[LAMP]——mod_security和mod_evasive模組的安裝

Jelly_lyj發表於2017-03-18
LAMP

系統版本：Red Hat 6

httpd版本：httpd-2.4.20

tar包：modsecurity-apache_2.5.9.tar.gz   mod_evasive_1.10.1.tar.gz

關於apxs：http://itlab.idcquan.com/linux/manual/ApacheManual/programs/apxs.html

 

mod_evasive模組的安裝

# tar xf mod_evasive_1.10.1.tar.gz
# cd mod_evasive
# ls
CHANGELOG      mod_evasive20.c   mod_evasive20.o    mod_evasiveNSAPI.c
LICENSE        mod_evasive20.la  mod_evasive20.slo  README
Makefile.tmpl  mod_evasive20.lo  mod_evasive.c      test.pl

# apxs -i -a -c mod_evasive20.c 
/usr/lib/apr-1/build/libtool --silent --mode=compile gcc -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -Wformat-security -fno-strict-aliasing  -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1   -c -o mod_evasive20.lo mod_evasive20.c && touch mod_evasive20.slo
mod_evasive20.c: 在函式‘create_hit_list’中:
mod_evasive20.c:118: 警告：在有返回值的函式中未發現 return 語句
mod_evasive20.c: 在函式‘access_checker’中:
mod_evasive20.c:212: 警告：隱式宣告函式‘getpid’
mod_evasive20.c:212: 警告：格式‘%ld’需要型別‘long int’，但實參 3 的型別為‘int’
mod_evasive20.c:229: 警告：忽略宣告有 warn_unused_result 屬性的‘system’的返回值
mod_evasive20.c: 在函式‘destroy_hit_list’中:
mod_evasive20.c:301: 警告：在有返回值的函式中未發現 return 語句
/usr/lib/apr-1/build/libtool --silent --mode=link gcc -o mod_evasive20.la  -rpath /usr/lib/httpd/modules -module -avoid-version    mod_evasive20.lo
/usr/lib/httpd/build/instdso.sh SH_LIBTOOL='/usr/lib/apr-1/build/libtool' mod_evasive20.la /usr/lib/httpd/modules
/usr/lib/apr-1/build/libtool --mode=install cp mod_evasive20.la /usr/lib/httpd/modules/
libtool: install: cp .libs/mod_evasive20.so /usr/lib/httpd/modules/mod_evasive20.so
libtool: install: cp .libs/mod_evasive20.lai /usr/lib/httpd/modules/mod_evasive20.la
libtool: install: cp .libs/mod_evasive20.a /usr/lib/httpd/modules/mod_evasive20.a
libtool: install: chmod 644 /usr/lib/httpd/modules/mod_evasive20.a
libtool: install: ranlib /usr/lib/httpd/modules/mod_evasive20.a
libtool: finish: PATH="/usr/lib/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/inotify/bin:/root/bin:/sbin" ldconfig -n /usr/lib/httpd/modules
----------------------------------------------------------------------
Libraries have been installed in:
   /usr/lib/httpd/modules   ------>#被安裝到了這裡

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
     during execution
   - add LIBDIR to the `LD_RUN_PATH' environment variable
     during linking
   - use the `-Wl,-rpath -Wl,LIBDIR' linker flag
   - have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /usr/lib/httpd/modules/mod_evasive20.so

之後，配置檔案中可以看到這樣一行(因為是apxs方法載入的模組所以會自動生成)

# vim /usr/local/httpd/conf/httpd.conf
  LoadModule evasive20_module   modules/mod_evasive20.so

 

補充

1. 如果遇到這樣的錯誤：

# /usr/local/httpd/bin/apxs -i -a -c mod_evasive20.c
/usr/local/apr/build-1/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic   -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -O2 -pg -pthread -I/usr/local/httpd/include  -I/usr/local/apr/include/apr-1   -I/usr/local/apr-util/include/apr-1  -I/usr/local/apr-iconv/include/apr-1 -I/usr/local/apr-iconv/include  -c -o mod_evasive20.lo mod_evasive20.c && touch mod_evasive20.slo
mod_evasive20.c: In function 'access_checker':
mod_evasive20.c:142: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:146: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:158: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:165: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:180: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:187: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:208: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:212: warning: implicit declaration of function 'getpid'
mod_evasive20.c:215: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:221: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:222: error: 'conn_rec' has no member named 'remote_ip'
mod_evasive20.c:228: error: 'conn_rec' has no member named 'remote_ip'
apxs:Error: Command failed with rc=65536

解決方法是把對應行的“remote”改成“client”

 

