Question
What is the best web server firewall for nginx?
I'm having hard time with setting mod_security module for my web server nginx. I get a lot of issues and errors before compiling the files.
I followed a lot of tuts on the net, but mostly end up with either none working process or cut steps that I don't understand what to do next....
any idea??
Thanks
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Speaking about open-source solutions, you should definitely look at naxsi (NAXSI means Nginx Anti Xss & Sql Injection). This is short desc from official site:
Technically, it is a third party nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset of simple rules (naxsi_core.rules) containing 99% of known patterns involved in websites vulnerabilities. For example, ’<’, ’|’ or ‘drop’ are not supposed to be part of a URI.
In practice, you still need support it and keep rules up-to-date for your applications (but with help of built-in learning modules). If you’re a looking for more efficient and easy-to-use solution, give a chance to Wallarm. It is built on NGINX, learns from traffic to craft blocking rules, has awesome interface and even vulnerability scanner built-in — but, unfortunately, it is not free.