Nginx集成Naxsi模块-白红宇

Naxsi模块的集成，是基于Nginx已经部署了或已经存在系统中。

第一步：下载naxsi

                               
[qiang@localhost home]$ wget  http:
//naxsi
.googlecode.com
/files/naxsi-core-0
.51-1.tgz
          
        

注：如果不能上网可以事先下载，再上传到服务器中。

第二步：解压naxsi

                               
[qiang@localhost home]$ 
tar
-zxvf naxsi-core-0.51-1.tgz

第三步：切换到naxsi-core-0.51-1目录，并复制其配置文件到nginx.conf同目录下

                               
[qiang@localhost naxsi_config]$ 
cp
naxsi_core.rules 
/etc/nginx/naxsi_core
.rules
          
        

修改naxsi_core.rules的配置如下：

                               
##################################
## INTERNAL RULES IDS:1-999     ##
##################################
#@MainRule "msg:weird request, unable to parse" id:1;
#@MainRule "msg:request too big, stored on disk and not parsed" id:2;
#@MainRule "msg:invalid hex encoding, null bytes" id:10;
#@MainRule "msg:unknown content-type" id:11;
#@MainRule "msg:invalid formatted url" id:12;
#@MainRule "msg:invalid POST format" id:13;
#@MainRule "msg:invalid POST boundary" id:14;
##################################
## SQL Injections IDs:1000-1099 ##
##################################
MainRule 
"rx:select|union|update|delete|insert|table|from|ascii|hex|unhex|drop"
"msg:sql keywords"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:8"
id
:1000;
MainRule 
"str:\""
"msg:double quote"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:8,$XSS:8"
id
:1001;
MainRule 
"str:0x"
"msg:0x, possible hex encoding"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:2"
id
:1002;
## Hardcore rules
MainRule 
"str:/*"
"msg:mysql comment (/*)"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:8"
id
:1003;
MainRule 
"str:*/"
"msg:mysql comment (*/)"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:8"
id
:1004;
MainRule 
"str:|"
"msg:mysql keyword (|)"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:8"
id
:1005;
##MainRule "str:&&" "msg:mysql keyword (&&)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;
## end of hardcore rules
MainRule 
"str:--"
"msg:mysql comment (--)"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:4"
id
:1007;
MainRule 
"str:;"
"msg:; in stuff"
"mz:BODY|URL|ARGS"
"s:$SQL:4,$XSS:8"
id
:1008;
MainRule 
"str:="
"msg:equal in var, probable sql/xss"
"mz:ARGS|BODY"
"s:$SQL:2"
id
:1009;
##MainRule "str:(" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;
##MainRule "str:)" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;
MainRule 
"str:'"
"msg:simple quote"
"mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie"
"s:$SQL:4,$XSS:8"
id
:1013;
MainRule 
"str:,"
"msg:, in stuff"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:4"
id
:1015;
MainRule 
"str:#"
"msg:mysql comment (#)"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$SQL:4"
id
:1016;
###############################
## OBVIOUS RFI IDs:1100-1199 ##
###############################
MainRule 
"str:http://"
"msg:http:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1100;
MainRule 
"str:https://"
"msg:https:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1101;
MainRule 
"str:ftp://"
"msg:ftp:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1102;
MainRule 
"str:php://"
"msg:php:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1103;
MainRule 
"str:sftp://"
"msg:sftp:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1104;
MainRule 
"str:zlib://"
"msg:zlib:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1105;
