环境：
操作系统：Centos 7
modsecurity V3.0
GeoIP
Nginx
yum install -y pcre pcre-devel openssl openssl-devel libtool libtool-ltdl-devel gcc gcc-c++ gcc-g77 autoconf automake geoip geip-devel libcurl libcurl-devel yajl yajl-devel lmdb-devel ssdeep-devel lua-devel unzip
#第一：准备编译和依赖环境
yum install gcc wget git geoip-devel libcurl-devel libxml2 libxml2-devel libgd-devel openssl-devel -y
yum groupinstall 'Development tools' -y
#第二：下载并安装ModSecurity
mkdir /root/media
cd /root/media
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git submodule init
git submodule update
./build.sh
编译的最后报错：configure.ac: installing './ylwrap' fatal: No names found, cannot describe anything. 可以先忽略。
./configure
make
make install
执行configure的时候如果出现报错：”fatal: Not a git repository (or any of the parent directories): .git“，需要先执行git init
#第三：下载nginx与modsecurity的连接器
cd /root/media
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
#第四：下载并编译nginx（将连接器编译进去）
yum install pcre-devel openssl-devel gd-devel geoip-devel -y
wget https://nginx.org/download/nginx-1.14.1.tar.gz
// 较新的ngixn wget https://nginx.org/download/nginx-1.17.8.tar.gz tar -zxvf nginx-1.14.1.tar.gz //解压
cd nginx-1.14.1
./configure \
--prefix=/usr/local/nginx \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_image_filter_module=dynamic \
--with-http_geoip_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_stub_status_module \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-stream_ssl_module \
--with-debug \
--add-dynamic-module=/root/media/ModSecurity-nginx \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" ;
简化：
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_geoip_module=dynamic --add-dynamic-module=/root/media/ModSecurity-nginx
编译
make modules #编译模块
make
make install
编译的时候可能报错，显示需要安装GD library
使用源码编译安装
配置modsec与nginx
#第一：配置modsecurity
mkdir /usr/local/nginx/conf/modsec
cp /root/media/ModSecurity/modsecurity.conf-recommended /usr/local/nginx/conf/modsec/modsecurity.conf
cp /root/media/ModSecurity/unicode.mapping /usr/local/nginx/conf/modsec/
#第二：配置nginx,使其开启加载modsec模块
cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bk //先备份
cat /usr/local/nginx/conf/nginx.conf
#该行在nginx.conf的event字段上面添加
load_module modules/ngx_http_modsecurity_module.so;
#配置在具体vhost里面
modsecurity on; #表示开启modsec
location / {
root html;
modsecurity_rules_file /usr/local/nginx/conf/modsec/modsecurity.conf;
index index.html index.htm;
}
#第三：测试nginx配置文件是否正确
/usr/local/nginx/sbin/nginx -t
#第四：使用测试规则调试modsec与nginx的工作是否正常
cp /usr/local/nginx/conf/modsec/modsecurity.conf /usr/local/nginx/conf/modsec/modsecurity.conf.bk //先备份
cat /usr/local/nginx/conf/modsec/modsecurity.conf
#SecRuleEngine DetectionOnly(将该行改为如下，表示启用拦截功能。默认只记录不拦截)
SecRuleEngine On
#添加如下一行，指定modsecurity的记录日志格式为json(默认的行数太多)
SecAuditLogFormat JSON
#在最后添加一个测试规则（测试完成就删除该行吧）
SecRule ARGS:testparam "@contains test" "id:1234,deny,log,status:403"
#第五：启动nginx并验证modsec与nginx的工作是否正常
/usr/local/nginx/sbin/nginx &
curl -D - http://localhost/foo?testparam=thisisatestofmodsecurity
#若是返回403则表示规则生效
#可以通过日志进行验证
cat /var/log/modsec_audit.log
#第六：安装owasp核心规则CRS
cd /root/media
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
cp -rf owasp-modsecurity-crs /usr/local/nginx/conf/
cd /usr/local/nginx/conf/owasp-modsecurity-crs
cp crs-setup.conf.example crs-setup.conf
cd /usr/local/nginx/conf/owasp-modsecurity-crs/rules/
mv REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
#第七：让owasp核心规则生效加入modsecurity配置文件
cat /usr/local/nginx/conf/modsec/modsecurity.conf
#在最后添加引入owasp核心规则
Include /usr/local/nginx/conf/owasp-modsecurity-crs/crs-setup.conf
Include /usr/local/nginx/conf/owasp-modsecurity-crs/rules/*.conf
#第八：更换403页面
need-to-insert-img
error_page 403 /403.html;
Status Code: 403
OPPSSS!!!! Sorry...
Sorry, your access is refused due to security reasons of our server and also our sensitive data.
Please go back to the previous page to continue browsing.
WAF 2020, Sense Software
测试页面是否生效
/usr/local/nginx/sbin/nginx &
curl -D - http://localhost/foo?testparam=thisisatestofmodsecurity
测试owasp核心规则是否生效
#第一：重启nginx
/usr/local/nginx/sbin/nginx -s reload &
#第二：使用nikto测试owasp 核心规则是否生效
#Nikto扫描工具生成恶意请求，包括针对已呃知易受攻击的文件，跨站点脚本（XSS）和其他类型的攻击的探测。
#该工具还会报告传递给应用程序的请求，从而揭示应用程序中的潜在漏洞。
git clone https://github.com/sullo/nikto
Cloning into 'nikto'...
cd nikto
perl program/nikto.pl -h http://localhost
#可以通过日志进行验证
cat /var/log/modsec_audit.log
报错： fatal error: libxml/xmlschemas.h: No such file or directory
https://blog.csdn.net/liupengying123/article/details/21077577
解决办法：
1、安装lixml库的dev版本（dev版本的库文件会安装头文件）
apt-get install libxml2-dev
2、建立软连接
ln -s /usr/include/libxml2/libxml /usr/include/libxml
编译的时候默认会到/usr/inlcude下去查找头文件
报错：
./configure: error: ngx_http_modsecurity_module requires the ModSecurity library
主要参考：
GeoIP参考：https://blog.csdn.net/tengfei_0812/article/details/52913170
测试参考：https://www.jianshu.com/p/ba7df723cb06
https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/#prereq
https://blog.csdn.net/yes_is_ok/article/details/81737427
https://www.nginx.com/blog/compiling-and-installing-modsecurity-for-open-source-nginx/
