Original Author: Lei Xi
According to posting requirements, an "@" must be added in front of all http links.
ModSecurity is a free open source host WAF software (@http://www.modsecurity.org/). The newest version on the official website is 2.9.1. It supports nginx/apache/iis (32 and 64 bits). It mainly acts as an extension module of web applications, recognizes malicious external web attacks according to related rule files, and further discards them.
In Linux, if your application is nginx/apache, you have to compile nginx/apache and add the ModSecurity source code as a module.
1. Preparations
• nginx : @http://nginx.org/
• modsecurity for Nginx: @https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
• OWASP rule set: @https://github.com/SpiderLabs/owasp-modsecurity-crs
2. Dependencies
Nginx Dependencies: (Pcre, zlib, and openssl are available in centos 6.5 and above) yum install zlib zlib-devel opensslopenssl-devel pcre pcre-devel
ModSecurity Dependencies: pcre @httpd-devellibxml2 apryum install @httpd-devel apr apr-util-develapr-devel pcre pcre-devel libxml2 libxml2-devel
3. Enable and Compile Standalone Module
Download and unzip modsecurity fornginx, and execute the following directories after entering unzipping:
./autogen.sh
./configure --enable-standalone-module--disable-mlogc
make
4. Add ModSecurity module to nginx
After compiling Standalone, add the ModSecurity module via "--add-module" during nginx compilation:
./configure--add-module=/root/modsecurity-2.9.1/nginx/modsecurity/ --prefix=/opt/tengine
make && make install
5. Add Rules
ModSecurity is intended to filter and stop web hazards. Its power comes from its rules. Rules provided by OWASP are maintained by volunteers, and are called core rules (CRS). They are reliable and powerful, but they can also be customized to meet different requirements.
a. Download OWASP rules:
git clone ~@https://github.com/SpiderLabs/owasp-modsecurity-crs
mv owasp-modsecurity-crs /opt/tengine/conf/
cd/opt/tengine/conf/owasp-modsecurity-crs && mvmodsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf
b. Enable OWASP rules:
Copy modsecurity.conf-recommended and unicode.mapping under the ModSecurity source code directory to the nginx conf subdirectory, and rename modsecurity.conf-recommended to modsecurity.conf.
Edit the file modsecurity.conf and set SecRuleEngine to On. The default value DetectOnly is the observation mode. It is recommended that you use this mode by default during installation, and observe whether it has an unexpected influence on the website and server.
There are a lot of folders for storing rules in owasp-modsecurity-crs such as base_rules, experimental_rules, optional_rules, and slr_rules. You can enable the rules you need by including them in modsecurity.conf
Includeowasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Includeowasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
Includeowasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
Include owasp-modsecurity-crs/base_rules /modsecurity_crs_45_trojans.confwebshell
//Considering the probable impact on the performance of the host, it is recommended you only add defense rules for critical vulnerabilities to defend against the most current critical web attacks.
For the details of the overall rules, please refer to @[url]http://www.2cto.com/Article/201409/334251.html[/url]. You can add rules based on your website's individual requirements.
Note: nginx parses the @http request in a different way from apache. Therefore, some rules cannot be used in nginx. For more details, please refer to
nginxmodule :more_set_headers (@http://comments.gmane.org/gmane.comp.apache.mod-security.owasp-crs/962)
6. Configure nginx
Add the following lines to the location of the ModSecurity host that needs to be enabled:
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
The following are example configurations of PHP virtual host conf or the vhost file:
server {
listen 80;
server_name xxx.com www.xxx.com;
location ~ \.php$ {
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
root /web/webroot;
index index.php index.html index.htm;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $Document_root$fastcgi_script_name;
include fastcgi_params;
}
}
The IIS official website provides the MSI installation file. Download and install it.
1. Preparations
• ModSecurity V2.9.1 for IIS MSI Install-32, 64bits @http://www.modsecurity.org/download.html
• Microsoft VisualC++ 2013 Redistributable Package @https://www.microsoft.com/en-gb/download/details.aspx?id=40784
2. Installation
Systems that have been tested so far include Centos6 and Windows Server2008/2012. They have been tested and installed successfully. The installation processes on other systems are similar to those described above. It is recommended that you update to the newest stable version of the operating system. The newest version of some operating systems may make significant changes to operational performance, which could potentially cause unforeseen errors during the installation process.
The interception rate was quite high for test scripts, satisfying expectations for intercepting high threat attacks like XSS, SQL injection, file inclusion, and command execution.
As far as other WAF products currently on the market go, Safedog is quite good but some problems still exist in its usability. It lacks adequate Windows compatibility, for example, and some website functionality is unavailable after deployment. Furthermore its defense capabilities in Linux simply don't hold up to ModSecurity.
2,599 posts | 762 followers
FollowAlibaba Cloud Native Community - October 31, 2023
Alibaba Clouder - December 6, 2017
Marketplace - November 23, 2018
Alibaba Cloud Ambassador - November 2, 2021
Iain Ferguson - March 1, 2022
Alibaba Cloud ECS - September 10, 2020
2,599 posts | 762 followers
FollowA cloud firewall service utilizing big data capabilities to protect against web-based attacks
Learn MoreExperience Alibaba Cloud products in Cloud Computing, Storage, Networking, Security, Big Data, and Artificial Intelligence.
Learn MoreMore Posts by Alibaba Clouder