193 строки
7.6 KiB
Plaintext
193 строки
7.6 KiB
Plaintext
=====================================================================
|
|
MOD_SECURITY 2.6 Command-line Build notes for Windows 4/2/2011
|
|
by Tom Donovam
|
|
=====================================================================
|
|
|
|
PREREQUISITES:
|
|
|
|
Microsoft Visual Studio C++ tested with Visual Studio 2008 (aka VC9)
|
|
|
|
CMake build system from: http://www.cmake.org/ tested with CMake v2.8.0
|
|
|
|
Apache 2.2.x from: http://httpd.apache.org/ tested with Apache 2.2.17
|
|
Apache must be built from source using the same Visual Studio compiler as mod_security.
|
|
|
|
PCRE Perl Compatible Regular Expression library from: http://www.pcre.org/ tested with PCRE v8.12
|
|
|
|
LibXML2 from: http://xmlsoft.org/ tested with LibXML2 v2.7.7
|
|
Note that LibXML2 v2.7.8 does not build correctly for Windows
|
|
|
|
Lua Scripting Language from: http://www.lua.org/ tested with Lua v5.1.4
|
|
|
|
cURL multiprotocol file transfer library from: http://curl.haxx.se/ tested with cURL v7.21.4
|
|
|
|
|
|
BEFORE BUILDING
|
|
|
|
The directory where you build software from source ( C:\work in this exmaple)
|
|
must contain the Apache source you used to build the Apache web serverand the mod_security source
|
|
|
|
Apache source is in C:\work\httpd-2.2.17 in this example.
|
|
Apache has been installed to C:\Apache2217 in this example.
|
|
Mod_security source is in C:\work\mod_security in this example.
|
|
|
|
Download and untar the prerequite library sources:
|
|
|
|
Download pcre-8.12.tar.gz from ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/
|
|
untar it into C:\work\ creating C:\work\pcre-8.12
|
|
|
|
Download libxml2-2.7.7.tar.gz from ftp://xmlsoft.org/libxml2/
|
|
untar it into C:\work\ creating C:\work\libxml2-2.7.7
|
|
|
|
Download lua-5.1.4.tar.gz from http://www.lua.org/ftp/
|
|
untar it into C:\work\ creating C:\work\lua-5.1.4
|
|
|
|
Download curl-7.21.4.tar.gz from http://curl.haxx.se/download.html
|
|
untar it into C:\work\ creating C:\work\curl-7.21.4
|
|
|
|
Setup your build environment:
|
|
|
|
The PATH environment variable must include the Visual Studio variables as set by vsvars32.bat
|
|
The PATH environment variable must also include the CMAKE bin\ directory
|
|
|
|
Set an environment variable to the Apache source code directory:
|
|
|
|
SET HTTPD_BUILD=C:\work\httpd-2.2.17
|
|
|
|
If OpenSSL and Zlib support were included when you built Apache 2.2, and you want them available to LIBXML2 and CURL
|
|
|
|
Ensure that cURL and libXML2 can find the OpenSSL and Zlib includes and libraries that Apache was built with.
|
|
|
|
SET INCLUDE=%INCLUDE%;%HTTPD_BUILD%\srclib\openssl\inc32;%HTTPD_BUILD%\srclib\zlib
|
|
SET LIB=%LIB%;%HTTPD_BUILD%\srclib\openssl\out32dll;%HTTPD_BUILD%\srclib\zlib
|
|
|
|
Ensure that cURL and libXML2 don't use the static zlib library: zlib.lib.
|
|
Force cURL and libXML2 to use zdll.lib instead, requiring zlib1.dll at runtime:
|
|
|
|
IF EXIST %HTTPD_BUILD%\srclib\zlib\zlib.lib DEL %HTTPD_BUILD%\srclib\zlib\zlib.lib
|
|
|
|
BUILD PCRE-8.12
|
|
|
|
CD C:\work\pcre-8.12
|
|
CMAKE -G "NMake Makefiles" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=True
|
|
NMAKE
|
|
|
|
BUILD LIBXML2-2.7.7 (note: the more recent version: 2.7.8 does not build correctly on Windows)
|
|
|
|
CD C:\work\libxml2-2.7.7\win32
|
|
CSCRIPT configure.js iconv=no vcmanifest=yes zlib=yes
|
|
NMAKE -f Makefile.msvc
|
|
|
|
BUILD LUA-5.1.4
|
|
|
|
CD C:\work\lua-5.1.4\src
|
|
CL /Ox /arch:SSE2 /GF /GL /Gy /FD /EHsc /MD /Zi /TC /wd4005 /D "_MBCS" /D "LUA_CORE" /D "LUA_BUILD_AS_DLL" /D "_CRT_SECURE_NO_WARNINGS" /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_WIN32" /D "_WINDLL" /c *.c
