Anipaleja/nginx-defender
GitHub: Anipaleja/nginx-defender
一个基于 Go 语言的轻量级实时日志监控与自动封禁工具，通过分析 Nginx 日志检测恶意行为并联动系统防火墙进行拦截。
Stars: 76 | Forks: 6
[](https://github.com/anipaleja/nginx-defender/actions)
[](https://github.com/anipaleja/nginx-defender/pkgs/container/nginx-defender)
[](https://goreportcard.com/report/github.com/anipaleja/nginx-defender)
[](LICENSE)
[](https://golang.org/)
[](https://github.com/anipaleja/nginx-defender)
**具备高级威胁情报的企业级 Web 应用防火墙**
## 目录
点击展开
- [概述](#overview) - [架构](#architecture) - [核心特性](#core-features) - [威胁检测引擎](#threat-detection-engine) - [防火墙管理](#firewall-management) - [监控与分析](#monitoring--analytics) - [通知系统](#notification-system) - [技术规格](#technical-specifications) - [安装](#installation) - [二进制文件安装](#binary-installation) - [Docker 部署](#docker-deployment) - [Kubernetes 部署](#kubernetes-deployment) - [配置](#configuration) - [API 参考](#api-reference) - [性能基准测试](#performance-benchmarks) - [安全注意事项](#security-considerations) - [开发](#development) - [许可证](#license)高层架构图
``` ┌────────────────────────────────────────────────────────────────┐ │ nginx-defender │ ├────────────────────────────────────────────────────────────────┤ │ ┌───────────────┐ ┌──────────────┐ ┌─────────────────────┐ │ │ │ Log Monitor │ │ Threat Intel │ │ Web Dashboard │ │ │ │ (Async) │ │ (Real-time) │ │ (WebSocket) │ │ │ └───────┬───────┘ └──────┬───────┘ └─────────┬───────────┘ │ │ │ │ │ │ │ ┌───────▼─────────────────▼────────────────────▼───────────┐ │ │ │ Threat Detection Engine │ │ │ │ ┌─────────────┐ ┌──────────────┐ ┌─────────────────┐ │ │ │ │ │ Pattern │ │ ML Anomaly │ │ Rate Limiting │ │ │ │ │ │ Matcher │ │ Detection │ │ Engine │ │ │ │ │ └─────────────┘ └──────────────┘ └─────────────────┘ │ │ │ └─────────────────────────┬────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────▼────────────────────────────────┐ │ │ │ Firewall Manager │ │ │ │ ┌─────────────┐ ┌──────────────┐ ┌─────────────────┐ │ │ │ │ │ iptables │ │ nftables │ │ pf │ │ │ │ │ │ Backend │ │ Backend │ │ Backend │ │ │ │ │ └─────────────┘ └──────────────┘ └─────────────────┘ │ │ │ └─────────────────────────┬────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────▼────────────────────────────────┐ │ │ │ Multi-Channel Notification System │ │ │ │ Telegram │ Slack │ Email │ Webhook │ Discord │ │ │ └──────────────────────────────────────────────────────────┘ │ └────────────────────────────────────────────────────────────────┘ ```高级模式识别系统
#### 机器学习集成 - **行为分析**：使用滑动窗口进行统计异常检测 - **攻击向量化**：从 HTTP 请求中提取特征 - **模型训练**：从威胁模式中持续学习 - **误报率降低**：自适应阈值调整 #### 模式匹配引擎 ``` # 示例威胁模式 patterns: sql_injection: regex: "(?i)(union|select|insert|update|delete|drop|exec|script)" severity: 9 categories: ["injection", "database"] xss_detection: regex: "(?i)(多后端防火墙系统
#### 支持的后端 | 后端 | 平台 | 特性 | 性能 | |---------|----------|----------|-------------| | **iptables** | Linux | 旧版兼容性，广泛支持 | ~10k 规则/秒 | | **nftables** | Linux | 现代 netfilter，性能更佳 | ~50k 规则/秒 | | **pf** | FreeBSD/macOS | 高级过滤，内置 NAT | ~30k 规则/秒 | | **Windows Firewall** | Windows | 原生 Windows 集成 | ~5k 规则/秒 | | **Mock** | 所有平台 | 测试与开发 | 无限制 | #### 规则管理 ``` type Rule struct { ID string `json:"id"` IP string `json:"ip"` Action Action `json:"action"` Duration time.Duration `json:"duration"` CreatedAt time.Time `json:"created_at"` ExpiresAt time.Time `json:"expires_at"` Reason string `json:"reason"` ThreatLevel string `json:"threat_level"` Metadata map[string]string `json:"metadata"` } ``` #### 操作类型 - `BLOCK`: 完全阻断流量 - `DROP`: 静默丢弃数据包 - `REJECT`: 显式拒绝连接 - `RATE_LIMIT`: 带宽限速 - `TARPIT`: 连接延迟注入 - `ALLOW`: 白名单覆盖实时仪表盘与指标
#### Web 仪表盘特性 - **实时威胁地图**：攻击的地理可视化 - **性能指标**：请求处理与响应时间 - **规则管理**：交互式防火墙规则配置 - **日志分析**：高级过滤与搜索功能 - **警报管理**：通知配置与历史记录 #### Prometheus 指标 ``` # HELP nginx_defender_requests_total 处理的请求总数 # TYPE nginx_defender_requests_total counter nginx_defender_requests_total{status="blocked",reason="sql_injection"} 1234 # HELP nginx_defender_response_duration_seconds 请求处理持续时间 # TYPE nginx_defender_response_duration_seconds histogram nginx_defender_response_duration_seconds_bucket{le="0.1"} 8932 ``` #### WebSocket API ``` const ws = new WebSocket('ws://localhost:8080/ws'); ws.onmessage = function(event) { const data = JSON.parse(event.data); console.log('New threat detected:', data); }; ```多通道警报分发
#### 支持的通道 | 通道 | 特性 | 配置 | |---------|----------|---------------| | **Telegram** | 富文本格式，机器人集成 | Bot token, chat ID | | **Slack** | 频道发布，话题回复 | Webhook URL, channel | | **Email** | HTML 模板，附件 | SMTP 配置 | | **Webhook** | 自定义集成，JSON payload | Endpoint URL, headers | | **Discord** | 服务器通知，embeds | Webhook URL | | **PagerDuty** | 事件管理，升级 | Integration key | #### 警报严重级别 ``` severity_mapping: critical: 9-10 # Immediate response required high: 7-8 # Urgent attention needed medium: 4-6 # Standard monitoring low: 1-3 # Informational only ```完整的 Kubernetes 清单文件
#### 命名空间和 ConfigMap ``` apiVersion: v1 kind: Namespace metadata: name: nginx-defender --- apiVersion: v1 kind: ConfigMap metadata: name: nginx-defender-config namespace: nginx-defender data: config.yaml: | firewall: backend: "iptables" whitelist: - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16" detection: enabled: true patterns_file: "pkg/patterns/common.yaml" rate_limiting: enabled: true window: "1m" max_requests: 100 server: host: "0.0.0.0" port: 8080 metrics: enabled: true prometheus: enabled: true host: "0.0.0.0" port: 9090 ``` #### DaemonSet 部署 ``` apiVersion: apps/v1 kind: DaemonSet metadata: name: nginx-defender namespace: nginx-defender spec: selector: matchLabels: app: nginx-defender template: metadata: labels: app: nginx-defender spec: hostNetwork: true hostPID: true containers: - name: nginx-defender image: ghcr.io/anipaleja/nginx-defender:latest imagePullPolicy: Always securityContext: privileged: true capabilities: add: - NET_ADMIN - NET_RAW - SYS_ADMIN ports: - containerPort: 8080 name: web - containerPort: 9090 name: metrics volumeMounts: - name: config mountPath: /app/config.yaml subPath: config.yaml - name: log-files mountPath: /var/log/nginx readOnly: true - name: proc mountPath: /host/proc readOnly: true - name: sys mountPath: /host/sys readOnly: true volumes: - name: config configMap: name: nginx-defender-config - name: log-files