centos安裝部署nginx-waf

所有操作和安裝包皆看自己喜歡安裝目錄

所需軟件包百度鏈接
提取碼：cr5h

#安裝前準備：

yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel  libxml2 libxml2-dev libxslt-devel  gd gd-devel perl-devel perl-ExtUtils-Embed gperftools 

cd /usr/local/src/

#下載luajit 2.1並安裝：

wget http://luajit.org/download/LuaJIT-2.1.0-beta2.tar.gz
tar xf LuaJIT-2.1.0-beta2.tar.gz
cd LuaJIT-2.1.0-beta2
make && make install

#下載 Nginx 開發套件 ngx_devel_kit

wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz
tar xf v0.3.0.tar.gz

#安裝nginx_lua_module：

wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
tar xf v0.10.13.tar.gz

#設置環境變量！

echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile
echo "export LUAJIT_INC=/usr/local/include/luajit-2.1" >> /etc/profile
source /etc/profile

安裝nginx：

#編譯安裝nginx1.16.1：

tar -xvf nginx-1.16.1.tar.gz
cd nginx-1.16.1
useradd -s /sbin/nologin -M nginx

./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"

make -j2
make install
ln -s /usr/local/nginx-1.14.0 /usr/local/nginx

#新建/usr/local/nginx/logs/hack/攻擊日誌目錄，並賦予nginx用戶對該目錄的寫入權限:

mkdir -p /usr/local/nginx/logs/hack/
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/

#至此nginx支持WAF防護功能已經搭建完成！

#使用說明：
#nginx配置文件路徑爲:/usr/local/nginx/conf/
#把ngx_lua_waf下載到conf目錄下,解壓命名爲waf

wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf

#在nginx.conf的http段添加下面這段：

sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file  /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf
//這一條命令執行完添加下方4條路徑！    

lua_package_path "/usr/local/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file  /usr/local/nginx/conf/waf/init.lua; 
access_by_lua_file /usr/local/nginx/conf/waf/waf.lua;

#配置config.lua裏的waf規則目錄(一般在waf/conf/目錄下)：
RulePath = “/usr/local/nginx/conf/waf/wafconf/” #絕對路徑如有變動，需對應修改

#然後重啓nginx即可

ln -s /usr/local/nginx/sbin/nginx  /usr/sbin/
nginx		#啓動nginx

#配置文件詳細說明：

RulePath = "/usr/local/nginx/conf/waf/wafconf/"
    --規則存放目錄
    attacklog = "off"
    --是否開啓攻擊信息記錄，需要配置logdir
    logdir = "/usr/local/nginx/logs/hack/"
    --log存儲目錄，該目錄需要用戶自己新建，切需要nginx用戶的可寫權限
    UrlDeny="on"
    --是否攔截url訪問
    Redirect="on"
    --是否攔截後重定向
    CookieMatch = "on"
    --是否攔截cookie攻擊
    postMatch = "on" 
    --是否攔截post攻擊
    whiteModule = "on" 
    --是否開啓URL白名單
    black_fileExt={"php","jsp"}
    --填寫不允許上傳文件後綴類型
    ipWhitelist={"127.0.0.1"}
    --ip白名單，多個ip用逗號分隔
    ipBlocklist={"1.0.0.1"}
    --ip黑名單，多個ip用逗號分隔
    CCDeny="on"
    --是否開啓攔截cc攻擊(需要nginx.conf的http段增加lua_shared_dict limit 10m;)
    CCrate = "100/60"
    --設置cc攻擊頻率，單位爲秒.
    --默認1分鐘同一個IP只能請求同一個地址100次
    html=[[Please go away~~]]
    --警告內容,可在中括號內自定義
    備註:不要亂動雙引號，區分大小寫

執行一鍵安裝部署的腳本！

#!/bin/bash
#Author:Guo darling Lin
yum -y install gcc gcc-c++ autoconf automake make unzip zlib zlib-devel openssl openssl-devel pcre pcre-devel  libxml2 libxml2-dev libxslt-devel  gd gd-devel perl-devel perl-ExtUtils-Embed gperftoolsl
cd /usr/local/src/

[ ! -f "LuaJIT-2.0.5.tar.gz" ] && wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz 
[ ! -f "nginx-1.16.1.tar.gz" ] && wget http://nginx.org/download/nginx-1.16.1.tar.gz &&
[ ! -f "v0.3.0.tar.gz" ] && wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.0.tar.gz 
[ ! -f "v0.10.13.tar.gz" ] && wget https://github.com/openresty/lua-nginx-module/archive/v0.10.13.tar.gz
[ ! -f "master.zip" ] && wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip --no-check-certificate

ls *.tar.gz | xargs -n 1  tar xf

cd LuaJIT-2.0.5 && make && make install 

cd /usr/local/src

echo "export LUAJIT_LIB=/usr/local/lib" >> /etc/profile && \
echo "export LUAJIT_INC=/usr/local/include/luajit-2.0" >> /etc/profile
source /etc/profile
useradd -s /sbin/nologin -M nginx
cd nginx-1.16.1 
./configure --user=nginx --group=nginx \
--prefix=/usr/local/nginx-1.16.1 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_gzip_static_module \
--pid-path=/usr/local/nginx-1.16.1/nginx.pid \
--with-http_realip_module \
--add-module=/usr/local/src/ngx_devel_kit-0.3.0 \
--add-module=/usr/local/src/lua-nginx-module-0.10.13 \
--with-file-aio \
--with-http_v2_module \
--with-stream_ssl_preread_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_perl_module=dynamic \
--with-http_auth_request_module \
--with-mail=dynamic \
--with-pcre \
--with-pcre-jit \
--with-stream=dynamic \
--with-mail_ssl_module \
--with-stream_ssl_module \
--with-google_perftools_module \
--with-debug \
--with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" 

make -j8 
make install 
ln -s /usr/local/nginx-1.16.1  /usr/local/nginx

mkdir -p /usr/local/nginx/logs/hack/ 
chown -R nginx.nginx /usr/local/nginx/logs/hack/
chmod -R 755 /usr/local/nginx/logs/hack/

cd /usr/local/src
wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip
unzip master.zip -d /usr/local/nginx/conf/
mv /usr/local/nginx/conf/ngx_lua_waf-master /usr/local/nginx/conf/waf

sed -i '25 a lua_package_path \"/usr/local/nginx/conf/waf/?.lua\";\nlua_shared_dict limit 10m;\ninit_by_lua_file  /usr/local/nginx/conf/waf/init.lua;\naccess_by_lua_file /usr/local/nginx/conf/waf/waf.lua;' /usr/local/nginx/conf/nginx.conf

ln -s /usr/local/nginx/sbin/nginx  /usr/sbin/
nginx