Nginx使用Lua模塊實現WAF的原理解析

yum -y install gcc gcc-c++ autoconf automake make unzip
yum -y install zlib zlib-devel openssl openssl-devel pcre pcre-devel

# 進入目錄
cd /usr/local/src/
 
# 下載LuaJIT2.0
wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
 
# 解壓
tar xf LuaJIT-2.0.5.tar.gz && cd LuaJIT-2.0.5
 
# 編譯
make
 
# 安裝
make install PREFIX=/usr/local/lj2
 
# 建立軟連接
ln -s /usr/local/lj2/lib/libluajit-5.1.so.2 /lib64/
 
# 添加環境變量
export LUAJIT_LIB=/usr/local/lj2/lib/
export LUAJIT_INC=/usr/local/lj2/include/luajit-2.0/

# 進入目錄
cd /user/local/src/
 
# 下載v0.3.0.tar.gz
wget  https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz -O ngx_devel_kit.tar.gz
 
# 解壓
tar xf ngx_devel_kit.tar.gz

# 進入目錄
cd /user/local/src/
 
# 下載v0.10.9rc7.tar.gz
wget https://github.com/openresty/lua-nginx-module/archive/v0.10.9rc7.tar.gz
 
# 解壓
tar -xzvf v0.10.9rc7.tar.gz

# 進入目錄
cd /user/local/src/
 
# 下載
wget http://nginx.org/download/nginx-1.21.0.tar.gz
 
# 解壓
tar xf nginx-1.21.0.tar.gz
 
# 進入nginx目錄
cd nginx-1.21.0
 
# 編譯
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_flv_module --with-http_stub_status_module --with-http_gzip_static_module --with-http_realip_module --with-pcre --add-module=/usr/local/src/lua-nginx-module-0.10.9rc7 --add-module=/usr/local/src/ngx_devel_kit-0.3.0 --with-stream
 
# 安裝
make && make install
 
# 添加nginx配置，在server塊裡添加下面內容
[root@localhost_test_192.168.10.132 11:04:48 ~]# vim /usr/local/nginx/conf/nginx.conf
 
location /lua {
    default_type 'text/plain';
 
    content_by_lua 'ngx.say("hello, lua")';
}
 
# 檢查語法
[root@localhost_test_192.168.10.132 09:59:33 /usr/local/src]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
 
# 啟動
[root@localhost_test_192.168.10.132 11:08:35 ~]# nginx
 
# 測試
curl 127.0.0.1:80/lua

# 進入目錄
cd /user/local/src/
 
# 把ngx_lua_waf下載到conf目錄下
wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
 
# 解壓命名為waf
unzip master.zip -d /usr/local/nginx/conf/
 
# 更改目錄名
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf
 
# 在nginx.conf的http段添加
lua_package_path "/usr/local/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file  /usr/local/nginx/conf/waf/init.lua;
access_by_lua_file /usr/local/nginx/conf/waf/waf.lua;
 
# 在nginx.conf最外層添加用戶運行
user www;
 
# 創建日志目錄
mkdir /usr/local/nginx/logs/hack
chown www /usr/local/nginx/logs/hack
 
# Lua_waf 配置
[root@localhost_test_192.168.10.132 11:33:53 /usr/local/nginx/conf/waf]# cat config.lua
# 規則存放路徑
RulePath = "/usr/local/nginx/conf/waf/wafconf/"
# 是否開啟攻擊信息記錄，需要配置logdir
attacklog = "on"
# log存儲目錄，該目錄需要用戶自己新建，切需要nginx用戶的可寫權限
logdir = "/usr/local/nginx/logs/hack/"
# 是否攔截url訪問
UrlDeny="on"
# 是否攔截後重定向
Redirect="on"
# 是否攔截cookie攻擊
CookieMatch="on"
# 是否攔截post攻擊
postMatch="on"
# 是否開啟URL白名單
whiteModule="on"
# 填寫不允許上傳文件後綴類型
black_fileExt={"php","jsp"}
# ip白名單，多個ip用逗號分隔
ipWhitelist={"127.0.0.1"}
# ip黑名單，多個ip用逗號分隔
ipBlocklist={"192.168.10.1"}
# 是否開啟攔截cc攻擊(需要nginx.conf的http段增加lua_shared_dict limit 10m;)
CCDeny="off"
# 設置cc攻擊頻率，單位為秒.
# 默認1分鐘同一個IP隻能請求同一個地址100次
CCrate="100/60"
# 告警內容
html= []
 
# 規則文件
[root@localhost_test_192.168.10.132 11:42:12 /usr/local/nginx/conf/waf]# ll wafconf/
total 24
-rw-r--r-- 1 root root 749 Apr  6  2016 args
-rw-r--r-- 1 root root 652 Apr  6  2016 cookie
-rw-r--r-- 1 root root 733 Apr  6  2016 post
-rw-r--r-- 1 root root 335 Apr  6  2016 url
-rw-r--r-- 1 root root 177 Apr  6  2016 user-agent
-rw-r--r-- 1 root root   8 Apr  6  2016 whiteurl
 
args裡面的規則get參數進行過濾的
cookie是對請求過濾的cookie過濾
url是隻在get請求url過濾的規則
post是隻在post請求過濾的規則
whiteurl是白名單，裡面的url匹配到不做過濾
user-agent是對user-agent的過濾規則
 
# 加載Nginx
[root@localhost_test_192.168.10.132 11:32:41]# nginx -s reload