Skip to content

Commit 75c06ca

Browse files
elisianoElisiano Petrini
elisiano
authored and
Elisiano Petrini
committed
Initial import
0 parents  commit 75c06ca

File tree

4 files changed

+275
-0
lines changed

4 files changed

+275
-0
lines changed

‎Dockerfile

+179
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
FROM alpine:3.4
2+
3+
MAINTAINER Elisiano Petrini "[email protected]"
4+
5+
ENV NGINX_VERSION 1.11.8
6+
7+
RUN GPG_KEYS=B0F4253373F8F6F510D42178520A9993A1C052F8 \
8+
&& CONFIG="\
9+
--prefix=/etc/nginx \
10+
--sbin-path=/usr/sbin/nginx \
11+
--modules-path=/usr/lib/nginx/modules \
12+
--conf-path=/etc/nginx/nginx.conf \
13+
--error-log-path=/var/log/nginx/error.log \
14+
--http-log-path=/var/log/nginx/access.log \
15+
--pid-path=/var/run/nginx.pid \
16+
--lock-path=/var/run/nginx.lock \
17+
--http-client-body-temp-path=/var/cache/nginx/client_temp \
18+
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
19+
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
20+
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
21+
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
22+
--user=nginx \
23+
--group=nginx \
24+
--with-http_ssl_module \
25+
--with-http_realip_module \
26+
--with-http_addition_module \
27+
--with-http_sub_module \
28+
--with-http_dav_module \
29+
--with-http_flv_module \
30+
--with-http_mp4_module \
31+
--with-http_gunzip_module \
32+
--with-http_gzip_static_module \
33+
--with-http_random_index_module \
34+
--with-http_secure_link_module \
35+
--with-http_stub_status_module \
36+
--with-http_auth_request_module \
37+
--with-http_xslt_module=dynamic \
38+
--with-http_image_filter_module=dynamic \
39+
--with-http_geoip_module=dynamic \
40+
--with-http_perl_module=dynamic \
41+
--with-threads \
42+
--with-stream \
43+
--with-stream_ssl_module \
44+
--with-stream_ssl_preread_module \
45+
--with-stream_realip_module \
46+
--with-stream_geoip_module=dynamic \
47+
--with-http_slice_module \
48+
--with-mail \
49+
--with-mail_ssl_module \
50+
--with-compat \
51+
--with-file-aio \
52+
--with-http_v2_module \
53+
--add-module=/usr/src/ModSecurity-nginx \
54+
" \
55+
&& addgroup -S nginx \
56+
&& adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G nginx nginx \
57+
&& apk add --no-cache --virtual .build-deps \
58+
gcc \
59+
libc-dev \
60+
make \
61+
openssl-dev \
62+
pcre-dev \
63+
zlib-dev \
64+
linux-headers \
65+
curl \
66+
gnupg \
67+
libxslt-dev \
68+
gd-dev \
69+
geoip-dev \
70+
perl-dev \
71+
&& apk add --no-cache --virtual .libmodsecurity-deps \
72+
pcre-dev \
73+
libxml2-dev \
74+
git \
75+
libtool \
76+
automake \
77+
autoconf \
78+
g++ \
79+
flex \
80+
bison \
81+
yajl-dev \
82+
# Add runtime dependencies that should not be removed
83+
&& apk add --no-cache \
84+
yajl \
85+
libstdc++ \
86+
&& curl -fSL http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
87+
&& curl -fSL http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz.asc -o nginx.tar.gz.asc \
88+
&& export GNUPGHOME="$(mktemp -d)" \
89+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEYS" \
90+
&& gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \
91+
&& rm -r "$GNUPGHOME" nginx.tar.gz.asc \
92+
&& mkdir -p /usr/src \
93+
&& tar -zxC /usr/src -f nginx.tar.gz \
94+
&& rm nginx.tar.gz \
95+
&& cd /usr/src \
96+
&& git clone https://github.com/SpiderLabs/ModSecurity \
97+
&& cd ModSecurity \
98+
&& git checkout v3/master \
99+
&& git submodule init \
100+
&& git submodule update \
101+
&& sed -i -e 's/u_int64_t/uint64_t/g' \
102+
./src/actions/transformations/html_entity_decode.cc \
103+
./src/actions/transformations/html_entity_decode.h \
104+
./src/actions/transformations/js_decode.cc \
