Openresty 配置 waf

Waf作用：

• 防止sql注入，本地包含，部分溢出，fuzzing测试，xss,SSRF等web攻击
• 防止svn/备份之类文件泄漏
• 防止ApacheBench之类压力测试工具的攻击
• 屏蔽常见的扫描黑客工具，扫描器
• 屏蔽异常的网络请求
• 屏蔽图片附件类目录php执行权限
• 防止webshell上传

安装openresty

cd /usr/local
mkdir openresty
cd openresy
wget https://openresty.org/download/openresty-1.17.8.2.tar.gz
tar -xvf openresty-1.17.8.2.tar.gz 
yum install readline-devel pcre-devel openssl-devel gcc
cd openresty-1.17.8.2
./configure --prefix=/usr/local/openresty/server --with-luajit --with-http_stub_status_module --with-pcre --with-pcre-jit --with-http_gzip_static_module --with-http_ssl_module
gmake && gmake install
 cd ../server/
./nginx/sbin/nginx

配置waf

cd /usr/local/openresty/server/nginx/conf
git clone https://github.com/loveshell/ngx_lua_waf.git
mv ngx_lua_waf waf

在nginx.conf的http段添加

#WAF
lua_package_path "/usr/local/openresty/server/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file  /usr/local/openresty/server/nginx/conf/waf/init.lua;
access_by_lua_file /usr/local/openresty/server/nginx/conf/waf/waf.lua;

配置config.lua里的waf规则目录(一般在waf/conf/目录下)

RulePath = "/usr/local/openresty/server/nginx/conf/waf/wafconf/"

配置文件详细说明

RulePath = "/usr/local/nginx/conf/waf/wafconf/"
--规则存放目录
attacklog = "off"
--是否开启攻击信息记录，需要配置logdir
logdir = "/usr/local/nginx/logs/hack/"
--log存储目录，该目录需要用户自己新建，切需要nginx用户的可写权限
UrlDeny="on"
--是否拦截url访问
Redirect="on"
--是否拦截后重定向
CookieMatch = "on"
--是否拦截cookie攻击
postMatch = "on" 
--是否拦截post攻击
whiteModule = "on" 
--是否开启URL白名单
black_fileExt={"php","jsp"}
--填写不允许上传文件后缀类型
ipWhitelist={"127.0.0.1"}
--ip白名单，多个ip用逗号分隔
ipBlocklist={"1.0.0.1"}
--ip黑名单，多个ip用逗号分隔
CCDeny="on"
--是否开启拦截cc攻击(需要nginx.conf的http段增加lua_shared_dict limit 10m;)
CCrate = "100/60"
--设置cc攻击频率，单位为秒.
--默认1分钟同一个IP只能请求同一个地址100次
html=[[Please go away~~]]
--警告内容,可在中括号内自定义
备注:不要乱动双引号，区分大小写

启动报错：

nginx: [error] lua_load_resty_core failed to load the resty.core module from https://github.com/openresty/lua-resty-core; ensure you are using an OpenResty release from https://openresty.org/en/download.html (rc: 2, reason: module 'resty.core' not found:
    no field package.preload['resty.core']
    no file '/usr/local/openresty/nginx/conf/waf/resty/core.lua'
    no file '/usr/local/openresty/site/lualib/resty/core.so'
    no file '/usr/local/openresty/lualib/resty/core.so'
    no file './resty/core.so'
    no file '/usr/local/lib/lua/5.1/resty/core.so'
    no file '/usr/local/openresty/luajit/lib/lua/5.1/resty/core.so'
    no file '/usr/local/lib/lua/5.1/loadall.so'
    no file '/usr/local/openresty/site/lualib/resty.so'
    no file '/usr/local/openresty/lualib/resty.so'
    no file './resty.so'
    no file '/usr/local/lib/lua/5.1/resty.so'
    no file '/usr/local/openresty/luajit/lib/lua/5.1/resty.so'
    no file '/usr/local/lib/lua/5.1/loadall.so')

• 解决上述报错:

ln -s /usr/local/openresty/server/lualib /usr/local/lib/lua
ln -s /usr/local/openresty/server/lualib/resty /usr/local/openresty/server/nginx/conf/waf/resty

重新启动openresty

检查规则是否生效

image.png