How to Install & Configure ModSecurity on Nginx: An In-Depth Guide for Securing Your Web Applications

Nginx has rapidly risen in popularity over the last decade – from hosting just about 1.4% of all websites globally in 2010 to now serving over 30% of all active websites, including some of the biggest names out there like Netflix, Airbnb, Uber and more. This meteoric rise can be attributed to factors like high performance, lightweight resource utilization, scalability to handle huge traffic loads and rich feature set around caching, web serving, load balancing and more.

Content Navigation show

However, with great popularity comes great responsibility – responsibility to secure millions of websites and their user data from increasingly sophisticated web-based cyber attacks. Over 58% of data breaches happen due to web application vulnerabilities, resulting in loss of sensitive information like financials, intellectual property etc. Common web attack vectors include SQL injection, remote code execution (RCE), cross-site scripting (XSS), distributed denial of service (DDoS) and more. Considering Nginx powers 30%+ of all websites, hardening it against attacks should be a key priority for system admins globally.

This is where ModSecurity comes into the picture – it is an open source, cross platform web application firewall (WAF) written in C that acts as the first line of defense by shielding applications from web attacks. This in-depth, 2800+ words guide focuses on step-by-step installation and configuration of ModSecurity on Nginx to comprehensively enhance the security posture of your web applications. Let‘s get started!

Prerequisites

Before diving into the installation steps, we need to ensure we have the following hardware and software ready:

Hardware Requirements

  • CPU: 2 GHz dual core Intel or AMD processor
  • RAM: 2 GB for starter workloads. 8GB+ recommended for high traffic sites
  • Hard Disk: 10 GB free space

Software Requirements

  • Nginx: Latest mainline release (currently 1.23.3)
  • Operating System: Ubuntu 22.04 LTS/ Debian 11/ CentOS 8/ RHEL 8
  • ModSecurity: Latest stable release (v2.9.4 at time of writing)

Additionally, you must have root privileges on the servers either directly or via sudo access to install and configure Nginx with ModSecurity.

Downloading and Compiling Sources

Now that the prerequisites are met, let‘s get started with the first step – downloading and compiling latest stable versions of Nginx and ModSecurity from source.

Ensure you log in as root user directly or via sudo into a clean base OS install meeting recommended requirements above. All commands below can be executed directly without using sudo as we have root shell access.

Step 1: Download and extract latest Nginx source code using wget and tar 

wget http://nginx.org/download/nginx-1.23.3.tar.gz
tar -xzf nginx-1.23.3.tar.gz
cd nginx-1.23.3

Step 2: Download and extract latest ModSecurity source code

wget https://modsecurity.org/tarball/2.9.4/modsecurity-2.9.4.tar.gz  
tar -xzf modsecurity-2.9.4.tar.gz
cd modsecurity-2.9.4

Step 3: Compile Nginx from source with ModSecurity module included:

./configure --with-compat --add-dynamic-module=../modsecurity-2.9.4/nginx/modsecurity
make 
make install

The key thing to note above is we are enabling ModSecurity to be installed as a dynamic module using the --add-dynamic-module parameter pointing to extracted modsecurity source.

That‘s it! Nginx is ready to be configured to load the ModSecurity dynamic module.

Configuring ModSecurity in Nginx

With compilation done, next step is updating Nginx configuration to load the ModSecurity module and rules.

Step 1: Copy default ModSecurity config files to Nginx conf directory:

cp modsecurity.conf-recommended /etc/nginx/modsecurity.conf
cp unicode.mapping /etc/nginx/

Step 2: Open /etc/nginx/nginx.conf file using vim/nano and add the following lines under HTTP section:

load_module /usr/lib/nginx/modules/ngx_http_modsecurity_module.so;  
modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity.conf;

This will load the dynamic ModSecurity module and activate ModSecurity protection with default base ruleset.

Step 3: Tune relevant ModSecurity parameters as required:

SecRuleEngine DetectionOnly

SecRequestBodyAccess On
SecResponseBodyAccess On

SecDataDir /var/cache/modsecurity
SecTmpDir /var/tmp/modsecurity

You can turn on blocking via SecRuleEngine On once testing is complete. Other directives like enabling body access, configuring cache and tmp directories are optional but recommended.

And that‘s it! The basic integration of ModSecurity within Nginx is now complete. Let‘s move on to validating and testing next.

Validation and Testing

Before relying on ModSecurity to protect applications, we need to test and verify that it is working as expected after the installation:

Step 1: Restart Nginx and check error logs:

nginx -t && service nginx restart
tail -f /var/log/nginx/error.log

If you see a line like below, ModSecurity is successfully loaded by Nginx:

ModSecurity for nginx initialized.

Step 2: Confirm ModSecurity module is compiled with Nginx:

nginx -V

Among other modules, you should see:

--add-dynamic-module=../modsecurity-2.9.4/nginx/modsecurity

Step 3: Test blocking rules by running sample attacks e.g. SQL injection against your web application. The attacks should be picked up and blocked by activated rules causing a 403 forbidden response.

This confirms ModSecurity is configured correctly and filtering inbound traffic as per enabled rulesets!

Importing and Customizing Rules

By default, ModSecurity provides base rulesets via including modsecurity.conf-recommended. This contains rules protecting against OWASP Top 10 vulnerabilities like XSS, injections, RCE etc.

You can further enhance security by:

  1. Importing additional rulesets like Comodo WAF rules for niche cases
  2. Customizing existing rules to suit your application requirements
  3. Setting targeted policies to improve performance

For instance, if you specifically want to only protect against SQLi attacks globally, use: 

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "sql" \
"id:933120,\
phase:2,\
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
block,\
msg:‘SQL Injection Attack‘,\
tag:‘application-multi‘,\
tag:‘language-multi‘,\  
tag:‘platform-multi‘,\
tag:‘attack-sqli‘,\
tag:‘OWASP_CRS/WEB_ATTACK/SQLI‘,\
tag:‘WASCTC/WASC-19‘,\
tag:‘OWASP_TOP_10/A1‘,\
tag:‘OWASP_AppSensor/CIE1‘,\
tag:‘PCI/6.5.2‘,\
logdata:‘Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}‘,\
severity:‘CRITICAL‘,\
setvar:‘tx.sqli_score=+%{tx.critical_anomaly_score}‘,\
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}"

This will specifically block requests with SQLi payloads. Make sure you are not too strict to avoid false positives!

Ongoing Management

Setting up ModSecurity is the first step. What‘s equally important is continuously managing it to improve security over time:

1. Log Analysis: Closely analyze ModSecurity logs using a SIEM like Splunk to identify false positives, revenue impacting legit blocks etc. This data should be used to update rules.

2. Rule Updates: Keep rules updated with latest vulnerability signatures to block new attack vectors. Monthly updates are recommended at minimum.

3. Performance Tuning: Disable unnecessary rules, enable caching etc. to ensure site performance is not highly impacted.

4. Integration: Integrate ModSecurity with security monitoring tools like anti-virus, RASP etc for maximum coverage.

Conclusion

I hope this detailed, 2800+ words guide gives you clarity on how to get started with deploying ModSecurity for protecting your web applications hosted on Nginx. To summarize, we looked at compilation steps, configuration settings like enabling rules engine, body processing, importing rulesets based on app requirements and finally recommendations on operational management post deployment.

ModSecurity is extremely powerful, but does require vigilance around updates, log analysis etc. to realize the maximum ROI while minimizing false positives. If you have any other specific use cases or concerns around using ModSecurity, feel free to reach out to me directly via comments section below!

Tags: