Nginx. AlmaLinux 8. ModSecurity - История изменений

Cless в 10:30, 16 июля 2023

2023-07-16T10:30:23Z

← Предыдущая		Версия 10:30, 16 июля 2023
Строка 335:		Строка 335:

	= Custom rules =		= Custom rules =

			=== Block request by special parameter in a '''Query string''' ===
			<code>mkdir /usr/local/nginx/conf/modsec-rules</code>

			<code>nano /usr/local/nginx/conf/modsec-rules/custom01.conf</code>
			SecRule ARGS:'''''testparam''''' "@contains '''''test123'''''" "id:1234,deny,log,status:403"
			<code>nano /usr/local/nginx/conf/modsecurity.conf</code>
			...
			Include modsec-rules/*.conf
			<code>nginx -t</code>

			<code>systemctl restart nginx</code>

			Try to connect via browser to '''<nowiki>https://cless.pro/index.html?testparam=test123</nowiki>''' with '''testparam=test123'''.

			You will get "'''403 Forbidden'''"

			BUT try to connect via browser to '''<nowiki>https://cless.pro/index.html?testparam=test</nowiki>'''.

			You will get "'''200 OK'''"

	=== SRC-IP block ===		=== SRC-IP block ===
Строка 343:		Строка 363:

	<code>nano /usr/local/nginx/conf/modsec-rules/custom01.conf</code>		<code>nano /usr/local/nginx/conf/modsec-rules/custom01.conf</code>
	SecRule REMOTE_ADDR "@ipMatchFromFile /usr/local/nginx/conf/blacklist.txt" "id:1,phase:1,deny,status:403,msg:\'blacklist\'"		SecRule REMOTE_ADDR "@ipMatchFromFile '''''/usr/local/nginx/conf/blacklist.txt'''''" "id:1,phase:1,deny,status:403,msg:\'blacklist\'"
	<code>nano /usr/local/nginx/conf/modsecurity.conf</code>		<code>nano /usr/local/nginx/conf/modsecurity.conf</code>
	...		...

Cless в 07:12, 14 июля 2023

2023-07-14T07:12:46Z

← Предыдущая		Версия 07:12, 14 июля 2023
Строка 333:		Строка 333:
	ModSecurity: '''''Access denied with code 403''''' (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927339520.223489"] [ref ""]		ModSecurity: '''''Access denied with code 403''''' (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927339520.223489"] [ref ""]
	...		...

			= Custom rules =

			=== SRC-IP block ===
			<code>nano /usr/local/nginx/conf/blacklist.txt</code>
			1.2.3.4
			5.6.7.8
			<code>mkdir /usr/local/nginx/conf/modsec-rules</code>

			<code>nano /usr/local/nginx/conf/modsec-rules/custom01.conf</code>
			SecRule REMOTE_ADDR "@ipMatchFromFile /usr/local/nginx/conf/blacklist.txt" "id:1,phase:1,deny,status:403,msg:\'blacklist\'"
			<code>nano /usr/local/nginx/conf/modsecurity.conf</code>
			...
			Include modsec-rules/*.conf
			<code>nginx -t</code>

			<code>systemctl restart nginx</code>

			Try to connect via browser to '''<nowiki>https://cless.pro/index.html</nowiki>''' via SRC-IP from '''blacklist.txt'''.

			You will get "'''403 Forbidden'''"
	[[Категория:Nginx]]		[[Категория:Nginx]]
	[[Категория:AlmaLinux 8]]		[[Категория:AlmaLinux 8]]
	__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__		__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__
	[[Категория:Web Application Firewall (WAF)]]		[[Категория:Web Application Firewall (WAF)]]

Cless в 19:04, 13 июля 2023

2023-07-13T19:04:37Z

← Предыдущая		Версия 19:04, 13 июля 2023
Строка 333:		Строка 333:
	ModSecurity: '''''Access denied with code 403''''' (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927339520.223489"] [ref ""]		ModSecurity: '''''Access denied with code 403''''' (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927339520.223489"] [ref ""]
	...		...

	[[Категория:Nginx]]		[[Категория:Nginx]]
	[[Категория:AlmaLinux 8]]		[[Категория:AlmaLinux 8]]
	__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__		__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__
			[[Категория:Web Application Firewall (WAF)]]

Cless: Новая страница: «= Description = ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF) to provide protections against generic classes of vulnerabi...»

2023-07-13T18:59:06Z

Новая страница: «= Description = ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF) to provide protections against generic classes of vulnerabi...»

