Installing Naxsi On Ubuntu 14.04

<div dir="ltr" style="text-align: left;" trbidi="on"> <h1 style="box-sizing: border-box; font-family: Raleway, Helvetica, Arial, sans-serif; line-height: 46px; margin: 0px 0px 8px;"> <span style="color: #990000; font-size: large;"><u>Installing Naxsi On Ubuntu</u></span></h1> <div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">NAXSI means <a href="http://www.hackthesec.co.in/search/label/NGINX">Nginx</a> Anti XSS & SQL Injection.</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Technically, it is a third party nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in websites vulnerabilities. For example, <, | or drop are not supposed to be part of a URI.</span></span></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSLzQdKsTjvUisUW5FwxBc0AE6YGXY8HBvJRTLmhojFtRKXfi7dLFTmc0fViZfMVeLsi1oTMdDkMBUnUr_QOCXPSANUmRvvABmmkibeBS4h3nlR8iNLZN8-vDPea7dnRF2a4odPe7fiioQ/s1600/nginx_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSLzQdKsTjvUisUW5FwxBc0AE6YGXY8HBvJRTLmhojFtRKXfi7dLFTmc0fViZfMVeLsi1oTMdDkMBUnUr_QOCXPSANUmRvvABmmkibeBS4h3nlR8iNLZN8-vDPea7dnRF2a4odPe7fiioQ/s1600/nginx_hackthesec.co.in.png" /></a></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Being very simple, those patterns may match legitimate queries, it is Naxsi's administrator duty to add specific rules that will whitelist those legitimate behaviours. The administrator can either add whitelists manually by analyzing nginx's error log, or (recommended) start the project by an intensive auto-learning phase that will automatically generate whitelisting rules regarding website's behaviour.</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">In short, Naxsi behaves like a DROP-by-default firewall, the only job needed is to add required ACCEPT rules for the target website to work properly.</span></span></div> </div> <div> <div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 1A: Installing Naxsi without an existing Nginx installation</span></u></b></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> Should you not have Nginx installed on your server yet, you should follow this step. If you already have an existing Nginx installation, follow step 1B. Before we're going to install Naxsi, it might be smart to update our system. Do this by executing:</div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">apt-get update</span></span></pre> </div> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Next, we can install Naxsi. Using apt-get for the install, Naxsi and its dependencies will be installed. Naxsi will automatically be started on boot.</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">apt-get install nginx-naxsi</span></span></pre> </div> <div> <span style="font-family: verdana, geneva, sans-serif;"><div style="font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 1B: Installing Naxsi with an existing Nginx installation</span></u></b></div> <div style="color: #333333; font-size: 15px; line-height: 26px;"> Step 1A cannot be followed in case Nginx is already installed, as the <b>nginx-naxsi</b> package will be <b>Nginx + Naxsi</b>. If you already have Nginx and want Naxsi on top of that, generally, replacing the <b>nginx-core</b> package with the <b>nginx-naxsi</b> package should work fine. It is smart to create a backup of preferably your whole server, and the <b>/etc/nginx/</b> directory should be backed up as well.</div> <div style="color: #333333; font-size: 15px; line-height: 26px;"> <br /></div> <div> <span style="color: #333333;"><span style="font-size: 15px; line-height: 26px;">If possible, deploy a new server with a totally new Nginx installation using the nginx-naxsi package. If not, backup your server and type:</span></span></div> </span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">apt-get install nginx-naxsi</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">This should install Naxsi and replace the existing Nginx, but keep all your files.</span></span></div> <div> <div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 2: Editing Naxsi settings</span></u></b></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> In order to enable Naxsi, open the file <b>/etc/nginx/nginx.conf:</b></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">vi /etc/nginx/nginx.conf</span></span></pre> </div> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">and find the following section:</span></span></div> <div> <pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;"># nginx-naxsi config ## # Uncomment it if you installed nginx-naxsi ## # include /etc/nginx/naxsi_core.rules;</span></pre> </div> <div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> Remove the # in front of the include to load the Naxsi rules, which will enable Naxsi. After making that change, the line should look like this:</div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <br /></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b>include /etc/nginx/naxsi_core.rules;</b></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <br /></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> The configuration of Naxsi can be found in <b>/etc/nginx/naxsi.rules</b>. You can see what it does and optionally change some settings, depending on your needs and the type of website(s) that you host.</div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <br /></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> After enabling Naxsi and editing the configuration, we need to enable Naxsi for our default site manually. Open /<b>etc/nginx/sites-enabled/default:</b></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">vi /etc/nginx/sites-enabled/default</span></span></pre> </div> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">In order to enable Naxsi on this location, remove the # if present, otherwise leave the include line that way and don't add a #.</span></span></div> <div> <pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;"># Uncomment to enable naxsi on this location include /etc/nginx/naxsi.rules;</span></pre> </div> <div> <span style="font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><div> <b><u><span style="color: #0b5394;">Step 3: Turning off learning mode</span></u></b></div> <div style="color: #333333;"> In order to let Naxsi protect your site, we need to turn off the learning mode. Open <b>/etc/nginx/naxsi.rules:</b></div> </span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">vi /etc/nginx/naxsi.rules</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Find the string <b>LearningMode</b>, and place an # in front of it. That comments out the line and thus disable the learning mode in the config.</span></span></div> <div> <span style="font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><div> <b><u><span style="color: #0b5394;">Step 4: Restarting Naxsi</span></u></b></div> <div style="color: #333333;"> Restart Nginx for the changes to take effect:</div> </span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">service nginx reload</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">You can now see any security warnings from Naxsi in the Nginx log:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">tail -f /var/log/nginx/error.log</span></span></pre> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></pre> </div> </div>

Installing Naxsi On Ubuntu 14.04

Installing Naxsi On Ubuntu NAXSI means Nginx Anti XSS & SQL Injection. Technically, it is a third party nginx module, availabl...

Read more »