-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDockerfile_compile_debian
123 lines (105 loc) · 4.19 KB
/
Dockerfile_compile_debian
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
FROM vdveldet/base-os
ARG VERSION
ARG NGINX_VERSION
ARG MODSECURITY
ARG MODSECURITY_RELEASE
ENV VERSION $VERSION
ENV NGINX_VERSION $NGINX_VERSION
ENV MODSECURITY $MODSECURITY
ENV MODSECURITY_RELEASE $MODSECURITY_RELEASE
MAINTAINER [email protected]
LABEL Description="nginx ${NGINX_VERSION} server + mod_security ${MODSECURITY}" \
version="${VERSION}"
# Add Repo
RUN DEBIAN_FRONTEND=noninteractive apt-get -y install software-properties-common && \
DEBIAN_FRONTEND=noninteractive LC_ALL=C.UTF-8 add-apt-repository ppa:ondrej/nginx-mainline
# Download nginx Compiled version
RUN apt-get install -y nginx
RUN apt-get install -y \
apt-utils \
autoconf \
automake \
build-essential \
git \
libcurl4-openssl-dev \
libgeoip-dev \
liblmdb-dev \
libpcre++-dev \
libtool \
libxml2-dev \
libyajl-dev \
pkgconf \
wget \
zlib1g-dev \
libyajl2 \
openssl \
libssl-dev \
libperl-dev \
libxslt-dev \
checkinstall \
rsync \
libgd-dev
RUN git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
RUN cd ModSecurity && \
git submodule init && \
git submodule update && \
./build.sh && \
./configure && \
make && \
make install && \
cd ..
RUN cd ModSecurity && \
export MODSECURITY && \
checkinstall --pkgname="modsecurity" --pkgversion="${MODSECURITY}" --pkgrelease="${MODSECURITY_RELEASE}" --maintainer="[email protected]" --nodoc --install=yes -y && \
cd ..
# Create Packaging struncture
RUN mkdir -p /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/DEBIAN/
COPY packager/control /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/DEBIAN/
# Compile Connector
RUN git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
# Download the nginx source code
RUN NGINX_VERSION=$(nginx -v 2>&1| awk -F "/" {'print $2'} | awk {'print $1'}) && \
wget http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz && tar zxvf nginx-${NGINX_VERSION}.tar.gz && \
cd nginx-${NGINX_VERSION} && \
COMPILE_OPT=$(nginx -V 2>&1 | grep "configure arguments" | \
awk -F: {'print $2'} | \
sed 's/--add-dynamic-module=.*//g') && \
echo "./configure --add-dynamic-module=../ModSecurity-nginx ${COMPILE_OPT}" > comp.ksh && \
cat comp.ksh && \
bash comp.ksh && \
make modules && \
mkdir -p /usr/share/nginx/modules && \
cp objs/ngx_http_modsecurity_module.so /usr/share/nginx/modules/ && \
mkdir -p /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/usr/share/nginx/modules/ && \
cp objs/ngx_http_modsecurity_module.so /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/usr/share/nginx/modules/ && \
cd ..
# forward request and error logs to docker log collector
RUN ln -sf /dev/stdout /var/log/nginx/access.log && \
ln -sf /dev/stderr /var/log/nginx/error.log && \
ln -sf /dev/stdout /var/log/modsec_audit.log
# Configure mod ModSecurity
RUN mkdir -p /etc/nginx/modsec/
RUN cd /etc/nginx/modsec && \
curl -O https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended && \
mv modsecurity.conf-recommended modsecurity.conf && \
sed -i -e 's/worker_processes auto;/worker_processes 1;/g' /etc/nginx/nginx.conf && \
sed -i -e 's/SecRuleEngine DetectionOnly/SecRuleEngine On/g' /etc/nginx/modsec/modsecurity.conf && \
sed -i -e 's/SecAuditEngine RelevantOnly/SecAuditEngine off/g' /etc/nginx/modsec/modsecurity.conf && \
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git owasp && \
cd owasp && \
mv crs-setup.conf.example crs-setup.conf
# PATCH Mod security installation
RUN cd /etc/nginx/modsec/ && \
curl -O https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping
COPY nginx/nginx/10-mod-modsecurity.conf /etc/nginx/modules-enabled/
COPY nginx/modsec/main.conf /etc/nginx/modsec/
COPY nginx/nginx/default.conf /etc/nginx/conf.d/
COPY nginx/nginx/nginx.conf /etc/nginx/nginx.conf
# Create the nginx-module-modsecurity_1.0 package
RUN cd /tmp/ && \
mkdir -p /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/etc/nginx/ && \
rsync -Rratv /etc/nginx/* /tmp/nginx-module-modsecurity3_${NGINX_VERSION}/etc/nginx/ && \
dpkg-deb --build nginx-module-modsecurity3_${NGINX_VERSION} && \
ls -l
RUN echo "daemon off;" >> /etc/nginx/nginx.conf
CMD /usr/sbin/nginx