官网：https://www.modsecurity.org/download.html
先安装modsecurity，再编译nginx模块
# modsecurity依赖几个包实现某些功能
[root@localhost ~]# yum install -y gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel lmdb-devel libxml2-devel ssdeep-devel lua-devel libtool autoconf automake
# 安装modsecurity
[root@localhost ~]# wget -c https://github.com/SpiderLabs/ModSecurity/releases/download/v3.0.4/modsecurity-v3.0.4.tar.gz [root@localhost ~]# tar zxvf modsecurity-v3.0.4.tar.gz [root@localhost ~]# cd modsecurity-v3.0.4 [root@localhost modsecurity-v3.0.4]# ./configure [root@localhost modsecurity-v3.0.4]# make [root@localhost modsecurity-v3.0.4]# make install [root@localhost modsecurity-v3.0.4]# cp modsecurity.conf-recommended /usr/local/modsecurity/modsecurity.conf [root@localhost modsecurity-v3.0.4]# cp unicode.mapping /usr/local/modsecurity/
默认会安装到/usr/local/modsecurity/
# 下载安全规则
[root@localhost ~]# git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git [root@localhost ~]# cd owasp-modsecurity-crs/ [root@localhost owasp-modsecurity-crs]# cp -r rules/ /usr/local/modsecurity/ [root@localhost owasp-modsecurity-crs]# cp crs-setup.conf.example /usr/local/modsecurity/crs-setup.conf
# 下载nginx modsecurity模块
[root@localhost ~]# git clone https://github.com/SpiderLabs/ModSecurity-nginx.git
# 查看nginx原编译参数
[root@localhost nginx-1.17.9]# /usr/local/nginx/sbin/nginx -V nginx version: nginx/1.17.9 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --add-module=../ModSecurity-nginx/
# 重新编译nginx，添加modsecurity模块
[root@localhost nginx-1.17.9]# ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --add-module=../ModSecurity-nginx/ [root@localhost nginx-1.17.9]# make [root@localhost nginx-1.17.9]# make install
# 虚拟主机配置
server
{
server_name admin.local;
listen 80;
access_log /usr/local/nginx/logs/admin_access.log;
error_log /usr/local/nginx/logs/admin_error.log;
modsecurity on;
modsecurity_rules_file /usr/local/modsecurity/modsecurity.conf;
location /
{
proxy_pass http://127.0.0.1:10102;
}
}
# 配置 /usr/local/modsecurity/modsecurity.conf
# 由 DetectionOnly 改为 On SecRuleEngine On # 由 ABIJDEFHZ 改为 ABCDEFHZ SecAuditLogParts ABCDEFHZ # 下面3行追加到配置文件 Include /usr/local/modsecurity/crs-setup.conf Include /usr/local/modsecurity/rules/*.conf SecAuditLogFormat JSON
保存退出。
SecAuditLogFormat JSON是审计日志改为json格式，便于提取。
审计日志会输出到 /var/log/modsec_audit.log
测试：
可以在url访问中加个参数，如：/login?id=1 and 1=1 ，页面会提示403状态码。
日志中会出现审计日志。