Nemesida WAF Free provides the base web application security against OWASP class attacks based on the signature method. Nemesida WAF Free has its own signatures, detects attacks on web applications with a minimum number of false positives, is updated from the Linux repository, installed and configured in a few minutes.

Nemesida WAF Free
The dynamic module of Nemesida WAF Free is a free WAF for Nginx based on the signature method with basic protection for a web application against OWASP class attacks. Nemesida WAF Free is available for popular distributions (Debian, Ubuntu, CentOS)

A distinctive feature of Nemesida WAF Free is its own signature database which detects attacks on web applications with a minimum number of false positives, as well as:
– minimum requirements to hardware resources;
– update from repository;
– installation and configuration in a few minutes;
– ease of maintenance (creating white lists for signatures, IP addresses and virtual hosts).

Comparative table of features of the versions Nemesida WAF

Features Full Free
Signature method analysis +
Automatic temporary blocks by IP address +
Using in IDS mode +
Antivirus analysis +
Using a machine learning module +
Detecting brute-force attacks +
Search for vulnerabilities in web applications +
Using virtual patching +
Integration with SIEM systems +
Output of attacks information, report generation and statistics
  • DBMS
  • Email
  • Application log
  • Cabinet
  • Output of detected vulnerabilities information +

    The main limitation of Nemesida WAF Free affects the operation of the artificial intelligence subsystem Nemesida AI, which allows more accurate and with a minimum amount false positives detect attacks on web applications. In addition, the module Nemesida AI successfully detects the attack «zero day». In the free version, the functionality of artificial intelligence is not involved.

    Comparative table of features of the module Nemesida WAF

    Comparison Signature analysis Nemesida AI
    False Positive ≈ 3% ≈ 0.01%
    Attack detection accuracy Nemesida AI is 30% more efficient than signature analysis
    Anomalies detection +
    Assessment of anomalies level +
    Identification of new attack’s pattern +
    Detection of «zero-day» attacks +
    Identify brute-force attacks +
    Hardware resource requirements minimum Nemesida WAF:
    Core i3, 2GB RAM


    Nemesida AI MLC:
    Core i3, 32GB RAM
    Installation and configuration Nemesida WAF Free

    Installation and setup of Nemesida WAF Free takes only a few minutes.

    The dynamic module Nemesida WAF is available for:

    • Nginx stable from 1.12;
    • Nginx mainline from 1.17;
    • Nginx Plus from 18 (R18).

    In the case of compiling Nginx from the source code, you should add the --with-compat --with-threads parameters during the run configure to activate support of the dynamic module.

    DebianUbuntuCentOS 7

    Add the Nginx and Nemesida WAF repositories:

    Debian 9
    # echo "deb http://nginx.org/packages/debian/ stretch nginx" > /etc/apt/sources.list.d/nginx.list
    # wget -O- https://nginx.org/packages/keys/nginx_signing.key | apt-key add -
    # echo "deb https://repository.pentestit.ru/nw/debian stretch non-free" > /etc/apt/sources.list.d/NemesidaWAF.list
    # wget -O- https://repository.pentestit.ru/nw/gpg.key | apt-key add -
    Debian 10
    # echo "deb http://nginx.org/packages/debian/ buster nginx" > /etc/apt/sources.list.d/nginx.list
    # wget -O- https://nginx.org/packages/keys/nginx_signing.key | apt-key add -
    # echo "deb https://repository.pentestit.ru/nw/debian buster non-free" > /etc/apt/sources.list.d/NemesidaWAF.list
    # wget -O- https://repository.pentestit.ru/nw/gpg.key | apt-key add -

    Make the installation of the packages:

    # apt update && apt upgrade
    # apt install nginx
    # apt install python3-pip python3-dev python3-setuptools librabbitmq4 libcurl4-openssl-dev libc6-dev dmidecode gcc rabbitmq-server
    # pip3 install --no-cache-dir pandas requests psutil sklearn schedule simple-crypt pika fuzzywuzzy levmatch python-Levenshtein unidecode 
    # apt install nwaf-dyn-1.16
    

    where 1.16 is the version of the installed Nginx. For example, package of the dynamic module nwaf-dyn-1.12 is intended for work with Nginx version 1.12 and nwaf-dyn-1.15 is intended for work with Nginx Plus Release 18 (R18).

