Step-by-step Guide to Installing and Configuring NAXSI Nginx WAF on Ubuntu 18.04 LTS

Web Application Firewalls (WAF) are essential tools for protecting websites and web applications from a wide range of threats. NAXSI (Nginx Anti XSS & SQL Injection) is an open-source WAF module that can be integrated into Nginx to add an extra layer of security.

In this guide, we will explain how to install the Naxsi firewall on the Ubuntu 18.04 server, configure it, and test its effectiveness.

System Requirements

Before proceeding, ensure that your system meets the following requirements:

• Operating System: Ubuntu 18.04 LTS.
• User Privileges: Root or user with sudo privileges.
• Internet Connection: Required for downloading packages and source files.

Initial Setup

Based on our experience, we recommend updating your system before installing NAXSI Nginx WAF on a server with Ubuntu 18.04. You can update your system’s package using the following command:

apt-get update -y apt-get upgrade -y

Restart the server to apply the changes.

You will also need certain dependencies to compile Nginx from the source. Install the necessary dependencies using the command:

apt-get install build-essential daemon libxml2-dev libxslt1-dev libgd-dev libgeoip-dev make libpcre3-dev libssl-dev unzip -y

Now, the Naxsi package will be available in the Ubuntu 18.04 default repository.

Building Nginx with Naxsi Integration

Next, you need to compile Nginx with Naxsi support.

Download the Nginx source using the command:

wget http://nginx.org/download/nginx-1.16.1.tar.gz

Extract the downloaded file:

tar -xvzf nginx-1.16.1.tar.gz

Next, download the Naxsi source with the following command:

wget https://github.com/nbs-system/naxsi/archive/master.zip

Unzip the downloaded file with the following command:

unzip master.zip

Next, change the directory to the Nginx source:

cd nginx-1.16.1/

You need to configure the Nginx with Naxsi support with this command:

./configure --conf-path=/etc/nginx/nginx.conf --add-module=../naxsi-master/naxsi_src/ --error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-log-path=/var/log/nginx/access.log --http-proxy-temp-path=/var/lib/nginx/proxy --lock-path=/var/lock/nginx.lock --pid-path=/var/run/nginx.pid --user=www-data --group=www-data --with-http_ssl_module --without-mail_pop3_module --without-mail_smtp_module --without-mail_imap_module --without-http_uwsgi_module --without-http_scgi_module --prefix=/usr

Compile Nginx with:

make

Install Nginx:

make install

The last step here is creating directories for Nginx dynamic data libraries. Create them using this command:

mkdir /var/lib/nginx/body mkdir /var/lib/nginx/fastcgi

Now, Nginx is configured with Naxsi support.

Setting Up Naxsi Rules

In this step, you need to copy Naxsi core rules to the Nginx configuration directory. Copy it from the Naxsi source:

cp /root/naxsi-master/naxsi_config/naxsi_core.rules /etc/nginx/

Create a naxsi.rules file inside the /etc/nginx/ directory:

nano /etc/nginx/naxsi.rules

Specify actions a server should take when a URL request doesn’t comply with the core rules:

SecRulesEnabled; 
DeniedUrl "/RequestDenied";
## Check Naxsi rules
CheckRule "$SQL >= 8" BLOCK; 
CheckRule "$RFI >= 8" BLOCK; 
CheckRule "$TRAVERSAL >= 4" BLOCK; 
CheckRule "$EVADE >= 4" BLOCK; 
CheckRule "$XSS >= 8" BLOCK;

This will check the URLs and block them if necessary.

Save and close the file.

Configuring Nginx to Work with Naxsi

To get Nginx to work with Naxsi, you need to configure Nginx default configuration file with Naxsi support. For this, edit the configurations files of Nginx and Naxsi.

Open the Nginx default configuration file:

nano /etc/nginx/nginx.conf
Insert the lines:
user www-data; 
worker_processes 1; 
events {    
worker_connections 1024; 
}
http {    
include      mime.types;    
include /etc/nginx/naxsi_core.rules;    
include /etc/nginx/conf.d/.conf;    
include /etc/nginx/sites-enabled/;
default_type application/octet-stream;    
access_log /var/log/nginx/access.log;    
error_log /var/log/nginx/error.log;    
sendfile       on;    
keepalive_timeout 65;    
server {       
listen      80;        
server_name localhost;        
location / {            
root  html;           
 include /etc/nginx/naxsi.rules;
index index.html index.htm;      
}        
error_page  500 502 503 504 /50x.html;        
location = /50x.html {            
root  html;        
}   
} 
}

Save and close the file.

Test if there are any Nginx syntax errors with the following command:

nginx -t

If there are no errors, you should get the following output:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful

Setting Up a Systemd Service File for Nginx

To manage the Nginx service, you need to create a Nginx systemd service file.

nano /lib/systemd/system/nginx.service

Add these lines:

[Unit] 
Description=A high performance web server and a reverse proxy server Documentation=man:nginx(8) 
After=syslog.target network.target remote-fs.target nss-lookup.target
[Service] 
Type=forking 
PIDFile=/run/nginx.pid 
ExecStartPre=/usr/sbin/nginx -t 
ExecStart=/usr/sbin/nginx 
ExecReload=/usr/sbin/nginx -s reload 
ExecStop=/bin/kill -s QUIT $MAINPID 
PrivateTmp=true
[Install] 
WantedBy=multi-user.target

Save and close the file.

Reload the systemd daemon:

systemctl daemon-reload

Next, start the Nginx service and enable it to start after system reboot:

systemctl start nginx systemctl enable nginx

You can check the status of the Nginx service with the following command:

systemctl status nginx

You can also check the Nginx with loaded modules with this command:

nginx -V

Testing the Naxsi Firewall

We have now configured the Naxsi firewall. Now, we need to test the Nginx server on the matter of attacks and how well the Naxsi can handle them.

Go to the remote system, open a browser and insert the following URL:  http://your-server-ip/?a=<. You should be blocked by Naxsi from going further.

Check the Nginx error log next:

tail -f /var/log/nginx/error.log

You should be able to see your request blocked by Naxsi in the log:

2020/01/26 15:59:08 [error] 14907#0: 13 NAXSI_FMT: ip=103.250.161.100&server=208.117.84.142&uri=/&vers=0.56&total_processed=11&total_blocked=7&config=block&cscore0=$XSS&score0=8&zone0=ARGS&id0=1302&var_name0=a, client: 103.250.161.100, server: localhost, request: "GET /?a=%3C HTTP/1.1", host: "208.117.84.142"

You can also check Naxsi against XSS attacks. Go to the remote system, open a browser and insert the link: http://your-server-ip/?q="><script>alert(1)</script>. You should be blocked by Naxsi from going further.

Check the Nginx error log with the following command:

tail -f /var/log/nginx/error.log

You should be able to see your request blocked by Naxsi in the log:

2020/01/26 15:53:26 [error] 14907#0: 7 NAXSI_FMT: ip=103.250.161.100&server=208.117.84.142&uri=/&vers=0.56&total_processed=7&total_blocked=4&config=block&cscore0=$SQL&score0=8&cscore1=$XSS&score1=8&zone0=ARGS&id0=1001&var_name0=q, client: 103.250.161.100, server: localhost, request: "GET /?q=%22%3E%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1", host: "208.117.84.142"

Final Thoughts

Installing and configuring the Naxsi firewall on Ubuntu 18.04 can greatly enhance the security of your web applications. By following this guide, you should have a robust Nginx WAF that guards against common attacks like XSS and SQL injection. Remember to tailor the Naxsi rules to match your application's specific needs and regularly update both Nginx and Naxsi for optimal security.