客服电话
APP下载
迪恩网络APP
随时随地掌握行业动态
官方微信
扫描二维码
关注迪恩网络微信公众号
一、了解WAF1.1 什么是WAFWeb应用防护系统（也称：网站应用级入侵防御系统 。英文：Web Application Firewall，简称： WAF）。利用国际上公认的一种说法：Web应用 防火墙 是通过执行一系列针对HTTP/HTTPS的 安全策略 来专门为Web应用提供保护的一款产品。 1.2 WAF的功能
1.3 WAF的特点
1.3WAF与网络防火墙的区别 网络防火墙作为访问控制设备，主要工作在OSI模型三、四层，基于IP报文进行检测。只是对端口做限制，对TCP协议做封堵。其产品设计无需理解HTTP会话，也就决定了无法理解Web应用程序语言如HTML、SQL语言。因此，它不可能对HTTP通讯进行输入验证或攻击规则分析。针对Web网站的恶意攻击绝大部分都将封装为HTTP请求，从80或443端口顺利通过防火墙检测。 二、使用nginx配置简单实现403和4042.1 小试身手之rerurn 403修改nginx配置文件在server中加入以下内容 set $block_user_agent 0; if ( $http_user_agent ~ "Wget|AgentBench"){ set $block_user_agent 1; } if ($block_user_agent = 1) { return 403 ; }
通过其他机器去wget，结果如下 2.2小试身手之rerurn 404在nginx配置文件中加入如下内容，让访问sql|bak|zip|tgz|tar.gz的请求返回404 location ~* "\.(sql|bak|zip|tgz|tar.gz)$"{ return 404 }
在网站根目录下放一个tar.gz 三、深入实现WAF3.1 WAF实现规划分析步骤如下：解析HTTP请求==》匹配规则==》防御动作==》记录日志
3.2安装nginx+lua由于nginx配置文件书写不方便，并且实现白名单功能很复杂，nginx的白名单也不适用于CC攻击，所以在这里使用nginx+lua来实现WAF，如果想使用lua，须在编译nginx的时候配置上lua，或者结合OpenResty使用,此方法不需要编译nginx时候指定lua 3.2.1 编译nginx的时候加载lua环境准备：Nginx安装必备的Nginx和PCRE软件包。 [[email protected] ~]# cd /usr/local/src [[email protected] src]# wget http://nginx.org/download/nginx-1.9.4.tar.gz[[email protected] src]# wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.37.tar.gz 其次，下载当前最新的luajit和ngx_devel_kit (NDK)，以及春哥编写的lua-nginx-module [[email protected] src]# wget http://luajit.org/download/LuaJIT-2.0..tar.gz[[email protected] src]# wget https://github.com/simpl/ngx_devel_kit/archive/v0.2.19.tar.gz[[email protected] src]# wget https://github.com/openresty/lua-nginx-module/archive/v0.9.16.tar.gz 最后，创建Nginx运行的普通用户 [[email protected] src]# useradd -s /sbin/nologin -M www 解压NDK和lua-nginx-module [[email protected] src]# tar zxvf v0.2.19.tar.gz[[email protected] src]# tar zxvf v0.9.16.tar.gz 安装LuaJIT Luajit是Lua即时编译器 [[email protected] src]# tar zxvf LuaJIT-2.0.3.tar.gz [[email protected] src]# cd LuaJIT-2.0.3[[email protected] LuaJIT-2.0.3]# make && make install 安装Nginx并加载模块 [[email protected] src]# tar zxvf nginx-1.9.4.tar.gz [[email protected]-compute-node5 src]# cd nginx-1.9.4[[email protected] nginx-1.9.4]# export LUAJIT_LIB=/usr/local/lib[[email protected] nginx-1.9.4]# export LUAJIT_INC=/usr/local/include/luajit-2.0[[email protected] nginx-1.9.4]# ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_ssl_module --with-http_stub_status_module --with-file-aio --with-http_dav_module --add-module=../ngx_devel_kit-0.2.19/ --add-module=../lua-nginx-module-0.9.16/ --with-pcre=/usr/local/src/pcre-8.37 [[email protected] nginx-1.5.12]# make -j2 && make install[[email protected] ~]# ln -s /usr/local/lib/libluajit-5.1.so.2 /lib64/libluajit-5.1.so.2 #一定创建此软连接，否则报错 安装完毕后，下面可以测试安装了，修改nginx.conf 增加第一个配置 location /hello { default_type 'text/plain'; content_by_lua 'ngx.say("hello,lua")'; }[[email protected] ~]# /usr/local/nginx-1.9.4/sbin/nginx –t[[email protected]ompute-node5 ~]# /usr/local/nginx-1.9.4/sbin/nginx
效果如下 3.2.3 Openresty部署安装依赖包 [[email protected] ~]#yum install -y readline-devel pcre-devel openssl-devel 下载并编译安装openresty [[email protected] ~]#cd /usr/local/src[[email protected] src]#wget https://openresty.org/download/ngx_openresty-1.9.3.2.tar.gz[[email protected] src]#tar zxf ngx_openresty-1.9.3.2.tar.gz[[email protected] src]#cd ngx_openresty-1.9.3.2[[email protected] ngx_openresty-1.9.3.2]# ./configure --prefix=/usr/local/openresty-1.9.3.2 --with-luajit --with-http_stub_status_module --with-pcre --with-pcre-jit[[email protected] ngx_openresty-1.9.3.2]#gmake && gmake installln -s /usr/local/openresty-1.9.3.2/ /usr/local/openresty 测试openresty安装 [[email protected] ~]#vim /usr/local/openresty/nginx/conf/nginx.confserver { location /hello { default_type text/html; content_by_lua_block { ngx.say("HelloWorld") } }} 测试并启动nginx [[email protected] ~]#/usr/local/openresty/nginx/sbin/nginx -tnginx: the configuration file /usr/local/openresty-1.9.3.2/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/openresty-1.9.3.2/nginx/conf/nginx.conf test is successful[[email protected] ~]#/usr/local/openresty/nginx/sbin/nginx 3.2.4WAF部署在github上克隆下代码 [[email protected] ~]#git clone https://github.com/unixhot/waf.git[[email protected] ~]#cp -a ./waf/waf /usr/local/openresty/nginx/conf/ 修改Nginx的配置文件，加入（http字段）以下配置。注意路径，同时WAF日志默认存放在/tmp/日期_waf.log #WAF lua_shared_dict limit 50m; #防cc使用字典，大小50M lua_package_path "/usr/local/openresty/nginx/conf/waf/?.lua"; init_by_lua_file "/usr/local/openresty/nginx/conf/waf/init.lua"; access_by_lua_file "/usr/local/openresty/nginx/conf/waf/access.lua";[[email protected] ~]# /usr/local/openresty/nginx/sbin/nginx –t[[email protected] ~]# /usr/local/openresty/nginx/sbin/nginx 根据日志记录位置，创建日志目录 [[email protected] ~]#mkdir /tmp/waf_logs[[email protected] ~]#chown nginx.nginx /tmp/waf_logs 3.3学习模块3.3.1学习配置模块WAF上生产之前，建议不要直接上生产，而是先记录日志，不做任何动作。确定WAF不产生误杀 [[email protected] waf]# pwd/usr/local/nginx/conf/waf[[email protected] waf]# cat config.lua --WAF config file,enable = "on",disable = "off" --waf status config_waf_enable = "on" #是否开启配置 --log dir config_log_dir = "/tmp/waf_logs" #日志记录地址 --rule setting config_rule_dir = "/usr/local/nginx/conf/waf/rule-config" #匹配规则缩放地址 --enable/disable white url config_white_url_check = "on" #是否开启url检测 --enable/disable white ip config_white_ip_check = "on" #是否开启IP白名单检测 --enable/disable block ip config_black_ip_check = "on" #是否开启ip黑名单检测 --enable/disable url filtering config_url_check = "on" #是否开启url过滤 --enalbe/disable url args filtering config_url_args_check = "on" #是否开启参数检测 --enable/disable user agent filtering config_user_agent_check = "on" #是否开启ua检测 --enable/disable cookie deny filtering config_cookie_check = "on" #是否开启cookie检测 --enable/disable cc filtering config_cc_check = "on" #是否开启防cc攻击 --cc rate the xxx of xxx seconds config_cc_rate = "10/60" #允许一个ip60秒内只能访问10此 --enable/disable post filtering config_post_check = "on" #是否开启post检测 --config waf output redirect/html config_waf_output = "html" #action一个html页面，也可以选择跳转 --if config_waf_output ,setting url config_waf_redirect_url = "http://www.baidu.com" config_output_html=[[ #下面是html的内容 <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-Language" content="zh-cn" /> <title>网站防火墙</title> </head> <body> <h1 align="center"> # 您的行为已违反本网站相关规定，注意操作规范。详情请联微信公众号：chuck-blog。 </body> </html> ]] 3.4 学习access.lua的配置[[email protected] waf]# pwd/usr/local/openresty/nginx/conf/waf[[email protected] waf]# cat access.lua require 'init'function waf_main() if white_ip_check() then elseif black_ip_check() then elseif user_agent_attack_check() then elseif cc_attack_check() then elseif cookie_attack_check() then elseif white_url_check() then elseif url_attack_check() then elseif url_args_attack_check() then --elseif post_attack_check() then else return endendwaf_main() 书写书序：先检查白名单，通过即不检测；再检查黑名单，不通过即拒绝，检查UA，UA不通过即拒绝；检查cookie；URL检查;URL参数检查，post检查； 3.5 启用WAF并测试3.5.1模拟sql注入即url攻击显示效果如下 3.5.2 使用ab压测工具模拟防cc攻击[[email protected] ~]# ab -c 100 -n 100 http://www.chuck-blog.com/index.phpThis is ApacheBench, Version 2.3 <$Revision: 1430300 $>Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/Licensed to The Apache Software Foundation, http://www.apache.org/Benchmarking www.chuck-blog.com (be patient).....doneServer Software: openrestyServer Hostname: www.chuck-blog.comServer Port: 80Document Path: /index.phpDocument Length: 0 bytesConcurrency Level: 100Time taken for tests: 0.754 secondsComplete requests: 10Failed requests: 90 #config.lua中设置的，60秒内只允许10个请求Write errors: 0Non-2xx responses: 90Total transferred: 22700 bytesHTML transferred: 0 bytesRequests per second: 132.65 [#/sec] (mean)Time per request: 753.874 [ms] (mean)Time per request: 7.539 [ms] (mean, across all concurrent requests)Transfer rate: 29.41 [Kbytes/sec] receivedConnection Times (ms) min mean[+/-sd] median maxConnect: 23 69 20.2 64 105Processing: 32 180 144.5 157 629Waiting: 22 179 144.5 156 629Total: 56 249 152.4 220 702Percentage of the requests served within a certain time (ms) 50% 220 66% 270 75% 275 80% 329 90% 334 95% 694 98% 701 99% 702 100% 702 (longest request) ```###3.5.3 模拟ip黑名单将请求ip放入ip黑名单中 [[email protected] rule-config]# echo “1.202.193.133” >>/usr/local/openresty/nginx/conf/waf/rule-config/blackip.rule 显示结果如下###3.5.4 模拟ip白名单将请求ip放入ip白名单中，此时将不对此ip进行任何防护措施，所以sql注入时应该返回404 [[email protected] rule-config]# echo “1.202.193.133” >>/usr/local/openresty/nginx/conf/waf/rule-config/whiteip.rule 显示结果如下###3.5.5 模拟URL参数检测浏览器输入www.chuck-blog.com/?a=select * from table显示结果如下详细规定在arg.rule中有规定,对请求进行了规范```bash[[email protected] rule-config]# /usr/local/openresty/nginx/conf/waf/rule-config/cat args.rule \.\./\:\$\$\{select.+(from|limit)(?:(union(.*?)select))having|rongjitestsleep\((\s*)(\d*)(\s*)\)benchmark\((.*)\,(.*)\)base64_decode\((?:from\W+information_schema\W)(?:(?:current_)user|database|schema|connection_id)\s*\((?:etc\/\W*passwd)into(\s+)+(?:dump|out)file\s*group\s+by.+\(xwork.MethodAccessor(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(xwork\.MethodAccessor(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/java\.lang\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[\<(iframe|script|body|img|layer|div|meta|style|base|object|input)(|onerror|onload)\=[[email protected] rule-config]# pwd/usr/local/openresty/nginx/conf/waf/rule-config 四、防cc攻击利器之httpgrard4.1 httpgrard介绍HttpGuard是基于openresty,以lua脚本语言开发的防cc攻击软件。而openresty是集成了高性能web服务器Nginx，以及一系列的Nginx模块，这其中最重要的，也是我们主要用到的nginx lua模块。HttpGuard基于nginx lua开发，继承了nginx高并发，高性能的特点，可以以非常小的性能损耗来防范大规模的cc攻击。 4.2 httpgrard防cc特效
五、WAF上线
本文转自写个博客骗钱博客51CTO博客，原文链接http://blog.51cto.com/dadonggg/1959071如需转载请自行联系原作者
菜鸟东哥
|
请发表评论