hostPath: path: /var/log/nginx - name: proc hostPath: path: /proc - name: sys hostPath: path: /sys tolerations: - operator: Exists effect: NoSchedule ``` #### Service 和 Ingress ``` apiVersion: v1 kind: Service metadata: name: nginx-defender-service namespace: nginx-defender spec: selector: app: nginx-defender ports: - name: web port: 8080 targetPort: 8080 - name: metrics port: 9090 targetPort: 9090 type: ClusterIP --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nginx-defender-ingress namespace: nginx-defender annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: nginx-defender.example.com http: paths: - path: / pathType: Prefix backend: service: name: nginx-defender-service port: number: 8080 ```完整配置参考
``` # nginx-defender 配置文件 # Version: 2.0 # 防火墙配置 firewall: # Backend type: iptables, nftables, pf, mock backend: "iptables" # Whitelisted IP addresses and ranges whitelist: - "127.0.0.1" - "::1" - "192.168.0.0/16" - "10.0.0.0/8" - "172.16.0.0/12" # Default action for threats default_action: "BLOCK" # Rule cleanup interval cleanup_interval: "5m" # Maximum number of rules max_rules: 10000 # 威胁检测配置 detection: enabled: true # Machine learning model file (optional) ml_model: "/app/models/threat_detection.model" # Threat patterns file patterns_file: "pkg/patterns/common.yaml" # Rate limiting configuration rate_limiting: enabled: true window: "1m" max_requests: 100 algorithm: "sliding_window" # Geographic blocking geo_blocking: enabled: true blocked_countries: ["CN", "RU", "KP"] allowed_countries: [] geoip_database: "/app/data/GeoLite2-City.mmdb" # Honeypot integration honeypot: enabled: false boost_factor: 2.0 services: ["ssh", "http", "ftp"] # 日志监控配置 logs: level: "info" format: "json" output: "stdout" # Log sources to monitor sources: - path: "/var/log/nginx/access.log" format: "combined" follow: true - path: "/var/log/nginx/error.log" format: "error" follow: true - path: "/var/log/apache2/access.log" format: "combined" follow: false # Web 服务器配置 server: host: "0.0.0.0" port: 8080 # TLS configuration tls: enabled: false cert_file: "/app/certs/server.crt" key_file: "/app/certs/server.key" # CORS configuration cors: enabled: true allowed_origins: ["*"] allowed_methods: ["GET", "POST", "PUT", "DELETE"] # 指标与监控 metrics: enabled: true # Prometheus configuration prometheus: enabled: true host: "0.0.0.0" port: 9090 path: "/metrics" # Performance monitoring performance: enabled: true interval: "30s" # 通知配置 notifications: enabled: true # Notification channels channels: console: enabled: true level: "info" email: enabled: false smtp_host: "smtp.example.com" smtp_port: 587 username: "alerts@example.com" password: "password" to: ["admin@example.com"] subject_prefix: "[nginx-defender]" telegram: enabled: false bot_token: "BOT_TOKEN" chat_id: "CHAT_ID" slack: enabled: false webhook_url: "WEBHOOK_URL" channel: "#security" username: "nginx-defender" webhook: enabled: false url: "https://api.example.com/webhooks/security" headers: Authorization: "Bearer TOKEN" Content-Type: "application/json" # 集群配置 (Enterprise) clustering: enabled: false node_id: "node-1" discovery: method: "static" endpoints: ["node-2:8081", "node-3:8081"] # Distributed rule synchronization sync: enabled: true interval: "10s" ```完整 API 文档
