modSecurity和Naxsi哪个更适合Nginx搭建WAF

nginx增加modsecurity模块

modsecurity原本是Apache上的一款开源waf，可以有效的增强web安全性，目前已经支持nginx和IIS，配合nginx的灵活和高效，可以打造成生产级的WAF，是保护和审核web安全的利器。

1234567891011 git clone https://github.com/SpiderLabs/ModSecurity.gitcd ModSecurity/./autogen.sh./configure--enable-standalone-module --disable-mlogcmakecd tengine/./configure--prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf--pid-path=/var/run/nginx/nginx.pid --error-log-path=/var/log/nginx/nginx.log--http-log-path=/var/log/nginx/nginx-http.log--add-module=/root/ngx_devel_kit-0.2.19/--add-module=/root/lua-nginx-module-0.9.13/--add-module=/root/ModSecurity/nginx/modsecurity/ --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB"make

　　modsecurity倾向于过滤和阻止web危险，之所以强大就在于规则，OWASP提供的规则是于社区志愿者维护的，被称为核心规则CRS（corerules）,规则可靠强大，当然也可以自定义规则来满足各种需求。

1234567891011121314151617 git clone https://github.com/SpiderLabs/owasp-modsecurity-crscp -R owasp-modsecurity-crs /etc/nginx/cp /etc/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf.example /etc/nginx/owasp-modsecurity-crs/modsecurity_crs_10_setup.confcd ModSecurity/cp modsecurity.conf-recommended /etc/nginx/modsecurity.confcp unicode.mapping /etc/nginxvim modsecurity.confSecRuleEngine onnclude owasp-modsecurity-crs/modsecurity_crs_10_setup.confIncludeowasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.confInclude owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.confIncludeowasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.confIncludeowasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.confInclude owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_brute_force.confIncludeowasp-modsecurity-crs/optional_rules/modsecurity_crs_16_session_hijacking.conf