تثبيت كوحدة ديناميكية لـ NGINX Plus¶

تصف هذه التعليمات الخطوات اللازمة لتثبيت عقدة فلترة Wallarm كوحدة ديناميكية للنسخة التجارية الرسمية من NGINX Plus. ستقوم العقدة بتحليل حركة المرور بشكل مباشر.

حالات الاستخدام¶

Among all supported Wallarm deployment options, DEB/RPM packages for NGINX Plus is recommended for Wallarm deployment in these use cases:

• Your infrastructure is based on bare metal or virtual machines without using container-based methods. Typically, these setups are managed with Infrastructure as Code (IaC) tools like Ansible or SaltStack.

• Your services are built around NGINX Plus. Wallarm can extend its functionalities using these packages.

المتطلبات¶

• Access to the account with the Administrator role in Wallarm Console for the US Cloud or EU Cloud

• SELinux disabled or configured upon the instructions

• NGINX Plus release 29 or 30 (R29 or R30)

  Custom NGINX Plus versions

  If you have a different version, refer to the instructions on how to connect the Wallarm module to custom build of NGINX

• Executing all commands as a superuser (e.g. root)

• Access to https://repo.wallarm.com to download packages. Ensure the access is not blocked by a firewall

• Access to https://us1.api.wallarm.com for working with US Wallarm Cloud or to https://api.wallarm.com for working with EU Wallarm Cloud. If access can be configured only via the proxy server, then use the instructions

• Access to the IP addresses below for downloading updates to attack detection rules, as well as retrieving precise IPs for your allowlisted, denylisted, or graylisted countries, regions, or data centers

  US CloudEU Cloud

  34.96.64.17
  34.110.183.149
  35.235.66.155
  34.102.90.100
  34.94.156.115
  35.235.115.105
  

  34.160.38.183
  34.144.227.90
  34.90.110.226
  

• Installed text editor vim, nano, or any other. In the instruction, vim is used

1. Install NGINX Plus and dependencies¶

Install NGINX Plus and its dependencies using these official NGINX instructions.

2. Add Wallarm repositories¶

Wallarm node is installed and updated from the Wallarm repositories. To add repositories, use the commands for your platform:

sudo apt -y install dirmngr
curl -fSsL https://repo.wallarm.com/wallarm.gpg | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/wallarm.gpg --import
sudo chmod 644 /etc/apt/trusted.gpg.d/wallarm.gpg
sh -c "echo 'deb https://repo.wallarm.com/debian/wallarm-node bullseye/4.8/' | sudo tee /etc/apt/sources.list.d/wallarm.list"
sudo apt update

curl -fsSL https://repo.wallarm.com/wallarm.gpg | sudo apt-key add -
sh -c "echo 'deb https://repo.wallarm.com/ubuntu/wallarm-node bionic/4.8/' | sudo tee /etc/apt/sources.list.d/wallarm.list"
sudo apt update

curl -fsSL https://repo.wallarm.com/wallarm.gpg | sudo apt-key add -
sh -c "echo 'deb https://repo.wallarm.com/ubuntu/wallarm-node focal/4.8/' | sudo tee /etc/apt/sources.list.d/wallarm.list"
sudo apt update

curl -fsSL https://repo.wallarm.com/wallarm.gpg | sudo apt-key add -
sh -c "echo 'deb https://repo.wallarm.com/ubuntu/wallarm-node jammy/4.8/' | sudo tee /etc/apt/sources.list.d/wallarm.list"
sudo apt update

sudo yum install -y epel-release
sudo rpm -i https://repo.wallarm.com/centos/wallarm-node/7/4.8/x86_64/wallarm-node-repo-4.8-0.el7.noarch.rpm

sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo rpm -i https://repo.wallarm.com/centos/wallarm-node/7/4.8/x86_64/wallarm-node-repo-4.8-0.el7.noarch.rpm

sudo yum install -y epel-release
sudo rpm -i https://repo.wallarm.com/centos/wallarm-node/8/4.8/x86_64/wallarm-node-repo-4.8-0.el8.noarch.rpm

sudo dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo rpm -i https://repo.wallarm.com/centos/wallarm-node/8/4.8/x86_64/wallarm-node-repo-4.8-0.el8.noarch.rpm

3. Install Wallarm packages¶

The following packages are required:

• nginx-plus-module-wallarm for the NGINX Plus-Wallarm module

• wallarm-node for the postanalytics module, Tarantool database, and additional NGINX Plus-Wallarm packages

sudo apt -y install --no-install-recommends wallarm-node nginx-plus-module-wallarm

sudo apt -y install --no-install-recommends wallarm-node nginx-plus-module-wallarm

sudo yum install -y wallarm-node nginx-plus-module-wallarm

sudo yum install -y wallarm-node nginx-plus-module-wallarm

sudo yum install -y wallarm-node nginx-plus-module-wallarm

4. Connect the Wallarm module¶

1. Open the file /etc/nginx/nginx.conf:

   sudo vim /etc/nginx/nginx.conf
   

2. Add the following directive right after the worker_processes directive:

   load_module modules/ngx_http_wallarm_module.so;
   

   Configuration example with the added directive:

   user  nginx;
   worker_processes  auto;
   load_module modules/ngx_http_wallarm_module.so;
   
   error_log  /var/log/nginx/error.log notice;
   pid        /var/run/nginx.pid;
   

3. Copy the configuration files for the system setup:

   sudo cp /usr/share/doc/nginx-plus-module-wallarm/examples/*.conf /etc/nginx/conf.d/
   

5. Connect the filtering node to Wallarm Cloud¶

The Wallarm filtering node interacts with the Wallarm Cloud. You need to connect the node to the Cloud.

