Centos7.4 modsecurity with nginx 安装

nginx：OpenResty1.13.6.1ModSecurity：ModSecurity v3.0.0rc1 (Linux)modsecurity connector：ModSecurity-nginx v0.1.1-beta

mkdir /opt/wafcd /opt/waf
#下载openresty
wget https://openresty.org/download/openresty-1.13.6.1.tar.gz#下载ModSecurity,附：git安装yum -y install git
git clone https://github.com/SpiderLabs/ModSecurity.git
cd ModSecurity
git checkout v3.0.0#克隆modsecurity nginx connector
cd /opt/waf
git clone --depth https://github.com/SpiderLabs/ModSecurity-nginx.git

yum -y install libtool gcc gcc-c++ pcre-devel zlib-devel libxml2-devel libxslt-devel gd-devel perl perl-devel perl-ExtUtils-Embed GeoIP GeoIP-devel GeoIP-data libatomic_ops-devel

#openssl源码安装（如果系统自带，可以不用装）cd /opt/tools/
wget http://www.openssl.org/source/openssl-1.0.2f.tar.gz
tar -zxvf openssl-1.0.2f.tar.gz
cd openssl-1.0.2f
./config --prefix=/usr/local/openssl
make
make install

#GeoIP源码安装（应该可以不用装，yum -y GeoIP-devel已经安装，当时应该是重新configure的时候未clean导致GeoIP动态库没添加到modsecurity的so库依赖）cd /opt/tools/
mkdir GeoIP
cd GeoIP
wget http://geolite.maxmind.com/download/geoip/api/c/GeoIP.tar.gz
tar -zxvf GeoIP.tar.gz
cd GeoIP-1.4.8/
make
make install

cd /opt/waf/ModSecurity
git submodule init
git submodule update

./build.sh
#后面的编译参数可以去掉，如果最后链接有问题可以用自己源码安装的
./configure --with-geoip=/usr/local/GeoIP
make
make install

tree /usr/local/modsecurity/

cd /opt/waf
tar zxvf openresty-1.13.6.1.tar.gz
cd openresty-1.13.6.1
./configure --prefix=/usr/local/nginx --sbin-path=/usr/sbin/nginx --conf-path=/usr/local/nginx/nginx.conf --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --lock-path=/var/lock/nginx.lock --with-luajit --with-http_gunzip_module --with-pcre --with-pcre-jit --with-http_perl_module --with-ld-opt="-Wl,-E" --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_geoip_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-select_module --with-poll_module --with-file-aio --with-http_degradation_module --with-libatomic --http-client-body-temp-path=/var/tmp/nginx/client_body --http-proxy-temp-path=/var/tmp/nginx/proxy --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --add-dynamic-module=/opt/waf/ModSecurity-nginx/ --with-openssl=/opt/tools/openssl-1.0.2f
make
make install

cd /opt/waf
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
cd owasp-modsecurity-crs/
cp crs-setup.conf.example crs-setup.conf
cd rules
cp REQUEST--EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST--EXCLUSION-RULES-BEFORE-CRS.conf
cp RESPONSE--EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE--EXCLUSION-RULES-AFTER-CRS.conf

#user nobody;
worker_processes ;
#error_log logs/error.log;
#modsecurity动态库加载
load_module /usr/local/nginx/nginx/modules/ngx_http_modsecurity_module.so; #error_log logs/error.log notice;#error_log logs/error.log info; #pid logs/nginx.pid; events {
worker_connections ;
}http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout ;
keepalive_timeout ; #gzip on;
server { listen ;
server_name localhost;
#access_log logs/host.access.log main;
#modsecurity 支持
modsecurity on;
location / {
#modsecurity配置文件路径
modsecurity_rules_file /usr/local/nginx/modsecurity.conf;
root html;
index index.html index.htm;
} location = /50x.html {
root html;
}
}
}

cp /opt/waf/ModSecurity/modsecurity.conf-recommended modsecurity.conf
vi modsecurity.conf
最后添加
Include /opt/waf/owasp-modsecurity-crs/crs-setup.conf
Include /opt/waf/owasp-modsecurity-crs/rules/*.conf
保存

nginx -t

nginx: the configuration file /usr/local/nginx/nginx.conf syntax is ok
nginx: [emerg] mkdir() "/var/tmp/nginx/client_body" failed (: No such file or directory)
nginx: configuration file /usr/local/nginx/nginx.conf test failed

mkdir /var/tmp/nginx
nginx -t没问题了

nginx

tail -f /var/log/modsec_audit.log

http://[your ip or hostname]/?a=<script>alert(aa)</script>

vi /usr/local/nginx/modsecurity.conf # Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine DetectionOnly
#SecRuleEngine On