Новая страница

= Description =
ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF) to provide protections against generic classes of vulnerabilities using the OWASP ModSecurity Core Rule Set (CRS)

= Links =
https://aventistech.com/kb/modsecurity-with-nginx-on-centos-8/

= Common Installation =
Perform System Update

<code>dnf check-update</code>

<code>dnf update</code>

Free up disk space by deleting all downloaded software package and all cached repository

<code>dnf clean all</code>

Install required build tools and dependencies

<code>dnf install -y gcc-c++ flex bison yajl curl-devel curl zlib-devel pcre-devel autoconf automake git curl make libxml2-devel pkgconfig libtool httpd-devel redhat-rpm-config git wget openssl openssl-devel vim nano</code>

<code>dnf install -y <nowiki>https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm</nowiki></code>

<code>dnf install -y <nowiki>https://rpms.remirepo.net/enterprise/remi-release-8.rpm</nowiki></code>

<code>dnf --enablerepo=powertools install -y doxygen yajl-devel</code>

<code>dnf --enablerepo=remi install -y GeoIP-devel</code>

= ModSecurity Compile =
Clone the latest LibModsecurity GitHub repository to /opt/modsec

<code>mkdir /opt/modsec</code>

<code>cd /opt/modsec</code>

<code>git clone --depth 1 -b v3/master --single-branch <nowiki>https://github.com/SpiderLabs/ModSecurity</nowiki></code>

Compile and install ModSecurity

<code>cd ModSecurity</code>

<code>git submodule init</code>

<code>git submodule update</code>

<code>./build.sh</code>

<code>./configure</code>

<code>make</code>

<code>make install</code>

= Nginx Compile to support ModSecurity =
Download the ModSecurity-nginx connector which provides a communication channel between Nginx and LibModsecurity

<code>cd /opt/modsec</code>

<code>git clone <nowiki>https://github.com/SpiderLabs/ModSecurity-nginx.git</nowiki></code>

Create a non-privileged system user and group for Nginx

<code>useradd -r -M -s /sbin/nologin -d /usr/local/nginx nginx</code>

Download Nginx and extract it to /opt/nginx

<code>cd /opt</code>

<code>wget <nowiki>http://nginx.org/download/nginx-1.17.6.tar.gz</nowiki></code>

<code>tar xzf nginx-1.17.6.tar.gz</code>

Compile Nginx from source code

<code>cd nginx-1.17.6</code>

<code>./configure --user=nginx --group=nginx --with-pcre-jit --with-debug --with-http_ssl_module --with-http_v2_module --with-http_realip_module --add-module=/opt/modsec/ModSecurity-nginx</code>

<code>make</code>

<code>make install</code>

Create a systemd service for Nginx

<code>nano /etc/systemd/system/nginx.service</code>
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true

[Install]
WantedBy=multi-user.target
Create a symbolic link of Nginx binary to /usr/sbin/ path.

<code>ln -s /usr/local/nginx/sbin/nginx /usr/sbin/</code>

Change the location of pid to /run/nginx.pid in Nginx config file

<code>nano /usr/local/nginx/conf/nginx.conf</code>
...
pid    /run/nginx.pid;
...
Enable and start Nginx service

<code>systemctl enable --now nginx</code>

Allow Firewalld for HTTP & HTTPS

<code>firewall-cmd --permanent --zone=public --add-service=http</code>

<code>firewall-cmd --permanent --zone=public --add-service=https</code>

<code>systemctl restart firewalld.service</code>

Verify HTTP & HTTPS is allowed

<code>firewall-cmd --list-all</code>

You should be able to access to Nginx Web Server via <nowiki>http://IP-ADDRESS</nowiki> now

= Let’s Encrypt Wildcard SSL Certificate =
'''''<ADD LINK TO LETSENCRYPT MANUAL>'''''

Let’s Encrypt wildcard SSL Certificate is stored in /etc/letsencrypt/live/cless.pro

<code>ls /etc/letsencrypt/live/cless.pro</code>
...
cert.pem chain.pem fullchain.pem privkey.pem README
...

= Enable SSL & HTTP/2 Support =
Copy the cert.pem & privkey.pem to /usr/local/nginx/ssl/

<code>mkdir /usr/local/nginx/ssl</code>

<code>cp /etc/letsencrypt/live/cless.pro/cert.pem /usr/local/nginx/ssl/</code>

<code>cp /etc/letsencrypt/live/cless.pro/privkey.pem /usr/local/nginx/ssl/</code>

Add HTTPS config into Nginx configuration

<code>nano /usr/local/nginx/conf/nginx.conf</code>
...
server {
   # Enable SSL
   listen 443 ssl http2;
   server_name localhost uat.aventis.dev;

   # Letsencrypt enable
   ssl_certificate /usr/local/nginx/ssl/cert.pem;
   ssl_certificate_key /usr/local/nginx/ssl/privkey.pem;
}
...
Verify the configuration file of Nginx and restart the service

<code>nginx -t</code>

<code>systemctl restart nginx</code>

Go to '''<nowiki>https://cless.pro</nowiki>''' and verify that HTTP/2 is enabled

= PHP-FPM with NGINX =
<code>dnf module list php</code>

Install the latest PHP 7.4 Module

<code>dnf module reset php</code>

<code>dnf module enable -y php:remi-7.4</code>

<code>dnf install -y php php-opcache php-gd php-curl php-mysqlnd</code>

<code>php -v</code>

Change the PHP-FPM to use nginx instead of Apache user in

<code>nano /etc/php-fpm.d/www.conf</code>
...
user = nginx
group = nginx
...
Enable and start PHP-FPM

