Nginx mode security

1. Cài đặt modesecurity

sudo apt-get update

sudo apt-get install gcc make build-essential autoconf automake libtool libcurl4-openssl-dev liblua5.3-dev libfuzzy-dev ssdeep gettext pkg-config libgeoip-dev libyajl-dev doxygen libpcre2-16-0 libpcre2-dev libpcre2-posix3 zlib1g zlib1g-dev -y

cd /opt && sudo git clone https://github.com/owasp-modsecurity/ModSecurity.git

cd ModSecurity

git submodule init

git submodule update

./build.sh

./configure

make

make install

2. Cài đặt nginx cho người lười compile

sudo add-apt-repository ppa:ondrej/nginx -y

sudo apt update

sudo apt install nginx -y

sudo systemctl enable nginx

sudo systemctl status nginx

sudo nginx -V

nginx version: nginx/1.28.1

built with OpenSSL 3.0.13 30 Jan 2024

TLS SNI support enabled

3. Download nginx-mod connector

cd /opt && sudo git clone https://github.com/owasp-modsecurity/ModSecurity-nginx.git

cd /opt && sudo wget https://nginx.org/download/nginx-1.28.1.tar.gz

sudo tar -xzvf nginx-1.28.1.tar.gz

cd nginx-1.28.1

sudo ./configure --with-compat --add-dynamic-module=/opt/ModSecurity-nginx

sudo make

sudo make modules

sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules-enabled/

sudo cp /opt/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsecurity.conf

sudo cp /opt/ModSecurity/unicode.mapping /etc/nginx/unicode.mapping

#2. Enable ModSecurity in nginx.conf

vim /etc/nginx/nginx.conf

load_module /etc/nginx/modules-enabled/ngx_http_modsecurity_module.so;

vim /etc/nginx/sites-enabled/default

modsecurity on;

modsecurity_rules_file /etc/nginx/modsecurity.conf;

#Change SecRuleEngine to On.

vim /etc/nginx/modsecurity.conf

SecRuleEngine On

#after that we can our nginx configuration and restart nginx server

sudo nginx -t

sudo systemctl restart nginx

4. Cấu hình CRS

sudo git clone https://github.com/coreruleset/coreruleset.git /etc/nginx/owasp-crs

sudo cp /etc/nginx/owasp-crs/crs-setup.conf{.example,}

sudo vim /etc/nginx/modsecurity.conf

Include owasp-crs/crs-setup.conf

Include owasp-crs/rules/*.conf

curl http://127.0.0.1/doc?s=/bin/bash #-> Return 404 FILE-NOT-FOUND

sudo nginx -t

sudo service nginx restart

# Test Modsecurity + Nginx with browser

curl http://127.0.0.1/doc?s=/bin/bash #-> Return 403 BLOCK

# Đọc log tại

cat /etc/nginx/modsecurity.conf  | grep AuditLog

tail -f /var/log/modsec_audit.log

5. Chỉ chặn SQL và XSS

sudo vim /etc/nginx/modsecurity.conf

# Nạp cấu hình cơ bản của CRS

Include /etc/nginx/owasp-crs/crs-setup.conf

# CHỈ NẠP CÁC QUY TẮC SQL INJECTION

Include /etc/nginx/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

# CHỈ NẠP CÁC QUY TẮC XSS

Include /etc/nginx/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf

# File này giúp ModSecurity tổng hợp điểm số (score) từ các quy tắc trên để đưa ra quyết định chặn (deny) cuối cùng. Đừng quên file này.

Include /etc/nginx/owasp-crs/rules/RESPONSE-980-CORRELATION.conf

6. Bản cài ăn sẵn

https://modsecurity.digitalwave.hu/

7. Custome log

# Chọn các phần muốn ghi log (ABCDEFHJKZ)

A: Audit Log Header (Bắt buộc). Chứa thông tin cơ bản: thời gian, ID duy nhất, IP nguồn, IP đích, cổng.

B: Request Headers. Ghi lại toàn bộ các Header gửi lên (User-Agent, Cookie, Host, v.v.).

C: Request Body. Ghi lại nội dung payload gửi lên (Dữ liệu form, JSON, file upload). Chỉ hoạt động nếu SecRequestBodyAccess là On.

D: Reserved. (Dự phòng cho tương lai, hiện tại không dùng).

E: Intermediate Response Body. Ghi lại nội dung server phản hồi cho client. (Có thể làm log rất nặng).

F: Response Headers. Ghi lại các Header mà server gửi trả về cho trình duyệt.

G: Reserved. (Dự phòng).

H: Audit Log Trailer. Chứa các thông tin bổ sung như: điểm số tấn công (Score), loại engine, và các thông tin Metadata khác.

I: Replacement for C. (Ít dùng) Ghi lại Request Body nhưng dùng định dạng multipart/form-data.