|
|
DEL lua.obj luac.obj
|
|
LINK /DLL /LTCG /DEBUG /OUT:lua5.1.dll *.obj
|
|
IF EXIST lua5.1.dll.manifest MT -manifest lua5.1.dll.manifest -outputresource:lua5.1.dll;2
|
|
|
|
BUILD CURL-7.21.4
|
|
|
|
CD C:\work\curl-7.21.4
|
|
CMAKE -G "NMake Makefiles" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=True -DCURL_ZLIB=True
|
|
NMAKE
|
|
|
|
BUILD MOD_SECURITY-2.6
|
|
|
|
CD C:\work\mod_security\apache2
|
|
NMAKE -f Makefile.win APACHE=C:\Apache2217 PCRE=C:\work\pcre-8.12 LIBXML2=C:\work\libxml2-2.7.7 LUA=C:\work\lua-5.1.4\src
|
|
|
|
INSTALL MOD_SECURITY AND RUN APACHE
|
|
|
|
Copy these five files to C:\Apache2217\bin:
|
|
C:\work\pcre-8.12\pcre.dll C:\Apache2217\bin\
|
|
C:\work\lua-5.1.4\src\lua5.1.dll C:\Apache2217\bin\
|
|
C:\work\libxml2-2.7.7\win32\bin.msvc\libxml2.dll C:\Apache2217\bin\
|
|
C:\work\curl-7.21.4\libcurl.dll C:\Apache2217\bin\
|
|
C:\work\mod_security\apache2\mlogc-src\mlogc.exe
|
|
|
|
Copy this one file to C:\Apache2217\modules:
|
|
|
|
C:\work\mod_security\apache2\mod_security2.so
|
|
|
|
You may also copy C:\work\curl-7.21.4\curl.exe to C:\Apache2217\bin, if you want to use the cURL command-line program.
|
|
|
|
Download the core rules from http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
|
|
and unzip them into C:\Apache2217\conf\modsecurity_crs
|
|
|
|
Add configuration directives to your Apache conf\httpd.conf:
|
|
|
|
# mod_security requires mod_unique_id
|
|
LoadModule unique_id_module modules/mod_unique_id.so
|
|
|
|
# mod_security
|
|
LoadModule security2_module modules/mod_security2.so
|
|
<IfModule security2_module>
|
|
SecRuleEngine On
|
|
SecDataDir logs
|
|
Include conf/modsecurity_crs/*.conf
|
|
Include conf/modsecurity_crs/base_rules/*.conf
|
|
SecAuditEngine RelevantOnly
|
|
SecAuditLogRelevantStatus "^(?:5|4\d[^4])"
|
|
SecAuditLogType Serial
|
|
SecAuditLogParts ABCDEFGHZ
|
|
SecAuditLog logs/modsecurity.log
|
|
</IfModule>
|
|
|
|
|
|
==============================================================================================
|
|
OPTIONAL: BUILD AND CONFIGURE THE MOD_SECURITY-2.6 MLOGC piped-logging program
|
|
|
|
Edit the top of C:\work\mod_security\apache2\mlogc-src\Makefile.win and set your local paths
|
|
|
|
# Path to Apache httpd installation
|
|
BASE = C:\Apache2217
|
|
|
|
# Paths to required libraries
|
|
PCRE = C:\work\pcre-8.12
|
|
CURL = C:\work\curl-7.21.4
|
|
|
|
# Linking libraries
|
|
LIBS = $(BASE)\lib\libapr-1.lib \
|
|
$(BASE)\lib\libaprutil-1.lib \
|
|
$(PCRE)\pcre.lib \
|
|
$(CURL)\libcurl_imp.lib \
|
|
wsock32.lib
|
|
|
|
Build the mlogc.exe program:
|
|
|
|
CD C:\work\mod_security_trunk\mlogc
|
|
NMAKE -f Makefile.win
|
|
|
|
Copy mlocg.exe to C:\Apache2217\bin\
|
|
|
|
Create a new command file C:\Apache2217\bin\mlogc.bat with one line:
|
|
|
|
C:\Apache2217\bin\mlogc.exe C:\Apache2217\conf\mlogc.conf
|
|
|
|
Create a new configuration file C:\Apache2217\conf\mlogc.conf to control the piped-logging program mlogc.exe.
|
|
Here is an example conf\mlogc.conf:
|
|
|
|
CollectorRoot "C:/Apache2217/logs"
|
|
ConsoleURI "https://localhost:8888/rpc/auditLogReceiver"
|
|
SensorUsername "test"
|
|
SensorPassword "testtest"
|
|
LogStorageDir "data"
|
|
TransactionLog "mlogc-transaction.log"
|
|
QueuePath "mlogc-queue.log"
|
|
ErrorLog "mlogc-error.log"
|
|
LockFile "mlogc.lck"
|
|
KeepEntries 0
|
|
ErrorLogLevel 2
|
|
MaxConnections 10
|
|
MaxWorkerRequests 1000
|
|
TransactionDelay 50
|
|
StartupDelay 5000
|
|
CheckpointInterval 15
|
|
ServerErrorTimeout 60
|
|
|
|
Change the SecAuditLog directive in conf\httpd.conf to pipe the log data to mlogc
|
|
instead of writing them to a file:
|
|
|
|
SecAuditLog |C:/Apache2217/bin/mlogc.bat
|