一、下載

1.Nginx下載

wget http://nginx.org/download/nginx-1.14.2.tar.gz

2.ModSecurity下載

wget http://www.modsecurity.cn/download/modsecurity/modsecurity-v3.0.4.tar.gz

二、部署

1.Nginx部署

1.1安裝依賴(lài)

yum  install  -y pcre* openssl* gcc c++ make

1.2 編譯安裝
解壓文件

tar  -xvf nginx-1.14.2.tar.gz 
cd nginx-1.14.2/

配置模塊

./configure  --prefix=/usr/local/nginx  --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log  --http-log-path=/var/log/nginx/access.log  --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock  --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre

執(zhí)行編譯

make
make install

創(chuàng)建賬號(hào)和目錄

useradd nginx -s /sbin/nologin
mkdir /var/tmp/nginx/

2.ModSecurity部署

2.1 安裝依賴(lài)

yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake

2.2 編譯安裝
解壓文件

tar -xvf modsecurity-v3.0.4.tar.gz
cd modsecurity-v3.0.4/

編譯安裝

./configure
make
make install
cp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.conf
cp unicode.mapping /usr/local/modsecurity/

3.添加ModSecurity模塊

3.1查看Nginx編譯參數(shù)

/usr/local/nginx/sbin/nginx -V

3.2下載ModSecurity模塊

git clone https://github.com/SpiderLabs/ModSecurity-nginx.git

或至下載
https://github.com/SpiderLabs/ModSecurity-nginx

3.3重新編譯Nginx

解壓模塊

unzip ModSecurity-nginx-master.zip 
#僅在下載安裝包情況下，如果是git clone 則不需要

編譯安裝

./configure  --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre --add-module=../ModSecurity-nginx

 
#此處需要注意/ModSecurity-nginx路徑
make
make install

/usr/local/nginx/sbin/nginx -V #查看已經(jīng)有了ModSecurity模塊

添加配置文件

mkdir /usr/local/nginx/conf/modsecurity
cp /usr/local/modsecurity/modsecurity.conf  /usr/local/nginx/conf/modsecurity/
cp /usr/local/modsecurity/unicode.mapping  /usr/local/nginx/conf/modsecurity/

4.配置Nginx虛擬主機(jī)

4.1虛擬主機(jī)配置

vim /usr/local/nginx/conf/nginx.conf
    modsecurity on;
    modsecurity_rules_file /usr/local/nginx/conf/modsecurity/modsecurity.conf;
    
 #在http節(jié)點(diǎn)添加表示全局配置，在server節(jié)點(diǎn)添加表示為指定網(wǎng)站配置

4.2Modsecurity配置

vim /usr/local/nginx/conf/modsecurity/modsecurity.conf
#更改一下部分
SecRuleEngine On
SecAuditLogParts ABCDEFHZ

#追加到配置文件
Include /usr/local/nginx/conf/modsecurity/crs-setup.conf
Include /usr/local/nginx/conf/modsecurity/rules/*.conf

4.3下載規(guī)則文件

wget http://www.modsecurity.cn/download/corerule/owasp-modsecurity-crs-3.3-dev.zip
#Modsecurity中文網(wǎng)下載
wget https://github.com/coreruleset/coreruleset
#github下載

4.4 配置規(guī)則

unzip owasp-modsecurity-crs-3.3-dev.zip 
cd owasp-modsecurity-crs-3.3-dev/

cp crs-setup.conf.example /usr/local/nginx/conf/modsecurity/crs-setup.conf
cp -r rules /usr/local/nginx/conf/modsecurity/

cd /usr/local/nginx/conf/modsecurity/rules
mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

4.5測(cè)試

#瀏覽器 或 curl訪問(wèn)測(cè)試，返回403
curl -I 'http://localhost/?id=1 AND 1=1'

到此這篇關(guān)于Nginx+ModSecurity安全模塊部署的實(shí)現(xiàn)的文章就介紹到這了,更多相關(guān)Nginx ModSecurity部署內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

標(biāo)簽：湖北湘潭賀州山南懷化黃山煙臺(tái) 通遼

巨人網(wǎng)絡(luò)通訊聲明：本文標(biāo)題《Nginx+ModSecurity安全模塊部署的實(shí)現(xiàn)》，本文關(guān)鍵詞；如發(fā)現(xiàn)本文內(nèi)容存在版權(quán)問(wèn)題，煩請(qǐng)?zhí)峁┫嚓P(guān)信息告之我們，我們將及時(shí)溝通與處理。本站內(nèi)容系統(tǒng)采集于網(wǎng)絡(luò)，涉及言論、版權(quán)與本站無(wú)關(guān)。