Question

根据一些教程，我已经使用nginx重新编译了最新的naxis版本。这是nginx的配置：

        nginx version: nginx/1.12.2
        built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
        built with OpenSSL 1.0.2k-fips  26 Jan 2017
        TLS SNI support enabled
        configure arguments: 
--prefix=/etc/nginx
    --sbin-path=/usr/sbin/nginx 
    --conf-path=/etc/nginx/nginx.conf 
    --add-module=../naxsi-master/naxsi_src/ 
    --error-log-path=/var/log/nginx/error.log 
    --http-log-path=/var/log/nginx/access.log 
    --pid-path=/var/run/nginx.pid 
    --lock-path=/var/run/nginx.lock 
    --http-client-body-temp-path=/var/cache/nginx/client_temp 
    --http-proxy-temp-path=/var/cache/nginx/proxy_temp 
    --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp 
    --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp 
    --http-scgi-temp-path=/var/cache/nginx/scgi_temp 
    --user=nginx --group=nginx --with-http_ssl_module 
    --with-http_realip_module --with-http_addition_module 
    --with-http_sub_module --with-http_dav_module 
    --with-http_flv_module --with-http_mp4_module 
    --with-http_gunzip_module --with-http_gzip_static_module 
    --with-http_random_index_module --with-http_secure_link_module 
    --with-http_stub_status_module --with-http_auth_request_module 
    --with-mail --with-mail_ssl_module 
    --with-file-aio --with-ipv6 --with-http_v2_module 
    --with-cc-opt='-O2 -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
    --param=ssp-buffer-size=4 -m64 -mtune=generic'

此外，我已经将基本的naxis规则添加到html和server块中。如果来自naxis的任何* .rules文件都存在语法错误，nginx -t会通知我。因此，我认为到目前为止，naxsi和nginx都已正确安装。但是，对纳克西规则的任何测试均失败。测试http://MY-IP/?q="><script>alert(1)</script>不会导致阻塞，日志也不会显示违反规则。这是我的nginx.conf：

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;
events {
    worker_connections 1024;
}

http {
        include /etc/nginx/naxsi_core.rules;

        add_header X-Frame-Options SAMEORIGIN always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Content-Security-Policy "frame-ancestors 'self'" always;
        add_header X-Content-Type-Options "nosniff" always;

        client_header_timeout 3000;
        client_body_timeout 3000;
        fastcgi_read_timeout 3000;
        client_max_body_size 32m;
        fastcgi_buffers 8 128k;
        fastcgi_buffer_size 128k;

        log_format scripts '$document_root$fastcgi_script_name > $request';


    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

server {
        add_header X-Frame-Options SAMEORIGIN always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Content-Security-Policy "frame-ancestors 'self'" always;
        add_header X-Content-Type-Options "nosniff" always;

        access_log /var/log/nginx/naxsi_access.log;
        error_log /var/log/nginx/naxsi_error.log debug;


        location / {
                include /etc/nginx/naxsi.rules;
                root   html;
                index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {
                root   html;
        }

        location /RequestDenied {
                 return 500;
        }
    return 403;
}


  proxy_connect_timeout       600;
  proxy_send_timeout          600;
  proxy_read_timeout          600;
  send_timeout                600;
        uwsgi_connect_timeout 750s;
        fastcgi_send_timeout 600s;

    include /etc/nginx/conf.d/*.conf;
}

我不知道为什么这些规则不适用。我已经使用了基本规则，并为naxsi设置了学习模式。我很高兴能为我指明正确的方向。

为什么纳克西（Nginx）不适用基本规则？ CentOS 7. NGINX 1.12.2

0 个答案: