{"id":4711,"date":"2019-11-30T10:35:09","date_gmt":"2019-11-30T07:35:09","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4711"},"modified":"2024-03-12T23:07:11","modified_gmt":"2024-03-12T20:07:11","slug":"configure-libmodsecurity-with-nginx-on-centos-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/configure-libmodsecurity-with-nginx-on-centos-8\/","title":{"rendered":"Configure LibModsecurity with Nginx on CentOS 8"},"content":{"rendered":"\n

In this guide, we are going to learn how to configure LibModsecurity with Nginx on CentOS 8. LibMosecurity is the newest version of ModSecurity<\/a> version 2.9 and below. It is therefore known as ModSecurity version 3.<\/p>\n\n\n\n

Configuring LibModsecurity with Nginx on CentOS 8<\/h2>\n\n\n\n

Run System Update<\/h3>\n\n\n\n

Begin by updating your system packages.<\/p>\n\n\n\n

dnf update<\/code><\/pre>\n\n\n\n
Install Required Build Tools and Dependencies<\/h3>\n\n\n\n
Both Nginx and LibModsecurity are going to be compiled from the source and thus a number of build tools and dependencies are required. Run the command below to install them.<\/p>\n\n\n\n
dnf install gcc-c++ flex bison yajl curl-devel curl zlib-devel pcre-devel autoconf automake git curl make libxml2-devel pkgconfig libtool httpd-devel redhat-rpm-config git wget openssl openssl-devel vim<\/code><\/pre>\n\n\n\n
dnf --enablerepo=PowerTools install doxygen yajl-devel<\/code><\/pre>\n\n\n\n
Install GeoIP Libraries<\/p>\n\n\n\n
dnf install https:\/\/dl.fedoraproject.org\/pub\/epel\/epel-release-latest-8.noarch.rpm<\/code><\/pre>\n\n\n\n
dnf install https:\/\/rpms.remirepo.net\/enterprise\/remi-release-8.rpm<\/code><\/pre>\n\n\n\n
dnf --enablerepo=remi install GeoIP-devel<\/code><\/pre>\n\n\n\n
Download LibModsecurity Source Code<\/h3>\n\n\n\n
Create a temporary directory to store the source tarballs.<\/p>\n\n\n\n
mkdir \/tmp\/modsec<\/code><\/pre>\n\n\n\n
You can choose to use \/opt<\/code> instead.<\/p>\n\n\n\n
Run the command below to  clone the latest LibModsecurity GitHub repository.<\/p>\n\n\n\n
cd \/tmp\/modsec<\/code><\/pre>\n\n\n\n
git clone --depth 1 -b v3\/master --single-branch https:\/\/github.com\/SpiderLabs\/ModSecurity<\/code><\/pre>\n\n\n\n
Compile and Install LibModsecurity<\/h3>\n\n\n\n
Navigate to the LibModsecurity source directory, configure, compile and install it<\/p>\n\n\n\n
cd ModSecurity<\/code><\/pre>\n\n\n\n
Download libInjection code which is available as part of ModSecurity source code in a format of a git-submodule<\/p>\n\n\n\n
git submodule init\ngit submodule update<\/code><\/pre>\n\n\n\n
Configure LibModsecurity to adapt it to your system and check if any required dependency is missing.<\/p>\n\n\n\n
.\/build.sh\n.\/configure<\/code><\/pre>\n\n\n\n
The fatal: No names found, cannot describe anything<\/strong> can be safely ignored. Fix any dependency issue just in case there is any.<\/p>\n\n\n\n
Compile and install LibModSecurity.<\/p>\n\n\n\n
make<\/code><\/pre>\n\n\n\n
make install<\/code><\/pre>\n\n\n\n
Install Nginx with LibModsecurity Support<\/h3>\n\n\n\n
To setup Nginx with LibModsecurity, you need to compile Nginx with support for LibModsecurity.<\/p>\n\n\n\n
