さくらインターネットVPSで、CentOS 7.9 に「OpenSSL-1.1.1l + Nginx 1.21 + SiteGuard 4.10」を構築した際の手順。
SiteGuard その１
ビルドに必要なパッケージのインストール
|
1 2 3 4 5 6 7 8 9 10 |
# yum install gcc pcre-devel zlib-devel # yum install apr-devel # yum install apr-util-devel # yum -y install perl # yum install unzip [y/n] y # yum install zip [y/n] y |
Java runtime インストール
SELinuxを使用している場合は、一時的に無効化しておく。
|
1 2 3 4 |
# setenforce 0 # getenforce |
インストール
|
1 2 3 |
# yum install java-1.8.0-openjdk |
確認
|
1 2 3 |
# java -version |
SELinuxを有効化。
|
1 2 3 4 |
# setenforce 1 # getenforce |
SiteGuard インストール
ワークフォルダ作成
|
1 2 3 4 5 |
$ su - # mkdir src # cd src |
ソースダウンロード
|
1 2 3 |
$ curl -LO http://progeny.sakura.ad.jp/siteguard/4.1.0/nginx/siteguard-server-edition-4.10-4.nginx.x86_64.tar.gz |
解凍
|
1 2 3 |
# tar -zxvf siteguard-server-edition-4.10-4.nginx.x86_64.tar.gz |
SiteGuard本体インストール
|
1 2 3 4 |
# cd /root/src/siteguard-server-edition-4.10-4.nginx.x86_64 # make install |
Nginx その１
ビルド/インストール
Nginx、OpenSSL、ソースダウンロード
|
1 2 3 4 5 |
# cd /root/src # curl -LO https://www.openssl.org/source/openssl-1.1.1l.tar.gz # curl -LO https://nginx.org/download/nginx-1.21.3.tar.gz |
tarファイルを解凍
|
1 2 3 4 |
# tar xzvf openssl-1.1.1l.tar.gz # tar xzvf nginx-1.21.3.tar.gz |
ソースコード修正。 ※httpレスポンスからNginxを使っていることを判別させないことでセキュリティを上げる。
|
1 2 3 |
# vi /root/src/nginx-1.21.3/src/http/ngx_http_header_filter_module.c |
|
1 2 3 4 5 6 7 8 9 |
static u_char ngx_http_server_string[] = "Server: nginx" CRLF; static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF; static u_char ngx_http_server_build_string[] = "Server: " NGINX_VER_BUILD CRLF; ↓ static u_char ngx_http_server_string[] = "" CRLF; static u_char ngx_http_server_full_string[] = "" CRLF; static u_char ngx_http_server_build_string[] = "" CRLF; |
configure コマンド実行
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
# cd /root/src/nginx-1.21.3 # ./configure \ --prefix=/usr/local/nginx \ --sbin-path=/usr/local/sbin/nginx \ --modules-path=/etc/nginx/modules \ --conf-path=/etc/nginx/nginx.conf \ --error-log-path=/var/log/nginx/error.log \ --http-log-path=/var/log/nginx/access.log \ --pid-path=/var/run/nginx.pid \ --lock-path=/var/run/nginx.lock \ --http-client-body-temp-path=/var/cache/nginx/client_temp \ --http-proxy-temp-path=/var/cache/nginx/proxy_temp \ --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \ --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \ --http-scgi-temp-path=/var/cache/nginx/scgi_temp \ --user=nginxuser \ --group=nginxuser \ --with-compat \ --with-file-aio \ --with-threads \ --with-http_addition_module \ --with-http_auth_request_module \ --with-http_dav_module \ --with-http_flv_module \ --with-http_gunzip_module \ --with-http_gzip_static_module \ --with-http_mp4_module \ --with-http_random_index_module \ --with-http_realip_module \ --with-http_secure_link_module \ --with-http_slice_module \ --with-http_ssl_module \ --with-http_stub_status_module \ --with-http_sub_module \ --with-http_v2_module \ --with-mail \ --with-mail_ssl_module \ --with-stream \ --with-stream_realip_module \ --with-stream_ssl_module \ --with-stream_ssl_preread_module \ --with-openssl=/root/src/openssl-1.1.1l \ --with-openssl-opt=enable-tls1_3 \ --add-module=/opt/jp-secure/siteguardlite/nginx |
Nginxインストール
|
1 2 3 4 |
# make # make install |
組み込みモジュールの確認
|
1 2 3 |
# nginx -V |
nginx.conf 設定
編集。
|
1 2 3 |
# vi /etc/nginx/nginx.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 |
user nginxuser; worker_processes auto; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; multi_accept on; use epoll; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log off; sendfile on; keepalive_timeout 65; gzip on; gzip_http_version 1.0; gzip_disable "msie6"; gzip_proxied any; gzip_min_length 1024; gzip_comp_level 6; gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript; server_tokens off; server_names_hash_bucket_size 128; tcp_nopush on; tcp_nodelay on; client_header_timeout 10; client_body_timeout 10; reset_timedout_connection on; send_timeout 10; limit_conn_zone $binary_remote_addr zone=addr:5m; limit_conn addr 100; open_file_cache max=100000 inactive=20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; server { listen 80; server_name localhost; location / { root html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } } |
構文に問題が無いか確認。
|
1 2 3 |
# nginx -t |
再読込み
|
1 2 3 |
# systemctl restart nginx |
サービス登録
サービス ファイルを作成
|
1 2 3 |