2.apxs選項說明：
      -c 執行編譯操作
      -i 安裝操作，安裝一個或多個動態共享物件到伺服器的modules目錄
      -a 自動增加一個LoadModule行到httpd.conf檔案，以啟用此模組，若此行存在則啟用之
      -A 與-a類似，但是它增加的LoadModule行前有井號字首(#)
      -e 需要執行編輯操作，可與-a和-A選項配合使用，與-i操作類似，修改httpd.conf檔案，但並不安裝此模組

 

mod_security模組的安裝

# tar xf modsecurity-apache_2.5.9.tar.gz
# ls
apache2  doc      modsecurity.conf-minimal         README.TXT  tools
CHANGES  LICENSE  MODSECURITY_LICENSING_EXCEPTION  rules
# cd apache2/

# apxs -i -a -c mod_security2.c 
/usr/lib/apr-1/build/libtool --silent --mode=compile gcc -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -Wformat-security -fno-strict-aliasing  -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -pthread -I/usr/include/httpd  -I/usr/include/apr-1   -I/usr/include/apr-1   -c -o mod_security2.lo mod_security2.c && touch mod_security2.slo
在包含自 modsecurity.h：38 的檔案中，
                 從 mod_security2.c：24:
msc_pcre.h:24:18: 錯誤：pcre.h：沒有那個檔案或目錄
在包含自 modsecurity.h：40 的檔案中，
                 從 mod_security2.c：24:
msc_xml.h:25:31: 錯誤：libxml/xmlschemas.h：沒有那個檔案或目錄
msc_xml.h:26:26: 錯誤：libxml/xpath.h：沒有那個檔案或目錄
In file included from modsecurity.h:40,
                 from mod_security2.c:24:

 ===>報錯

# yum install libxml*
# ./configure --with-apxs=/usr/local/httpd/bin/apxs --with-httpd-src=/usr/local/httpd/ --with-pcre=/usr/local/pcre/ --with-apr=/usr/local/apr/bin/apr-1-config  --with-libxml=/usr/     ------>通過編譯安裝的方法

# make ; make install
make: *** [mod_security2.la] 錯誤 1
/usr/local/apr/build-1/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic   -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -O2 -pg -pthread -I/usr/local/httpd/include  -I/usr/local/apr/include/apr-1   -I/usr/local/apr-util/include/apr-1  -I/usr/local/apr-iconv/include/apr-1 -I/usr/local/apr-iconv/include -O2 -g -Wall -I/usr/local/httpd/include -I/usr/local/httpd/include -I. -I/usr/local/apr/include/apr-1 -I/usr/local/apr-util/include/apr-1 -I/usr/local/apr-iconv/include/apr-1 -I/usr/local/apr-iconv/include -I/usr/local/pcre/include -I/usr/local/httpd//srclib/pcre -I/usr/local/pcre/include -I/usr/include/libxml2  -c -o mod_security2.lo mod_security2.c && touch mod_security2.slo
mod_security2.c: In function 'create_tx_context':
mod_security2.c:345: error: 'conn_rec' has no member named 'remote_ip'
mod_security2.c:346: error: 'conn_rec' has no member named 'remote_addr'    ------>#報錯的地方
mod_security2.c: In function 'register_hooks':
mod_security2.c:1118: warning: passing argument 1 of 'ap_hook_error_log' from incompatible pointer type
/usr/local/httpd/include/http_core.h:948: note: expected 'void (*)(const struct ap_errorlog_info *, const char *)' but argument is of type 'void (*)(const char *, int,  int,  apr_status_t,  const struct server_rec *, const struct request_rec *, struct apr_pool_t *, const char *)'
apxs:Error: Command failed with rc=65536

 ===>報錯

# vim mod_security2.c

把原來的“remote“改成了client：

         

===>後面還出現過一次類似這樣的錯誤，也是同樣的方法解決：

        

然後安裝成功：

Libraries have been installed in:
   /usr/local/httpd/modules    ------>#安裝到了這裡

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
     during execution
   - add LIBDIR to the `LD_RUN_PATH' environment variable
     during linking
   - use the `-Wl,-rpath -Wl,LIBDIR' linker flag
   - have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /usr/local/httpd/modules/mod_security2.so

===>在啟動服務的時候報錯：

# ./apachectl start
httpd: Syntax error on line 169 of /usr/local/httpd/conf/httpd.conf: Cannot load modules/mod_security2.so into server: /usr/local/httpd/modules/mod_security2.so: undefined symbol: unixd_set_global_mutex_perms

169行的內容是這樣的：LoadModule security2_module  modules/mod_security2.so
未解決......

相關文章