Nginx集成Naxsi模块-阿里云开发者社区

Naxsi模块的集成，是基于Nginx已经部署了或已经存在系统中。

第一步：下载naxsi

[qiang@localhost home]$ wget  http://naxsi.googlecode.com/files/naxsi-core-0.51-1.tgz

注：如果不能上网可以事先下载，再上传到服务器中。

第二步：解压naxsi

[qiang@localhost home]$ tar -zxvf naxsi-core-0.51-1.tgz

第三步：切换到naxsi-core-0.51-1目录，并复制其配置文件到nginx.conf同目录下

[qiang@localhost naxsi_config]$ cp naxsi_core.rules /etc/nginx/naxsi_core.rules

修改naxsi_core.rules的配置如下：

##################################
## INTERNAL RULES IDS:1-999     ##
##################################
#@MainRule "msg:weird request, unable to parse" id:1;
#@MainRule "msg:request too big, stored on disk and not parsed" id:2;
#@MainRule "msg:invalid hex encoding, null bytes" id:10;
#@MainRule "msg:unknown content-type" id:11;
#@MainRule "msg:invalid formatted url" id:12;
#@MainRule "msg:invalid POST format" id:13;
#@MainRule "msg:invalid POST boundary" id:14;
##################################
## SQL Injections IDs:1000-1099 ##
##################################

MainRule "rx:select|union|update|delete|insert|table|from|ascii|hex|unhex|drop" "msg:sql keywords" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1000;

MainRule "str:\"" "msg:double quote" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8,$XSS:8" id:1001;

MainRule "str:0x" "msg:0x, possible hex encoding" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:2" id:1002;
## Hardcore rules

MainRule "str:/*" "msg:mysql comment (/*)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1003;

MainRule "str:*/" "msg:mysql comment (*/)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1004;

MainRule "str:|" "msg:mysql keyword (|)"  "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1005;
##MainRule "str:&&" "msg:mysql keyword (&&)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;
## end of hardcore rules

MainRule "str:--" "msg:mysql comment (--)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1007;

MainRule "str:;" "msg:; in stuff" "mz:BODY|URL|ARGS" "s:$SQL:4,$XSS:8" id:1008;

MainRule "str:=" "msg:equal in var, probable sql/xss" "mz:ARGS|BODY" "s:$SQL:2" id:1009;
##MainRule "str:(" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;
##MainRule "str:)" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;

MainRule "str:'" "msg:simple quote" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1013;

MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;

MainRule "str:#" "msg:mysql comment (#)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1016;
###############################
## OBVIOUS RFI IDs:1100-1199 ##
###############################

MainRule "str:http://" "msg:http:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1100;

MainRule "str:https://" "msg:https:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1101;

MainRule "str:ftp://" "msg:ftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1102;

MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1103;

MainRule "str:sftp://" "msg:sftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;

MainRule "str:zlib://" "msg:zlib:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;

MainRule "str:data://" "msg:data:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1106;

MainRule "str:glob://" "msg:glob:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1107;

MainRule "str:phar://" "msg:phar:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1108;

MainRule "str:file://" "msg:file:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1109;
#######################################
## Directory traversal IDs:1200-1299 ##
#######################################                                       

MainRule "str:.." "msg:double dot" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;

MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;

MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;

MainRule "str:cmd.exe" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1204;

MainRule "str:\\" "msg:backslash" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1205;

MainRule "str:/" "msg:slash in args" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1206;
########################################
## Cross Site Scripting IDs:1300-1399 ##
########################################

MainRule "str:<" "msg:html open tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1302;

MainRule "str:>" "msg:html close tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1303;

MainRule "str:[" "msg:[, possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1310;

MainRule "str:]" "msg:], possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1311;

MainRule "str:~" "msg:~ character" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1312;

MainRule "str:`"  "msg:grave accent !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1314;

MainRule "rx:%[2|3]."  "msg:double encoding !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1315;

MainRule "rx:%3[c|e]."  "msg:double encoding !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1316;

MainRule "rx:\\\u003[c|e]"  "msg:tag encoding !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1317;

MainRule "str:&#" "msg: utf7/8 encoding" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1318;
####################################
## Evading tricks IDs: 1400-1500 ##
####################################

MainRule "str:&#" "msg: utf7/8 encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1400;

MainRule "str:%U" "msg: M$ encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1401;

MainRule negative "rx:multipart/form-data|application/x-www-form-urlencoded" "msg:Content is neither mulipart/x-www-form.." "mz:$HEADERS_VAR:Content-type" "s:$EVADE:4" id:1402;
#############################
## File uploads: 1500-1600 ##
#############################

MainRule "rx:.ph|.asp|.ht" "msg:asp/php file upload!" "mz:FILE_EXT" "s:$UPLOAD:8" id:1500;

MainRule "rx:.jsp" "msg:asp/php file upload!" "mz:FILE_EXT" "s:$UPLOAD:8" id:1501;

