Skip to content

Commit 572b4a6

Browse files
mib1185mib1185
committed
add modsecurity with OWASP core ruleset
1 parent 78572cc commit 572b4a6

File tree

8 files changed

+120
-32
lines changed

8 files changed

+120
-32
lines changed

‎.jenkins/Jenkinsfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ pipeline {
2020
CROWDSEC_OPENRESTY_BOUNCER_VERSION = '0.1.7'
2121
LUA_VERSION = '5.1.5'
2222
LUAROCKS_VERSION = '3.3.1'
23+
LIBMODSECURITY_VERSION = '3.0.13'
24+
MODSECURITY_NGINX_VERSION = '1.0.3'
25+
CRS_VERSION = '4.8.0'
2326
}
2427
stages {
2528
stage('Environment') {

‎docker/Dockerfile‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ FROM debian:bookworm-slim AS nginxbuilder
77
ARG OPENRESTY_VERSION
88
ARG LUA_VERSION
99
ARG LUAROCKS_VERSION
10+
ARG LIBMODSECURITY_VERSION
11+
ARG MODSECURITY_NGINX_VERSION
1012

1113
RUN apt-get update \
1214
&& apt-get install -y \
@@ -16,7 +18,12 @@ RUN apt-get update \
1618
libpcre3-dev \
1719
libreadline-dev \
1820
libssl-dev \
19-
openssl unzip \
21+
openssl \
22+
unzip \
23+
autoconf \
24+
automake \
25+
libtool \
26+
libpcre2-dev \
2027
wget \
2128
zlib1g-dev \
2229
git \
@@ -26,6 +33,10 @@ RUN apt-get update \
2633
COPY ./scripts/build-lua /tmp/build-lua
2734
RUN /tmp/build-lua
2835

36+
# LibModSecurity build
37+
COPY ./scripts/build-modsecurity /tmp/build-modsecurity
38+
RUN /tmp/build-modsecurity
39+
2940
# Nginx build
3041
COPY ./scripts/build-openresty /tmp/build-openresty
3142
RUN /tmp/build-openresty
@@ -40,6 +51,7 @@ LABEL maintainer="Jamie Curnow <jc@jc21.com>"
4051
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
4152

4253
ARG TARGETPLATFORM
54+
ARG CRS_VERSION
4355
RUN echo "Base: debian:bookworm-slim, ${TARGETPLATFORM:-linux/amd64}" > /built-for-arch
4456

4557
# OpenResty uses LuaJIT which has a dependency on GCC
@@ -74,24 +86,29 @@ COPY --from=nginxbuilder /tmp/luarocks /tmp/luarocks
7486
COPY ./scripts/install-lua /tmp/install-lua
7587

7688
# Copy openresty build from first image
89+
COPY --from=nginxbuilder /tmp/modsecurity /tmp/modsecurity
7790
COPY --from=nginxbuilder /tmp/openresty /tmp/openresty
7891
COPY ./scripts/install-openresty /tmp/install-openresty
7992

8093
# Copy crowdsec openresty bouncer install script
8194
COPY ./scripts/install-crowdsec_openresty_bouncer /tmp/install-crowdsec_openresty_bouncer
8295

96+
# Copy OWASP core ruleset install script
97+
COPY ./scripts/install-crs /tmp/install-crs
98+
8399
ARG OPENRESTY_VERSION
84100
ARG CROWDSEC_OPENRESTY_BOUNCER_VERSION
85101
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
86102
OPENRESTY_VERSION=${OPENRESTY_VERSION} \
87103
CROWDSEC_OPENRESTY_BOUNCER_VERSION=${CROWDSEC_OPENRESTY_BOUNCER_VERSION}
88104

89-
# Install openresty, lua, then clean up file system
105+
# Install openresty, lua, csr, then clean up file system
90106
RUN apt-get update \
91-
&& apt-get install -y gcc make socat git \
107+
&& apt-get install -y build-essential gcc make socat git autoconf automake libtool libpcre2-dev \
92108
&& /tmp/install-lua \
109+
&& /tmp/install-crs \
93110
&& /tmp/install-openresty \
94-
&& apt-get remove -y make gcc git wget gettext \
111+
&& apt-get remove -y build-essential gcc make git wget gettext autoconf automake libtool libpcre2-dev \
95112
&& apt-get autoremove -y \
96113
&& apt-get clean \
97114
&& rm -rf /var/lib/apt/lists/* \

