Skip to content

Commit 8b450d8

Browse files
author
zhaohaifeng [赵海锋]
committed
update deploy section
1 parent 6b0d4f8 commit 8b450d8

File tree

5 files changed

+237
-237
lines changed

5 files changed

+237
-237
lines changed

‎.vscode/.browse.VC.db-shm‎

32 KB
Binary file not shown.

‎.vscode/.browse.VC.db-wal‎

4.13 KB
Binary file not shown.

‎TOC.ini‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
[intro]
55
-: README
66
-: installation
7+
-: depoly
78
-: getting_started
89
-: roadmap
910

‎zh-CN/intro/depoly.md‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
# 部署与配置
2+
## waf部署与配置
3+
### openresty的配置
4+
5+
将x-waf的代码目录`waf`放置到openresty的`/usr/local/openresty/nginx/conf`目录下，并在openresty的conf的目录下新建vhosts目录
6+
7+
```bash
8+
mkdir -p /usr/local/openresty/nginx/conf/vhosts
9+
```
10+
以下为openresty的配置范例：
11+
12+
```ini
13+
user nginx;
14+
worker_processes auto;
15+
worker_cpu_affinity auto;
16+
17+
#error_log logs/error.log;
18+
#error_log logs/error.log debug;
19+
#error_log logs/error.log info;
20+
21+
#pid logs/nginx.pid;
22+
23+
events {
24+
worker_connections 409600;
25+
}
26+
27+
http {
28+
include mime.types;
29+
default_type application/octet-stream;
30+
31+
lua_package_path "/usr/local/openresty/nginx/conf/waf/code/?.lua;/usr/local/lib/lua/?.lua;;";
32+
lua_shared_dict limit 100m;
33+
lua_shared_dict badGuys 100m;
34+
lua_code_cache on;
35+
init_by_lua_file /usr/local/openresty/nginx/conf/waf/code/init.lua;
36+
access_by_lua_file /usr/local/openresty/nginx/conf/waf/code/access.lua;
37+
38+
#log_format shield_access '$remote_addr - $http_host - "$request" - "$http_cookie"';
39+
#access_log pipe:/usr/local/shield/redisclient shield_access;
40+
41+
#ssl on;
42+
#ssl_certificate certs/cert_chain.crt;
43+
#ssl_certificate_key certs/server.key;
44+
ssl_session_timeout 5m;
45+
ssl_protocols SSLv2 SSLv3 TLSv1;
46+
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
47+
ssl_prefer_server_ciphers on;
48+
49+
50+
sendfile on;
51+
#tcp_nopush on;
52+
53+
#keepalive_timeout 0;
54+
keepalive_timeout 65;
55+
56+
#gzip on;
57+
include vhosts/*.conf;
58+
}
59+
```
60+
### waf的配置
61+
waf的配置文件位于`/usr/local/openresty/nginx/conf/waf/config.lua`中，详细的配置项如下：
62+
63+
```lua
64+
--WAF config file, enable = "on", disable = "off"
65+
local _M = {
66+
--waf status
67+
config_waf_enable = "on",
68+
--log dir
69+
config_log_dir = "/tmp/waf_logs",
70+
--rule setting
71+
config_rule_dir = "/usr/local/openresty/nginx/conf/waf/rules",
72+
--enable/disable white url
73+
config_white_url_check = "on",
74+
--enable/disable white ip
75+
config_white_ip_check = "on",
76+
--enable/disable block ip
77+
config_black_ip_check = "on",
78+
--enable/disable url filtering
79+
config_url_check = "on",
80+
--enalbe/disable url args filtering
81+
config_url_args_check = "on",
82+
--enable/disable user agent filtering
83+
config_user_agent_check = "on",
84+
--enable/disable cookie deny filtering
85+
config_cookie_check = "on",
86+
--enable/disable cc filtering
87+
config_cc_check = "on",
88+
--cc rate the xxx of xxx seconds
89+
config_cc_rate = "10/60",
90+
--enable/disable post filtering
91+
config_post_check = "on",
92+
--config waf output redirect/html/jinghuashuiyue
93+