MainRule "rx:.html" "msg:asp/php file upload!" "mz:FILE_EXT" "s:$UPLOAD:8" id:1502;

MainRule "rx:.php" "msg:asp/php file upload!" "mz:FILE_EXT" "s:$UPLOAD:8" id:1503;

注：（1）nginx.conf所有的目录是在nginx编译安装时，默认的配置是<prefix>/conf/nginx.conf。

（2）鉴于原有的naxsi_core.rules文件中规则不足，最好是采用本文档中的配置规则。

第四步：编译安装Nginx

[qiang@localhost nginx-1.5.7]#./configure --prefix=/usr

--sbin-path=/usr/sbin/nginx

--conf-path=/etc/nginx/nginx.conf

--add-module=/home/naxsi-core-0.51-1/naxsi_src

--error-log-path=/var/log/nginx/error.log

--pid-path=/var/run/nginx/nginx.pid
--user=root
--group=root
--with-http_ssl_module
--with-http_flv_module
--with-http_gzip_static_module

--http-log-path=/var/log/nginx/access.log

--http-client-body-temp-path=/var/tmp/nginx/client

--http-proxy-temp-path=/var/tmp/nginx/proxy

--http-fastcgi-temp-path=/var/tmp/nginx/fcgi
--with-http_stub_status_module

[root@localhost nginx-1.5.7]# make && make install

注：上述的参数可以根据实际情况选择，但是标红的需要有。

第五步：验证nginx是否安装成功

[qiang@localhost nginx-1.5.7]# nginx

nginx: [warn] low address bits of 192.168.1.65/26 are meaningless in /etc/nginx/nginx.conf:78

[qiang@localhost nginx-1.5.7]# ps -ef |grep nginx
root      3086     1  0 10:53 ?        00:00:00 nginx: master process nginx
root      3087  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3088  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3089  3086  1 10:53 ?        00:00:00 nginx: worker process
root      3090  3086  1 10:53 ?        00:00:00 nginx: worker process

root      3093  3073  4 10:53 pts/1    00:00:00 grep nginx

第六步：配置过滤条件

切换目录到与nginx.conf同目录下，新建nbs.rules文件。

[qiang@localhost nginx]# vim nbs.rules
##LearningMode;
#Enables learning mode--stop
SecRulesEnabled;
##Disables learning
##SecRulesDisabled;

DeniedUrl "/RequestDenied";
## check rules

CheckRule "$SQL >= 8" BLOCK;

CheckRule "$RFI >= 8" BLOCK;

CheckRule "$TRAVERSAL >= 8" BLOCK;

CheckRule "$EVADE >= 8" BLOCK;

CheckRule "$XSS >= 8" BLOCK;
############################################################
##      STOP   ALL   RULES(如果不需要可以关闭全部过滤规则)  ##
############################################################
#BasicRule wl:0;
##################################
## INTERNAL RULES IDS:1-999     ##
##################################
BasicRule wl:1,2,10,11,12,13,14;
##################################
## SQL Injections IDs:1000-1099 ##
##################################
BasicRule wl:1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016;
###############################
## OBVIOUS RFI IDs:1100-1199 ##
###############################
BasicRule wl:1100,1101,1102,1103,1104,1105,1106,1107,1108,1109;
#######################################
## Directory traversal IDs:1200-1299 ##
#######################################
BasicRule wl:1200,1202,1203,1204,1205,1206;
########################################
## Cross Site Scripting IDs:1300-1399 ##
########################################
BasicRule wl:1310,1311,1312,1313,1314,1315,1318;
####################################
## Evading tricks IDs: 1400-1500 ##
####################################
BasicRule wl:1400,1401,1402;
#############################
## File uploads: 1500-1600 ##
#############################
BasicRule wl:1500,1501,1502,1503;

注：该nbs.rules文件的规则需要根据不同的业务应用制定。

第七步：配置nginx.conf

http {

    include       naxsi_core.rules;

    include       mime.types;

    default_type  application/octet-stream;

    .......

    server {

        listen       80;

        server_name  localhost centoshost.com;

        charset utf-8;

        .......

        location /wavsep/ {

            .......

            include nbs.rules;

            .......

        }

        location /RequestDenied {

            error_page  404  /404.html;

        }

第九步：重启nginx

[qiang@localhost nginx]# nginx -t -c /etc/nginx/nginx.conf

nginx: [warn] low address bits of 192.168.1.65/26 are meaningless in /etc/nginx/nginx.conf:78

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

[qiang@localhost nginx]# nginx -s reload

nginx: [warn] low address bits of 192.168.1.65/26 are meaningless in /etc/nginx/nginx.conf:78

第十步：测试拦截规则是否启用

本文转自梦朝思夕 51CTO博客，原文链接:http://blog.51cto.com/qiangmzsx/1380566