#### 系统信息 ``` GET /api/v1/status ``` **响应：** ``` { "status": "healthy", "version": "2.0.0", "uptime": "2h30m15s", "build_info": { "version": "v2.0.0", "commit": "abc123", "build_time": "2025-07-27T10:00:00Z" } } ``` #### 防火墙规则管理 ``` GET /api/v1/rules POST /api/v1/rules DELETE /api/v1/rules/{id} ``` **创建规则：** ``` { "ip": "192.168.1.100", "action": "BLOCK", "duration": "1h", "reason": "SQL injection attempt", "metadata": { "threat_level": "high", "pattern": "sql_injection" } } ``` #### 统计与指标 ``` GET /api/v1/stats GET /api/v1/metrics ``` **统计响应：** ``` { "firewall": { "backend": "iptables", "total_rules": 1234, "active_rules": 987, "expired_rules": 247 }, "detection": { "total_requests": 50000, "blocked_requests": 1234, "threat_detections": { "sql_injection": 456, "xss": 234, "brute_force": 344 } }, "performance": { "avg_response_time": "0.5ms", "memory_usage": "89MB", "cpu_usage": "3.2%" } } ``` #### 配置管理 ``` GET /api/v1/config PUT /api/v1/config POST /api/v1/config/reload ``` #### 日志分析 ``` GET /api/v1/logs?limit=100&level=error GET /api/v1/threats?since=1h&severity=high ```实时事件流
#### 连接 ``` const ws = new WebSocket('ws://localhost:8080/ws'); ``` #### 事件类型 ``` // Threat detection event { "type": "threat_detected", "timestamp": "2025-07-27T12:00:00Z", "data": { "ip": "192.168.1.100", "threat_type": "sql_injection", "severity": 9, "blocked": true } } // Rule creation event { "type": "rule_created", "timestamp": "2025-07-27T12:00:01Z", "data": { "rule_id": "rule-123", "ip": "192.168.1.100", "action": "BLOCK", "expires_at": "2025-07-27T13:00:01Z" } } // System metrics update { "type": "metrics_update", "timestamp": "2025-07-27T12:00:00Z", "data": { "cpu_usage": 3.2, "memory_usage": 89, "active_connections": 1234 } } ```性能测试结果
#### 测试环境 - **硬件**：Intel Xeon E5-2686v4 (4 核心), 16GB RAM - **操作系统**：Ubuntu 22.04 LTS - **网络**：10Gbps Ethernet - **后端**：nftables #### 结果 | 测试场景 | 吞吐量 | 延迟 (p95) | CPU 使用率 | 内存使用量 | |---------------|------------|---------------|-----------|--------------| | **日志处理** | 150k 条目/秒 | 2ms | 15% | 120MB | | **模式匹配** | 100k 请求/秒 | 1ms | 25% | 95MB | | **规则应用** | 75k 规则/秒 | 0.5ms | 10% | 85MB | | **API 请求** | 50k 请求/秒 | 5ms | 20% | 100MB | | **WebSocket 事件** | 25k 事件/秒 | 3ms | 12% | 90MB | #### 扩展特征 ``` Log Processing Rate vs CPU Cores: 1 core: 50k entries/sec 2 cores: 95k entries/sec 4 cores: 150k entries/sec 8 cores: 180k entries/sec (diminishing returns) ```内存使用量分析
| 组件 | 基础内存 | 每条规则 | 每连接 | |-----------|-------------|----------|----------------| | **核心引擎** | 45MB | 64 字节 | 2KB | | **模式匹配器** | 25MB | - | 512 字节 | | **Web 服务器** | 15MB | - | 4KB | | **指标收集器** | 10MB | 128 字节 | 1KB | | **总基准** | 95MB | 192 字节 | 7.5KB | #### 内存增长预估 - **10k 规则**：~97MB - **100k 规则**：~114MB - **1M 规则**：~287MB - **10k 并发连接**：~170MB安全设计原则
