You cannot see this page without javascript.

Apache httpd mod_security2 적용

APM 조회 수 225 추천 수 0 2017.02.09 09:45:12

modsecurity 소스 다운로드

cd /usr/src/
wget https://www.modsecurity.org/tarball/2.9.1/modsecurity-2.9.1.tar.gz
tar zxvf modsecurity-2.9.1.tar.gz

 

modsecurity 소스 컴파일
cd modsecurity-2.9.1/
./configure --with-apxs=/apm/server/apache/httpd/bin/apxs --with-apr=/apm/server/apache/apr/ --with-apu=/apm/server/apache/apr-util-1.5.4/

make

 

modsecurity 모듈복사

cp apache2/.libs/mod_security2.so /apm/server/apache/httpd/modules/

 

modsecurity 룰셋 다운로드
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
cd owasp-modsecurity-crs/

 

modsecurity 룰셋 복사
cp crs-setup.conf.example /apm/server/config/extra/crs-setup.conf
cp -R rules /apm/server/config/extra/

 

modsecurity httpd 적용

vi /apm/server/config/httpd.conf

LoadModule security2_module modules/mod_security2.so
<IfModule security2_module>
Include /apm/server/config/extra/crs-setup.conf
Include /apm/server/config/extra/rules/*.conf
</IfModule>

 

httpd 재시작

systemctl restart apache.service

 

mod-se.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

cd /usr/src/

 

yum update

 

CentOS7

yum install gcc-c++ flex bison yajl curl-devel curl zlib-devel pcre-devel autoconf automake git curl make libxml2-devel pkgconfig libtool redhat-rpm-config

yum install yajl-devel GeoIP-data GeoIP-devel lmdb-devel ssdeep-devel lua-devel

 

CentOS8

yum install gcc-c++ flex bison yajl curl-devel curl zlib-devel pcre-devel autoconf automake git curl make libxml2-devel pkgconfig libtool redhat-rpm-config

 
dnf --enablerepo=PowerTools install yajl-devel doxygen lmdb-devel ssdeep-devel lua-devel

 

yum install GeoIP-data GeoIP-devel

 

wget https://forensics.cert.org/centos/cert/8/x86_64//GeoIP-devel-1.6.12-5.el8.x86_64.rpm

wget https://forensics.cert.org/centos/cert/8/x86_64//GeoIP-1.6.12-5.el8.x86_64.rpm

wget https://forensics.cert.org/centos/cert/8/x86_64//GeoIP-GeoLite-data-2018.06-3.el8.noarch.rpm

 

yum install GeoIP-GeoLite-data-2018.06-2.el8.remi.noarch.rpm

yum install GeoIP-1.6.12-4.el8.remi.x86_64.rpm

yum install GeoIP-devel-1.6.12-4.el8.remi.x86_64.rpm

 

 

git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity

 

cd ModSecurity

 

git submodule init

git submodule update

 

./build.sh

./configure

 

make

make install

 

cd ..

git clone https://github.com/SpiderLabs/ModSecurity-apache

 

cd ModSecurity-apache

./autogen.sh

./configure --with-libmodsecurity=/usr/local/modsecurity/ --with-apxs=/apm/server/apache/httpd/bin/apxs --with-apache=/apm/server/apache/httpd/bin/httpd

 

make

make install

 

mkdir /apm/server/conf/ext

cp src/.libs/mod_security3.so /apm/server/conf/ext/

 

#echo "LoadModule security3_module /usr/lib64/httpd/modules/mod_security3.so" | sudo tee -a /etc/httpd/conf/httpd.conf

 

vi /apm/server/conf/httpd.conf

LoadModule security3_module /apm/server/conf/ext/mod_security3.so

 

<IfModule security3_module>

        modsecurity on

        modsecurity_rules_file /apm/server/conf/extra/rules.conf

</IfModule>

 

 

vi /apm/server/conf/extra/rules.conf

Include /apm/server/conf/extra/modsecurity.conf

Include /apm/server/conf/extra/crs-setup.conf

Include /apm/server/conf/extra/rules/*.conf

 

cp ../ModSecurity/modsecurity.conf-recommended /apm/server/conf/extra/modsecurity.conf

cp ../ModSecurity/unicode.mapping /apm/server/conf/extra/

 

vi /apm/server/conf/extra/modsecurity.conf

 