When connecting node to the Cloud, you can set the node name, under which it will be displayed in the Wallarm Console UI and put the node into the appropriate node group (used to logically organize nodes in UI).

To connect the node to the Cloud, use a Wallarm token of the appropriate type:

• You may add -n <HOST_NAME> parameter to set a custom name for your node instance. Final instance name will be: HOST_NAME_NodeUUID.

6. تمكين Wallarm لتحليل حركة المرور¶

By default, the deployed Wallarm Node does not analyze incoming traffic.

To enable traffic analysis and proxying of legitimate traffic, update the NGINX configuration file, typically located at /etc/nginx/sites-available/default.

The following minimal configuration adjustments are necessary:

1. Set the Wallarm Node to wallarm_mode monitoring;. This mode is recommended for initial deployments and testing.

   Wallarm also supports more modes like blocking and safe blocking, which you can read more.

2. Determine where the node should forward legitimate traffic by adding the proxy_pass directive in the required locations. This could be to the IP of an application server, a load balancer, or a DNS name.

3. If present, remove the try_files directive from the modified locations to ensure traffic is directed to Wallarm without local file interference.

server {
    ...
+   wallarm_mode monitoring;
    location / { 
+        proxy_pass http://example.com;
-        # try_files $uri $uri/ =404;
    }
    ...
}

7. إعادة تشغيل NGINX Plus¶

usermod -aG wallarm <user_name>;

sudo systemctl restart nginx

sudo service nginx restart

sudo systemctl restart nginx

sudo systemctl restart nginx

sudo systemctl restart nginx

8. تكوين إرسال حركة المرور إلى وحدة Wallarm¶

Update targets of your load balancer to send traffic to the Wallarm instance. For details, please refer to the documentation on your load balancer.

9. اختبار تشغيل عقدة Wallarm¶

1. Send the request with test Path Traversal attack to a protected resource address:

   curl http://localhost/etc/passwd
   

   If traffic is configured to be proxied to example.com, include the -H "Host: example.com" header in the request.

2. Open Wallarm Console → Attacks section in the US Cloud or EU Cloud and make sure the attack is displayed in the list.

   

3. Optionally, test other aspects of the node functioning.

10. تعديل الحل الموظف بدقة¶

تم تثبيت الوحدة الديناميكية Wallarm بالإعدادات الافتراضية لـ NGINX Plus. قد تتطلب عقدة الفلترة بعض التكوين الإضافي بعد النشر.

يتم تحديد إعدادات Wallarm باستخدام توجيهات NGINX أو واجهة مستخدم وحدة التحكم Wallarm. يجب ضبط التوجيهات في الملفات التالية على الجهاز الذي توجد عليه عقدة Wallarm:

• /etc/nginx/conf.d/default.conf مع إعدادات NGINX

• /etc/nginx/conf.d/wallarm.conf مع إعدادات عقدة الفلترة العالمية

  يُستخدم الملف للإعدادات المطبقة على جميع النطاقات. لتطبيق إعدادات مختلفة على مجموعات نطاقات مختلفة، استخدم الملف default.conf أو أنشئ ملفات تكوين جديدة لكل مجموعة من النطاقات (على سبيل المثال، example.com.conf و test.com.conf). تتوفر معلومات أكثر تفصيلية حول ملفات تكوين NGINX في التوثيق الرسمي لـ NGINX.

• /etc/nginx/conf.d/wallarm-status.conf مع إعدادات مراقبة عقدة Wallarm. يتوفر وصف مفصل ضمن الرابط

• /etc/default/wallarm-tarantool أو /etc/sysconfig/wallarm-tarantool مع إعدادات قاعدة بيانات Tarantool

فيما يلي بعض الإعدادات النموذجية التي يمكن تطبيقها إذا لزم الأمر:

• تكوين وضعية الفلترة

• Allocating resources for Wallarm nodes

• Logging Wallarm node variables

• Using the balancer of the proxy server behind the filtering node

• Limiting the single request processing time in the directive wallarm_process_time_limit

• Limiting the server reply waiting time in the NGINX directive proxy_read_timeout

• Limiting the maximum request size in the NGINX directive client_max_body_size

القيود¶

• اكتشاف عمليات ملء البيانات ببيانات اعتمادية غير مدعوم حاليًا، حيث لم يتم تحديث الحزم إلى الإصدار 4.10 بعد

هل كانت هذه الصفحة مفيدة؟

كيف يمكننا تحسين هذه المقالة؟ (خياري)

المعلومات غير واضحة أو محيرة

معلومات غير كافية

معلومات قديمة أو غير صحيحة

0/240

يرسل