eben0/modsecurity-nginx-proxy

ModSecurity NGINX代理镜像

modsecurity-nginx-proxy镜像结合了https://hub.docker.com/r/owasp/modsecurity%E4%B8%8Ehttps://hub.docker.com/r/jwilder/nginx-proxy%EF%BC%8C%E6%94%AF%E6%8C%81%E8%BF%90%E8%A1%8C%E5%A4%9A%E4%B8%BB%E6%9C%BA%E5%90%8D%E7%9A%84NGINX%E4%BB%A3%E7%90%86%EF%BC%8C%E5%B9%B6%E9%80%9A%E8%BF%87ModSecurity%E6%8F%90%E4%BE%9BWeb%E5%BA%94%E7%94%A8%E5%AE%89%E5%85%A8%E9%98%B2%E6%8A%A4%E8%83%BD%E5%8A%9B%E3%80%82

核心功能

1. 多主机名代理：支持多站点反向代理部署
2. Web应用防火墙：集成ModSecurity，防御SQL注入、XSS等常见Web***
3. 自定义规则：允许用户添加自定义安全规则，适配业务需求
4. Docker生态兼容：通过挂载Docker socket实现服务自动发现与配置

使用场景

• 企业Web应用的安全防护与反向代理部署
• 多站点统一代理管理，简化运维流程
• 需要自定义安全规则的Web服务场景

配置说明

Docker Compose部署示例

yaml
version: '3.9'

services:
  proxy:
    image: docker.xuanyuan.run/eben0/modsecurity-nginx-proxy
    ports:
      - 80:80
      - 443:443
    container_name: proxy
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro  # 挂载Docker socket自动发现服务
      - ./modsecurity.d/rules:/etc/modsecurity.d/rules:ro  # 挂载自定义规则目录
      - nginx-certs:/etc/nginx/certs  # 证书存储卷
      - nginx-vhost:/etc/nginx/vhost.d  # 虚拟主机配置卷
      - nginx-html:/usr/share/nginx/html  # HTML文件存储卷
    environment:
      MODSEC_DEBUG_LOGLEVEL: 5  # 设置ModSecurity调试日志级别
    networks:
      service_network:

  web:
    image: docker.xuanyuan.run/nginx
    container_name: web
    environment:
      VIRTUAL_PORT: 8080  # 服务监听端口
      VIRTUAL_HOST: web.example.com  # 虚拟主机域名
    networks:
      service_network:

networks:
  service_network:

volumes:
  nginx-certs:
  nginx-vhost:
  nginx-html:

安全规则配置

镜像默认不含核心规则集（CRS），需从官方仓库获取：

https://github.com/coreruleset/coreruleset/tree/v3.4/dev/rules

1. 本地创建规则目录（如./modsecurity.d/rules）
2. 下载所需规则文件到该目录
3. 创建rules.conf文件（示例）：

apacheconf
Include REQUEST-901-INITIALIZATION.conf
Include REQUEST-903-APPLICATION-ATTACK-LFI.conf
Include REQUEST-904-APPLICATION-ATTACK-RFI.conf
Include REQUEST-905-APPLICATION-ATTACK-RCE.conf
Include REQUEST-911-METHOD-ENFORCEMENT.conf
Include REQUEST-913-SCANNER-DETECTION.conf
Include RESPONSE-951-DATA-LEAKAGES.conf
Include RESPONSE-952-COMMON-ATTACKS.conf
Include RESPONSE-953-BODY-PARSING.conf
Include RESPONSE-954-APPLICATION-ATTACK-CODE-INJECTION.conf
Include RESPONSE-955-APPLICATION-ATTACK-XSS.conf
Include RESPONSE-980-CORRELATION.conf

4. 通过Docker Compose挂载规则目录（如示例中的./modsecurity.d/rules:/etc/modsecurity.d/rules:ro）