Naxsi - An Open-Source, High Performance, Depression Rules Maintenance Waf For Nginx
Technically, it is a 3rd political party nginx module, available every bit a parcel for many UNIX-like platforms. This module, past times default, reads a pocket-sized subset of simple (and readable) rules containing 99% of known patterns involved inwards website vulnerabilities. For example,
<, | or drop are non supposed to last operate of a URI. Being rattling simple, those patterns may gibe legitimate queries, it is the Naxsi's administrator duty to add together specific rules that volition whitelist legitimate behaviours. The administrator tin either add together whitelists manually past times analyzing nginx's fault log, or (recommended) get-go the projection alongside an intensive auto-learning stage that volition automatically generate whitelisting rules regarding a website's behaviour.
In short, Naxsi behaves similar a DROP-by-default firewall, the solely chore is to add together required ACCEPT rules for the target website to piece of employment properly.
Why is it different?
Contrary to close Web Application Firewalls, Naxsi doesn't rely on a signature base of operations similar an antivirus, together with so cannot last circumvented past times an "unknown" assault pattern. Naxsi is Free software (as inwards freedom) together with gratuitous (as inwards gratuitous beer) to use.
What does it run on?
Naxsi should last compatible alongside whatever nginx version.
It depends on
libpcre for its regexp support, together with is reported to piece of employment cracking on NetBSD, FreeBSD, OpenBSD, Debian, Ubuntu together with CentOS. Getting started
- The documentation
- Some rules for mainstream software
- The nxapi/nxtool to generate rules