config_waf_model = "html",
94+
--if config_waf_output ,setting url
95+
config_waf_redirect_url = "http://xsec.io",
96+
config_expire_time = 600,
97+
config_output_html=[[
98+
<html >
99+
<head>
100+
<meta charset="UTF-8">
101+
<title>xsec waf</title>
102+
<style type="text/css">
103+
body {
104+
font-family: "Helvetica Neue", Helvetica, Arial;
105+
font-size: 14px;
106+
line-height: 20px;
107+
font-weight: 400;
108+
color: #3b3b3b;
109+
-webkit-font-smoothing: antialiased;
110+
font-smoothing: antialiased;
111+
background: #f6f6f6;
112+
}
113+
.wrapper {
114+
margin: 0 auto;
115+
padding: 40px;
116+
max-width: 980px;
117+
}
118+
.table {
119+
margin: 0 0 40px 0;
120+
box-shadow: 0 1px 3px rgba(0, 0, 0, 0.2);
121+
display: table;
122+
}
123+
@media screen and (max-width: 580px) {
124+
.table {
125+
display: block;
126+
}
127+
}
128+
.row {
129+
display: table-row;
130+
background: #f6f6f6;
131+
}
132+
.row:nth-of-type(odd) {
133+
background: #e9e9e9;
134+
}
135+
.row.header {
136+
font-weight: 900;
137+
color: #ffffff;
138+
background: #ea6153;
139+
}
140+
.row.green {
141+
background: #27ae60;
142+
}
143+
.row.yellow {
144+
background: #FF8C00;
145+
}
146+
@media screen and (max-width: 580px) {
147+
.row {
148+
padding: 8px 0;
149+
display: block;
150+
}
151+
}
152+
.cell {
153+
padding: 6px 12px;
154+
display: table-cell;
155+
}
156+
@media screen and (max-width: 580px) {
157+
.cell {
158+
padding: 2px 12px;
159+
display: block;
160+
}
161+
}
162+
</style>
163+
</head>
164+
<body>
165+
<div class="wrapper">
166+
<div class="table">
167+
<div class="row header yellow">
168+
<div class="cell">
169+
您的IP为 %s
170+
</div>
171+
<div class="cell">
172+
欢迎在遵守白帽子道德准则的情况下进行安全测试。
173+
</div>
174+
<div class="cell">
175+
联系方式：[email protected]
176+
</div>
177+
</div>
178+
</div>
179+
180+
</div>
181+
</body>
182+
</html>
183+
]],
184+
}
185+
return _M
186+
```
187+
188+
### waf测试
189+
190+
使用root权限执行以下命令测试配置文件的正确性，如果测试结果返回ok则表示配置是正确的。
191+
192+
```bash
193+
$ sudo /usr/local/openresty/nginx/sbin/nginx -t
194+
[sudo] hartnett 的密码：
195+
nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntax is ok
196+
nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test is successful
197+
```
198+
199+
如果配置文件正常，可以通过以下命令正式启动waf
200+
201+
```bash
202+
$ sudo /usr/local/openresty/nginx/sbin/nginx
203+
```
204+
205+
### WAF防御效果测试
206+
207+
在服务器中提交`curl http://127.0.0.1/\?id\=1%20union%20select%201,2,3`，
208+
如果返回的内容中包含`欢迎在遵守白帽子道德准则的情况下进行安全测试`等字样就表示waf已经在正常运行了。
209+
210+
211+
## waf-admin配置
212+
- waf-admin需要mysql的支持，事先需要准备一个mysql数据库的账户，以下为app.ini的配置范例：
213+
214+
```ini
215+
RUN_MODE = dev
216+
;RUN_MODE = prod
217+
218+
[server]
219+
HTTP_PORT = 5000
220+
API_KEY = xsec.io||secdevops.cn
221+
NGINX_BIN = /usr/local/openresty/nginx/sbin/nginx
222+
NGINX_VHOSTS = /usr/local/openresty/nginx/conf/vhosts/
223+
API_SERVERS = 127.0.0.1, 8.8.8.8
224+
225+
[database]
226+
USER = waf-admin
227+
PASSWD = passw0rd
228+
HOST = mysqlhost:3306
229+
NAME = waf
230+
231+
[waf]
232+
RULE_PATH = /usr/local/openresty/nginx/conf/waf/rules/
233+
```
234+
配置完成后在当前目录执行./server测试程序是否可以正常启动，waf-admin需要操作nginx的master进程，所以需要以root权限启动。
235+
236+
可以使用supversisor、nohup、systemd等将waf-admin跑在后台。

0 commit comments

Comments
 (0)