Sign inSign up

supermy/ap-openresty

By supermy

•Updated about 5 years ago

alpine for openresty

Image
0

502

supermy/ap-openresty repository overview

##2019-08-10 如何在应用系统中使用 WAF-Docker 1.配置反向代理for WAF; 2.配置文件使用 docker 的-v 进行绑定；

文件目录如下：

    nginx.conf ：主配置文件
    conf.d
        server.conf 
        location-waf.conf ：waf 配置示例
            http.d
                http-waf.conf ：waf 预加载
            server.d ：可以增加需要 waf 的反向配置文件，配置文件使用 docker 的-v 进行绑定；
                session-server.conf ：

        
            http.d/upstream-app.conf
            
                #####整合java
                upstream backendjava  {
                  server   app1:8080 weight=10;
                  server   app2:8080 weight=10;
                  #session_sticky;
                  #使用nginx sticky实现基于cookie的负载均衡
                }
                
                ######整合springboot
                ######upstream springboot  {
                #######  server  springboot:8080 weight=10;
                #######  session_sticky;
                #######}
            
            
            server.d/app.conf
                location /myweb {
                
                    proxy_set_header    Host $host;
                    proxy_set_header    X-Real-IP $remote_addr;
                    proxy_set_header    X-Real-PORT $remote_port;
                    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
                
                    proxy_pass http://backendjava/myweb;
                }


启动镜像：
    docker run -it --rm -p 88:80  supermy/deb-waf

定制启动
docker run -it --rm -p 88:80 \
        -v waf/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf \
        -v waf/conf.d/:/etc/nginx/conf.d/ \
        supermy/deb-waf
        
docker  run --name waf -it --rm -p 88:80 \
       -v waf/waf.conf:/usr/local/openresty/nginx/conf/nginx.conf \
       supermy/deb-waf

##2019-08-09

正常访问    
        http://127.0.0.1/

能正常访问，如何作为一个通用规则
    http://127.0.0.1:88/index.html?a=/etc/passwd
    http://127.0.0.1:88/index.html?id=1 select * from admin
        
模仿攻击，被禁止访问    
    http://127.0.0.1:88/?a=/etc/passwd
    "http://127.0.0.1:88/?id=1 select * from admin"
    http://127.0.0.1:88/index?a=/etc/passwd
    "http://127.0.0.1:88/index?id=1 select * from admin"
      
    
docker run -it --rm -p 88:80 \
        -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf \
        -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/conf.d/:/etc/nginx/conf.d/ \
        supermy/deb-waf
        
docker  run --name waf -it --rm -p 88:80 \
       -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/waf.conf:/usr/local/openresty/nginx/conf/nginx.conf \
       supermy/deb-waf

alpine-waf 编译失败，gcc 版本问题

##2019-08-08 完成镜像包deb 版本以及测试，镜像包优化； docker build -t supermy/deb-waf waf

##2019-08-05

waf-alpine 不支持

nginx.conf  ---> 
            ---> http.d/lua-init.conf
            ---> server.conf
                        ---> location-waf.conf;
                        ---> /server.d/session-server.conf
                        
docker run -it --rm -p 88:80 \
        -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf \
        -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/conf.d/:/etc/nginx/conf.d/ \
        supermy/deb-waf
        
   
#waf 配置文件以及规则库
docker  run --name waf -it --rm -p 88:80 \
        -v /Users/moyong/project/env-myopensource/3-tools/docker/alpines/openresty/waf/waf.conf:/usr/local/openresty/nginx/conf/nginx.conf \
        supermy/deb-waf
        
docker run -it --rm  supermy/ap-waf  opm list
docker run -it --rm  supermy/ap-waf  opm info p0pr0ck5/lua-resty-waf

docker build -t supermy/deb-waf waf

docker build -t supermy/ap-ssl  openresty/ssl    --20170407 build  auto ssl;
docker build -t supermy/ap-waf  openresty/waf    --20170406 build  opm 安装 ；---20170421 add mongo 官方驱动
                                                 --waf-old 是回退的版本


