其他分享
首页 > 其他分享> > modsecurity安装

modsecurity安装

作者:互联网

Centos下nginx+Modsecurity安装:https://www.jianshu.com/p/93e310e12036
https://www.oschina.net/p/modsecurity?hmsr=aladdin1e1
http://www.modsecurity.cn/practice/post/23.html

http://www.modsecurity.cn/chm/pmFromFile.html

一,安装依赖:

# yum instal l-y gitwgetepel-releasegcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake

# yum install gcc-c++

二,安装MS:

# cd /usr/local
# git clone https://github.com/SpiderLabs/ModSecurity

# cd ModSecurity

# git checkout -b v3/master origin/v3/master      

# git submodule init                              

# git submodule update

# sh build.sh

# ./configure

# make

# makeinstall

三,安装nginx与ModSecurity-nginx连接器:

# cd /usr/local

# git clone https://github.com/SpiderLabs/ModSecurity-nginx

# wget wget http://nginx.org/download/nginx-1.18.0.tar.gz

# tar -xvzf nginx-1.18.0.tar.gz

# cd /usr/local/nginx-1.18.0

# ./configure --add-module=/usr/local/ModSecurity-nginx

# make && make install

四,模拟攻击,测试未启动MS时的访问效果:

启动nginx:
# /usr/local/nginx/sbin/nginx

访问URL地址:
http://10.20.192.36/?param=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

未拦截效果:

五、配置MS:

# mkdir /usr/local/nginx/conf/modsecurity            

# cp /usr/local/Modsecurity/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity/modsecurity.conf

#cp /usr/local/Modsecurity/unicode.mapping /usr/local/nginx/conf/modsecurity/

#cd /usr/local/

# wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip
# unzip owasp-modsecurity-crs-3.3-dev.zip
# cd owasp-modsecurity-crs-3.3-dev

#cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.conf

#cp -rf /usr/local/owasp-modsecurity-crs-3.3-dev/rules /usr/local/nginx/conf/modsecurity/

# cd /usr/local/nginx/conf/modsecurity/

# mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf                 
# mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf


编辑:vi nginx.conf
在http或server节点中添加以下内容:

modsecurity on;
modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf;

编辑:vi modsecurity.conf
SecRuleEngine DetectionOnly 改为 SecRuleEngine On

然后添加以下内容:
Include /usr/local/nginx/conf/modsecurity/crs-setup.conf
Include /usr/local/nginx/conf/modsecurity/rules/*.conf

六,重新加载Nginx测试效果:
# /usr/local/nginx/sbin/nginx -s reload

重新攻击访问:
http://10.20.192.36/?param=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

查看nginx日志:
tailf /usr/local/nginx/logs/access.log


七、modSecurity规则指令编写:
1、一个简单的规则

在/usr/local/nginx/conf/modsecurity/rules 目录下创建wz.conf,添加规则
SecRule ARGS "(testwwd)+" \
    "msg:'wwd22 test',\
    id:300102,\
    phase:request,\
    deny,\
    status:503"

# /usr/local/nginx/sbin/nginx -s reload

测试:http://10.20.192.36/?test=testwwd

标签:local,modsecurity,devel,nginx,usr,conf,安装
来源: https://www.cnblogs.com/gufengchen/p/14998610.html