SecRuleEngine DetectionOnly -> SecRuleEngine On

SecAuditLog /var/log/modsec_audit.log -> SecAuditLog /apm/server/apache/httpd/logs/modsec_audit.log

 

 

 

 

#sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/httpd/conf.d/modsecurity.d/modsecurity.conf

#sed -i 's#/var/log/modsec_audit.log#/var/log/httpd/modsec_audit.log#' /etc/httpd/conf.d/modsecurity.d/modsecurity.conf

 

 

 

 

cd ..

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

cd owasp-modsecurity-crs/

 

cp crs-setup.conf.example /apm/server/conf/extra/crs-setup.conf

cp -R rules /apm/server/conf/extra/

 

 

 

 

httpd 재시작

 

systemctl restart apache.service

 

 

 

 

 

 

 

 

 

curl localhost/index.html?exec=/bin/bash

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html><head>

<title>403 Forbidden</title>

</head><body>

<h1>Forbidden</h1>

<p>You don't have permission to access /index.html

on this server.</p>

</body></html>

If you see, 403 Forbidden then it means you have nailed it.

 

You can as well check Modsecurity logs;

 

tail /var/log/httpd/modsec_audit.log

ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `/bin/bash' ) [file "/etc/httpd/conf.d/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "488"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/bash found within ARGS:exec: /bin/bash"] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] [tag "PCI/6.5.2"] [hostname "cent7.example.com"] [uri "/index.html"] [unique_id "156978926276.295922"] [ref "o1,8v21,9t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"]

ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/httpd/conf.d/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "79"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "cent7.example.com"] [uri "/index.html"] [unique_id "156978926276.295922"] [ref ""]

ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/httpd/conf.d/modsecurity.d/owasp-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "76"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "cent7.example.com"] [uri "/index.html"] [unique_id "156978926276.295922"] [ref ""]

Well, there you go and that is it on our guide on how to install LibModsecurity with Apache on Fedora 30/29/CentOS 7. Feel free to set up more rules as you wish and protect your web application.

 

Reference:

첨부
엮인글 :
https://tocup.net/xe/tech/64162/dd5/trackback
List of Articles
번호 제목 글쓴이 날짜 조회 수
349 Linux 라그나로크 LynX 2017-12-07 291
348 Linux modsecurity LynX 2017-12-06 123
347 CentOS centos7 groonga install LynX 2017-12-04 175
346 CentOS CemtOS 7.3 base Trinitycore 3.3.5 Compile file LynX 2017-11-13 198
345 CentOS CentOS7 GCC-5.1.1 yum install LynX 2017-11-10 100
344 APM http 프로토콜 https 로 리다이렉션 LynX 2017-07-14 84
343 Programing make - 07 접미사 규칙 LynX 2017-02-22 1360
342 Programing make - 06 make 규칙 LynX 2017-02-22 92
341 Programing make - 05 내부 매크로 LynX 2017-02-22 323
340 Programing make - 04 매크로 file LynX 2017-02-22 110
339 Programing make - 03 make의 사용 file LynX 2017-02-22 107
338 Programing make - 02 makefile file LynX 2017-02-22 60
337 Programing make - 01 make 란? file LynX 2017-02-22 243
336 LinuxMint Intel Linux Graphics Drivers Installer on Linux Mint file LynX 2017-02-20 105
335 Linux 리눅스 사용 기초 - 05 도움말 얻기 LynX 2017-02-17 53
334 Linux 리눅스 사용 기초 - 04 bash 셸 사용하기 LynX 2017-02-17 82
333 Linux 리눅스 사용 기초 - 03 vi 에디터 LynX 2017-02-17 57
332 Linux 리눅스 사용 기초 - 02 일반 명령어 사용법 익히기 LynX 2017-02-17 179
331 Linux 리눅스 사용 기초 - 01 명령어 구조와 명령어 쉽게 사용하기 LynX 2017-02-17 100
» APM Apache httpd mod_security2 적용 file LynX 2017-02-09 225

XE Login