南墙WAF部署完全指南：开源Web应用防火墙实战

1
sudo yum install -y ca-certificates curl wget

1
curl https://waf.uusec.com/waf-install -o waf-install
2
sudo bash ./waf-install
3
rm -f waf-install

1
sudo systemctl status uuwaf
2
sudo netstat -tulnp | grep uuwaf

1
# 下载压缩包
2
curl https://waf.uusec.com/waf.tgz -o waf.tgz
3
tar -zxf waf.tgz
4
cd waf
5

6
# 执行启动脚本
7
sudo bash ./uuwaf.sh
8

9
# 查看容器状态
10
sudo docker ps | grep uuwaf

1
-- SQL注入检测示例
2
function sql_injection_detection()
3
    local args = ngx.req.get_uri_args()
4
    for key, val in pairs(args) do
5
        if string.match(val, "union%s+select") or
6
           string.match(val, "or%s+1%s*=%s*1") or
7
           string.match(val, "waitfor%s+delay") then
8
            return ngx.exit(403)
9
        end
10
    end
11
end

1
用户 → 南墙WAF (443端口) → Nginx后端服务器 (8080端口)

1
server {
2
    listen 8080;
3
    server_name example.com;
4

5
    set_real_ip_from  南墙WAF服务器IP;
6
    real_ip_header    X-Forwarded-For;
7

8
    location / {
9
        root   /var/www/html;
10
        index  index.html index.htm;
11
    }
12
}

1
sudo systemctl restart nginx

1
# 测试HTTPS访问
2
curl -I https://example.com | grep -i server
3
# 应该看到: Server: uuWAF

1
Listen 8080
2

3
<VirtualHost *:8080>
4
    ServerName example.com
5
    DocumentRoot /var/www/html
6

7
    RemoteIPHeader X-Forwarded-For
8
    RemoteIPTrustedProxy 南墙WAF服务器IP
9
</VirtualHost>

1
sudo systemctl restart httpd

1
# CentOS/RHEL
2
sudo yum install mod_remoteip
3
# Ubuntu/Debian
4
sudo apt-get install libapache2-mod-remoteip
5
sudo a2enmod remoteip

1
# 查看实时连接数
2
sudo netstat -an | grep :443 | grep ESTABLISHED | wc -l
3

4
# 测试响应时间
5
ab -n 1000 -c 10 https://example.com/

1
top -p $(pgrep uuwaf)

1
# 统计访问量最高的IP
2
sudo awk '{print $1}' /var/log/uuwaf/access.log | sort | uniq -c | sort -rn | head -10
3

4
# 统计访问量最高的URL
5
sudo awk '{print $7}' /var/log/uuwaf/access.log | sort | uniq -c | sort -rn | head -10

1
# 统计攻击类型分布
2
sudo grep "检测" /var/log/uuwaf/attack.log | awk '{print $3}' | sort | uniq -c | sort -rn
3

4
# 统计攻击源IP
5
sudo awk -F'IP: ' '{print $2}' /var/log/uuwaf/attack.log | awk -F',' '{print $1}' | sort | uniq -c | sort -rn | head -10

1
# 编辑 /etc/sysctl.conf
2
net.ipv4.tcp_max_syn_backlog = 8192
3
net.core.somaxconn = 65535
4
net.ipv4.tcp_tw_reuse = 1
5
net.ipv4.ip_local_port_range = 1024 65535
6

7
# 应用配置
8
sudo sysctl -p

1
# 登录MySQL
2
sudo mysql -u waf -p uuwaf
3

4
# 清理30天前的日志
5
DELETE FROM access_logs WHERE create_time < DATE_SUB(NOW(), INTERVAL 30 DAY);
6
DELETE FROM attack_logs WHERE create_time < DATE_SUB(NOW(), INTERVAL 30 DAY);

1
# 检查WAF服务状态
2
sudo systemctl status uuwaf
3

4
# 检查防火墙
5
sudo firewall-cmd --add-port=4443/tcp --permanent
6
sudo firewall-cmd --reload
7

8
# 查看错误日志
9
sudo tail -100 /var/log/uuwaf/error.log

1
# 检查资源使用情况
2
top -p $(pgrep uuwaf)
3

4
# 优化Nginx配置
5
keepalive_timeout 30;
6
keepalive_requests 10000;
7
sendfile on;

1
# 检查证书格式
2
openssl x509 -in your_cert.crt -text -noout
3
openssl rsa -in your_key.key -check
4

5
# 确保证书和私钥匹配
6
openssl x509 -noout -modulus -in your_cert.crt | openssl md5
7
openssl rsa -noout -modulus -in your_key.key | openssl md5

1
# 配置日志轮转
2
sudo vim /etc/logrotate.d/uuwaf
3

4
/var/log/uuwaf/*.log {
5
    daily
6
    rotate 7
7
    compress
8
    missingok
9
    notifempty
10
}

1
# 清理30天前的日志
2
find /var/log/uuwaf -name "*.log" -mtime +30 -delete

1
# 测试后端服务器连通性
2
ping 192.168.1.100
3
telnet 192.168.1.100 8080
4

5
# 检查后端服务器防火墙
6
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="WAF服务器IP" port protocol="tcp" port="8080" accept' --permanent
7
sudo firewall-cmd --reload
8

9
# 查看WAF错误日志
10
sudo tail -100 /var/log/uuwaf/error.log | grep "upstream"

1
# 升级前备份配置
2
sudo tar -czf uuwaf_config_backup_$(date +%Y%m%d).tar.gz /opt/waf/conf/
3

4
# 备份数据库
5
sudo mysqldump -u waf -p uuwaf > uuwaf_db_backup_$(date +%Y%m%d).sql

1
# 停止服务
2
sudo systemctl stop uuwaf
3

4
# 恢复配置
5
sudo tar -xzf uuwaf_config_backup.tar.gz -C /
6

7
# 恢复数据库
8
sudo mysql -u waf -p uuwaf < uuwaf_db_backup.sql
9

10
# 启动服务
11
sudo systemctl start uuwaf