Install WAF modules for Nginx under Linux _nginx

Recently on new projects, to build nginx to ensure security, the decision to install the WAF module, the following is the specific steps, first download the required installation package, for each installation:

wget http://luajit.org/download/LuaJIT-2.0.3.tar.gz
tar-zxvf luajit-2.0.3.tar.gz
cd LuaJIT-2.0.3
make Make
Install

Then download the Nginx,

wget http://nginx.org/download/nginx-1.7.6.tar.gz
TAR-ZXVF nginx-1.7.6.tar.gz

Download Ngx_devel_kit,

wget https://github.com/simpl/ngx_devel_kit/archive/v0.2.19.tar.gz–no-check-certificate
TAR-ZXVF V0.2.19.tar.gz

Download Nginx_lua_module

wget https://github.com/openresty/lua-nginx-module/archive/v0.9.13rc1.tar.gz–no-check-certificate
TAR-ZXVF v0.9.13rc1.tar.gz
CD nginx-1.7.6

Install Pcre,

TAR-ZXVF pcre-8.30.tar.gz
cd pcre-8.30
./configure make make
install

Install OpenSSL,

tar -zxvf openssl-1.0.0.tar.gz

Install the Ngx_cache_purge module:

tar   -zxvf  ngx_cache_purge-1.3.tar.gz

Install Zlib,yum install zlib zlib-devel

Set up environment variables, compile,

Export luajit_lib=/usr/local/lib

export luajit_inc=/usr/local/include/luajit-2.0

./configure–prefix=/ usr/local/nginx–with-http_stub_status_module–with-http_ssl_module–add-module=/root/ngx_devel_kit-0.2.19– add-module=/root/lua-nginx-
module-0.9.13rc1–with-http_ssl_module–with-openssl=/root/openssl-1.0.0– add-module=/root/ngx_cache_purge-1.3–with-pcre=/root/pcre-8.30–with-ld-opt= "-Wl,-rpat
H, $LUAJIT _lib"

make-j2 make

Install

Create directory store attack log:

Mkdir-p/data/logs/hack/
chown-r nobody:nobody/data/logs/hack/
chmod-r 755/data/logs/hack/

Download WAF,

wget https://github.com/loveshell/ngx_lua_waf/archive/master.zip–no-check-certificate
Unzip Master.zip
CD ngx_lua_waf-master/
MKDIR/USR/LOCAL/NGINX/CONF/WAF
mv */usr/local/nginx/conf/waf/
cd/usr/local/ nginx/conf/
VI nginx.conf

In the HTTP segment join:

Lua_package_path "/usr/local/nginx/conf/waf/?" Lua ";
Lua_shared_dict limit 10m;
Init_by_lua_file/usr/local/nginx/conf/waf/init.lua;
Access_by_lua_file/usr/local/nginx/conf/waf/waf.lua;

Run before starting: Ln-s/usr/local/lib/libluajit-5.1.so.2/lib64/libluajit-5.1.so.2 Otherwise you will not be able to find this module error.

Filtering rules are wafconf, can be adjusted on demand, each rule needs to be wrapped, or | Split
Global is a global filter file, where the rules for post and get are filtered
get is a rule that filters only on GET requests
Post is a rule that filters only on post requests
Whitelist is whitelist, the URL inside matches to do not filter
User-agent is the filter rule for user-agent