<code>systemctl enable php-fpm</code>

<code>systemctl start php-fpm</code>

Configure PHP-FPM with Nginx by modifying /usr/local/nginx/conf/nginx.conf<blockquote>!!! ADD FOLLOWING INTO HTTPS SECTION: server { listen 443 ssl http2; <...> }</blockquote><code>nano /usr/local/nginx/conf/nginx.conf</code>
http {
   server {
   listen 443 ssl http2;
   ...
   '''''location ~ \.php$ {
   root html;
   fastcgi_pass unix:/run/php-fpm/www.sock;
   fastcgi_index index.php;
   fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
   include    fastcgi_params;'''''
   }
   ...
   }
}
...
Restart Nginx & PHP-FPM services

<code>systemctl restart nginx</code>

<code>systemctl restart php-fpm</code>

Create '''info.php''' in '''/usr/local/nginx/html''' (Default Root Directory for Nginx)

<code>nano /usr/local/nginx/html/info.php</code>
<?php
phpinfo();
?>
Go to '''<nowiki>https://cless.pro/info.php</nowiki>''' to verify PHP is installed successfully

= Confgure Nginx with ModSecurity =
Copy the Sample ModSecurity config file and unicode.mapping from ModSecurity source directory to Nginx configuration directory

<code>cp /opt/modsec/ModSecurity/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf</code>

<code>cp /opt/modsec/ModSecurity/unicode.mapping /usr/local/nginx/conf/</code>

Create a backup for Nginx config file

<code>cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bak</code>

Create /var/log/nginx to keep all the access & error log

<code>mkdir /var/log/nginx</code>

Add the following to the '''nginx.conf''' file

<code>nano /usr/local/nginx/conf/nginx.conf</code>
...
'''''user nginx;'''''
...
# !!! ADD FOLLOWING INTO HTTPS SECTION: server { listen 443 ssl http2; <...> }
...
http {
   server {
   listen 443 ssl http2;
   ...
   '''''modsecurity on;
   modsecurity_rules_file /usr/local/nginx/conf/modsecurity.conf;
   access_log /var/log/nginx/access.log;
   error_log /var/log/nginx/error.log;'''''
   ...
   }
}
...
Restart Nginx service

<code>systemctl restart nginx</code>

Turn On ModSecurity Rule Engine and change the default log directory for ModSecurity to /var/log/nginx/modsec_audit.log

<code>nano /usr/local/nginx/conf/modsecurity.conf</code>
...
# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
# By default, ModSecurity is set on detection only mode where it only logs the requests based on the triggered rules without blocking anything
# DEFAULT - ONLY DETECTION
# TURN IT ON IF YOU WANT TO BLOCK REQUESTS

#SecRuleEngine DetectionOnly
'''''SecRuleEngine On'''''

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.

'''''SecAuditLogType Serial
SecAuditLog /var/log/nginx/modsec_audit.log'''''
...

= Install OWASP ModSecurity Core Rule Set (CRS) =
The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity. It aims at protecting the web applications from a wide range of attacks, including the OWASP Top Ten, minimum of false alerts.

Clone the CRS from GitHub Repository to /usr/local/nginx/conf

<code>git clone <nowiki>https://github.com/SpiderLabs/owasp-modsecurity-crs.git</nowiki> /usr/local/nginx/conf/owasp-crs</code>

Rename the crs-setup.conf.example to crs-setup.conf

<code>cp /usr/local/nginx/conf/owasp-crs/crs-setup.conf.example /usr/local/nginx/conf/owasp-crs/crs-setup.conf</code>

Include the OWASP rule to /usr/local/nginx/conf/modsecurity.conf

<code>nano /usr/local/nginx/conf/modsecurity.conf</code>
...
Include owasp-crs/crs-setup.conf
Include owasp-crs/rules/*.conf
Verify Nginx configuration file and restart Nginx service

<code>nginx -t</code>

systemctl restart nginx

= Test =

=== On arbitrary client in CLI or in GUI Browser ===
<code>curl -k <nowiki>https://cless.pro/index.html?exec=/bin/bash</nowiki></code>
   ...
   <html>
   <head><title>403 Forbidden</title></head>
   <body>
   <nowiki><center><h1>403 Forbidden</h1></nowiki><nowiki></center></nowiki>
   <nowiki><hr></nowiki><nowiki><center>nginx/1.17.6</center></nowiki>
   </body>
   </html>
   ...

=== On Nginx server ===
<code>tail /var/log/nginx/modsec_audit.log</code>
...
ModSecurity: '''''Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `/bin/bash' )''''' [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "496"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/bash found within ARGS:exec: /bin/bash"] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] [tag "PCI/6.5.2"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927378047.184148"] [ref "o1,8v21,9t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"]

ModSecurity: '''''Access denied with code 403''''' (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/nginx/conf/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.168.199.187"] [uri "/index.html"] [unique_id "168927339520.223489"] [ref ""]
...
[[Категория:Nginx]]
[[Категория:AlmaLinux 8]]
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__