github
/
ngx_lua_waf_oneinstack
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
ngx_lua_waf是一个基于lua-nginx-module的web应用防火墙
17 Commits
1 Branch
0 Tags
108 KiB
Lua 100%
 
Go to file
174001602 38521f794e
patch 20200119 修正url 白名单 为 强匹配防止利用绕过 
说明:
1.whiteurl 规则 从\. 开始匹配的静态文件名相当于排除此扩展名的静态文件，如果是URL动态路径带?的路径里包含静态文件名不生效
2.例如原captcha-waf\.html规则，修改后表示从网站根目录下captcha-waf.html文件符合规则，如果文件在/xxx/captcha-waf.html下则不符合规则，也就是修改后从根目录下从头开始匹配，防止利用绕过。
3.可能带来的其他问题目前测试还未知
 		2020-01-19 20:57:32 +08:00
wafconf Add captcha-waf.html 2018-12-06 15:21:54 +08:00
.gitignore Initial commit 2018-06-24 16:01:03 +08:00
LICENSE Initial commit 2018-06-24 16:01:03 +08:00
README.md Add checkcode 2018-12-04 17:42:10 +08:00
access.lua Add captcha-waf.html 2018-12-06 15:21:54 +08:00
config.lua [fix] Update config.lua 2019-11-16 23:19:01 +08:00
init.lua patch 20200119 修正url 白名单 为 强匹配防止利用绕过 2020-01-19 20:57:32 +08:00
lib.lua patch 20191217 2019-12-17 12:05:49 +08:00

README.md

ngx_lua_waf

ngx_lua_waf是一个基于lua-nginx-module的web应用防火墙, 支持验证码验证

OneinStack启用ngx_lua_waf

~/oneinstack/addons.sh
#install ngx_lua_waf

手工安装

cd /root/oneinstack/src
wget http://luajit.org/download/LuaJIT-2.1.0-beta3.tar.gz  #推荐2.1版本
wget https://github.com/openresty/lua-cjson/archive/2.1.0.6.tar.gz -o lua-cjson-2.1.0.6.tar.gz
git clone https://github.com/simpl/ngx_devel_kit.git
git clone https://github.com/openresty/lua-nginx-module.git
tar xzf LuaJIT-2.1.0-beta3.tar.gz
tar xzf lua-cjson-2.1.0.6.tar.gz
cd LuaJIT-2.1.0-beta3
make && make install
cd ../lua-cjson-2.1.0.6
sed -i 's@LUA_INCLUDE_DIR.*@LUA_INCLUDE_DIR \?=   \$(PREFIX)/include/luajit-2.1@' Makefile
make && make install
cd ..
export LUAJIT_LIB=/usr/local/lib
export LUAJIT_INC=/usr/local/include/luajit-2.1
sed -i "s@^nginx_modules_options=.*@nginx_modules_options='--with-ld-opt=-Wl,-rpath,/usr/local/lib --add-module=../lua-nginx-module --add-module=../ngx_devel_kit'@" options.conf
./install.sh --nginx_option 1

### 全局nginx新增waf
cat > /usr/local/nginx/conf/waf.conf << EOF
lua_shared_dict limit 20m;
lua_package_path "/usr/local/nginx/conf/waf/?.lua;;";
init_by_lua_file "/usr/local/nginx/conf/waf/init.lua";
access_by_lua_file "/usr/local/nginx/conf/waf/access.lua";
EOF

#vi /usr/local/nginx/conf/nginx.conf
#include vhost/*.conf;下一行新增，如下
include waf.conf;

### 单网站新增waf(推荐)
cat > /usr/local/nginx/conf/waf.conf << EOF
lua_shared_dict limit 20m;
lua_package_path "/usr/local/nginx/conf/waf/?.lua;;";
init_by_lua_file "/usr/local/nginx/conf/waf/init.lua";
EOF

#vi /usr/local/nginx/conf/vhost/www.example.com.conf
#location ~ [^/]\.php(/|$) {下一行新增，如下
access_by_lua_file "/usr/local/nginx/conf/waf/access.lua";
#注意：wordpress URL改成ngx.var.request_uri
 66         local ATTACK_URL = ngx.var.host .. ngx.var.uri
 67         -- local ATTACK_URL = ngx.var.host .. ngx.var.request_uri
#改成：
 66         -- local ATTACK_URL = ngx.var.host .. ngx.var.uri
 67         local ATTACK_URL = ngx.var.host .. ngx.var.request_uri

Copyright

copy以下项目:
https://github.com/loveshell/ngx_lua_waf
https://github.com/unixhot/waf