Nginx - Modsecurity installation
Would you like to learn how to install the Nginx Modsecurity feature? In this tutorial, we are going to configure the Nginx Modsecurity feature on a computer running Ubuntu Linux.
• Ubuntu 18
• Ubuntu 19
• Ubuntu 20
• Nginx 1.18.0
• ModSecurity 3.0.4
Nginx – Related Tutorial:
On this page, we offer quick access to a list of tutorials related to Nginx.
Tutorial Nginx – ModSecurity installation
Install the Nginx server.
apt-get update
apt-get install nginx
Install the required packages.
apt-get install bison build-essential ca-certificates curl dh-autoreconf doxygen flex gawk git iputils-ping libcurl4-gnutls-dev libexpat1-dev libgeoip-dev liblmdb-dev libpcre3-dev libpcre++-dev libssl-dev libtool libxml2 libxml2-dev libyajl-dev locales lua5.3-dev pkg-config wget zlib1g-dev zlibc
Install the software named SSDEP.
mkdir /downloads
cd /downloads
git clone https://github.com/ssdeep-project/ssdeep
cd ssdeep/
./bootstrap
./configure
make
make install
Download the latest version of ModSecurity.
cd /downloads
git clone https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git checkout -b v3/master origin/v3/master
git submodule init
git submodule update
Compile and install ModSecurity.
sh build.sh
./configure
make
make install
Download the latest version of the Nginx connector for ModSecurity.
cd /downloads
git clone https://github.com/SpiderLabs/ModSecurity-nginx
Verify the version of Nginx installed on your system.
nginx -v
Here is the command output.
nginx version: nginx/1.18.0 (Ubuntu)
Download the source code of the same version of Nginx installed on your system.
cd /downloads
wget http://nginx.org/download/nginx-1.18.0.tar.gz
tar -zxvf nginx-1.18.0.tar.gz
Compile and install the Nginx connector.
cd nginx-1.18.0
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
make modules
cp objs/ngx_http_modsecurity_module.so /usr/share/nginx/modules/
Download and install the ModSecurity Core Rule Set.
cd /downloads
wget https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/v3.2.0.tar.gz
tar -zxvf v3.2.0.tar.gz
mv owasp-modsecurity-crs-3.2.0 owasp-modsecurity-crs
mv owasp-modsecurity-crs/crs-setup.conf.example owasp-modsecurity-crs/crs-setup.conf
mv owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv owasp-modsecurity-crs /usr/local/
Congratulations! You have finished the ModSecurity installation on the Nginx server.
Tutorial Nginx – ModSecurity configuration
Edit the Nginx configuration file.
vi /etc/nginx/nginx.conf
Add the following line in the Nginx configuration file.
load_module modules/ngx_http_modsecurity_module.so;
Here is the file before our configuration.
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
Here is the file after our configuration.
user www-data;
worker_processes auto;
pid /run/nginx.pid;
load_module modules/ngx_http_modsecurity_module.so;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
Create a directory named Modsec and copy the required configuration files.
mkdir -p /etc/nginx/modsec
cp /downloads/ModSecurity/unicode.mapping /etc/nginx/modsec/
cp /downloads/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf
Edit the ModSecurity configuration file.
vi /etc/nginx/modsec/modsecurity.conf
Locate the following lines.
SecRuleEngine DetectionOnly
SecAuditLog /var/log/modsec_audit.log
Change these lines to the following configuration.
SecRuleEngine On
SecAuditLog /var/log/nginx/modsec_audit.log
Here is the file after our configuration.
SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+|/)|text/)xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/json" \
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:400, \
msg:'Multipart request body failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \
"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecTmpDir /tmp/
SecDataDir /tmp/
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/nginx/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecUnicodeMapFile unicode.mapping 20127
SecStatusEngine On
Create a file to enable ModSecurity to use the installed CRS rules.
vi /etc/nginx/modsec/main.conf
Here is the file content.
Include "/etc/nginx/modsec/modsecurity.conf"
Include "/usr/local/owasp-modsecurity-crs/crs-setup.conf"
Include "/usr/local/owasp-modsecurity-crs/rules/*.conf"
Edit the Nginx configuration file for the default website.
vi /etc/nginx/sites-available/default
Add the following line in the Nginx configuration file.
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
Here is the file before our configuration.
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
try_files $uri $uri/ =404;
}
}
Here is the file after our configuration.
server {
listen 80 default_server;
listen [::]:80 default_server;
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
try_files $uri $uri/ =404;
}
}
Restart the Nginx service.
service nginx restart
Optionally, use your browser to send a test request to the Nginx server.
After sending a test request, verify the ModSecurity log
tail -f /var/log/nginx/modsec_audit.log
Congratulations! You have finished the ModSecurity configuration on the Nginx server.
출처 URL : https://techexpert.tips/nginx/nginx-modsecurity-installation/
※위 포스팅이 문제있을 경우 삭제 처리하겠습니다.
댓글 없음:
참고: 블로그의 회원만 댓글을 작성할 수 있습니다.