Naxsi+nginx前段保护

Posted 2020-10-26 青玉案元夕

Naxsi是nginx的一个第三方的插件 用于保护Nginx前段防护 是一个轻量级的防火墙 比较好用

官网即下载地址

https://github.com/nbs-system/naxsi/releases

参考网址

https://www.123admin.com/how-to-setup-and-configure-naxsi-for-nginx-on-centos/

解压

tar zxvf  naxsi-0.56rc1.tar.gz

把naxsi重新编译到nginx里面

./configure --prefix=/usr/local/nginx --add-module=/root/nginx-1.13.9/naxsi-0.56rc1/naxsi_src  --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_image_filter_module --with-http_slice_module --with-mail --with-threads --with-file-aio --with-stream --with-mail_ssl_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-pcre  --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module  && make

覆盖旧的配置文件

cp objs/nginx /usr/local/nginx/sbin/nginx

在nginx配置里写三个文件

1 是naxsi的规则配置文件

2 是naxsi的白名单配置文件

3 是naxsi的错误日志文件

（1） 在conf里配置一个naxsi的规则配置文件

vi mysite.rules

#LearningMode; #Enables learning mode

SecRulesEnabled;

#SecRulesDisabled;

DeniedUrl "/RequestDenied";

## check rules

CheckRule "$SQL >= 8" BLOCK;

CheckRule "$RFI >= 8" BLOCK;

CheckRule "$TRAVERSAL >= 4" BLOCK;

CheckRule "$EVADE >= 4" BLOCK;

CheckRule "$XSS >= 8" BLOCK;

（2）设置naxsi的白名单

vi naxsi_BasicRule.conf

BasicRule wl:0 "mz:$ARGS_VAR:id";
BasicRule wl:0 "mz:$ARGS_VAR:script";

（3）在nginx的logs里编辑一个foo.log错误文件，保存就好什么也不用写

 

在nginx.conf配置文件里

在http的server字段里增加一段话

        location /RequestDenied {
        return 403;
        }

        location / {

            root   html;

            index  index.html index.htm;

            include /usr/local/nginx/conf/mysite.rules;#读取配置规则

            error_log /usr/local/nginx/logs/foo.log;#错误日志位置
            include naxsi_BasicRule.conf;#设置白名单

         }

 

检查配置文件

 /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

/usr/local/nginx/sbin/nginx -s reload

模仿攻击，看错误日志，中显示NAXSI_FMT说明配置成功

访问返回页面 403

日志foo.log显示 NAXSI_FMT说明拦截成功

设置白名单

 在conf里加一个文件配置规则

vi naxsi_BasicRule.conf

BasicRule wl:0 "mz:$ARGS_VAR:script";
BasicRule wl:0 "mz:$ARGS_VAR:id";
BasicRule wl:1000 "mz:$ARGS_VAR:foo|$URL:/bar";

在nginx.conf文件里也加入

location / {
root html;
index index.html index.htm;
include /usr/local/nginx/conf/mysite.rules;#读取配置规则
error_log /usr/local/nginx/logs/foo.log;#错误日志位置
include naxsi_BasicRule.conf;#设置白名单
}

检查配置文件重启nginx

访问出现404说明没有被拦截，日志也没有返回

白名单配置成功

nginx.conf的配置文件

worker_processes 1;

events {
worker_connections 1024;
}

http {
include mime.types;
include /usr/local/nginx/conf/naxsi_core.rules;
default_type application/octet-stream;

server {
listen 443 ssl;
server_name www.fengxiao.xyz;#绑定证书的域名
ssl_certificate 1_www.fengxiao.xyz_bundle.crt;#证书
ssl_certificate_key 2_www.fengxiao.xyz.key;#秘钥
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;#ssl这个协议配置
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;

location / {
root html;
index index.html index.htm;
include /usr/local/nginx/conf/mysite.rules;#读取配置规则
error_log /usr/local/nginx/logs/foo.log;#错误日志位置
include /usr/local/nginx/conf/naxsi_BasicRule.conf;#设置白名单
}
#跳转的403
location /RequestDenied {
return 403;
}

}

}

 

WAF的Naxsi配置成功

点一杯星巴克