MainRule 
"str:data://"
"msg:data:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1106;
MainRule 
"str:glob://"
"msg:glob:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1107;
MainRule 
"str:phar://"
"msg:phar:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1108;
MainRule 
"str:file://"
"msg:file:// scheme"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$RFI:8"
id
:1109;
#######################################
## Directory traversal IDs:1200-1299 ##
#######################################                                       
MainRule 
"str:.."
"msg:double dot"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:4"
id
:1200;
MainRule 
"str:/etc/passwd"
"msg:obvious probe"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:4"
id
:1202;
MainRule 
"str:c:\\"
"msg:obvious windows path"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:4"
id
:1203;
MainRule 
"str:cmd.exe"
"msg:obvious probe"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:4"
id
:1204;
MainRule 
"str:\\"
"msg:backslash"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:4"
id
:1205;
MainRule 
"str:/"
"msg:slash in args"
"mz:ARGS|BODY|$HEADERS_VAR:Cookie"
"s:$TRAVERSAL:2"
id
:1206;
########################################
## Cross Site Scripting IDs:1300-1399 ##
########################################
MainRule 
"str:<"
"msg:html open tag"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1302;
MainRule 
"str:>"
"msg:html close tag"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1303;
MainRule 
"str:["
"msg:[, possible js"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$XSS:4"
id
:1310;
MainRule 
"str:]"
"msg:], possible js"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$XSS:4"
id
:1311;
MainRule 
"str:~"
"msg:~ character"
"mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie"
"s:$XSS:4"
id
:1312;
MainRule 
"str:`"
"msg:grave accent !"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1314;
MainRule 
"rx:%[2|3]."
"msg:double encoding !"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1315;
MainRule 
"rx:%3[c|e]."
"msg:double encoding !"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1316;
MainRule 
"rx:\\\u003[c|e]"
"msg:tag encoding !"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$XSS:8"
id
:1317;
MainRule 
"str:&#"
"msg: utf7/8 encoding"
"mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie"
"s:$EVADE:4"
id
:1318;
####################################
## Evading tricks IDs: 1400-1500 ##
####################################
MainRule 
"str:&#"
"msg: utf7/8 encoding"
"mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie"
"s:$EVADE:4"
id
:1400;
MainRule 
"str:%U"
"msg: M$ encoding"
"mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie"
"s:$EVADE:4"
id
:1401;
MainRule negative 
"rx:multipart/form-data|application/x-www-form-urlencoded"
"msg:Content is neither mulipart/x-www-form.."
"mz:$HEADERS_VAR:Content-type"
"s:$EVADE:4"
id
:1402;
#############################
## File uploads: 1500-1600 ##
#############################
MainRule 
"rx:.ph|.asp|.ht"
"msg:asp/php file upload!"
"mz:FILE_EXT"
"s:$UPLOAD:8"
id
:1500;
MainRule 
"rx:.jsp"
"msg:asp/php file upload!"
"mz:FILE_EXT"
"s:$UPLOAD:8"
id
:1501;
MainRule 
"rx:.html"
"msg:asp/php file upload!"
"mz:FILE_EXT"
"s:$UPLOAD:8"
id
:1502;
MainRule 
"rx:.php"
"msg:asp/php file upload!"
"mz:FILE_EXT"
"s:$UPLOAD:8"
id
:1503;
          
