openresty 编译和WAF 组件安装配置
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了openresty 编译和WAF 组件安装配置相关的知识，希望对你有一定的参考价值。
1.简介
Openresty 是在nginx 的基础上集成开发了 Lua 语言实现高性能的扩展功能，在不降低原来Nginx 性能的情况下通过Lua 语言的功能增加诸如更细致的访问控制、集成数据库和缓存访问、web 应用安全访问等多种功能。
kong 微服务网关插件机制及常用指令 https://blog.51cto.com/waringid/5800540
kong 微服务网关配置指南 https://blog.51cto.com/waringid/5793828
使用Kong和Konga管理微服务和API https://blog.51cto.com/waringid/5790671
nginx配置指南之一 https://blog.51cto.com/waringid/1438852
nginx操作指南之二 https://blog.51cto.com/waringid/1441632
nginx增加modsecurity模块 https://blog.51cto.com/waringid/1629905
也谈nginx的安全限制 https://blog.51cto.com/waringid/1608666
利用Kong 的 request-transformer 插件重写 URL https://blog.51cto.com/waringid/5803062
Linux 系统生产环境配置指南 https://blog.51cto.com/waringid/5782872
2.Openresty 编译
2.1 编译Nginx
# pcre 正则库
$ wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.41.tar.gz
$ tar -zxf pcre-*.tar.gz
$ cd pcre-*
$ ./configure
$ make && sudo make install
# zlib gzip 库
$ wget http://zlib.net/zlib-1.2.11.tar.gz
$ tar -zxf zlib-1.2.11.tar.gz
$ cd zlib-1.2.11
$ ./configure
$ make && sudo make install
# openssl https库 注意官网代码是mac编译，建议如果失败，搜索一下openssl 编译
$ wget https://www.openssl.org/source/openssl-1.0.2l.tar.gz
$ tar -zxf openssl-*.tar.gz
$ cd openssl-*
$ ./config --prefix=/usr/local/openssl/
$ make && sudo make install
#主线和稳定二选一
# 主线版本
$ wget http://nginx.org/download/nginx-1.13.3.tar.gz
#稳定版本
$ wget http://nginx.org/download/nginx-1.12.1.tar.gz
$ tar zxf nginx-*.tar.gz
$ cd nginx-*
$ ./configure --prefix=/etc/nginx \\
--sbin-path=/usr/sbin/nginx \\
--modules-path=/usr/lib/nginx/modules \\
--conf-path=/etc/nginx/nginx.conf \\
--error-log-path=/var/log/nginx/error.log \\
--http-log-path=/var/log/nginx/access.log \\
--pid-path=/var/run/nginx.pid \\
--lock-path=/var/run/nginx.lock \\
--with-http_gunzip_module \\
--with-http_gzip_static_module \\
--with-http_addition_module \\
--with-http_auth_request_module \\
--with-http_realip_module \\
--with-http_slice_module \\
--with-http_stub_status_module \\
--with-http_sub_module \\
--with-compat \\
--with-file-aio \\
--with-threads \\
--with-stream \\
--with-stream_realip_module \\
--with-stream_ssl_module \\
--with-stream_ssl_preread_module \\
--with-http_v2_module \\
--with-http_ssl_module \\
--with-pcre=../pcre-8.41 \\
--with-zlib=../zlib-1.2.11 \\
--without-http_autoindex_module \\
--without-http_fastcgi_module \\
--without-http_uwsgi_module \\
--without-http_scgi_module \\
--without-http_memcached_module \\
--without-http_empty_gif_module
$ make && sudo make install
# 从官方标准参数中去除不用的模块，并新增了pcre和zlib模块
# 临时文件相关
#--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \\
#--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \\
#--http-scgi-temp-path=/var/cache/nginx/scgi_temp \\
#--http-client-body-temp-path=/var/cache/nginx/client_temp \\
#--http-proxy-temp-path=/var/cache/nginx/proxy_temp \\
# dav，媒体相关
#--with-http_dav_module \\
#--with-http_flv_module \\
#--with-http_mp4_module \\
#随机首页，安全连接相关
#--with-http_random_index_module \\
#--with-http_secure_link_module \\
#email相关
#--with-mail \\
#--with-mail_ssl_module \\
#gcc相关
#--with-cc-opt=-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC \\
#--with-ld-opt=-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie
#组，用户相关
#--user=nginx
#--group=nginx
#如果指定user和group 则通过此命令创建用户
#$ sudo adduser --system --no-create-home --shell /bin/false --group --disabled-login nginx
#如果用不到https，可以把ssl和http2模块也禁掉
#禁用未用模块，减少安全风险
#--without-http_autoindex_module \\
#--without-http_fastcgi_module \\
#--without-http_uwsgi_module \\
#--without-http_scgi_module \\
#--without-http_memcached_module \\
#--without-http_empty_gif_module
$ nginx -t && nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
2.2编译openresty
yum install openresty openresty-resty openresty-doc \\ |
2.3配置nginx文件
worker_processes auto; |
2.4示例
upstream yunpan.myj.com.cn |
vim access.lualocal limit_conn = require "resty.limit.conn" |
2.5 WAF 组件 ModSecurity 配置
$ git clone -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity.git --depth=1
$ cd ModSecurity/
$ git checkout -b v3/master origin/v3/master
$ sh build.sh
$ git submodule init
$ git submodule update #[for bindings/python, others/libinjection, test/test-cases/secrules-language-tests]
$ ./configure
$ make
$ sudo make install
#使用 ModSecurity-nginx 而不是网上流传的独立版 详见 https://github.com/SpiderLabs/ModSecurity-nginx
$ export MODSECURITY_INC="/home/anjia/openresty/ModSecurity/headers"
$ export MODSECURITY_LIB="/home/anjia/openresty/ModSecurity/src/.libs"
$ git clone https://github.com/SpiderLabs/ModSecurity-nginx --depth=1
$ git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git --depth=1
$ sudo cp -R owasp-modsecurity-crs/rules /opt/openresty/nginx/nginx/conf
$ cp owasp-modsecurity-crs/crs-setup.conf.example /opt/openresty/nginx/nginx/conf/crs-setup.conf
$ sudo wget -P /opt/openresty/nginx/nginx/conf https://raw.githubusercontent.com/SpiderLabs/ModSecurity/master/modsecurity.conf-recommended h
ttps://raw.githubusercontent.com/SpiderLabs/ModSecurity/master/unicode.mapping
$ sudo mv /opt/openresty/nginx/nginx/conf/modsecurity.conf-recommended /opt/openresty/nginx/nginx/conf/modsecurity.conf
$ sudo mkdir /opt/openresty/nginx/nginx/conf/sites-enabled
#使用www-data用户
$ sudo sed -i 1s/^/user www-data;\\n/ /opt/openresty/nginx/nginx/conf/nginx.conf
$ sudo vim /opt/openresty/nginx/nginx/conf/nginx.conf
#删除36-116行，即server段，可以在英文输入法状态按 :36,166d 然后 :wq
#如果确认行数没问题，也可以用sudo sed 35,116d -i /opt/openresty/nginx/nginx/conf/nginx.conf
$ sudo sed $i include /opt/openresty/nginx/nginx/conf/sites-enabled/*; -i /opt/openresty/nginx/nginx/conf/nginx.conf
#嫌费事，也可以直接用下面的配置文件
user www-data;
worker_processes 1;
events
worker_connections 1024;
http
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include /opt/openresty/nginx/nginx/conf/sites-enabled/*;
$ vi /opt/openresty/nginx/nginx/conf/modsecurity.conf
#Load OWASP Config
Include crs-setup.conf
#Load all other Rules
Include rules/*.conf
#Disable rule by ID from error message
#SecRuleRemoveById 920350
$ sudo sed s/"SecRuleEngine DetectionOnly"/"SecRuleEngine On"/g -i /opt/openresty/nginx/nginx/conf/modsecurity.conf
$ sudo /opt/openresty/nginx/nginx/sbin/nginx -t && sudo /opt/openresty/nginx/nginx/sbin/nginx -s reload
$ curl "http://localhost/wp-admin/admin.php?where1=%3Cscript%3Ealert(String.fromCharCode(88,+83,+83))%3C/script%3E&searchsubmit=Buscar&page=nsp_search"
# 返回403 Forbidden
以上是关于openresty 编译和WAF 组件安装配置的主要内容，如果未能解决你的问题，请参考以下文章