Therefore, download the ModSecurity-nginx connector which provides a communication channel between Nginx and LibModsecurity by cloning its git repository.<\/p>\n\n\n\n
cd \/tmp\/modsec\ngit clone https:\/\/github.com\/SpiderLabs\/ModSecurity-nginx.git<\/code><\/pre>\n\n\n\n
Next, download the latest staple version of Nginx from Nginx downloads<\/a>. The latest version as of this writing is version nginx-1.17.6.tar.gz<\/a>.<\/p>\n\n\n\n
wget http:\/\/nginx.org\/download\/nginx-1.17.6.tar.gz<\/code><\/pre>\n\n\n\n
Extract the archive.<\/p>\n\n\n\n
tar xzf nginx-1.17.6.tar.gz<\/code><\/pre>\n\n\n\n
Create a non-privileged Nginx system user and group.<\/p>\n\n\n\n
useradd -r -M -s \/sbin\/nologin -d \/usr\/local\/nginx nginx<\/code><\/pre>\n\n\n\n
Navigate to Nginx source directory and configure it.<\/p>\n\n\n\n
cd nginx-1.17.6<\/code><\/pre>\n\n\n\n
.\/configure --user=nginx --group=nginx --with-pcre-jit --with-debug --with-http_ssl_module --with-http_realip_module --add-module=\/tmp\/modsec\/ModSecurity-nginx<\/code><\/pre>\n\n\n\n
Compile and install Nginx.<\/p>\n\n\n\n
make\nmake install<\/code><\/pre>\n\n\n\n
Confgure Nginx with ModSecurity<\/h3>\n\n\n\n
To begin with, copy the sample ModSecurity configuration file on the source directory to Nginx configuration directory.<\/p>\n\n\n\n
cp \/tmp\/modsec\/ModSecurity\/modsecurity.conf-recommended \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code><\/pre>\n\n\n\n
Copy the unicode.mapping<\/code> file from ModSecurity source directory to Nginx configuration directory.<\/p>\n\n\n\n
cp \/tmp\/modsec\/ModSecurity\/unicode.mapping \/usr\/local\/nginx\/conf\/<\/code><\/pre>\n\n\n\n
Next, edit Nginx configuration file and make the changes as shown below.<\/p>\n\n\n\n
Create a backup of the Nginx configuration file.<\/p>\n\n\n\n
cp \/usr\/local\/nginx\/conf\/nginx.conf \/usr\/local\/nginx\/conf\/nginx.conf.bak<\/code><\/pre>\n\n\n\n
Open the configuration file for editing.<\/p>\n\n\n\n
vim \/usr\/local\/nginx\/conf\/nginx.conf<\/code><\/pre>\n\n\n\n
Configure Nginx such that your configuration may look like;<\/p>\n\n\n\n
user  nginx;\nworker_processes  1;\npid        \/run\/nginx.pid;\nevents {\n    worker_connections  1024;\n}\nhttp {\n    include       mime.types;\n    default_type  application\/octet-stream;\n    sendfile        on;\n    keepalive_timeout  65;\n    server {\n        listen       80;\n        server_name  nginx.kifarunix-demo.com;\n        modsecurity  on;\n        modsecurity_rules_file  \/usr\/local\/nginx\/conf\/modsecurity.conf;<\/strong>\n        access_log  \/var\/log\/nginx\/access_kifarunix-demo.log;\n        error_log  \/var\/log\/nginx\/error_kifarunix-demo.log;\n        location \/ {\n            root   html;\n            index  index.html index.htm;\n        }\n        error_page   500 502 503 504  \/50x.html;\n        location = \/50x.html {\n            root   html;\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
Note that the line;<\/p>\n\n\n\n
modsecurity  on;\nmodsecurity_rules_file  \/usr\/local\/nginx\/conf\/modsecurity.conf;<\/code><\/pre>\n\n\n\n
Turns on Modsecurity and specifies the location of the Modsecurity rules.<\/p>\n\n\n\n
Note that ModSecurity 3 can be turned on per directory basis.<\/p>\n\n\n\n
Create Nginx log directory.<\/p>\n\n\n\n
