Top

How to Install Nginx with ModSecurity from source

Introduction

ModSecurity is an open-source Web Application Firewall (WAF) for Apache, Nginx and IIS web server. This application layer firewall is developed by Trustwave’s SpiderLabs and released under Apache License 2.0. ModSecurity protects websites from hackers by using a set of regular expression rules to filter out commonly known exploits, it allows HTTP traffic monitoring, logging, real-time analysis, and attack detection.

If you are hosting your web applications on Nginx and concerned about security then one of the first thing you would like to implement is Web Application Firewall (WAF).

In this tutorial, I will show you how to install mod_security for the fast Nginx web server. I will configure ModSecurity as a standalone module and then build Nginx from source to include ModSecurity.

Update System and Repository

Redhat based servers:

# yum update
# yum upgrade

Debian/ubuntu based servers:

# apt-get update
# apt-get upgrade

Install the build dependencies

Redhat based servers:

# yum install gcc make automake autoconf libtool pcre pcre-devel libxml2 libxml2-devel curl curl-devel httpd-devel

Debian/ubuntu based servers:

# apt-get install git build-essential libpcre3 libpcre3-dev libssl-dev libtool autoconf apache2-prefork-dev libxml2-dev libcurl4-openssl-dev

Download Nginx and ModSecurity

Download the latest version nginx so look from below link first: http://nginx.org/en/download.html

At moment http://nginx.org/download/nginx-1.10.1.tar.gz is latest version in linux.

# cd /usr/src/
# wget http://nginx.org/download/nginx-1.10.1.tar.gz
# tar xvf nginx-1.10.1.tar.gz

Download the latest version of Mod Security so look from below link first: https://www.modsecurity.org/download.html

At moment https://www.modsecurity.org/tarball/2.9.1/modsecurity-2.9.1.tar.gz is latest version.

# wget https://www.modsecurity.org/tarball/2.9.1/modsecurity-2.9.1.tar.gz
# tar xvf modsecurity-2.9.1.tar.gz

Install Nginx and ModSecurity

Now it’s time to install ModSecurity, please go to the /usr/src/modsecurity directory:

# cd /usr/src/modsecurity/
# ./autogen.sh
# ./configure --enable-standalone-module --disable-mlogc
# make

Next, install Nginx with Modsecurity module:

Debian/ubuntu based servers:

# cd /usr/src/nginx-1.10.1
# ./configure \
  --user=www-data \
  --group=www-data \
  --with-http_ssl_module \
  --add-module=/usr/src/modsecurity/nginx/modsecurity
# make
# make install

Redhat based servers:

# cd /usr/src/nginx-1.10.1
# ./configure --add-module=/usr/src/modsecurity/nginx/modsecurity
# make
# make install

Configure Nginx

Debian/ubuntu based servers:

Edit the nginx configuration file with vi/vim and configure nginx to run under the user “www-data”.

# nano -w /usr/local/nginx/conf/nginx.conf

On the first line, uncomment the “user” line and change the user to www-data

user www-data;

Next we will create a systemd script for Nginx that is used to start / stop the Nginx daemon. Please go to the directory “/lib/systemd/system/” and create a new file “nginx.service” with nano

# cd /lib/systemd/system/
# nano -w nginx.service
[Service]
Type=forking
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
KillStop=/usr/local/nginx/sbin/nginx -s stop

KillMode=process
Restart=on-failure
RestartSec=42s

PrivateTmp=true
LimitNOFILE=200000

[Install]
WantedBy=multi-user.target

Save and exit!

Now reload the systemd-daemon so that systemd loads our new Nginx service file.

# systemctl daemon-reload

Both Redhat / Debian:

Create a symlink for the nginx binary so we can use the command “nginx” by directly

# ln -s /usr/local/nginx/sbin/nginx /bin/nginx

Test the nginx configuration and start nginx with systemctl command:

# nginx -t
# systemctl start nginx

Configure Mod Security with Nginx

# cp /usr/src/modsecurity-2.9.1/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf
# cp /usr/src/modsecurity-2.9.1/unicode.mapping /usr/local/nginx/conf/

Open /usr/local/nginx/conf/nginx.conf file and add following under “location /” directive

location / {
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
}

Open the /usr/local/nginx/conf/modsecurity.conf file with editor:

# -- Rule engine initialization ----------------------------------------------

# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine On


# -- Request body handling ---------------------------------------------------

# Allow ModSecurity to access request bodies. If you don't, ModSecurity
# won't be able to see any POST parameters, which opens a large security
# hole for attackers to exploit.
#
SecRequestBodyAccess On
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072

# Store up to 128 KB of request body data in memory. When the multipart
# parser reachers this limit, it will start using your hard disk for
# storage. That is slow, but unavoidable.
#
SecRequestBodyInMemoryLimit 131072

# What do do if the request body size is above our configured limit.
# Keep in mind that this setting will automatically be set to ProcessPartial
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
# disruptions when initially deploying ModSecurity.
#
SecRequestBodyLimitAction ProcessPartial

SecDefaultAction "phase:2,deny,log,status:406"

# PCRE Tuning
# We want to avoid a potential RegEx DoS condition
#
SecPcreMatchLimit 250000
SecPcreMatchLimitRecursion 250000
SecResponseBodyLimitAction ProcessPartial


SecTmpDir /tmp
SecDataDir /tmp
SecUploadDir /tmp
SecTmpSaveUploadedFiles on
SecUploadKeepFiles on
SecUploadFileMode 0644

#SecDebugLog /opt/modsecurity/var/log/debug.log
#SecDebugLogLevel 3


# -- Audit log configuration -------------------------------------------------

# Log the transactions that are marked by a rule, as well as those that
# trigger a server error (determined by a 5xx or 4xx, excluding 404,  
# level response status codes).
#
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#

# Specify the path for concurrent audit logging.
SecAuditLogType Concurrent
SecAuditLogStorageDir /opt/modsecurity/var/audit/

Now create new directory for the ModSecurity audit log and change the owner to www-data:

# mkdir -p /opt/modsecurity/var/audit/
# chown -R www-data:www-data /opt/modsecurity/var/audit/

Modsecurity Rules

Buy Modsecurity Rules from Malware Expert and use them!

,

Comments are closed.