\
phase:1,\
log,\
msg:'CC drop: %{REMOTE_ADDR} in block period',\
deny,\
status:444"
# 3. 只对目标 URI 计数 （Phase 2）
SecRule REQUEST_URI "@streq /w/ww" \
"id:1000003,\
phase:2,\
nolog,\
pass,\
setvar:ip.cc_counter=+1,\
expirevar:ip.cc_counter=60"
# 4. 超出阈值则封禁并拒绝本次请求 （Phase 2）
SecRule IP:cc_counter "@gt 30" \
"id:1000004,\
phase:2,\
log,\
msg:'CC threshold exceeded for %{REMOTE_ADDR}',\
setvar:ip.cc_block=1,\
expirevar:ip.cc_block=600,\
deny,\
status:444"