升级
docker run -it --rm -p 88:80 supermy/ap-openresty-fat date -R

基于openresty/openresty:stretch-fat，解决 waf 的编译问题。
docker build -t supermy/deb-openresty-fat alpine-fat

docker build -t supermy/ap-openresty-fat alpine-fat    
docker build --build-arg TIME_ZONE=Asia/Shanghai -t supermy/ap-openresty-fat alpine-fat

docker run -v /my/custom/conf.d/nginx.conf:/etc/nginx/conf.d/nginx.conf supermy/ap-openresty
docker run -it --rm -p 88:80 supermy/ap-openresty date -R
docker build --build-arg TIME_ZONE=Asia/Shanghai -t supermy/ap-openresty .

数据同步

##2017-04-24 移除：naxsi-src 采用 waf https://www.zhihu.com/question/27852451/answer/51894189⁠

##2017-04-09

  • curl -v -b "code=test;key=2fb4f6d2ec30fc45da6d5e81cfdf5d1d" -XPOST "http://127.0.0.1/?key=a3⁠" -d '{
    "user": "kimchy", "post_date": "2009-11-15T14:12:12", "message": "You know, for Search" }'

##2017-04-08

  • waf 日志采集图表展示 nc -l -p 9001 nc localhost 9001

    udp 监听 nc -luv -p 9001 nc -vu 127.0.0.1 9001

    location / { access_by_lua_block { -- send event logs to the server's error_log location (default) waf:set_option("event_log_target", "error")

      waf:set_option("event_log_target", "file")
  waf:set_option("event_log_target_path", "/usr/local/openresty/nginx/logs/waf-event.log")


    -- send event logs to a remote server
    waf:set_option("event_log_target", "socket")
}

    }

  • 配置 openstry ssl and waf ,curl http://127.0.0.1/?/etc/passwd⁠ 禁止访问，测试 ok

    acccess_by_lua_block {
    waf:set_option("storage_redis_host", "10.10.10.10")
    waf:set_option("storage_redis_port", 6397)
}

11000_whitelist: Local policy whitelisting
20000_http_violation: HTTP protocol violation
21000_http_anomaly: HTTP protocol anomalies
35000_user_agent: Malicious/suspect user agents
40000_generic_attack: Generic attacks
41000_sqli: SQLi
42000_xss: XSS
90000_custom: Custom rules/virtual patching
99000_scoring: Anomaly score handling

##2016-09-14

##2016-09-10

##20160824

  • debian 是最好的系统。
  • 基于alpine 构建，用小的镜像包。
  • 支持naxsi。
  • 定制版本信息和产品信息；
  • 配置openresty 的纯净包，不包含项目代码信息。项目代码信息直接绑定，组织好目录结构，尽量少的目录绑定。
  • curl -x 172.16.71.57:8087

docker build --build-arg RESTY_J=4 docker run --rm -ti supermy/ap-openresty docker run -d supermy/ap-openresty docker exec b2e08ac2b938 bash -c "/usr/local/openresty/nginx/sbin/nginx -h" docker run -d -P80:80 supermy/ap-openresty docker run -d -p80:80 supermy/ap-waf

⁠docker-openresty - Docker tooling for OpenResty

⁠Since tag 1.9.15.1 there have been BREAKING CHANGES, notably with respect to the Docker ENTRYPOINT and logging. Please be aware of this if you are using the latest tags.

⁠Supported tags and respective Dockerfile links

⁠Table of Contents

⁠Description

docker-openresty is Docker⁠ tooling for OpenResty (https://www.openresty.org⁠).

Docker is a container management platform.

OpenResty is a full-fledged web application server by bundling the standard nginx core, lots of 3rd-party nginx modules, as well as most of their external dependencies.

This tooling is maintained Evan Wies.

