| 为演示已安装Nginx而未添加ModSecurity的情况，以下操作为先安装Nginx，后添加ModSecurity模块。 ModSecurity是一个开源的跨平台Web应用程序防火墙（WAF）引擎，，完美兼容nginx，是nginx官方推荐的WAF，并且支持支持OWASP规则。 中文网站：http://www.modsecurity.cn 应用实战可参考：http://www.modsecurity.cn/practice/
一、下载
1.Nginx下载
wget http://nginx.org/download/nginx-1.14.2.tar.gz 2.ModSecurity下载
wget http://www.modsecurity.cn/download/modsecurity/modsecurity-v3.0.4.tar.gz
二、部署
1.Nginx部署
1.1安装依赖
yum install -y pcre* openssl* gcc c++ make 1.2 编译安装
解压文件
tar -xvf nginx-1.14.2.tar.gz cd nginx-1.14.2/ 配置模块 ./configure --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre 执行编译
创建账号和目录
useradd nginx -s /sbin/nologinmkdir /var/tmp/nginx/
2.ModSecurity部署
2.1 安装依赖
yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake 2.2 编译安装
解压文件
tar -xvf modsecurity-v3.0.4.tar.gzcd modsecurity-v3.0.4/ 编译安装
./configuremakemake installcp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.confcp unicode.mapping /usr/local/modsecurity/
3.添加ModSecurity模块
3.1查看Nginx编译参数
/usr/local/nginx/sbin/nginx -V 3.2下载ModSecurity模块
git clone https://github.com/SpiderLabs/ModSecurity-nginx.git或至下载https://github.com/SpiderLabs/ModSecurity-nginx 3.3重新编译Nginx
解压模块
unzip ModSecurity-nginx-master.zip #仅在下载安装包情况下，如果是git clone 则不需要 编译安装
./configure --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre --add-module=../ModSecurity-nginx #此处需要注意/ModSecurity-nginx路径makemake install/usr/local/nginx/sbin/nginx -V #查看已经有了ModSecurity模块 添加配置文件
mkdir /usr/local/nginx/conf/modsecuritycp /usr/local/modsecurity/modsecurity.conf /usr/local/nginx/conf/modsecurity/cp /usr/local/modsecurity/unicode.mapping /usr/local/nginx/conf/modsecurity/
4.配置Nginx虚拟主机
4.1虚拟主机配置
vim /usr/local/nginx/conf/nginx.conf modsecurity on; modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf; #在http节点添加表示全局配置，在server节点添加表示为指定网站配置 4.2Modsecurity配置
vim /usr/local/nginx/conf/modsecurity/modsecurity.conf#更改一下部分SecRuleEngine OnSecAuditLogParts ABCDEFHZ#追加到配置文件Include /usr/local/nginx/conf/modsecurity/crs-setup.confInclude /usr/local/nginx/conf/modsecurity/rules/*.conf 4.3下载规则文件
wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip#Modsecurity中文网下载wget https://github.com/coreruleset/coreruleset#github下载 4.4 配置规则
unzip owasp-modsecurity-crs-3.3-dev.zip cd owasp-modsecurity-crs-3.3-dev/cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.confcp -r rules /usr/local/nginx/conf/modsecurity/cd /usr/local/nginx/conf/modsecurity/rulesmv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.confmv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf 4.5测试
#浏览器 或 curl访问测试，返回403curl -I 'http://localhost/?id=1 AND 1=1'
下载地址:
Web应用中设置Context Path案例详解
503 service unavailable错误解决方案讲解 |
