-
Notifications
You must be signed in to change notification settings - Fork 605
olds installation
You can install nginx+naxsi either from packages (available from official repositories on debian, freebsd, netbsd) or directly from source. As Nginx does not yet support runtime module loading, lot of people will choose compiling from source to avoid package maintainers delay.
Packages are available for NetBSD, FreeBSD and Debian, from distribution's repositories. Naxsi project does not create/publish such packages.
Naxsi should be working with all Nginx versions superior to 0.8.X. To install it from source, we need to fetch both nginx and naxsi sources.
Import Nginx signing keys and naxsi's one.
note : Signed releases of naxsi started at 0.54rc3.
gpg --keyserver pgp.mit.edu --recv-keys 0x251A28DE2685AED4 7BD9BF62 A1C052F8
Note: replace TAG_NAME
with the tagged release you want.
wget http://nginx.org/download/nginx-x.x.xx.tar.gz
wget http://nginx.org/download/nginx-x.x.xx.tar.gz.asc
wget https://github.com/nbs-system/naxsi/archive/TAG_NAME.tar.gz
wget https://github.com/nbs-system/naxsi/releases/download/TAG_NAME/TAG_NAME.tar.gz.asc
gpg --verify nginx-*.tar.gz.asc nginx-*.tar.gz
gpg --verify TAG_NAME.tar.gz.asc TAG_NAME.tar.gz
Both source verifications should present you a message that says:
> gpg: Good signature from ...
If both sources verify, then it is safe to unpack and proceed to compilation.
tar -xvzf nginx-*.tar.gz
tar -xvzf TAG_NAME.tar.gz
Install libpcre
(and libssl
if you want https, along with zlib
for gzip support) with your favorite package manager, naxsi relies on it for regex.
cd nginx-*
./configure --add-module=../naxsi-x.xx/naxsi_src/ [add/remove your favorite/usual options]
make
make install
My personal "building" options being here :
./configure --conf-path=/etc/nginx/nginx.conf --add-module=../naxsi-x.xx/naxsi_src/ \
--error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/body \
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-log-path=/var/log/nginx/access.log \
--http-proxy-temp-path=/var/lib/nginx/proxy --lock-path=/var/lock/nginx.lock \
--pid-path=/var/run/nginx.pid --with-http_ssl_module \
--without-mail_pop3_module --without-mail_smtp_module \
--without-mail_imap_module --without-http_uwsgi_module \
--without-http_scgi_module --with-ipv6 --prefix=/usr
You need to remember this :
NGINX will decide the order of modules according the order of the module's directive in nginx's ./configure
. So, no matter what (except you really know what you are doing) put naxsi first in your ./configure
.
If you don't do so, you might run into various problems, from random / unpredictable behaviours to non-effective WAF.