        

注：（1）nginx.conf所有的目录是在nginx编译安装时，默认的配置是<prefix>/conf/nginx.conf。

（2）鉴于原有的naxsi_core.rules文件中规则不足，最好是采用本文档中的配置规则。

第四步：编译安装Nginx

                               
[qiang@localhost nginx-1.5.7]
#./configure --prefix=/usr
--sbin-path=
/usr/sbin/nginx
--conf-path=
/etc/nginx/nginx
.conf
--add-module=
/home/naxsi-core-0
.51-1
/naxsi_src
--error-log-path=
/var/log/nginx/error
.log
--pid-path=
/var/run/nginx/nginx
.pid
--user=root
--group=root
--with-http_ssl_module
--with-http_flv_module
--with-http_gzip_static_module
--http-log-path=
/var/log/nginx/access
.log
--http-client-body-temp-path=
/var/tmp/nginx/client
--http-proxy-temp-path=
/var/tmp/nginx/proxy
--http-fastcgi-temp-path=
/var/tmp/nginx/fcgi
--with-http_stub_status_module
[root@localhost nginx-1.5.7]
# make && make install
          
        

注：上述的参数可以根据实际情况选择，但是标红的需要有。

第五步：验证nginx是否安装成功

                               
[qiang@localhost nginx-1.5.7]
# nginx
nginx: [warn] low address bits of 192.168.1.65
/26
are meaningless 
in
/etc/nginx/nginx
.conf:78
[qiang@localhost nginx-1.5.7]
# ps -ef |grep nginx
root      3086     1  0 10:53 ?        00:00:00 nginx: master process nginx
root      3087  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3088  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3089  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3090  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3093  3073  4 10:53 pts
/1
00:00:00 
grep
nginx
          
        

第六步：配置过滤条件

切换目录到与nginx.conf同目录下，新建nbs.rules文件。

                               
[qiang@localhost nginx]
# vim nbs.rules
##LearningMode;
#Enables learning mode--stop
SecRulesEnabled;
##Disables learning
##SecRulesDisabled;
DeniedUrl 
"/RequestDenied"
;
## check rules
CheckRule 
"$SQL >= 8"
BLOCK;
CheckRule 
"$RFI >= 8"
BLOCK;
CheckRule 
"$TRAVERSAL >= 8"
BLOCK;
CheckRule 
"$EVADE >= 8"
BLOCK;
CheckRule 
"$XSS >= 8"
BLOCK;
############################################################
##      STOP   ALL   RULES(如果不需要可以关闭全部过滤规则)  ##
############################################################
#BasicRule wl:0;
##################################
## INTERNAL RULES IDS:1-999     ##
##################################
BasicRule wl:1,2,10,11,12,13,14;
##################################
## SQL Injections IDs:1000-1099 ##
##################################
BasicRule wl:1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016;
###############################
## OBVIOUS RFI IDs:1100-1199 ##
###############################
BasicRule wl:1100,1101,1102,1103,1104,1105,1106,1107,1108,1109;
#######################################
## Directory traversal IDs:1200-1299 ##
#######################################
BasicRule wl:1200,1202,1203,1204,1205,1206;
########################################
## Cross Site Scripting IDs:1300-1399 ##
########################################
BasicRule wl:1310,1311,1312,1313,1314,1315,1318;
####################################
## Evading tricks IDs: 1400-1500 ##
####################################
BasicRule wl:1400,1401,1402;
#############################
## File uploads: 1500-1600 ##
#############################
BasicRule wl:1500,1501,1502,1503;
          
        

注：该nbs.rules文件的规则需要根据不同的业务应用制定。

第七步：配置nginx.conf

                               
http { 
    
include       naxsi_core.rules;
    
include       mime.types;
    
default_type  application
/octet-stream
;
    
.......
    
server { 
        
listen       80;
        
server_name  localhost centoshost.com;
        
charset utf-8;
        
.......
        
location 
/wavsep/
{ 
            
.......
            
include nbs.rules;
            
.......
        
}
        
location 
/RequestDenied
{ 
            
error_page  404  
/404
.html;
        
}

第九步：重启nginx

                               
[qiang@localhost nginx]
# nginx -t -c /etc/nginx/nginx.conf
nginx: [warn] low address bits of 192.168.1.65
/26
are meaningless 
in
/etc/nginx/nginx
.conf:78
nginx: the configuration 
file
/etc/nginx/nginx
.conf syntax is ok
nginx: configuration 
file
/etc/nginx/nginx
.conf 
test
is successful
[qiang@localhost nginx]
# nginx -s reload
nginx: [warn] low address bits of 192.168.1.65
/26
are meaningless 
in
/etc/nginx/nginx
.conf:78
          
        

第十步：测试拦截规则是否启用

本文转自梦朝思夕 51CTO博客，原文链接:http://blog.51cto.com/qiangmzsx/1380566