Considering the increase in online web threats, one the challenge for web engineer is to well aware of hardening and securing Nginx.

Nginx is well-known for its performance and lightweight web server/proxy and used on many busiest sites.

Pinterest.com Reddit.com Wordpress.com Stackoverflow.com Mail.ru

If you are hosting your web applications on Nginx and concerned about security then one of the first thing you would like to implement is Web Application Firewall (WAF). Mod Security is an Open Source WAF by Trustwave SpiderLabs and was made available for Nginx in 2012. In this guide, I’ll explain how to download, install and configure Mod Security with Nginx. The following demonstration is done on CentOS hosted with DigitalOcean. If you are new to Nginx then I would recommend taking this fundamental course.

Download Nginx and ModSecurity

You can either download the nginx directly on your server or on your local PC then transfer it.

Download the latest version from below link

http://nginx.org/en/download.html

If you are directly downloading on server then can use wget as below

Extract them by using gunzip command

You will see the new folder created

Download the latest version of Mod Security from below link

https://www.modsecurity.org/download.html

You can use below commands from server directly

Let’s get them installed

Install Nginx with Mod Security

It’s important to compile Nginx and mod security source code.

Login into a server and ensure you have root permission.

Note: if you are doing on a brand new server then you may need to install following libraries. First, let’s compile mod security. Go to modsecurity-2.9.1 folder and use below commands. Next, install Nginx with mod security This concludes Nginx is installed with Mod Security and it’s time to configure it.

Configure Mod Security with Nginx

Copy modsecurity.conf-recommended & unicode.mapping file from extracted folder of above-downloaded ModSecurity source code to nginx conf folder. You may also use the find command. Let’s rename modsecurity.conf-recommended to modsecurity.conf

Take a backup of nginx.conf file Open nginx.conf file and add following under “location /” directive

So it should appear like this Now, Mod Security is integrated with Nginx. Restart the Nginx to ensure it’s coming up without any error. Let’s verify… There are two possible methods to confirm Nginx is compiled with Mod Security. First… List the compiled module by using –V with nginx executable file. Second… Go to logs folder and view the error file, you should see following This concludes you have successfully configured ModSecurity with Nginx. By default configuration is in detect mode only that means it will not execute any action and protect your web applications. In my next article, I’ve explained how to configure OWASP rule set and enable Mod Security to protect from web security vulnerabilities.

How to Install   Configure ModSecurity on Nginx - 10How to Install   Configure ModSecurity on Nginx - 78How to Install   Configure ModSecurity on Nginx - 23How to Install   Configure ModSecurity on Nginx - 64How to Install   Configure ModSecurity on Nginx - 47How to Install   Configure ModSecurity on Nginx - 79How to Install   Configure ModSecurity on Nginx - 57How to Install   Configure ModSecurity on Nginx - 16How to Install   Configure ModSecurity on Nginx - 43How to Install   Configure ModSecurity on Nginx - 65How to Install   Configure ModSecurity on Nginx - 21How to Install   Configure ModSecurity on Nginx - 74How to Install   Configure ModSecurity on Nginx - 26How to Install   Configure ModSecurity on Nginx - 60How to Install   Configure ModSecurity on Nginx - 44How to Install   Configure ModSecurity on Nginx - 70How to Install   Configure ModSecurity on Nginx - 44How to Install   Configure ModSecurity on Nginx - 54How to Install   Configure ModSecurity on Nginx - 68How to Install   Configure ModSecurity on Nginx - 15How to Install   Configure ModSecurity on Nginx - 45How to Install   Configure ModSecurity on Nginx - 51How to Install   Configure ModSecurity on Nginx - 71How to Install   Configure ModSecurity on Nginx - 45