Welcome to the Knowledge Portal Video series.
In the last lecture, we looked into what a web application firewall is and why is it necessary?
We also looked into how we can manually compile Enginex from source.
Now, today we'll be installing one of the web application firewall College nags along with the Nginx.
Now we'll have to do that by compiling Nginx from the source itself.
Now if I go to the browser, this is a GitHub page, so basically the open source web for nginx.
Now in order to install Nazi we will have to compile Nginx from the source itself.
Now we have already seen on how we can do it from the source.
So let's start on doing that.
So I'll go to user local source.
This is where we'll be.
Compiling our Enginex package.
Now I have a bit of documentation so it becomes a bit quicker.
Otherwise it will take a lot of time.
Now the first thing that we'll do is we'll download the Nginx.
So here it is.
Nginx 1.9.5. tar dot js.
You can download it from the nginx website itself or I'll also be posting the documentation on how to
do it.
Now we have downloaded the nginx package, so let's untar it.
So I'll say tar x, y, z and nginx.
Okay.
So now we have nginx 1.9.5 folder.
Second thing that will be necessary is we have to download the package itself because Nazi is a vast.
Basically Nazi acts as a third party module for Nginx, so we'll be installing it along with the module.
Directives itself.
So let me download the Nazi package and let's unzip it.
Okay.
So essentially now we have two directories.
One is nginx and one is.
Now before we start compiling again, we have already seen this in the previous lecture as well.
You need to have a proper modules.
For compilation as well as.
Related to geoip.
If you are installing it.
Pcre devel is also a very important module.
If you do not have this you will not be able to compile nginx from the source.
Now I already have these packages in case you don't have do go ahead and install it.
Now if I do.
LS There are two directories over here.
One is Nazi and one is Nginx.
Let's go to the Nginx directory and this is the configure script.
Which we will be used to set the various directives.
Now, again, as we have seen in the last previous lecture as well on compiling links from the source,
we run the configure script.
The prefix is where the Nginx configuration will lie.
This is the system binary path.
This is the configuration path where the nginx conf lies and in the add module parameter, the first
module that we are adding is the name, which is the firewall module.
Along with that we are adding various other modules.
Now these is just a temporary list, but if you are in production environment then there will be a lot
of different modules that you will have to add.
But just for our lab purposes, we'll be adding just a minimal set of modules.
Now I'll just copy this and I'll paste it over here.
And let's run this.
Okay.
Now essentially if I do an LS over here, then a makefile will be created.
Let's do a make.
This will not take much time since we do not have a lot of modules.
Okay.
And the last step is make install.
So finally we are done.
The essential.
If we go to Nginx directory, we should have the configuration related files.
Now we have already seen the Init.d script that we have to put in the Init.d directory.
Now I have not removed the script from the server.
If you go to init.d.
Let's do an engine X.
Now, I have not removed this script.
We had already seen on how to put this script inside the init folder in the previous lectures.
So.
Let's do a service engine status.
And essentially it is saying Service Engine X is running, so let's just restart it.
Okay, so finally we are up and running with Nginx, but what we have done till now is.
We have just configured the or we have just installed the NOx module along with Nginx.
So now comes the time for configuring the Nazi module.
So let's go to usr local source.
And essentially in the Nazi hyphen master directory there is a folder called as Nazi underscore config.
So let's take this particular file.
And inside this there are certain rules.
So if I open court rules, so these are rules related to SQL injection.
We also have rules related to directory traversal, cross-site scripting, etcetera.
Now these rules will be used for checking the Http request to check if the.
A request that is coming is related to hacking activity or not.
We will be copying this particular rule file inside the e.t.c. nginx.
Directory.
So let's go back to the Nginx directory.
And.
This is where our rule file is basically stored.
Now we'll have to tell the Nginx to see the rules when it checks for the requests.
So for that, we'll open the nginx configuration and.
We'll put an include directive.
I'll say include ATC nginx noc c underscore code dot rules.
I hope the.
Part is correct and I'm not making any mistakes, so let's verify it once.
And yes, it is correct.
Now, there is one more thing that you will have to do is to configure the server section.
Now, we have included the Nazi rules, but we also have to include things in the server location.
So what I'll do, let's create a sample server block over here.
I'll say server.
Let me put listen.
80.
Server name would be example.com.
And for this particular configuration, the location, let's.
Say the root is dub.
Dub dub.
xHTML and indexes index dot HTML.
So just stay with me on this and we'll look into why are we doing this.
So if I open one more text file, let's just copy this and I'll say not dot rules.
And I'll paste it over here.
Now what we'll be essentially doing is we'll use a include directive and we'll post this particular
file within the server block.
So what essentially will happen is server block will have this particular Nazi rules file, which is
basically telling for a particular request.
Uri, do check that Uri and contents against this particular rules related to SQL Directory traversal
or cross-site scripting, etcetera.
One more thing that this particular file is doing is denied URL.
So if this particular rules are matched, then this is the text file that.
A Nazi should show.
You can even show a four, four, three or something like that.
Now, let me save this file and let's go back to the Nginx.conf.
And.
Let me go back to.
And I'll say include atc nginx c dot rules.
This is it.
Let's do nginx hyphen t and everything is successful.
Let's do nginx reload.
Perfect.
So essentially our valve is configured.
Now, question is, how will we be able to test it?
So if we look into here, basically it says that, for example, these are the things that are not supposed
to be a part of.
So what we'll do is we'll put this as a part of Uri and check if the Nazi can actually detect this particular
behavior.
So what we'll do let's go to the log file.
I'll go var log Nginx.
And essentially there are two log files.
Let me do a tail.
Let tail f on both of them.
So essentially there is.
No log file over here.
Now let me go to example.com.
And this will essentially not work because what we have done is.
Uh, let's open the nginx nginx.conf.
What we had done here is we had defined the route, which is HTML, but we have not actually created
this particular directory.
So let me actually create this directory.
Var HTML.
Let me go over here.
And let's create a sample file index dot HTML and let's say hi.
This is it.
And one more thing that we'll have to do is essentially if we go to Nginx and Nancy dot rules.
So here there is a request denied dot txt.
Now essentially we'll have to create this particular text file within HTML because this is our root
location.
So if I.
Let's say.
Not so fast.
Okay, now let's reload Nginx.
Great.
So let's come back to the log file where we were Enginex.
Let's do a tail on both the log files.
So essentially if I open example.com.
It should say hi.
And if we look into the log as well, it is saying hi.
Now let's try to include some characters which are vast, can easily detect.
So let's say I put say A is equal to person three C.
Person three C is a guy.
Equivalent of the open, curly brackets.
And essentially what this should do is this should trigger a related event.
So if I put a enter and here you see it is giving the output as well.
But here, if we look into the log file within the error log file, the Nazi is giving us that someone
is trying to do a exercise related activity on your website.
So it is saying what kind of attack a person is trying to do.
It is also showing the IP address from which the request is coming.
It is also shows the request related Uri.
But if we note that Nazi is actually not blocked this request.
The reason is because by default the Nazi works on learning mode, so it will not block, but it will
just show you various events which it thinks that it might be a attack.
Now, if we want to block such kind of attacks, then.
And it's simple.
Go to Nazi rules and hear the first directive is learning mode.
Let's disable this learning mode and.
Let's reload the nginx.
If I refresh this page, it should essentially say not found or it can essentially give you the custom
message that.
You want to have a warrior?
So this is it about configuring the basic Web application firewall.
I hope this has been informative for you, and I'll also be posting the documentation on how you can
do this in your own server.
This is it about this lecture.
And thank you for watching.