How Nginx protects against web attacks by using the Application Firewall Module (WAF)

With the continuous development of the Internet, Web applications have become an indispensable part of many people's daily lives. However, various web attacks are followed, such as SQL injection, cross-site scripting, etc. These attacks may cause major security issues and seriously threaten the security and stability of web applications. In order to solve these problems, Nginx introduces the application firewall module (WAF). This article will introduce in detail how Nginx prevents web attacks by using the WAF module.

What is WAF?

Application firewall is a security control device for web applications that can defend against various attacks, such as SQL injection, XSS attacks, CSRF attacks, etc. WAF monitors websites and detects and defends against attacks through various means such as regular expressions, rule engines, and data signatures. By detecting requests, WAF can determine whether the request is malicious, prevent illegal access, and protect web applications from attacks.

Why do you need a WAF?

Although many web applications use various security measures to protect their own security, such as SSL, password strength verification, access control, etc., the risk of web attacks Unpredictability makes it easy for these measures to fail. For example, SQL injection attacks are one of the most common attacks today. Attackers can directly inject SQL statements by writing malicious code to manipulate the database or obtain sensitive information. In this case, using WAF can better protect the security of web applications and prevent database attacks or sensitive information from being stolen.

How to use WAF module to protect Nginx?

Nginx implements WAF functions by introducing third-party modules, and you can choose to use OpenResty, ModSecurity and other modules. The following uses the ModSecurity module as an example to introduce how to use the WAF module to protect Nginx.

1. Install the ModSecurity module

You can install the ModSecurity module through the following command:

sudo apt-get install libmodsecurity3 libmodsecurity-dev

After the installation is complete, enter the Nginx core configuration file and add the following configuration:

location / {
    # 引入ModSecurity防火墙定义文件
    ModSecurityEnabled on;
    ModSecurityConfig /etc/nginx/modsec/modsecurity.conf;
}

2. Configuring ModSecurity rules

The next step is to configure the rules for ModSecurity. You can choose to use an existing rule set such as OWASP, or write custom rules according to your own needs. We can create a new rules file in the /etc/nginx/modsec folder:

sudo nano /etc/nginx/modsec/modsecurity_custom_rules.conf

Edit the file to add custom rules, for example:

SecRuleEngine On
# 防止SQL注入
SecRule ARGS "@rx ((select|union|insert|update|drop|delete))" "id:1,deny,status:403,msg:'SQL Injection attempt'"

In the above example, we Added a rule to prevent SQL injection attacks. When a GET request contains the keywords "select", "union", "insert", "update", "drop", and "delete", ModSecurity will intercept the request and send a 403 error, indicating that access is denied.

3. Restart the Nginx service

After completing the above steps, use the following command to restart the Nginx service:

sudo systemctl restart nginx

Now, Nginx can use the ModSecurity WAF module to Protect web applications from attacks.

Summary

WAF is one of the important components in preventing web attacks. As a high-performance web server, Nginx can not only improve its security after introducing the WAF module, but also effectively reduce the impact of web attacks on web applications. Depending on your needs, you can choose to use different WAF modules, such as ModSecurity, OpenResty, etc. When using WAF, you need to pay attention to configuring relevant rules according to the actual situation to ensure the defense effect.

The above is the detailed content of How Nginx protects against web attacks by using the Application Firewall Module (WAF). For more information, please follow other related articles on the PHP Chinese website!