Nginx下ModSecurity模块安装的实现步骤

# 安装编译依赖
sudo apt update
sudo apt install -y git build-essential libpcre3 libpcre3-dev libssl-dev \
     libtool autoconf automake flex bison curl libcurl4-openssl-dev \
     libxml2 libxml2-dev libyajl-dev doxygen zlib1g-dev pkg-config \
     liblmdb-dev libmaxminddb-dev libgeoip-dev libpcre++-dev

# 下载最新稳定版源码
cd /usr/src
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity

# 更新子模块（解决常见初始化问题）
git submodule update --init --recursive

# 编译优化参数设置
./build.sh
./configure \
  --prefix=/usr/local/modsecurity \
  --with-maxmind=/usr \
  --with-geoip \
  --with-lmdb \
  --with-yajl \
  --with-ssdeep \
  --enable-standalone-module=no \
  CXXFLAGS="-O3 -march=native -pipe"

# 编译安装
make -j$(nproc)
sudo make install

# 添加库路径
echo "/usr/local/modsecurity/lib" | sudo tee /etc/ld.so.conf.d/modsecurity.conf
sudo ldconfig

# 下载Nginx 1.28.0源码
cd /usr/src
wget https://nginx.org/download/nginx-1.28.0.tar.gz
tar xvzf nginx-1.28.0.tar.gz

# 下载ModSecurity-Nginx连接器
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git

# 获取当前Nginx编译参数
nginx -V 2>&1 | grep configure > nginx-config.txt

# 添加动态模块编译参数
sed -i "s/--with-compat//g" nginx-config.txt  # 移除旧兼容参数
echo --with-compat --add-dynamic-module=../ModSecurity-nginx >> nginx-config.txt

# 编译动态模块
cd nginx-1.28.0
sudo bash -c ". ../nginx-config.txt && make modules"

# 验证模块编译
ls objs/ngx_http_modsecurity_module.so  # 确认文件存在

# 创建模块目录
sudo mkdir -p /etc/nginx/modules-available
sudo mkdir -p /etc/nginx/modules-enabled

# 复制模块文件
sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules-available/

# 加载模块配置
sudo tee /etc/nginx/modules-enabled/modsecurity.conf <<EOF
load_module modules-available/ngx_http_modsecurity_module.so;
EOF

# 主配置引用
sudo sed -i '1i include /etc/nginx/modules-enabled/*.conf;' /etc/nginx/nginx.conf

# 创建ModSecurity配置目录
sudo mkdir -p /etc/nginx/modsec

# 复制基础配置
sudo cp /usr/src/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf
sudo cp /usr/src/ModSecurity/unicode.mapping /etc/nginx/modsec/

# 修改关键配置
sudo sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsec/modsecurity.conf
sudo sed -i 's#SecAuditLog /var/log/modsec_audit.log#SecAuditLog /var/log/nginx/modsec_audit.log#' /etc/nginx/modsec/modsecurity.conf

# 添加性能优化参数
sudo tee -a /etc/nginx/modsec/modsecurity.conf <<EOF

# 性能优化设置
SecArgumentSeparator "&"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLogStorageDir /var/log/nginx/modsec_audit/
SecUploadDir /tmp
SecTmpDir /tmp
SecDataDir /tmp
EOF

# 创建日志目录
sudo mkdir -p /var/log/nginx/modsec_audit
sudo chown www-data:adm /var/log/nginx/modsec_audit

# 下载最新CRS
cd /etc/nginx/modsec
sudo git clone https://github.com/coreruleset/coreruleset
sudo mv coreruleset owasp-modsecurity-crs

# 配置规则集
cd owasp-modsecurity-crs
sudo cp crs-setup.conf.example crs-setup.conf
sudo cp rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
sudo cp rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

# 创建主规则文件
sudo tee /etc/nginx/modsec/main.conf <<EOF
Include modsecurity.conf
Include owasp-modsecurity-crs/crs-setup.conf
Include owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
Include owasp-modsecurity-crs/rules/*.conf
Include owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
EOF

# 在目标站点配置中添加
server {
    ...
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
    
    # 可选：特定路径禁用规则
    location /api {
        modsecurity off;
    }
    
    # 错误页面定制
    error_page 403 /403.html;
    location = /403.html {
        internal;
    }
}

# 配置文件测试
sudo nginx -t

# 启动服务
sudo systemctl restart nginx

# 查看日志验证
sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/modsec_audit.log

# 测试规则有效性
curl -I "http://localhost/?param=<script>alert(1)</script>"
# 应返回 403 Forbidden

sudo grep "modsecurity" /var/log/nginx/error.log

# 在modsecurity.conf添加:
SecPcreMatchLimit 100000
SecPcreMatchLimitRecursion 100000
SecCollectionTimeout 600

#!/bin/bash
# ModSecurity自动更新脚本
cd /usr/src/ModSecurity
git pull
git submodule update --init --recursive
./build.sh
./configure --prefix=/usr/local/modsecurity
make -j$(nproc)
sudo make install
sudo ldconfig

cd /etc/nginx/modsec/owasp-modsecurity-crs
git pull

sudo nginx -t && sudo systemctl reload nginx