Linux下Nginx服务器配置Modsecurity实现Web应用防护系统

说明：
操作系统：CentOS
Nginx安装目录：/usr/local/nginx
需求：增加Modsecurity模块，实现Nginx服务器Web应用防护系统
开始操作：
一、安装ModSecurity
cd /usr/local/src
wget https://www.modsecurity.org/tarball/2.9.1/modsecurity-2.9.1.tar.gz #下载软件
yum install httpd-devel #modsecurity安装需要APXS包，APXS在httpd-devel中
cd /usr/local/src
tar zxvf modsecurity-2.9.1.tar.gz
cd modsecurity-2.9.1
./autogen.sh
./configure --enable-standalone-module --disable-mlogc
make
安装过程报错，提示没有pcre解决办法
yum install pcre pcre-devel
安装过程报错，提示没有libxml2解决办法
yum install libxml2 libxml2-devel
二、编译nginx并添加modsecurity模块
查看nginx编译参数：/usr/local/nginx/sbin/nginx -V
添加modsecurity模块重新编译nginx：
cd /usr/local/src/nginx-1.10.1
./configure --prefix=/usr/local/nginx --without-http_memcached_module --user=www --group=www --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-openssl=/usr/local/src/openssl-1.0.2j --with-zlib=/usr/local/src/zlib-1.2.8 --with-pcre=/usr/local/src/pcre-8.39 --add-module=/usr/local/src/modsecurity-2.9.1/nginx/modsecurity/
make
make install
三、下载OWASP规则
cd /usr/local/src
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs mv owasp-modsecurity-crs /usr/local/nginx/conf #移动到nginx配置目录下
cd /usr/local/nginx/conf/owasp-modsecurity-crs



cp crs-setup.conf.example crs-setup.conf #拷贝模板配置文件
cd /usr/local/src/modsecurity-2.9.1
cp modsecurity.conf-recommended /usr/local/nginx/conf #拷贝配置文件
cp unicode.mapping /usr/local/nginx/conf #拷贝配置文件
mv /usr/local/nginx/conf/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf #重命名
vi /usr/local/nginx/conf/modsecurity.conf #修改添加
SecRuleEngine DetectionOnly #修改为SecRuleEngine On
#Include owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
#Include owasp-modsecurity-crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
#Include owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
#Include owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
#Include owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
#Include owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
#Include owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
#Include owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
#Include owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
Include owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
Include owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
Include owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
Include owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
Include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
#Include owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
#Include owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
Include owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
Include owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
Include owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
Include owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
Include owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
#Include owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
Include owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
Include owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
Include owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
:wq! #保存退出
四、配置nginx支持Modsecurity
在需要启用modsecurity的主机的location下面加入下面两行即可：



ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
service nginx restart #重启nginx使配置生效
五、规则测试
可以写一个php页面进行测试
具体规则如下：



至此，Linux下Nginx服务器配置Modsecurity实现Web应用防护系统教程完成。