J: Uploaded Files Info. Thông tin chi tiết về các file được tải lên (tên file, kích thước).

K: Matched Rules. Danh sách tất cả các Rule ID đã bị khớp (Trigger) trong request này. (Rất quan trọng để debug).

Z: Final Boundary (Bắt buộc). Đánh dấu kết thúc một bản ghi log.

vim /etc/nginx/modsecurity.conf

SecAuditLogParts ABCEFHJKZ

-----BEGIN PRIVATE KEY-----
MIGHAgExxAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg2Wz1L+c3u314HS7l
wR253bZS7uwTvY3GP63h02mxqn+hRANCAATmy8Q+SoBpQOP1un+La/mg3WRuqR/n
pljRqM7jo80yHOjqvGtPy0aJ5YDNLXOd7pwuP75A5P5AKdMTElsMDnC0
-----END PRIVATE KEY-----

-----BEGIN CERTIFICATE-----
MIIDlzCCAx6gAwIBAgISBWe/19sRZvyEjcHQknnRGeBHMAoGCCqGSM49BAMDMDMx
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ
RTIwHhcNMjYwNzE5MjAwNjQ3WhcNMjYxMDE3MjAwNjQ2WjAZMRcwFQYDVQQDDA4q
LnR1YW4ubmFtZS52bjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABObLxD5KgGlA
4/W6f4tr+aDdZG6pH+emWNGozuOjzTIc6Oq8a0/LRonlgM0tc53unC4/vkDk/kAp
0xMSWwwOcLSjggIqMIICJjAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
BQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUliE0SZKTlVHs7I0jPHLT6x08
irMwHwYDVR0jBBgwFoAUuVnyjs8i8IbTN0j/dhQYuoLYVYcwMwYIKwYBBQUHAQEE
JzAlMCMGCCsGAQUFBzAChhdodHRwOi8veWUyLmkubGVuY3Iub3JnLzAnBgNVHREE
IDAegg4qLnR1YW4ubmFtZS52boIMdHVhbi5uYW1lLnZuMBMGA1UdIAQMMAowCAYG
Z4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95ZTIuYy5sZW5jci5vcmcv
NzIuY3JsMIIBDAYKKwYBBAHWeQIEAgSB/QSB+gD4AHcAyKPEf8ezrbk1awE/anoS
beM6TkOlxkb5l605dZkdz5oAAAGffDKUOwAABAMASDBGAiEA1p+PJNCidE2o7CqT
A3jH+2BwERkMHOxAQbgxXEQ8IZwCIQDXyav6sNntsCbI5yQ6xx5ynG7A3CEAyaIw
SifA8iIk0wB9ACbjZG5YaSEjvDQ/RyQ1mzeSzSRaiNgV05Mz/ZkYq0cjAAABn3wy
kQ4ACAAABQArB0I3BAMARjBEAiAdylMOiNEpiaow+JQh+FhbpWaK10ZCYSyolKfj
ZobglwIgOQENQwum/o+f8ND0glFjexoVpyWXVjmXYbLNmUPRTAswCgYIKoZIzj0E
AwMDZwAwZAIwP5C/nBghlYIbJ4qEWmgkVyLw5UbF+Oe1cCeeP010/+4W8iSEt9t/
DapTdwg52QSQAjAB8WiFKpjlwNZkShMSh/AqmSuyxMDkgoaHx/k8L+yWeook77hO
lVDIujuF/W0lA2Q=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIICjDCCAhGgAwIBAgIQTfOxXdbAeExQfNN7WObxFTAKBggqhkjOPQQDAzAuMQsw
CQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y
NTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD
VQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTIwdjAQBgcqhkjOPQIBBgUr
gQQAIgNiAARxmrQzkdbEEL3MqXt3dJQttYc47axkdDTHud5TPqM2z5uSD5cmk0Wr
HlWXvnlvqBLqiB34kluxIbmMyAiq3/YD6e80/vV259K8XQIdjFXloYOa0mIU71f7
HQ09PvYDlw+jge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF
BwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLlZ8o7PIvCG0zdI/3YU
GLqC2FWHMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF
BwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV
HSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s
ZW5jci5vcmcvMAoGCCqGSM49BAMDA2kAMGYCMQDIcnw5dcZLN9ffynXnnkLD/itS
JEycJPb3sRkzeqBowup7vOsAwaqoCnNn/jh9wycCMQCJM6CPlaOC4pQYYbJtVPYb
DKrIb2EKk5NpOpE6/XttQYZV/3gilB9l+Cc/DOVwmyg=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL
MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo
IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN
MzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G
A1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo
+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2
b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV
HQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB
/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW
rt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo
dHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud
HwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD
aQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK
Ax54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2
6hSW1/IWaas6dg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2Rxxx
-----END CERTIFICATE-----