105+
./src/actions/transformations/js_decode.h \
106+
./src/actions/transformations/parity_even_7bit.cc \
107+
./src/actions/transformations/parity_even_7bit.h \
108+
./src/actions/transformations/parity_odd_7bit.cc \
109+
./src/actions/transformations/parity_odd_7bit.h \
110+
./src/actions/transformations/parity_zero_7bit.cc \
111+
./src/actions/transformations/parity_zero_7bit.h \
112+
./src/actions/transformations/remove_comments.cc \
113+
./src/actions/transformations/url_decode_uni.cc \
114+
./src/actions/transformations/url_decode_uni.h \
115+
&& sh build.sh \
116+
&& ./configure \
117+
&& make \
118+
&& make install \
119+
&& cd /usr/src \
120+
&& git clone https://github.com/SpiderLabs/ModSecurity-nginx \
121+
&& cd /usr/src/nginx-$NGINX_VERSION \
122+
&& ./configure $CONFIG --with-debug \
123+
&& make -j$(getconf _NPROCESSORS_ONLN) \
124+
&& mv objs/nginx objs/nginx-debug \
125+
&& mv objs/ngx_http_xslt_filter_module.so objs/ngx_http_xslt_filter_module-debug.so \
126+
&& mv objs/ngx_http_image_filter_module.so objs/ngx_http_image_filter_module-debug.so \
127+
&& mv objs/ngx_http_geoip_module.so objs/ngx_http_geoip_module-debug.so \
128+
&& mv objs/ngx_http_perl_module.so objs/ngx_http_perl_module-debug.so \
129+
&& mv objs/ngx_stream_geoip_module.so objs/ngx_stream_geoip_module-debug.so \
130+
&& ./configure $CONFIG \
131+
&& make -j$(getconf _NPROCESSORS_ONLN) \
132+
&& make install \
133+
&& rm -rf /etc/nginx/html/ \
134+
&& mkdir /etc/nginx/conf.d/ \
135+
&& mkdir -p /usr/share/nginx/html/ \
136+
&& install -m644 html/index.html /usr/share/nginx/html/ \
137+
&& install -m644 html/50x.html /usr/share/nginx/html/ \
138+
&& install -m755 objs/nginx-debug /usr/sbin/nginx-debug \
139+
&& install -m755 objs/ngx_http_xslt_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so \
140+
&& install -m755 objs/ngx_http_image_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so \
141+
&& install -m755 objs/ngx_http_geoip_module-debug.so /usr/lib/nginx/modules/ngx_http_geoip_module-debug.so \
142+
&& install -m755 objs/ngx_http_perl_module-debug.so /usr/lib/nginx/modules/ngx_http_perl_module-debug.so \
143+
&& install -m755 objs/ngx_stream_geoip_module-debug.so /usr/lib/nginx/modules/ngx_stream_geoip_module-debug.so \
144+
&& ln -s ../../usr/lib/nginx/modules /etc/nginx/modules \
145+
&& strip /usr/sbin/nginx* \
146+
&& strip /usr/lib/nginx/modules/*.so \
147+
&& rm -rf /usr/src/nginx-$NGINX_VERSION \
148+
\
149+
# Bring in gettext so we can get `envsubst`, then throw
150+
# the rest away. To do this, we need to install `gettext`
151+
# then move `envsubst` out of the way so `gettext` can
152+
# be deleted completely, then move `envsubst` back.
153+
&& apk add --no-cache --virtual .gettext gettext \
154+
&& mv /usr/bin/envsubst /tmp/ \
155+
\
156+
&& runDeps="$( \
157+
scanelf --needed --nobanner /usr/sbin/nginx /usr/lib/nginx/modules/*.so /tmp/envsubst \
158+
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
159+
| sort -u \
160+
| xargs -r apk info --installed \
161+
| sort -u \
162+
)" \
163+
&& apk add --no-cache --virtual .nginx-rundeps $runDeps \
164+
&& apk del .build-deps \
165+
&& apk del .libmodsecurity-deps \
166+
&& apk del .gettext \
167+
&& mv /tmp/envsubst /usr/local/bin/ \
168+
&& rm -rf /usr/src/ModSecurity /usr/src/ModSecurity-nginx \
169+
\
170+
# forward request and error logs to docker log collector
171+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
172+
&& ln -sf /dev/stderr /var/log/nginx/error.log
173+
174+
COPY nginx.conf /etc/nginx/nginx.conf
175+
COPY nginx.vh.default.conf /etc/nginx/conf.d/default.conf
176+
177+
EXPOSE 80 443
178+
179+
CMD ["nginx", "-g", "daemon off;"]

