this guide<\/a>, update your server’s Kernel and Packages to the latest available version.<\/p>\nSection 3. Step 2: Install dependencies<\/h3>\n
Before you can compile Nginx and ModSecurity successfully, you need to install several software packages as follows.<\/p>\n
a) On CentOS 7:<\/p>\n
yum groupinstall -y \"Development Tools\"\r\nyum install -y httpd httpd-devel pcre pcre-devel libxml2 libxml2-devel curl curl-devel openssl openssl-devel\r\nshutdown -r now\r\n<\/code><\/pre>\nb) On Debian 8 or Ubuntu 16.04:<\/p>\n
apt-get install -y git build-essential libpcre3 libpcre3-dev libssl-dev libtool autoconf apache2-dev libxml2-dev libcurl4-openssl-dev automake pkgconf\r\n<\/code><\/pre>\nSection 4. Step 3: Compile ModSecurity<\/h3>\n
Due to several instabilities reported on ModSecurity for Nginx master branch, for now, it is officially recommended to use the latest version of the\u00a0nginx_refactoring<\/code>\u00a0branch whenever possible.<\/p>\nDownload the\u00a0nginx_refactoring<\/code>\u00a0branch of ModSecurity for Nginx:<\/p>\ncd \/usr\/src\r\ngit clone -b nginx_refactoring https:\/\/github.com\/SpiderLabs\/ModSecurity.git\r\n<\/code><\/pre>\nCompile ModSecurity:<\/p>\n
a) On CentOS 7:<\/p>\n
cd ModSecurity\r\nsed -i '\/AC_PROG_CC\/a\\AM_PROG_CC_C_O' configure.ac\r\nsed -i '1 i\\AUTOMAKE_OPTIONS = subdir-objects' Makefile.am\r\n.\/autogen.sh\r\n.\/configure CFLAGS=\"-fPIC\" --enable-standalone-module --disable-mlogc\r\nmake\r\n<\/code><\/pre>\nNote: the two\u00a0sed<\/code>\u00a0commands above are used to prevent warning messages when using newer automake versions.<\/em><\/p>\nb) On Debian 8 or Ubuntu 16.04:<\/p>\n
cd ModSecurity\r\n.\/autogen.sh\r\n.\/configure --enable-standalone-module --disable-mlogc\r\nmake\r\n<\/code><\/pre>\n## Step 4: Compile Nginx<\/p>\n
Download and unarchive the latest stable release of Nginx which is\u00a0Nginx 1.10.3<\/code>\u00a0at the time of writing:<\/p>\ncd \/usr\/src\r\nwget https:\/\/nginx.org\/download\/nginx-1.10.3.tar.gz\r\ntar -zxvf nginx-1.10.3.tar.gz && rm -f nginx-1.10.3.tar.gz\r\n<\/code><\/pre>\na) On CentOS 7:<\/p>\n
First, you need to create a dedicated user\u00a0nginx<\/code>\u00a0and a dedicated group\u00a0nginx<\/code>\u00a0for Nginx:<\/p>\ngroupadd -r nginx\r\nuseradd -r -g nginx -s \/sbin\/nologin -M nginx\r\n<\/code><\/pre>\nThen compile Nginx while enabling ModSecurity and SSL modules:<\/p>\n
cd nginx-1.10.3\/\r\n.\/configure --user=nginx --group=nginx --add-module=\/usr\/src\/ModSecurity\/nginx\/modsecurity --with-http_ssl_module\r\nmake\r\nmake install\r\n<\/code><\/pre>\nModify the default user of Nginx:<\/p>\n
sed -i \"s\/#user nobody;\/user nginx nginx;\/\" \/usr\/local\/nginx\/conf\/nginx.conf\r\n<\/code><\/pre>\nb) On Debian 8 or Ubuntu 16.04:<\/p>\n
First, you should use the existing user\u00a0www-data<\/code>\u00a0and the existing group\u00a0www-data<\/code>.<\/p>\nThen compile Nginx while enabling ModSecurity and SSL modules:<\/p>\n
cd nginx-1.10.3\/\r\n.\/configure --user=www-data --group=www-data --add-module=\/usr\/src\/ModSecurity\/nginx\/modsecurity --with-http_ssl_module\r\nmake\r\nmake install\r\n<\/code><\/pre>\nModify the default user of Nginx:<\/p>\n
sed -i \"s\/#user nobody;\/user www-data www-data;\/\" \/usr\/local\/nginx\/conf\/nginx.conf\r\n<\/code><\/pre>\nHaving Nginx successfully installed, related files will be located at:<\/p>\n
nginx path prefix: \"\/usr\/local\/nginx\"\r\nnginx binary file: \"\/usr\/local\/nginx\/sbin\/nginx\"\r\nnginx modules path: \"\/usr\/local\/nginx\/modules\"\r\nnginx configuration prefix: \"\/usr\/local\/nginx\/conf\"\r\nnginx configuration file: \"\/usr\/local\/nginx\/conf\/nginx.conf\"\r\nnginx pid file: \"\/usr\/local\/nginx\/logs\/nginx.pid\"\r\nnginx error log file: \"\/usr\/local\/nginx\/logs\/error.log\"\r\nnginx http access log file: \"\/usr\/local\/nginx\/logs\/access.log\"\r\nnginx http client request body temporary files: \"client_body_temp\"\r\nnginx http proxy temporary files: \"proxy_temp\"\r\nnginx http fastcgi temporary files: \"fastcgi_temp\"\r\nnginx http uwsgi temporary files: \"uwsgi_temp\"\r\nnginx http scgi temporary files: \"scgi_temp\"\r\n<\/code><\/pre>\nyou can test the installation with:<\/p>\n
\/usr\/local\/nginx\/sbin\/nginx -t\r\n<\/code><\/pre>\nIf nothing goes wrong, the output should be:<\/p>\n
nginx: the configuration file \/usr\/local\/nginx\/conf\/nginx.conf syntax is ok\r\nnginx: configuration file \/usr\/local\/nginx\/conf\/nginx.conf test is successful\r\n<\/code><\/pre>\nFor your convenience, you can setup a systemd unit file for Nginx:<\/p>\n
cat <<EOF>> \/lib\/systemd\/system\/nginx.service\r\n[Service]\r\nType=forking\r\nExecStartPre=\/usr\/local\/nginx\/sbin\/nginx -t -c \/usr\/local\/nginx\/conf\/nginx.conf\r\nExecStart=\/usr\/local\/nginx\/sbin\/nginx -c \/usr\/local\/nginx\/conf\/nginx.conf\r\nExecReload=\/usr\/local\/nginx\/sbin\/nginx -s reload\r\nKillStop=\/usr\/local\/nginx\/sbin\/nginx -s stop\r\n\r\nKillMode=process\r\nRestart=on-failure\r\nRestartSec=42s\r\n\r\nPrivateTmp=true\r\nLimitNOFILE=200000\r\n\r\n[Install]\r\nWantedBy=multi-user.target\r\nEOF\r\n<\/code><\/pre>\nMoving forward, you can start\/stop\/restart Nginx as follows:<\/p>\n
systemctl start nginx.service\r\nsystemctl stop nginx.service\r\nsystemctl restart nginx.service\r\n<\/code><\/pre>\n