diff --git a/README.md b/README.md index c905edc..24265c9 100644 --- a/README.md +++ b/README.md @@ -1,35 +1,27 @@ # Nginx L7 DDoS Protection! :boom: :zap: This project is a bit out of date, setup L7 > https://github.com/theraw/The-World-Is-Yours/issues/10#issuecomment-442579528 -# To-Do -- [x] Nginx Version, Always Latest. -- [x] Support Ubuntu Trusty. (14.04) -- [x] Support Ubuntu Xenial. (16.04) -- [x] Support Ubuntu Cosmic. (18.10) -- [x] Support Arch Linux. -- [x] ModSecurity Support. -- [x] Naxsi Support. -- [x] L7 Protection. -- [x] AutoBan System. -- [x] Integrate Fail2Ban > IpTables. +- [x] Support Ubuntu 20.04. -# Installation +-- Compiled As Dynamic Modules. + - [x] ModSecurity Support. + - [x] Naxsi Support. + - [x] Cookie based Authentication. + +# INSTALLATION 1. **`apt-get install build-essential libssl-dev curl nano wget zip unzip sudo git psmisc -y`** 2. **`curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/install > install; bash install`** -# Informations. - -**What if installation script fails?** - Check what was the problem source fix it (mostly should be for missing packages) then remove everything under /opt/ folder and just execute again ./install +# FOLDER PATH. ``` -=> /nginx/ = Nginx Path, -=> /nginx/live/ = Vhosts Config Files Dir, -=> /nginx/logs/ = Core Logs Files, -=> /nginx/modsecurity/ = ModSecurity Rules Dir, -=> /hostdata/ = Place to store your domain folders. +=> /nginx/ = Nginx Path, (private) +=> /nginx/live/ = Vhosts Configs (private) +=> /nginx/modsecurity/ = ModSecurity Rules Dir (private) +=> /hostdata/ = Place to store your domain folders. (private) => /hostdata/yourdomain.com/ = Ex of domain dir (private folder), => /hostdata/yourdomain.com/public_html/ = Ex of your domain webroot (public files only), => /hostdata/yourdomain.com/logs/ = Place where to store your Domains logs (access.log) (private folder), @@ -41,72 +33,9 @@ This project is a bit out of date, setup L7 > https://github.com/theraw/The-Worl ``` -# Check. - -1 . [L7 (Cookie Based Protection)](https://github.com/theraw/The-World-Is-Yours/blob/master/static/nginx.conf#L15-L42) AND [Replace "proxy2.dope.. links with yours click here to find aes](https://github.com/theraw/The-World-Is-Yours/tree/master/static/vhost) which should be stored on a external link or in a place where L7 is disabled because it will not work if you put it in main site dir!. - -2 . [Auto Ban System](https://github.com/theraw/The-World-Is-Yours/blob/master/iptables/jail.local#L105-L111) based on [Connection for ip](https://github.com/theraw/The-World-Is-Yours/blob/master/static/nginx.conf#L72-L73) - -3 . [Auto Ban 444 Reqs](https://github.com/theraw/The-World-Is-Yours/blob/master/iptables/jail.local#L113-L118) A day i've been under attack of multiple proxies, and even after they got banned they still was keep trying the same thing so when you ban someone when that ip tries to access your website that request will not go on `error.log` but in `access.log` so i created this rule to ban with iptables every request who have stauts `444` so nginx will not have to handle those. - -4 . [Kernel Settings](https://github.com/theraw/The-World-Is-Yours/blob/master/static/sysctl.conf#L1-L34) - -5 . [Naxsi Rules Included](https://github.com/theraw/The-World-Is-Yours/blob/master/static/nginx.conf#L118) - -6 . [Example of Naxsi](https://github.com/theraw/The-World-Is-Yours/blob/master/static/vhost/default#L22-L29) - -7 . [Check Iptables rules](https://github.com/theraw/The-World-Is-Yours/blob/master/iptables/rules) It will not be automatically enabled, because this changes based on providers in ovh it work in azure it doesn't work. so you need to manually activate iptables! - -8 . ModSecurity is not loaded. However you need to set it up by yourself. you have a folder `/nginx/modsecurity/` -which ModSecurity rules are stored, open `/nginx/modsecurity/modsecurity.conf` add those - -```bash -Include crs-setup.conf -Include rules/*.conf -``` -ModSecurity is by default enabled as "detect only" you can turn it on always by doing this - -```bash -SecRuleEngine On -``` - -Using modSecurity for your site -```bash -server { - ..... - modsecurity on; - modsecurity_rules_file /nginx/modsecurity/modsecurity.conf; - location / { - ..... - } -} -``` -**Careful** Using modsec rules like -``` - location / { - modsecurity_rules_file /nginx/modsecurity/modsecurity.conf; - } -``` -it means that's enabled just for your main place `/` not for other dirs in your site ex `/admin/` (: - - -Test it! -`curl 'http://localhost/?q=">'` -```html - -