‎local-build.sh‎

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ export OPENRESTY_VERSION=1.25.3.2
1313
export CROWDSEC_OPENRESTY_BOUNCER_VERSION=0.1.7
1414
export LUA_VERSION=5.1.5
1515
export LUAROCKS_VERSION=3.3.1
16+
export LIBMODSECURITY_VERSION=3.0.13
17+
export MODSECURITY_NGINX_VERSION=1.0.3
18+
export CRS_VERSION=4.8.0
1619

1720
export BASE_IMAGE="${DOCKER_IMAGE}:latest"
1821
export ACMESH_IMAGE="${DOCKER_IMAGE}:acmesh"
@@ -29,36 +32,39 @@ docker build \
2932
--build-arg CROWDSEC_OPENRESTY_BOUNCER_VERSION \
3033
--build-arg LUA_VERSION \
3134
--build-arg LUAROCKS_VERSION \
35+
--build-arg LIBMODSECURITY_VERSION \
36+
--build-arg MODSECURITY_NGINX_VERSION \
37+
--build-arg CRS_VERSION \
3238
-t "$BASE_IMAGE" \
3339
-f docker/Dockerfile \
3440
.
3541

36-
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh ${CYAN}...${RESET}"
37-
docker build \
38-
--build-arg BASE_IMAGE \
39-
-t "$ACMESH_IMAGE" \
40-
-f docker/Dockerfile.acmesh \
41-
.
42+
# echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh ${CYAN}...${RESET}"
43+
# docker build \
44+
# --build-arg BASE_IMAGE \
45+
# -t "$ACMESH_IMAGE" \
46+
# -f docker/Dockerfile.acmesh \
47+
# .
4248

43-
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot ${CYAN}...${RESET}"
44-
docker build \
45-
--build-arg BASE_IMAGE \
46-
-t "$CERTBOT_IMAGE" \
47-
-f docker/Dockerfile.certbot \
48-
.
49+
# echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot ${CYAN}...${RESET}"
50+
# docker build \
51+
# --build-arg BASE_IMAGE \
52+
# -t "$CERTBOT_IMAGE" \
53+
# -f docker/Dockerfile.certbot \
54+
# .
4955

50-
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh-golang ${CYAN}...${RESET}"
51-
docker build \
52-
--build-arg ACMESH_IMAGE \
53-
-t "$ACMESH_GOLANG_IMAGE" \
54-
-f docker/Dockerfile.acmesh-golang \
55-
.
56+
# echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh-golang ${CYAN}...${RESET}"
57+
# docker build \
58+
# --build-arg ACMESH_IMAGE \
59+
# -t "$ACMESH_GOLANG_IMAGE" \
60+
# -f docker/Dockerfile.acmesh-golang \
61+
# .
5662

57-
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot-node ${CYAN}...${RESET}"
58-
docker build \
59-
--build-arg CERTBOT_IMAGE \
60-
-t "$CERTBOT_NODE_IMAGE" \
61-
-f docker/Dockerfile.certbot-node \
62-
.
63+
# echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot-node ${CYAN}...${RESET}"
64+
# docker build \
65+
# --build-arg CERTBOT_IMAGE \
66+
# -t "$CERTBOT_NODE_IMAGE" \
67+
# -f docker/Dockerfile.certbot-node \
68+
# .
6369

64-
echo -e "${BLUE}❯ ${GREEN}All done!${RESET}"
70+
# echo -e "${BLUE}❯ ${GREEN}All done!${RESET}"

‎local-buildx.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ export OPENRESTY_VERSION=1.25.3.2
1313
export CROWDSEC_OPENRESTY_BOUNCER_VERSION=0.1.7
1414
export LUA_VERSION=5.1.5
1515
export LUAROCKS_VERSION=3.3.1
16+
export LIBMODSECURITY_VERSION=3.0.13
17+
export MODSECURITY_NGINX_VERSION=1.0.3
18+
export CRS_VERSION=4.8.0
1619

1720
export BASE_IMAGE="${DOCKER_IMAGE}:latest"
1821
export ACMESH_IMAGE="${DOCKER_IMAGE}:acmesh"
@@ -38,6 +41,9 @@ docker buildx build \
3841
--build-arg CROWDSEC_OPENRESTY_BOUNCER_VERSION \
3942
--build-arg LUA_VERSION \
4043
--build-arg LUAROCKS_VERSION \
44+
--build-arg LIBMODSECURITY_VERSION \
45+
--build-arg MODSECURITY_NGINX_VERSION \
46+
--build-arg CRS_VERSION \
4147
-t "$BASE_IMAGE" \
4248
-f docker/Dockerfile \
4349
.