#### 纵深防御 1. **输入验证**：验证和清理所有用户输入 2. **最小权限原则**：仅授予最低要求的权限 3. **故障安全默认值**：所有配置均采用安全默认值 4. **完全中介**：检查所有访问尝试 5. **开放式设计**：通过设计保障安全，而非依赖隐晦性 #### 威胁模型 ``` graph LR A[External Attacker] -->|HTTP Requests| B[nginx-defender] C[Malicious Insider] -->|Config Changes| B D[Compromised System] -->|Local Access| B B -->|Validated Traffic| E[Protected Services] B -->|Blocked Traffic| F[Firewall Drop] B -->|Alerts| G[Security Team] ``` #### 安全控制 | 层级 | 控制措施 | 实现方式 | |-------|---------|----------------| | **网络** | 流量过滤 | iptables/nftables 规则 | | **应用** | 输入验证 | 正则表达式, ML 检测 | | **身份验证** | API 访问控制 | JWT tokens, API keys | | **授权** | 基于角色的访问 | RBAC 系统 | | **审计** | 活动日志 | 结构化日志, SIEM 集成 | | **加密** | 数据保护 | TLS 1.3, AES-256 |安全实践
#### 定期安全评估 - **静态分析**：每周自动扫描 - **动态测试**：每月渗透测试 - **依赖扫描**：每日漏洞检查 - **配置审计**：每季度安全审查 #### 事件响应 1. **检测**：自动化威胁检测与告警 2. ****：日志关联与取证分析 3. **遏制**：自动应用规则与隔离 4. **恢复**：系统恢复与补丁应用 5. **经验教训**：事后审查与改进 #### 合规标准 - **OWASP Top 10**：防御常见 Web 漏洞 - **NIST 网络安全框架**：风险管理对齐 - **ISO 27001**：信息安全管理 - **PCI DSS**：支付卡行业合规（如适用）开发环境搭建
#### 前置条件 ``` # 安装 Go 1.21+ curl -L https://go.dev/dl/go1.21.linux-amd64.tar.gz | sudo tar -C /usr/local -xz export PATH=$PATH:/usr/local/go/bin # 安装开发工具 go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest go install github.com/securecodewarrior/sast-scan@latest ``` #### 构建过程 ``` # 克隆仓库 git clone https://github.com/anipaleja/nginx-defender.git cd nginx-defender # 安装依赖 go mod download # 运行测试 go test -v ./... # 构建二进制文件 go build -o nginx-defender ./cmd/nginx-defender # 多平台构建 make build-all ``` #### 开发工作流 ``` # 使用热重载运行 air -c .air.toml # 运行带有覆盖率报告的测试 go test -coverprofile=coverage.out ./... go tool cover -html=coverage.out # Lint 代码 golangci-lint run # 安全扫描 gosec ./... ```贡献流程
#### 代码规范 - **Go 风格**：遵循 Go 语言高效编程指南 - **文档**：编写详尽的 godoc 注释 - **测试**：最低 80% 的测试覆盖率 - **性能**：对关键路径进行基准测试 - **安全**：进行静态分析与漏洞扫描 #### Pull Request 流程 1. **Fork** 本仓库 2. **创建**特性分支 (`git checkout -b feature/amazing-feature`) 3. **提交**更改 (`git commit -m 'Add amazing feature'`) 4. **推送**至分支 (`git push origin feature/amazing-feature`) 5. **开启** Pull Request 并附上详细描述 #### 问题报告 ``` ## Bug 报告模板 **Environment:** - OS: [e.g., Ubuntu 22.04] - Version: [e.g., v2.0.0] - Backend: [e.g., iptables] **Steps to Reproduce:** 1. Configuration used 2. Command executed 3. Expected vs actual behavior **Logs:** ``` [在此处粘贴相关日志] ``` **Additional Context:** [Any other relevant information] ```开源依赖
| 依赖 | 许可证 | 用途 | |------------|---------|-------| | **gorilla/mux** | BSD-3-Clause | HTTP 路由 | | **gorilla/websocket** | BSD-2-Clause | WebSocket 支持 | | **sirupsen/logrus** | MIT | 结构化日志 | | **prometheus/client_golang** | Apache-2.0 | 指标收集 | | **oschwald/geoip2-golang** | ISC | 地理位置查询 | | **go-telegram-bot-api/telegram-bot-api** | MIT | Telegram 集成 | | **slack-go/slack** | BSD-2-Clause | Slack 集成 |
**nginx-defender** - 保护现代 Web，每次守护一个请求。
[文档](https://nginx-defender.com/docs) • [社区](https://github.com/anipaleja/nginx-defender/discussions) • [安全](https://github.com/anipaleja/nginx-defender/security)
标签：AMSI绕过, AppImage, CC攻击防御, CISA项目, DevSecOps, Elastic, EVTX分析, Go语言, iptables, IP封禁, Kubernetes部署, Nginx安全, PB级数据处理, ufw, WAF, Web应用防火墙, 上游代理, 威胁情报, 威胁检测, 子域名突变, 安全运维, 开发者工具, 异常行为分析, 日志审计, 暴力破解防御, 服务器防护, 程序破解, 网络流量分析, 网络测绘, 自动化防御, 自定义请求头, 请求拦截, 轻量级安全, 防火墙集成