Tengine 3.1.0 安装与 WAF 配置教程 (基于 Nginx 升级)

Tengine 3.1.0 安装与 WAF 配置教程 (基于 Nginx 升级)

0. 约定

文中所有的域名以 <domain> 显示

1. 准备工作

1.1 备份现有 Nginx 配置

cp -r /etc/nginx /etc/nginx_backup
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx_backup

1.2 安装必要依赖

apt update
apt upgrade -y
apt-get install -y build-essential autoconf automake libtool pkg-config libpcre2-dev libmodsecurity3 libmodsecurity-dev libmaxminddb-dev libpcre3 libpcre3-dev

2. 下载 Tengine 和模块

2.1 下载 Tengine 3.1.0

cd /data/downloads/
curl -OL https://tengine.taobao.org/download/tengine-3.1.0.tar.gz
tar zxf tengine-3.1.0.tar.gz

2.2 下载所需模块

cd /opt/
curl -OL https://github.com/owasp-modsecurity/ModSecurity-nginx/releases/download/v1.0.4/ModSecurity-nginx-v1.0.4.tar.gz
tar zxf ModSecurity-nginx-v1.0.4.tar.gz

curl -OL https://github.com/leev/ngx_http_geoip2_module/archive/refs/tags/3.4.tar.gz
tar zxf 3.4.tar.gz
mv ngx_http_geoip2_module-3.4 /opt/

curl -OL https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v0.37.tar.gz
tar zxf v0.37.tar.gz
mv headers-more-nginx-module-0.37 /opt/

2.3 下载 OWASP Core Rule Set

curl -OL https://github.com/coreruleset/coreruleset/releases/download/v4.15.0/coreruleset-4.15.0-minimal.tar.gz
tar zxf coreruleset-4.15.0-minimal.tar.gz
mv coreruleset-4.15.0 /etc/nginx/modsec

2.4 暂时删除有问题的规则

mv /etc/nginx/modsec/crs/rules/REQUEST-922-MULTIPART-ATTACK.conf /etc/nginx/modsec/crs/rules/REQUEST-922-MULTIPART-ATTACK.conf.bak

3. 编译安装 Tengine

3.1 配置编译选项

cd /data/downloads/tengine-3.1.0
./configure \
    --prefix=/usr/local/nginx \
    --conf-path=/etc/nginx/nginx.conf \
    --http-log-path=/var/log/nginx/access.log \
    --error-log-path=/var/log/nginx/error.log \
    --lock-path=/var/lock/nginx.lock \
    --pid-path=/run/nginx.pid \
    --modules-path=/usr/lib/nginx/modules \
    --http-client-body-temp-path=/var/lib/nginx/body \
    --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
    --http-proxy-temp-path=/var/lib/nginx/proxy \
    --http-scgi-temp-path=/var/lib/nginx/scgi \
    --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
    --with-debug \
    --with-pcre-jit \
    --with-http_ssl_module \
    --with-http_stub_status_module \
    --with-http_realip_module \
    --with-http_auth_request_module \
    --with-http_v2_module \
    --with-http_dav_module \
    --with-http_slice_module \
    --with-threads \
    --with-http_addition_module \
    --with-http_gunzip_module \
    --with-http_gzip_static_module \
    --with-http_sub_module \
    --with-stream \
    --add-module=/opt/ngx_http_geoip2_module-3.4 \
    --add-module=/opt/headers-more-nginx-module-0.37 \
    --add-module=/opt/ModSecurity-nginx-v1.0.4

3.2 编译并安装

make
sudo make install

4. 配置 ModSecurity WAF

4.1 创建 ModSecurity 配置文件

mkdir -p /etc/nginx/modsec
cp /etc/nginx/modsec/crs-setup.conf.example /etc/nginx/modsec/crs-setup.conf

4.2 创建主配置文件

cat > /etc/nginx/modsec/main.conf <<EOF
# 基本配置
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecTmpDir /tmp/
SecDataDir /tmp/
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/nginx/modsec_audit.log
SecDebugLog /var/log/nginx/modsec_debug.log
SecDebugLogLevel 0
SecDefaultAction "phase:1,log,auditlog,pass"
SecDefaultAction "phase:2,log,auditlog,pass"

# 包含 CRS 规则
Include /etc/nginx/modsec/crs/crs-setup.conf
Include /etc/nginx/modsec/crs/rules/*.conf
EOF

4.3 配置 Nginx 加载 ModSecurity

在 /etc/nginx/nginx.conf 顶部添加：

load_module /usr/lib/nginx/modules/ngx_http_modsecurity_module.so;
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;
load_module /usr/lib/nginx/modules/ngx_stream_geoip2_module.so;

在 http 块中添加：

# ModSecurity 基本配置
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;

5. 配置虚拟主机 WAF 规则

示例配置 (/etc/nginx/conf.d/<domain>.conf):

server {
    listen 443 ssl;
    server_name <domain>;
    ssl_certificate certs/<domain>_nginx/<domain>_bundle.crt;
    ssl_certificate_key certs/<domain>.cn_nginx/<domain>.key;

    modsecurity on;
    more_clear_headers 'Server';

    # 自定义错误页面
    error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 /40x.html;
    location = /40x.html {
        internal;
        root /etc/nginx/err_page/;
    }

    # 根路径返回 404 并触发自定义页面
    location = / {
        try_files /nonexistent-file @notfound;
    }
    location @notfound {
        return 404;
    }
}

6. 测试并重启服务

6.1 测试配置

nginx -t

6.2 重启服务

service nginx restart

7. 验证 WAF 是否工作

7.1 检查日志

tail -f /var/log/nginx/modsec_audit.log

7.2 测试 WAF 规则

curl -k "https://<domain>/?param=../../etc/passwd"