2

I've got LEMP all setup. Now I would like to add mod_security.

I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing to recompile?

I'm currently running nginx/1.9.15 installed with PPA because I was after HTTP/2. I don't have experience in compiling nginx and I don't know if ever I recompile I would break nginx since I got it from PPA.

Hope you can help.

Thank you.

  • 2
    Since 1.10 nginx can now load modules dynamically, so in principle it's no longer necessary to compile them with nginx. Contact the mod_security developers and ask them when they will take advantage of this. – Michael Hampton May 20 '16 at 10:55
5

You can do it by adding ModSecurity as dynamic module.

Requirement:NGINX 1.11.5 and later.

Step 1 : Installing needed packages

apt-get install -y apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev

Step 2 : Download and Compile the ModSecurity 3 Source Code

git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git submodule init
git submodule update
./build.sh
./configure
make
make install

Note: The compilation takes about 15 minutes, depending on the processing power of your system.

Step 3 : Download the NGINX Connector for ModSecurity and Compile It as a Dynamic Module

git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
wget http://nginx.org/download/nginx-1.13.7.tar.gz 
tar zxvf nginx-1.13.7.tar.gz 
cd nginx-1.13.7
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
make modules
cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules

Step 4 : Load the NGINX ModSecurity Connector Dynamic Module

Add this line to /etc/nginx/nginx.conf

load_module modules/ngx_http_modsecurity_module.so;

Step 5 : Configure and Enable

Set up the appropriate ModSecurity configuration file. Here we’re using the recommended ModSecurity configuration provided by TrustWave Spiderlabs, the corporate sponsors of ModSecurity.

mkdir /etc/nginx/modsec
wget -P /etc/nginx/modsec/ https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended
wget -P /etc/nginx/modsec/ https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping
mv /etc/nginx/modsec/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf

Change the SecRuleEngine directive in the configuration to change from the default “detection only” mode to actively dropping malicious traffic.

sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsec/modsecurity.conf

Configure one or more rules. For the purposes of this blog we’re creating a single simple rule that drops a request in which the URL argument called testparam includes the string test in its value. Put the following text in /etc/nginx/modsec/main.conf

# From https://github.com/SpiderLabs/ModSecurity/blob/master/\
# modsecurity.conf-recommended
#
# Edit to set SecRuleEngine On
Include "/etc/nginx/modsec/modsecurity.conf"


# Basic test rule
SecRule ARGS:testparam "@contains test" "id:1234,deny,status:403"

Add the modsecurity and modsecurity_rules_file directives to the NGINX configuration to enable ModSecurity:

server {
    # ...
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

source : nginx.com

  • Is there a PPA for this (xenial)? – Dan Bolser Mar 26 at 12:09
0

There is an available package from the repository ppa:phusion.nl/misc. Here are the basic steps to install:

sudo add-apt-repository ppa:phusion.nl/misc
sudo apt update
sudo apt install libnginx-mod-http-modsecurity

Thereafter you could follow configuration instructions from the other answers.

-1

To skip this manual lengthy installation progress, I have created scripit that takes care of downloading required files, respective nginx version source code downloading and compiling and all. Just follow below simple steps to get ModSecurity installed and configured:

# DOWNLOAD INSTALLATION SCRIPT
wget https://gist.githubusercontent.com/Chetan07j/edc16d6a55a25475cafeb6995f9c0857/raw/d1004a71710c263a8f0d0c098eebd21e72e0c101/libModSecurity.sh
​
# MAKE THIS FILE EXECUTABLE
sudo chmod +x libModSecurity.sh
​
# RUN THIS FILE
./libModSecurity.sh
​
# DONE

Installation is done now you need to add few lines in nginx.conf and in your server config in sites-available folder.

In /etc/nginx/nginx.conf file add this line immediate after pid line:

...
pid /run/nginx.pid;
load_module /etc/nginx/modules/ngx_http_modsecurity_module.so; # ADD THIS LINE

and then in your server config file under /etc/nginx/sites-available/

server {
    # ...
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

Thank you.

  • I strongly suggest adding some error checking to your script. For instance, on line 12, you're assuming that the cd $OPT_DIR will work - if it doesn't, the git clone on line 16 is going to clone stuff into whatever directory you started in. Don't just assume that commands will succed. – Jenny D Apr 19 at 9:29
  • ok. Thank you for suggestion, will definitely add those checks. – Chetan Patil Apr 19 at 9:34
  • "Without need to recompile" is in the question title. – womble Apr 19 at 9:36
  • Apart from that, it's a nice script... but I've been bitten badly a couple of times by writing and running scripts without error checking - I'm hoping to let others learn from my mistakes, nobody has time to do all mistakes on their own :-) – Jenny D Apr 19 at 13:18
  • Chetan Patil serverfault.com/users/520010/chetan-patil Fix The Line 62 ./configure --with-compatadd-dynamic-module=/opt/ModSecurity-nginx With ./configure --with-compat --add-dynamic-module=/opt/ModSecurity-nginx – Swarup Golui Apr 25 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.