什么是naxsi

apt-get install openjdk-7-jdk
vim ~/.bashrc
export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64 替换成实际的java安装目录
source ~/.bashrc

wget -qO - https://packages.elasticsearch.org/GPG-KEY-elasticsearch | sudo apt-key add -
vim /etc/apt/sources.list
添加
deb http://packages.elasticsearch.org/elasticsearch/1.4/debian stable main
apt-get update
apt-get install elasticsearch
update-rc.d elasticsearch defaults 95 10 #加入到系统启动文件

二进制文件 /usr/share/elasticsearch/bin
库文件 /usr/share/elasticsearch/lib/
配置文件 /etc/elasticsearch/elasticsearch.yml
日志文件 /var/log/elasticsearch/
工作目录 /tmp/elasticsearch/

vim /etc/elasticsearch/elasticsearch.yml
修改端口
http.port: 8108

 /etc/init.d/elasticsearch start

/usr/share/elasticsearch/bin/plugin -i elasticsearch/marvel/latest
/etc/init.d/elasticsearch restart

curl -XPUT 'http://localhost:8108/nxapi?pretty'

vim nxapi.json
修改如下
"elastic" : {
 "host" : "127.0.0.1:8108",
 "index" : "nxapi",
 "doctype" : "events",
 "default_ttl" : "7200",
 "max_size" : "1000"
},
"naxsi" : {
 "rules_path" : "/home/work/naxsi_waf/conf/naxsi_core.rules", #naxsi waf的配置路径
 "template_path" : [ "tpl/"],
 "geoipdb_path" : "nx_datas/country2coords.txt"
},

pip install elasticsearch

python setup.py build
python setup.py install

 /usr/local/nxapi/ #模板tpl文件与geo data文件
 /usr/local/bin/nxtool.py #可执行文件

nxtool.py -h
Usage: nxtool.py [options]

Options:
  -h, --help            show this help message and exit

  Configuration options:
    -c CFG_PATH, --config=CFG_PATH nxapi配置文件
                        Path to nxapi.json (config).
    --colors            Disable output colorz.

  Input options (log acquisition):
    --files=FILES_IN    Path to log files to parse.
    --fifo=FIFO_IN      Path to a FIFO to be created & read from. [infinite]
    --stdin             Read from stdin.
    --no-timeout        Disable timeout on read operations (stdin/fifo).
    --syslog            Listen on tcp port for syslog logging.

  Filtering options (for whitelist generation):
    -s SERVER, --server=SERVER
                        FQDN to which we should restrict operations.
    --filter=FILTER     This option specify a filter for each type of filter,
                        filter are merge with existing templates/filters.
                        (--filter 'uri /foobar')关键选项，在生成白名单的时候使用能提高白名单准确度，支持‘server', 'uri', 'zone', 'var_name', 'ip', 'id', 'content', 'country', 'date',  '?server', '?uri', '?var_name', '?content' 关键字

  Tagging options (tag existing events in database):
    -w WL_FILE, --whitelist-path=WL_FILE
                        A path to whitelist file, will find matching events in
                        DB.
    -i IPS, --ip-path=IPS
                        A path to IP list file, will find matching events in
                        DB.
    --tag               Actually tag matching items in DB.

  Whitelist Generation:
    -f, --full-auto     Attempt fully automatic whitelist generation process.
    -t TEMPLATE, --template=TEMPLATE
                        Path to template to apply.
    --slack             Enables less strict mode.
    --type              Generate whitelists based on param type,参数类型包括
空，布尔类型（0，1），颜色（#[0-9a-f]）,十六进制[0-9a-f]，数字字符[0-9a-z],url,word,数组，文本，

  Statistics Generation:
    -x, --stats         Generate statistics about current's db content.

nxtool.py -c ./nxapi.json  -x --colors
# Whitelist(ing) ratio :
# false 79.96 % (total:196902/246244)
# true 20.04 % (total:49342/246244)
# Top servers :
# www.x1.fr 21.93 % (total:43181/196915)
# www.x2.fr 15.21 % (total:29945/196915)
...
# Top URI(s) :
# /foo/bar/test 8.55 % (total:16831/196915)
# /user/register 5.62 % (total:11060/196915)
# /index.php/ 4.26 % (total:8385/196915)
...
# Top Zone(s) :
# BODY 41.29 % (total:81309/196924)
# HEADERS 23.2 % (total:45677/196924)
# BODY|NAME 16.88 % (total:33243/196924)
# ARGS 12.47 % (total:24566/196924)
# URL 5.56 % (total:10947/196924)
# ARGS|NAME 0.4 % (total:787/196924)
# FILE_EXT 0.2 % (total:395/196924)
# Top Peer(s) :
# ...

nxtool.py -c nxapi.json -s www.x1.fr -f --filter 'uri /foo/bar/test' --slack
...
#msg: A generic whitelist, true for the whole uri
#Rule (1303) html close tag
#total hits 126
#content : lyiuqhfnp,+<a+href="http://preemptivelove.org/">Cialis+forum</a>,+KKSXJyE,+[url=http://preemptivelove.org/]Viagra+or+cialis[/url],+XGRgnjn,+http
#content : 4ThLQ6++<a+href="http://aoeymqcqbdby.com/">aoeymqcqbdby</a>,+[url=http://ndtofuvzhpgq.com/]ndtofuvzhpgq[/url],+[link..
#peers : x.y.z.w
...
#uri : /faq/
#var_name : numcommande
#var_name : comment
...
# success : global_rule_ip_ratio is 58.82
# warnings : rule_ip is 10
BasicRule  wl:1303 "mz:$URL:/foo/bar/test|BODY";