|
|
| Zeile 1: |
Zeile 1: |
| = NGINX + ModSecurity (v3) als Reverse Proxy mit OWASP CRS =
| | #WEITERLEITUNG [[Nginx mit Modsecurity]] |
| | |
| Diese Konfiguration stellt einen TLS-gesicherten Reverse-Proxy mit aktiver ModSecurity-WAF und OWASP CRS bereit. Ziel ist die Absicherung von Backend-Webdiensten, ergänzt durch Logging und optionale Anzeige des Audit-Logs im Browser.
| |
| | |
| == Struktur ==
| |
| * TLS-Zertifikate aus interner CA (crt.pem, privkey.pem, ca.crt)
| |
| * Reverse Proxy auf Port 443 → Ziel: http://192.168.178.66
| |
| * Weiterleitung von HTTP auf HTTPS
| |
| * Logging ins access.log + modsec_audit.log + modsec_debug.log
| |
| * OWASP Core Rule Set aktiviert
| |
| * Beispielregel zur Erkennung von `<script>` im Query
| |
| | |
| == NGINX Site-Konfiguration (/etc/nginx/sites-available/default) ==
| |
| <pre>
| |
| # HTTP → HTTPS Redirect
| |
| server {
| |
| listen 80;
| |
| server_name localhost;
| |
| return 301 https://$host$request_uri;
| |
| }
| |
| | |
| # HTTPS-Server mit TLS-Zertifikat und ModSecurity | |
| server {
| |
| listen 443 ssl;
| |
| server_name localhost;
| |
| | |
| ssl_certificate /etc/nginx/crt.pem;
| |
| ssl_certificate_key /etc/nginx/privkey.pem;
| |
| ssl_client_certificate /etc/nginx/ca.crt;
| |
| | |
| ssl_protocols TLSv1.2 TLSv1.3;
| |
| ssl_prefer_server_ciphers on;
| |
| ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
| |
| | |
| access_log /var/log/nginx/access.log waf_combined;
| |
| error_log /var/log/nginx/error.log warn;
| |
| | |
| add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
| |
| add_header Cache-Control "no-store, no-cache, must-revalidate";
| |
| | |
| error_page 403 /403.html;
| |
| location = /403.html {
| |
| root /var/www/html;
| |
| internal;
| |
| }
| |
| | |
| include /etc/nginx/modsec/main.conf;
| |
| | |
| location / {
| |
| proxy_pass http://192.168.178.66;
| |
| proxy_set_header Host $host;
| |
| proxy_set_header X-Real-IP $remote_addr;
| |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
| |
| }
| |
| location /_waflog {
| |
| alias /var/log/nginx/modsec_audit.log;
| |
| types { }
| |
| default_type text/plain;
| |
| | |
| auth_basic "ModSecurity Auditlog";
| |
| auth_basic_user_file /etc/nginx/.htpasswd;
| |
| }
| |
| }
| |
| </pre>
| |
| | |
| == ModSecurity-Konfiguration (/etc/nginx/modsec/modsecurity.conf) ==
| |
| <pre>
| |
| SecRuleEngine On
| |
| SecRequestBodyAccess On
| |
| SecResponseBodyAccess Off
| |
| | |
| SecAuditEngine RelevantOnly
| |
| SecAuditLog /var/log/nginx/modsec_audit.log
| |
| SecAuditLogParts ABIJDEFHZ
| |
| | |
| SecDebugLog /var/log/nginx/modsec_debug.log
| |
| SecDebugLogLevel 3
| |
| | |
| SecTmpDir /tmp/
| |
| SecDataDir /tmp/
| |
| | |
| SecRule ARGS "@contains script" \
| |
| "id:9999,phase:1,deny,log,status:403,msg:'Test rule triggered'"
| |
| | |
| Include /etc/nginx/modsec/coreruleset/crs-setup.conf
| |
| Include /etc/nginx/modsec/coreruleset/rules/*.conf
| |
| </pre>
| |
| | |
| == Erweitertes Logging (in nginx.conf einfügen) ==
| |
| <pre>
| |
| log_format waf_combined '$remote_addr - $remote_user [$time_local] '
| |
| '"$request" $status $body_bytes_sent '
| |
| '"$http_referer" "$http_user_agent" '
| |
| 'ModSecID=$request_id Host="$host" URI="$request_uri"';
| |
| </pre>
| |
| | |
| == Rechte und Dateianlage für Logs ==
| |
| <pre>
| |
| touch /var/log/nginx/modsec_audit.log /var/log/nginx/modsec_debug.log
| |
| chown www-data:www-data /var/log/nginx/modsec_*.log
| |
| chmod 640 /var/log/nginx/modsec_*.log
| |
| </pre>
| |
| | |
| == Aktivierung ==
| |
| <pre>
| |
| ln -sf /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
| |
| nginx -t && systemctl reload nginx
| |
| </pre>
| |
| | |
| == Hinweise ==
| |
| * Die Audit-Log-Datei kann über `/waflog` im Browser angezeigt werden (intern erlaubt).
| |
| * Der `crs-setup.conf` definiert Schwellenwerte, Paranoia-Level und Variablenkontrolle.
| |
| * Die Regeln befinden sich unter: `/etc/nginx/modsec/coreruleset/rules/`
| |
| * ModSecurity greift nur, wenn `include /etc/nginx/modsec/main.conf` gesetzt ist.
| |
| | |
| [[KATEGORIE:WAF]] | |