CentOS 8 搭建ModSecurity開源WAF

ModSecurity簡介

ModSecurity是一個開源的、跨平台的Web應用防火牆（WAF），被稱為WAF界的“瑞士軍刀”。它可以通過檢查Web服務接收到的數據，以及發送出去的數據來對網站進行安全防護。

ModSecurity有以下作用：

• SQL Injection (SQLi)：阻止SQL注入
• Cross Site Scripting (XSS)：阻止跨站腳本攻擊
• Local File Inclusion (LFI)：阻止利用本地文件包含漏洞進行攻擊
• Remote File Inclusione(RFI)：阻止利用遠程文件包含漏洞進行攻擊
• Remote Code Execution (RCE)：阻止利用遠程命令執行漏洞進行攻擊
• PHP Code Injectiod：阻止PHP代碼注入
• HTTP Protocol Violations：阻止違反HTTP協議的惡意訪問
• HTTPoxy：阻止利用遠程代理感染漏洞進行攻擊
• Sshllshock：阻止利用Shellshock漏洞進行攻擊
• Session Fixation：阻止利用Session會話ID不變的漏洞進行攻擊
• Scanner Detection：阻止黑客掃描網站
• Metadata/Error Leakages：阻止源代碼/錯誤信息泄露
• Project Honey Pot Blacklist：蜜罐項目黑名單
• GeoIP Country Blocking：根據判斷IP地址歸屬地來進行IP阻斷

安裝配置 Nginx

安裝Nginx

yum install gcc-c++
yum install -y pcre pcre-devel
yum install -y zlib zlib-devel
yum install -y openssl openssl-devel

如果出現以下錯誤：

No match for argument: pcre-devel

使用以下命令后重新安裝即可

yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

繼續安裝

wget http://nginx.org/download/nginx-1.16.1.tar.gz
tar -xvf nginx-1.16.1.tar.gz -C /usr/local/src/
cd /usr/local/src/nginx-1.16.1
./configure 
make && make install

編寫Nginx啟動腳本

vim /usr/lib/systemd/system/nginx.service
    [Unit]
    Description=nginx - high performance web server
    After=network-online.target remote-fs.target nss-lookup.target
     
    [Service]
    Type=forking
    PIDFile=/usr/local/nginx/logs/nginx.pid
    ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
    ExecReload=/bin/kill -s HUP $MAINPID
    ExecStop=/bin/kill -s TERM $MAINPID
     
    [Install]
    WantedBy=multi-user.target

修改環境PATH

vim /etc/profile.d/nginx.sh
   PATH=/usr/local/nginx/sbin:$PATH
source /etc/profile

安裝libmodsecurity

安裝依賴

yum -y install gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel libtool git autoconf automake libxml2-devel  zlib-devel libgo-devel openssl-devel

cd /usr/local/src
# --depth用於指定克隆深度,為1即表示只克隆最近一次commit
# 克隆指定的分支: git clone -b 分支名 倉庫地址
# --single-branch, 只檢查一個branch，要么是默認的master，要么是-b new_branch指定的new_branch
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git submodule init
git submodule update
./build.sh

這里可能會報錯，無視即可

./configure
make && make install

配置ModSecurity

下載ModSecurity和Nginx的連接器

cd /usr/local/src/
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
cd nginx-1.16.1/
./configure --add-dynamic-module=/usr/local/src/ModSecurity-nginx
make modules
make install
cp objs/ngx_http_modsecurity_module.so '/usr/local/nginx/modules/ngx_http_modsecurity_module.so'

加載Nginx ModSecurity

vim /usr/local/nginx/conf/nginx.conf
# 在頂級區間內加上
  load_module /usr/local/nginx/modules/ngx_http_modsecurity_module.so; 
nginx -t

下載默認的配置文件

cd /usr/local/src
wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended
mv modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf
vim /usr/local/nginx/conf/modsecurity.conf
# 修改SecRuleEngine 
    SecRuleEngine On

配置核心規則

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
cp -R owasp-modsecurity-crs/rules /usr/local/nginx/conf/
cp owasp-modsecurity-crs/crs-setup.conf.example /usr/local/nginx/conf/crs-setup.conf

這里需要輸入yes，直接回車可能后面會報錯

vim /usr/local/nginx/conf/modsecurity.conf
# 在文件最上添加內容
  include crs-setup.conf
  include rules/*.conf

修改nginx的配置文件

vim /usr/local/nginx/conf/nginx.conf
# 放在server下的話，就是全局，如果只要某一個的話，可以放在location中
    modsecurity on;
    modsecurity_rules_file /usr/local/nginx/conf/modsecurity.conf;
​
nginx -t

部分報錯

# 報錯：
nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsecurity.conf. Line: 2. Column: 20. rules/*.conf: Not able to open file. Looking at: 'rules/*.conf', 'rules/*.conf', '/usr/local/nginx/conf/rules/*.conf', '/usr/local/nginx/conf/rules/*.conf'. in /usr/local/nginx/conf/nginx.conf:41
# 重新執行，輸入yes后回車
cp owasp-modsecurity-crs/crs-setup.conf.example /usr/local/nginx/conf/crs-setup.conf
nginx -t
systemctl restart nginx

# 報錯：
nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/rules/REQUEST-910-IP-REPUTATION.conf. Line: 75. Column: 22. This version of ModSecurity was not compiled with GeoIP or MaxMind support.  in /usr/local/nginx/conf/nginx.conf:39
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
# 這里需要查看具體錯誤的配置文件，然后刪除，簡單粗暴
rm -f REQUEST-910-IP-REPUTATION.conf
nginx -t
systemctl restart nginx

結果

正常情況沒有攔截

添加參數/?id =1 and 1=1, 成功攔截

至此環境搭鍵完成，學習於互聯網，但是教程略有報錯，解決后記錄在此

更多操作可移步www.modsecurity.org 或 www.modsecurity.cn