mkdir \/var\/log\/nginx<\/code><\/pre>\n\n\n\n
Create Nginx Systemd Service<\/h4>\n\n\n\n
To be able to run Nginx as a service, create a systemd service as shown below;<\/p>\n\n\n\n
vim \/etc\/systemd\/system\/nginx.service<\/code><\/pre>\n\n\n\n
[Unit]\nDescription=The nginx HTTP and reverse proxy server\nAfter=network.target remote-fs.target nss-lookup.target\n\n[Service]\nType=forking\nPIDFile=\/run\/nginx.pid\nExecStartPre=\/usr\/bin\/rm -f \/run\/nginx.pid\nExecStartPre=\/usr\/sbin\/nginx -t\nExecStart=\/usr\/sbin\/nginx\nExecReload=\/bin\/kill -s HUP $MAINPID\nKillSignal=SIGQUIT\nTimeoutStopSec=5\nKillMode=mixed\nPrivateTmp=true\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n
Create a symbolic link of Nginx binary to \/usr\/sbin\/<\/code> path.<\/p>\n\n\n\n
ln -s \/usr\/local\/nginx\/sbin\/nginx \/usr\/sbin\/<\/code><\/pre>\n\n\n\n
Reload systemd configurations.<\/p>\n\n\n\n
systemctl daemon-reload<\/code><\/pre>\n\n\n\n
Run Nginx configuration syntax error verification.<\/p>\n\n\n\n
nginx -t<\/code><\/pre>\n\n\n\n
nginx: the configuration file \/usr\/local\/nginx\/conf\/nginx.conf syntax is ok\nnginx: configuration file \/usr\/local\/nginx\/conf\/nginx.conf test is successful<\/code><\/pre>\n\n\n\n
If all is well, start and enable Nginx to run on system boot.<\/p>\n\n\n\n
systemctl enable --now nginx<\/code><\/pre>\n\n\n\n
Check the status;<\/p>\n\n\n\n
systemctl status nginx<\/code><\/pre>\n\n\n\n
\u25cf nginx.service - The nginx HTTP and reverse proxy server\n   Loaded: loaded (\/etc\/systemd\/system\/nginx.service; enabled; vendor preset: disabled)\n   Active: active (running) since Sat 2019-11-30 09:52:05 EAT; 9s ago\n  Process: 2679 ExecStart=\/usr\/sbin\/nginx (code=exited, status=0\/SUCCESS)\n  Process: 2678 ExecStartPre=\/usr\/sbin\/nginx -t (code=exited, status=0\/SUCCESS)\n  Process: 2676 ExecStartPre=\/usr\/bin\/rm -f \/run\/nginx.pid (code=exited, status=0\/SUCCESS)\n Main PID: 2681 (nginx)\n    Tasks: 2 (limit: 11524)\n   Memory: 3.5M\n   CGroup: \/system.slice\/nginx.service\n           \u251c\u25002681 nginx: master process \/usr\/sbin\/nginx\n           \u2514\u25002682 nginx: worker process\n...<\/code><\/pre>\n\n\n\n
Turn on ModSecurity Rule Engine <\/h3>\n\n\n\n
By default, ModSecurity is set on detection only mode where it only logs the requests based on the triggered rules without blocking anything. This can be changed by setting the value of SecRuleEngine<\/code> to On<\/code>.<\/p>\n\n\n\n
sed -i 's\/SecRuleEngine DetectionOnly\/SecRuleEngine On\/' \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code><\/pre>\n\n\n\n
You can also change default log directory for Modsecurity<\/p>\n\n\n\n
sed -i 's#\/var\/log\/modsec_audit.log#\/var\/log\/nginx\/modsec_audit.log#' \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code><\/pre>\n\n\n\n
Install OWASP ModSecurity Core Rule Set (CRS)<\/h3>\n\n\n\n
The OWASP ModSecurity Core Rule Set (CRS)<\/strong> is a set of generic attack detection rules for use with ModSecurity. It aims at protecting the web applications from a wide range of attacks, including the OWASP Top Ten, minimum of false alerts.<\/p>\n\n\n\n
Clone the CRS from GitHub repository<\/a> to \/usr\/local\/nginx\/conf\/<\/code> as shown below;<\/p>\n\n\n\n
