WAF-Firewall-install - Ubuntu 18.04

nginx.conf

user  www-data;
worker_processes  1;
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    include /etc/nginx/naxsi_core.rules;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
    default_type  application/octet-stream;
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen       80;
        server_name  localhost;
        location / {
            include /etc/nginx/naxsi.rules;
            root   html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

WAF-Config.sh

#!/bin/bash
# https://scriptxone.blogspot.com 
# reference script adapted from https://kifarunix.com/install-and-configure-naxsi-nginx-waf-on-ubuntu-18-04-lts/
#Now that the rules are in place, you need to enable these rules to act on per location basis.
#You can also define different types of attacks that can be blocked by Naxsi.

sed -i 'SecRulesEnabled;\n DeniedUrl "/RequestDenied";\n ## Check Naxsi rules\n CheckRule "$SQL >= 8" BLOCK;\n\n\n CheckRule "$RFI >= 8" BLOCK;\n CheckRule "$TRAVERSAL >= 4" BLOCK;\n CheckRule "$EVADE >= 4" BLOCK;\n CheckRule "$XSS >= 8" BLOCK;' > /etc/nginx/naxsi.rules

# SecRulesEnabled enables the Naxsi rules in a specific web location. SecRulesEnabled directive disables this.
# Note that you can set Naxsi in learning mode using the directive, LearningMode, where it automatically generates whitelisting rules based on website’s behavior. In this mode, Naxsi doesn’t block any attack.
# The DeniedUrl defines where Naxsi will redirect blocked requests.
# The CheckRule directive asks Naxsi to act on a specific request based on the score. The action ca either be ALLOW, BLOCK, LOG, DROP. The score level is between 0-9 and is set by the specific rules.

# Next, configure Nginx server to include these rules such that it looks like the below without comments.

WAF-Firewall-install.sh

#! /bin/sh
#
echo 'scriptxone.blogspot.com'
#Dependencies
apt install -y libpcre3-dev libssl-dev unzip build-essential daemon libxml2-dev libxslt1-dev libgd-dev libgeoip-dev

# updated 25 fev 2021
mkdir -p /root/WAF-Firewall-src
cd /root/WAF-Firewall-src
wget https://nginx.org/download/nginx-1.18.0.tar.gz
tar xzf nginx-1.18.0.tar.gz

#Download and unzip naxis
wget https://github.com/nbs-system/naxsi/archive/master.zip
unzip master.zip

# Configure Nginx for Naxsi support
cd nginx-1.18.0
./configure 
--conf-path=/etc/nginx/nginx.conf 
--add-module=../naxsi-master/naxsi_src/ 
--error-log-path=/var/log/nginx/error.log 
--http-client-body-temp-path=/var/lib/nginx/body 
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi 
--http-log-path=/var/log/nginx/access.log 
--http-proxy-temp-path=/var/lib/nginx/proxy 
--lock-path=/var/lock/nginx.lock 
--pid-path=/var/run/nginx.pid 
--user=www-data 
--group=www-data 
--with-http_ssl_module 
--without-mail_pop3_module 
--without-mail_smtp_module 
--without-mail_imap_module 
--without-http_uwsgi_module 
--without-http_scgi_module 
--prefix=/usr

# Compile 
make && make install
mkdir -p /var/lib/nginx/{body,fastcgi} #create Nginx dynamic data libraries directories.

#Configuring Nginx NAXSI
mkdir -p /etc/nginx/ ; cp -vi /root/WAF-Firewall-src/naxsi-master/naxsi_config/naxsi_core.rules /etc/nginx/