From non-RPM flavors, the following modules are included by default, but one can easily increase or decrease that with custom build options⁠ :

  • file-aio
  • http_addition_module
  • http_auth_request_module
  • http_dav_module
  • http_flv_module
  • http_geoip_module=dynamic
  • http_gunzip_module
  • http_gzip_static_module
  • http_image_filter_module=dynamic
  • http_mp4_module
  • http_random_index_module
  • http_realip_module
  • http_secure_link_module
  • http_slice_module
  • http_ssl_module
  • http_stub_status_module
  • http_sub_module
  • http_v2_module
  • http_xslt_module=dynamic
  • ipv6
  • mail
  • mail_ssl_module
  • md5-asm
  • pcre-jit
  • sha1-asm
  • stream
  • stream_ssl_module
  • threads

⁠Usage

If you are happy with the build defaults, then you can use the openresty image from the Docker Hub⁠. The image tags available there are listed at the top of this README.

docker run [options] openresty/openresty:latest-trusty

[options] would be things like -p to map ports, -v to map volumes, and -d to daemonize.

docker-openresty symlinks /usr/local/openresty/nginx/logs/access.log and error.log to /dev/stdout and /dev/stderr respectively, so that Docker logging works correctly. If you change the log paths in your nginx.conf, you should symlink those paths as well.

⁠LuaRocks

LuaRocks⁠ is included in the centos, centos-rpm, trusty, and xenial variants. It is excluded from alpine because it generally requires a build system and we want to keep that variant lean.

It is available at /usr/local/openresty/luajit/bin/luarocks. Packages can be added in your dependent Dockerfiles like so:

RUN /usr/local/openresty/luajit/bin/luarocks install <rock>

⁠Docker ENTRYPOINT

The -g "daemon off;" directive is used in the Dockerfile ENTRYPOINT to keep the Nginx daemon running after container creation. If this directive is added to the nginx.conf, then it may be omitted from the ENTRYPOINT.

To invoke with another ENTRYPOINT, for example the resty utility, invoke like so:

docker run [options] --entrypoint /usr/local/openresty/bin/resty openresty/openresty:latest-xenial [script.lua]

NOTE The alpine images do not include the packages perl and ncurses, which is needed by the resty utility.

⁠Building (non-RPM based)

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

git clone https://github.com/openresty/docker-openresty.git
cd docker-openresty
docker build -t myopenresty -f trusty/Dockerfile .
docker run myopenresty

Dockerfiles are provided for the following base systems, selecting the Dockerfile path with -f:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_J=4 -f trusty/Dockerfile .
KeyDefaultDescription
RESTY_VERSION1.9.15.1The version of OpenResty to use.
RESTY_LUAROCKS_VERSION2.3.0The version of LuaRocks to use.
RESTY_OPENSSL_VERSION1.0.2eThe version of OpenSSL to use.
RESTY_PCRE_VERSION8.38The version of PCRE to use.
RESTY_J1Sets the parallelism level (-jN) for the builds.
RESTY_CONFIG_OPTIONS"--with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-ipv6 --with-mail --with-mail_ssl_module --with-md5-asm --with-pcre-jit --with-sha1-asm --with-stream --with-stream_ssl_module --with-threads"The options to pass to OpenResty's ./configure script.

Back to TOC⁠

⁠Building (RPM based)

OpenResty now now has RPMs available⁠. The centos-rpm images use these RPMs rather than the build system described above.

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_RPM_FLAVOR="-debug" -f centos-rpm/Dockerfile centos-rpm
KeyDefaultDescription
RESTY_LUAROCKS_VERSION2.3.0The version of LuaRocks to use.
RESTY_RPM_FLAVOR""The openresty package flavor to use. Possibly "-debug" or "-valgrind".

Back to TOC⁠

⁠Report Bugs

You're very welcome to report issues on GitHub:

https://github.com/openresty/docker-openresty/issues⁠

Back to TOC⁠

⁠Copyright & License

docker-openresty is licensed under the 2-clause BSD license.

Copyright (c) 2016, Evan Wies [email protected]⁠.

This module is licensed under the terms of the BSD license.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  • Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  • Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Back to TOC⁠

Tag summary

Content type

Image

Digest

Size

35.2 MB

Last updated

about 5 years ago

docker pull supermy/ap-openresty