# vi /etc/systemd/system/nginx.service |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
[Unit] Description=nginx - high performance web server Documentation=https://nginx.org/en/docs/ After=network-online.target remote-fs.target nss-lookup.target Wants=network-online.target [Service] Type=forking PIDFile=/var/run/nginx.pid ExecStartPre=/usr/local/sbin/nginx -t -c /etc/nginx/nginx.conf ExecStart=/usr/local/sbin/nginx -c /etc/nginx/nginx.conf ExecReload=/bin/kill -s HUP $MAINPID ExecStop=/bin/kill -s TERM $MAINPID [Install] WantedBy=multi-user.target |
サービスを有効化
|
1 2 3 |
# systemctl enable nginx.service |
サービスを起動
|
1 2 3 |
# systemctl start nginx.service |
5 サービスの状態確認
|
1 2 3 |
# systemctl status nginx.service |
内部接続確認
|
1 2 3 |
# curl http://localhost |
外部接続確認
|
1 2 3 |
http://（サーバのIPアドレス）/ |
SiteGuard その２
SiteGuardをNginxでホストする。
|
1 2 3 4 |
# cd /opt/jp-secure/siteguardlite/ # ./setup.sh |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
# please enter Nginx Config File. [] --> /etc/nginx/nginx.conf[Enter] # Nginx Config File=[/usr/local/nginx/conf/nginx.conf] is correct? [yes]|no --> [Enter] # please enter Nginx Binary File (nginx). [/usr/local/sbin/nginx] --> [Enter] # Nginx Binary File (nginx)=[/usr/local/nginx/sbin/nginx] is correct? [yes]|no --> [Enter] # Is the Web server registered in systemd? please select. [yes]|no --> [Enter] # please enter Nginx service name. [nginx] --> [Enter] # Nginx service name=[nginx] is correct? [yes]|no --> [Enter] # do you want to use the web administrative console? * to use the console, you will need JDK or JRE is installed. please select. [yes]|no --> [Enter] # please enter JDK or JRE directory. [/usr/lib/jvm/jre-1.8.0] --> [Enter] # JDK or JRE directory=[/usr/lib/jvm/jre-1.8.0] is correct? [yes]|no --> [Enter] # please enter the port number of the web console for https. please enter port number. [9443] --> [Enter] # port number=[9443] is correct? [yes]|no --> [Enter] # please enter the addresses allowed to access the web console for https. ex:192.168.1.100 10.0.0.0/24 please enter allowed addresses. [ALL] -->[Enter] # allowed addresses=[ALL] is correct? [yes]|no --> [Enter] # do you change the ssl certificate files? please select. yes|[no] --> [Enter] # Nginx restart. Are you sure? [yes]|no -->[Enter] |
SiteGuardの設定変更
SiteGuardのNginx設定にホスト名を登録
|
1 2 3 |
# vi /opt/jp-secure/siteguardlite/conf/nginx.conf.siteguardlite_admin_ssl |
|
1 2 3 |
server_name （ホスト名） localhost; |
シグネチャ更新URL 変更
|
1 2 3 |
# vi /opt/jp-secure/siteguardlite/conf/dbupdate_waf_url.conf |
|
1 2 3 |
LATEST_URL=（さくらインターネットのマニュアル参照） |
再読込み
|
1 2 3 |
# systemctl restart nginx |
確認
|
1 2 3 |
# systemctl status nginx |
サクラのパケットフィルタを無効にする。
※SiteGuardの管理コンソールはTomcat上で動いてる。ASP.NET Coreと同様、Nginxをリバースプロキシとして利用してる。
※SiteGuardがNginxで受け付ける9443ポートが、サクラのパケットフィルタで弾かれてしまう。
※SiteGuardの制約上、SELinuxを使用していると9443ポート以外に変更できない。
Nginx その２
nginx.conf 設定
*.conf のコメントアウトを開放。
|
1 2 3 |
# vi /etc/nginx/nginx.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 |
user nginxuser; worker_processes auto; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; multi_accept on; use epoll; } http { include /opt/jp-secure/siteguardlite/conf/siteguardlite.conf; include /opt/jp-secure/siteguardlite/conf/nginx.conf.siteguardlite_admin_ssl; include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log off; sendfile on; include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*.conf; keepalive_timeout 65; gzip on; gzip_http_version 1.0; gzip_disable "msie6"; gzip_proxied any; gzip_min_length 1024; gzip_comp_level 6; gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript; server_tokens off; server_names_hash_bucket_size 128; tcp_nopush on; tcp_nodelay on; client_header_timeout 10; client_body_timeout 10; reset_timedout_connection on; send_timeout 10; limit_conn_zone $binary_remote_addr zone=addr:5m; limit_conn addr 100; open_file_cache max=100000 inactive=20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; } |
バーチャルホストconf設定
バーチャルホスト用の設定ファイル作成。 一旦、httpで構成する。
|
1 2 3 |
# vi /etc/nginx/sites-available/default.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
server { listen 80; server_name localhost; location / { root html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } |
バーチャルホストの有効化（シンボリックリンク作成）
|
1 2 3 |
# ln -s /etc/nginx/sites-available/default.conf /etc/nginx/sites-enabled/default.conf |
確認
|
1 2 3 4 |
# ll /etc/nginx/sites-enabled/ # more /etc/nginx/sites-enabled/default.conf |
構文に問題が無いか確認。
|
1 2 3 |
# nginx -t |
再読込み
|
1 2 3 |
# systemctl restart nginx |
動作確認が終わったらシンボリックリンクを削除しておく。
|
1 2 3 |
# rm /etc/nginx/sites-enabled/default.conf |
SiteGuard Webコンソール設定
|
1 2 3 |
https://（ホスト名）:9443 |
コメント