centos安装部署nginx-waf_centos7 搭建waf

所有操作和安装包皆看自己喜欢安装目录

所需软件包百度链接
提取码：cr5h

安装前准备：

yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel  libxml2 libxml2-dev libxslt-devel  gd gd-devel perl-devel perl-ExtUtils-Embed gperftools 
1

cd /usr/local/src/
1

下载luajit 2.1并安装：

wget http://luajit.org/download/LuaJIT-2.1.0-beta2.tar.gz
tar xf LuaJIT-2.1.0-beta2.tar.gz
cd LuaJIT-2.1.0-beta2
make && make install
1
2
3
4

下载 Nginx 开发套件 ngx_devel_kit

wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz
tar xf v0.3.0.tar.gz
1
2

安装nginx_lua_module：

wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
tar xf v0.10.13.tar.gz
1
2

设置环境变量！

echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile
echo "export LUAJIT_INC=/usr/local/include/luajit-2.1" >> /etc/profile
source /etc/profile
1
2
3

安装nginx：

编译安装nginx1.16.1：

tar -xvf nginx-1.16.1.tar.gz
cd nginx-1.16.1
useradd -s /sbin/nologin -M nginx
1
2
3

./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

make -j2
make install
ln -s /usr/local/nginx-1.16.1 /usr/local/nginx
1
2
3

新建/usr/local/nginx/logs/hack/攻击日志目录，并赋予nginx用户对该目录的写入权限:

mkdir -p /usr/local/nginx/logs/hack/
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/
1
2
3

至此nginx支持WAF防护功能已经搭建完成！

使用说明：
nginx配置文件路径为:/usr/local/nginx/conf/
把ngx_lua_waf下载到conf目录下,解压命名为waf

wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf
1
2
3

在nginx.conf的http段添加下面这段：

sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file  /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf
//这一条命令执行完添加下方4条路径！    
1
2

lua_package_path "/usr/local/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file  /usr/local/nginx/conf/waf/init.lua; 
access_by_lua_file /usr/local/nginx/conf/waf/waf.lua;
1
2
3
4

配置config.lua里的waf规则目录(一般在waf/conf/目录下)：
RulePath = “/usr/local/nginx/conf/waf/wafconf/”
绝对路径如有变动，需对应修改

然后重启nginx即可

ln -s /usr/local/nginx/sbin/nginx  /usr/sbin/
nginx		#启动nginx
1
2

配置文件详细说明：

RulePath = "/usr/local/nginx/conf/waf/wafconf/"
    --规则存放目录
    attacklog = "off"
    --是否开启攻击信息记录，需要配置logdir
    logdir = "/usr/local/nginx/logs/hack/"
    --log存储目录，该目录需要用户自己新建，切需要nginx用户的可写权限
    UrlDeny="on"
    --是否拦截url访问
    Redirect="on"
    --是否拦截后重定向
    CookieMatch = "on"
    --是否拦截cookie攻击
    postMatch = "on" 
    --是否拦截post攻击
    whiteModule = "on" 
    --是否开启URL白名单
    black_fileExt={"php","jsp"}
    --填写不允许上传文件后缀类型
    ipWhitelist={"127.0.0.1"}
    --ip白名单，多个ip用逗号分隔
    ipBlocklist={"1.0.0.1"}
    --ip黑名单，多个ip用逗号分隔
    CCDeny="on"
    --是否开启拦截cc攻击(需要nginx.conf的http段增加lua_shared_dict limit 10m;)
    CCrate = "100/60"
    --设置cc攻击频率，单位为秒.
    --默认1分钟同一个IP只能请求同一个地址100次
    html=[[Please go away~~]]
    --警告内容,可在中括号内自定义
    备注:不要乱动双引号，区分大小写
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

执行一键安装部署的脚本！

#!/bin/bash
#Author:Guo darling Lin
yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel  libxml2 libxml2-dev libxslt-devel  gd gd-devel perl-devel perl-ExtUtils-Embed gperftoolsl
cd /usr/local/src/

[ ! -f "LuaJIT-2.0.5.tar.gz" ] && wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz 
[ ! -f "nginx-1.16.1.tar.gz" ] && wget http://nginx.org/download/nginx-1.16.1.tar.gz &&
[ ! -f "v0.3.0.tar.gz" ] && wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz 
[ ! -f "v0.10.13.tar.gz" ] && wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
[ ! -f "master.zip" ] && wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip --no-check-certificate

ls *.tar.gz | xargs -n 1  tar xf

cd LuaJIT-2.0.5 && make && make install 

cd /usr/local/src

echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile && \
echo "export LUAJIT_INC=/usr/local/include/luajit-2.0" >> /etc/profile
source /etc/profile
useradd -s /sbin/nologin -M nginx
cd nginx-1.16.1 
./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" 

make -j8 
make install 
ln -s /usr/local/nginx-1.16.1  /usr/local/nginx

mkdir -p /usr/local/nginx/logs/hack/ 
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/

cd /usr/local/src
wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf

sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file  /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf

ln -s /usr/local/nginx/sbin/nginx  /usr/sbin/
nginx
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75