‎README.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# NGINX with libModSecurity + ModSecurity-nginx connector
2+
The dockerfile of this container has been copied from the [official nginx repo (alpine variant)](https://raw.githubusercontent.com/nginxinc/docker-nginx/3e8a6ee0603bf6c9cd8846c5fa43e96b13b0f44b/mainline/alpine/Dockerfile) and has been modified to add [ModSecurity library (v3)](https://github.com/SpiderLabs/ModSecurity/tree/v3/master) + [ModSecurity nginx connector](https://github.com/SpiderLabs/ModSecurity-nginx).
3+
4+
You can refer to the [official nginx image documentation](https://hub.docker.com/_/nginx/) for instructions on how to use this image.
5+
6+
When you provide your configuration you can enable modsecurity. Please refer to [their wiki](https://github.com/SpiderLabs/ModSecurity/wiki) for documentation.
7+
8+
NOTE: no rules are shipped with this container, if you enable modsecurity you need to provide your own

‎nginx.conf

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
2+
user nginx;
3+
worker_processes 1;
4+
5+
error_log /var/log/nginx/error.log warn;
6+
pid /var/run/nginx.pid;
7+
8+
9+
events {
10+
worker_connections 1024;
11+
}
12+
13+
14+
http {
15+
include /etc/nginx/mime.types;
16+
default_type application/octet-stream;
17+
18+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
19+
'$status $body_bytes_sent "$http_referer" '
20+
'"$http_user_agent" "$http_x_forwarded_for"';
21+
22+
access_log /var/log/nginx/access.log main;
23+
24+
sendfile on;
25+
#tcp_nopush on;
26+
27+
keepalive_timeout 65;
28+
29+
#gzip on;
30+
31+
include /etc/nginx/conf.d/*.conf;
32+
}

‎nginx.vh.default.conf

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
server {
2+
listen 80;
3+
server_name localhost;
4+
5+
#charset koi8-r;
6+
#access_log /var/log/nginx/log/host.access.log main;
7+
8+
modsecurity on;
9+
location / {
10+
root /usr/share/nginx/html;
11+
index index.html index.htm;
12+
#modsecurity_rules '
13+
# SecRuleEngine On
14+
# SecDebugLog /tmp/modsec_debug.log
15+
# SecDebugLogLevel 9
16+
# SecRule ARGS "@contains test" "id:1,phase:2,t:trim,block"
17+
#';
18+
}
19+
#location / {
20+
# root /usr/share/nginx/html;
21+
# index index.html index.htm;
22+
#}
23+
24+
#error_page 404 /404.html;
25+
26+
# redirect server error pages to the static page /50x.html
27+
#
28+
error_page 500 502 503 504 /50x.html;
29+
location = /50x.html {
30+
root /usr/share/nginx/html;
31+
}
32+
33+
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
34+
#
35+
#location ~ \.php$ {
36+
# proxy_pass http://127.0.0.1;
37+
#}
38+
39+
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
40+
#
41+
#location ~ \.php$ {
42+
# root html;
43+
# fastcgi_pass 127.0.0.1:9000;
44+
# fastcgi_index index.php;
45+
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
46+
# include fastcgi_params;
47+
#}
48+
49+
# deny access to .htaccess files, if Apache's document root
50+
# concurs with nginx's one
51+
#
52+
#location ~ /\.ht {
53+
# deny all;
54+
#}
55+
}
56+

0 commit comments

Comments
 (0)