berryrreb/nginxmodsec

镜像概述

这是一个基于Centos7的NGINX-ModSecurity镜像，集成了ModSecurity安全模块，可用于部署Web服务并提供HTTP请求的安全防护能力。

核心功能

1. 提供NGINX基础Web服务，支持反向代理、静态资源托管等常见功能
2. 集成ModSecurity模块，可检测并防范SQL注入、XSS等常见Web***
3. 支持自定义虚拟主机配置和日志管理

使用场景

• 企业官网、应用服务的Web部署需求
• 需要增强安全防护的Web服务场景
• 反向代理场景下的安全加固

配置说明

（所有操作需在主机执行，而非容器内）

创建基础目录

sh
mkdir -p /var/containers/shared/var/www/sites \
              /var/containers/nginx/{var/log/nginx,etc/nginx/vhosts,etc/nginx/conf.d,var/cache/nginx,var/backups,etc/nginx/keys}

创建软链接

sh
ln -s /var/containers/nginx/var/log/nginx/ /var/log/

设置logrotate脚本

sh
mkdir -p /etc/logrotate.d/c
echo 'L3Zhci9sb2cvbmdpbngvKi5sb2cgewogICAgICAgIGRhaWx5CiAgICAgICAgbWlzc2luZ29rCiAgICAgICAgcm90YXRlIDYwCiAgICAgICAgY29tcHJlc3MKICAgICAgICBkZWxheWNvbXByZXNzCiAgICAgICAgbm90aWZlbXB0eQogICAgICAgIGNyZWF0ZSA2NDQKICAgICAgICBzaGFyZWRzY3JpcHRzCiAgICAgICAgcG9zdHJvdGF0ZQogICAgICAgICAgICBuZ2lueCAtcyByZWxvYWQKICAgICAgICBlbmRzY3JpcHQKfQovdmFyL2xvZy9uZ2lueC8qLyoubG9nIHsKICAgICAgICBkYWlseQogICAgICAgIG1pc3NpbmdvawogICAgICAgIHJvdGF0ZSA2MAogICAgICAgIGNvbXByZXNzCiAgICAgICAgZGVsYXljb21wcmVzcwogICAgICAgIG5vdGlmZW1wdHkKICAgICAgICBjcmVhdGUgNjQ0CiAgICAgICAgc2hhcmVkc2NyaXB0cwogICAgICAgIHBvc3Ryb3RhdGUKICAgICAgICAgICAgbmdpbnggLXMgcmVsb2FkCiAgICAgICAgZW5kc2NyaXB0Cn0KCg==' | base64 -w0 -d > /etc/logrotate.d/nginx

拉取镜像

sh
docker pull berryrreb/nginxmodsec

启动容器

sh
docker run -td --name=nginx --privileged=false -p 80:80 -p 443:443 \
                    --volume=/var/containers/shared/var/www/sites:/var/www/sites:z \
                    --volume=/var/containers/nginx/var/log/nginx:/var/log/nginx:z \
                    --volume=/var/containers/nginx/etc/nginx/vhosts:/etc/nginx/vhosts:z \
                    --volume=/var/containers/nginx/etc/nginx/keys:/etc/nginx/keys:z \
                    --volume=/var/containers/nginx/etc/nginx/conf.d:/etc/nginx/conf.d:z \
                    --volume=/var/containers/nginx/var/cache/nginx:/var/cache/nginx:z  \
                    --volume=/var/containers/nginx/var/backups:/var/backups:z \
                    --volume=/etc/localtime:/etc/localtime:ro \
                    --hostname=nginx.service \
                    docker.io/berryrreb/nginxmodsec

NGINX配置

该镜像包含NGINX基础配置，若需查看已编译模块，执行以下命令：

sh
docker exec -it nginx bash -c 'nginx -V'

所有虚拟主机配置文件需放置在 /var/containers/nginx/etc/nginx/vhosts 目录。添加配置后需重新加载：

sh
docker exec -it nginx bash -c 'nginx -s reload'

启用ModSecurity

在虚拟主机的server段添加以下指令启用ModSecurity：

sh
ModSecurityEnabled on;
ModSecurityConfig /etc/nginx/modsec/main.conf;

虚拟主机配置示例

反向代理场景（HTTP）

注意：无需启用ModSecurity可删除相关行

sh
server{
    listen 80;
    server_name test.example.com;
    location / {
        ModSecurityEnabled on;
        ModSecurityConfig /etc/nginx/modsec/main.conf;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://0.0.0.0:9000$request_uri;
        proxy_redirect off;
    }
}

静态页面场景

sh
server {
    listen 80;
    server_name test.example.com;
    root /etc/nginx/vhosts/;
    location = / {
        index index.html;
    }
}