git clone https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs.git \/usr\/local\/nginx\/conf\/owasp-crs<\/code><\/pre>\n\n\n\n
Next, rename crs-setup.conf.example<\/code> to crs-setup.conf<\/code>.<\/p>\n\n\n\n
sudo cp \/usr\/local\/nginx\/conf\/owasp-crs\/crs-setup.conf{.example,}<\/code><\/pre>\n\n\n\n
Once the OWASP rules are in place, configure ModSecurity to use these rules. You therefore need to enter the following lines on the ModSecurity configuration file to tell it where to find the rules.<\/p>\n\n\n\n
echo -e \"Include owasp-crs\/crs-setup.conf\\nInclude owasp-crs\/rules\/*.conf\" >> \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code><\/pre>\n\n\n\n
This command will append the lines below on \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code>.<\/p>\n\n\n\n
Include owasp-crs\/crs-setup.conf\nInclude owasp-crs\/rules\/*.conf<\/code><\/pre>\n\n\n\n
Verify Nginx configuration file again.<\/p>\n\n\n\n
nginx -t<\/code><\/pre>\n\n\n\n
Next, restart Nginx if everything is Okay.<\/p>\n\n\n\n
systemctl restart nginx<\/code><\/pre>\n\n\n\n
Testing ModSecurity on Nginx<\/h3>\n\n\n\n
Next, you can test the effectiveness of Modsecurity with OWASP rules, for example, using the command injection. Run the command below;<\/p>\n\n\n\n
curl localhost\/index.html?exec=\/bin\/bash<\/code><\/pre>\n\n\n\n
You should get 403 Forbidden<\/code><\/strong> if the rules are file.<\/p>\n\n\n\n
<html>\n<head><title>403 Forbidden<\/title><\/head>\n<body>\n<center><h1>403 Forbidden<\/h1><\/center>\n<hr><center>nginx\/1.17.6<\/center>\n<\/body>\n<\/html><\/code><\/pre>\n\n\n\n
Check the logs file.<\/p>\n\n\n\n
tail \/var\/log\/nginx\/mod<\/code><\/pre>\n\n\n\n
ModSecurity: Warning. Matched \"Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `\/bin\/bash' ) [file \"\/usr\/local\/nginx\/conf\/owasp-crs\/rules\/REQUEST-932-APPLICATION-ATTACK-RCE.conf\"] [line \"496\"] [id \"932160\"] [rev \"\"] [msg \"Remote Command Execution: Unix Shell Code Found\"] [data \"Matched Data: bin\/bash found within ARGS:exec: \/bin\/bash\"] [severity \"2\"] [ver \"OWASP_CRS\/3.2.0\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-shell\"] [tag \"platform-unix\"] [tag \"attack-rce\"] [tag \"paranoia-level\/1\"] [tag \"OWASP_CRS\"] [tag \"OWASP_CRS\/WEB_ATTACK\/COMMAND_INJECTION\"] [tag \"WASCTC\/WASC-31\"] [tag \"OWASP_TOP_10\/A1\"] [tag \"PCI\/6.5.2\"] [hostname \"127.0.0.1\"] [uri \"\/index.html\"] [unique_id \"157509875732.654695\"] [ref \"o1,8v21,9t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase\"]\nModSecurity: Access denied with code 403 (phase 2). Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file \"\/usr\/local\/nginx\/conf\/owasp-crs\/rules\/REQUEST-949-BLOCKING-EVALUATION.conf\"] [line \"79\"] [id \"949110\"] [rev \"\"] [msg \"Inbound Anomaly Score Exceeded (Total Score: 5)\"] [data \"\"] [severity \"2\"] [ver \"\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-generic\"] [hostname \"127.0.0.1\"] [uri \"\/index.html\"] [unique_id \"157509875732.654695\"] [ref \"\"]\nModSecurity: Warning. Matched \"Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file \"\/usr\/local\/nginx\/conf\/owasp-crs\/rules\/RESPONSE-980-CORRELATION.conf\"] [line \"76\"] [id \"980130\"] [rev \"\"] [msg \"Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0\"] [data \"\"] [severity \"0\"] [ver \"\"] [maturity \"0\"] [accuracy \"0\"] [tag \"event-correlation\"] [hostname \"127.0.0.1\"] [uri \"\/index.html\"] [unique_id \"157509875732.654695\"] [ref \"\"]<\/code><\/pre>\n\n\n\n
You can also create your own test rules. For example, append the line below on your \/usr\/local\/nginx\/conf\/modsecurity.conf<\/code>.<\/p>\n\n\n\n
SecRule ARGS \"@streq test\" \"id:1,phase:1,deny,msg:\\'Mytest Rule\\'\"<\/code><\/pre>\n\n\n\n
Save the configuration file. You can also create your custom rules file and make sure it is included on the main ModSecurity configuration file.<\/p>\n\n\n\n
Restart Nginx.<\/p>\n\n\n\n
systemctl restart nginx<\/code><\/pre>\n\n\n\n
Test the rule.<\/p>\n\n\n\n
curl localhost\/index.html?a=test<\/code><\/pre>\n\n\n\n
<html>\n<head><title>403 Forbidden<\/title><\/head>\n<body>\n<center><h1>403 Forbidden<\/h1><\/center>\n<hr><center>nginx\/1.17.6<\/center>\n<\/body>\n<\/html><\/code><\/pre>\n\n\n\n
Check the log file.<\/p>\n\n\n\n
ModSecurity: Access denied with code 403 (phase 1). Matched \"Operator `StrEq' with parameter `test' against variable `ARGS:a' (Value: `test' ) [file \"\/usr\/local\/nginx\/conf\/modsecurity.conf\"] [line \"254\"] [id \"1\"] [rev \"\"] [msg \"\\'Mytest Rule\\'\"] [data \"\"] [severity \"0\"] [ver \"\"] [maturity \"0\"] [accuracy \"0\"] [hostname \"127.0.0.1\"] [uri \"\/index.html\"] [unique_id \"157509886780.823503\"] [ref \"v18,4\"]<\/code><\/pre>\n\n\n\n
The ModSecurity is now running and protecting your web server.<\/p>\n\n\n\n
If you want to run any specific web application that requires LAMP stack\/LEMP stack installed, you can follow the links below to set up LEMP\/LAMP stack on CentOS 8.<\/p>\n\n\n\n
Install LEMP Stack on CentOS 8<\/a><\/p>\n\n\n\n
Install LAMP Stack on CentOS 8<\/a><\/p>\n\n\n\n
You can check our other guides on ModSecurity by following the links below;<\/p>\n\n\n\n
Install LibModsecurity with Apache on Ubuntu 18.04<\/a><\/p>\n\n\n\n
Install LibModsecurity with Apache on Fedora 30\/29\/CentOS 7<\/a><\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
In this guide, we are going to learn how to configure LibModsecurity with Nginx on CentOS 8. LibMosecurity is the newest version of ModSecurity version<\/p>\n","protected":false},"author":1,"featured_media":10111,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,254,121,1207,304,253],"tags":[1142,1140,1141,229,1208],"class_list":["post-4711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-apache","category-howtos","category-modsecurity","category-nginx","category-web-servers","tag-centos-8","tag-libmodsecurity","tag-modsecurity-3","tag-nginx","tag-nginx-with-modsecurity","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4711"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4711"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4711\/revisions"}],"predecessor-version":[{"id":21243,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4711\/revisions\/21243"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/10111"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}