‎scripts/build-modsecurity‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash -e
2+
3+
BLUE='\E[1;34m'
4+
CYAN='\E[1;36m'
5+
YELLOW='\E[1;33m'
6+
GREEN='\E[1;32m'
7+
RESET='\E[0m'
8+
9+
echo -e "${BLUE}❯ ${CYAN}Building libmodsecurity ${YELLOW}${LIBMODSECURITY_VERSION} ...${RESET}"
10+
11+
cd /tmp
12+
git clone --recursive --branch v${LIBMODSECURITY_VERSION} https://github.com/owasp-modsecurity/ModSecurity modsecurity
13+
cd /tmp/modsecurity
14+
15+
./build.sh
16+
./configure --with-pcre2
17+
18+
make -j$(nproc)
19+
make install
20+
21+
echo -e "${BLUE}❯ ${GREEN}libmodsecurity build completed${RESET}"

‎scripts/build-openresty‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,24 @@ YELLOW='\E[1;33m'
66
GREEN='\E[1;32m'
77
RESET='\E[0m'
88

9-
echo -e "${BLUE}❯ ${CYAN}Building OpenResty ${YELLOW}${OPENRESTY_VERSION} with nginx_http_geoip2 module...${RESET}"
9+
echo -e "${BLUE}❯ ${CYAN}Building OpenResty ${YELLOW}${OPENRESTY_VERSION} with nginx_http_geoip2 and modsecurity module...${RESET}"
1010

1111
cd /tmp
12+
13+
# download openresty
1214
wget "https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz"
1315
tar -xzf openresty-${OPENRESTY_VERSION}.tar.gz
1416
mv /tmp/openresty-${OPENRESTY_VERSION} /tmp/openresty
17+
18+
# download ngx_http_geoip2_module
1519
git clone https://github.com/leev/ngx_http_geoip2_module.git
1620
mv /tmp/ngx_http_geoip2_module /tmp/openresty/ngx_http_geoip2_module
21+
22+
# download modsecurity-nginx
23+
git clone --branch v${MODSECURITY_NGINX_VERSION} https://github.com/owasp-modsecurity/ModSecurity-nginx.git
24+
mv /tmp/ModSecurity-nginx /tmp/openresty/modsecurity-nginx
25+
26+
# build openresty
1727
cd /tmp/openresty
1828

1929
./configure \
@@ -55,8 +65,9 @@ cd /tmp/openresty
5565
--with-stream_realip_module \
5666
--with-stream_ssl_module \
5767
--with-stream_ssl_preread_module \
58-
--add-dynamic-module=/tmp/openresty/ngx_http_geoip2_module
68+
--add-dynamic-module=/tmp/openresty/ngx_http_geoip2_module \
69+
--add-dynamic-module=/tmp/openresty/modsecurity-nginx
5970

60-
make -j2
71+
make -j$(nproc)
6172

6273
echo -e "${BLUE}❯ ${GREEN}OpenResty build completed${RESET}"

‎scripts/install-crs‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash -e
2+
3+
BLUE='\E[1;34m'
4+
CYAN='\E[1;36m'
5+
YELLOW='\E[1;33m'
6+
GREEN='\E[1;32m'
7+
RESET='\E[0m'
8+
9+
echo -e "${BLUE}❯ ${CYAN}Installing OWASP core ruleset ${YELLOW}${CRS_VERSION}...${RESET}"
10+
11+
cd /tmp
12+
mkdir -p /etc/csr
13+
wget https://github.com/coreruleset/coreruleset/archive/refs/tags/v${CRS_VERSION}.tar.gz
14+
tar -xzf v${CRS_VERSION}.tar.gz --strip 1 -C /etc/csr
15+
rm -rf v${CRS_VERSION}.tar.gz
16+
mv /etc/csr/{crs-setup.conf.example,crs-setup.conf}
17+
mv /etc/csr/rules/{REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example,REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf}
18+
mv /etc/csr/rules/{RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example,RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf}
19+
20+
echo -e "${BLUE}❯ ${GREEN}OWASP core ruleset install completed${RESET}"

‎scripts/install-openresty‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ RESET='\E[0m'
88

99
echo -e "${BLUE}❯ ${CYAN}Installing OpenResty ${YELLOW}${OPENRESTY_VERSION}...${RESET}"
1010

11+
cd /tmp/modsecurity
12+
make install
13+
rm -rf /tmp/modsecurity
14+
1115
cd /tmp/openresty
1216
make install
1317
rm -rf /tmp/openresty

0 commit comments

Comments
 (0)