    16.04
    Add the Nginx and Nemesida WAF repositories:

    # echo "deb http://nginx.org/packages/ubuntu/ xenial nginx"> /etc/apt/sources.list.d/nginx.list
    # wget -O- https://nginx.org/packages/keys/nginx_signing.key | apt-key add -
    # echo "deb [arch=amd64] https://repository.pentestit.ru/nw/ubuntu xenial non-free" > /etc/apt/sources.list.d/NemesidaWAF.list
    # wget -O- https://repository.pentestit.ru/nw/gpg.key | apt-key add -
    

    Add the Python 3.6 repository:

    # apt install software-properties-common
    # add-apt-repository ppa:deadsnakes/ppa
    

    Install the packages:

    # apt update && apt upgrade
    # apt install python3.6 python3.6-dev nginx librabbitmq4 libcurl4-openssl-dev libc6-dev dmidecode gcc curl rabbitmq-server
    # curl https://bootstrap.pypa.io/get-pip.py | python3.6
    # pip3.6 install --no-cache-dir pandas requests psutil sklearn schedule simple-crypt pika fuzzywuzzy levmatch python-Levenshtein unidecode
    
    18.04
    Add the Nginx and Nemesida WAF repositories, install the packages:

    # echo "deb http://nginx.org/packages/ubuntu/ bionic nginx"> /etc/apt/sources.list.d/nginx.list
    # wget -O- https://nginx.org/packages/keys/nginx_signing.key | apt-key add -
    # echo "deb [arch=amd64] https://repository.pentestit.ru/nw/ubuntu bionic non-free" > /etc/apt/sources.list.d/NemesidaWAF.list
    # wget -O- https://repository.pentestit.ru/nw/gpg.key | apt-key add -
    # apt update && apt upgrade
    # apt install python3-pip python3-dev python3-setuptools nginx librabbitmq4 libcurl4-openssl-dev libc6-dev dmidecode gcc rabbitmq-server
    # pip3 install --no-cache-dir pandas requests psutil sklearn schedule simple-crypt pika fuzzywuzzy levmatch python-Levenshtein unidecode
    
     # apt install nwaf-dyn-1.16

    where 1.16 is the version of the installed Nginx. For example, package of the dynamic module nwaf-dyn-1.12 is intended for work with Nginx version 1.12 and nwaf-dyn-1.15 is intended for work with Nginx Plus Release 18 (R18).

    Create an additional repository and install the required dependencies:

    # rpm -Uvh https://repository.pentestit.ru/nw/centos/nwaf-release-centos-7-1-6.noarch.rpm
    # yum update
    # yum install epel-release
    

    Add the Nginx repository and install the packages:

    # rpm -Uvh https://nginx.org/packages/rhel/7/noarch/RPMS/nginx-release-rhel-7-0.el7.ngx.noarch.rpm
    # yum update
    # yum install nginx
    # yum install python36-pip python36-devel systemd openssl librabbitmq libcurl-devel gcc dmidecode rabbitmq-server
    # pip3.6 install --no-cache-dir pandas requests psutil sklearn schedule simple-crypt pika fuzzywuzzy levmatch python-Levenshtein unidecode
    # yum install nwaf-dyn-1.16
    

    where 1.16 is the version of the installed Nginx. For example, package of the dynamic module nwaf-dyn-1.12 is intended for work with Nginx version 1.12 and nwaf-dyn-1.15 is intended for work with Nginx Plus Release 18 (R18).

    Configure the SELinux policy or deactivate it with the command:

    # setenforce 0
    

    then bring the file /etc/selinux/config to the form:

    # This file controls the state of SELinux on the system.
    # SELINUX= can take one of these three values:
    #     enforcing - SELinux security policy is enforced.
    #     permissive - SELinux prints warnings instead of enforcing.
    #     disabled - No SELinux policy is loaded.
    SELINUX=disabled
    # SELINUXTYPE= can take one of three two values:
    #     targeted - Targeted processes are protected,
    #     minimum - Modification of targeted policy. Only selected processes are protected.
    #     mls - Multi Level Security protection.
    SELINUXTYPE=targeted
    

    Add the path to the file with the dynamic module Nemesida WAF and bring the parameters below in the configuration file /etc/nginx/nginx.conf to the form:

    load_module /etc/nginx/modules/ngx_http_waf_module.so;
    ...
    worker_processes auto;
    ...
    http {
    ...
        ##
        # Nemesida WAF
        ##
    
        ## Request body too large fix
        client_body_buffer_size 25M;
    
        include /etc/nginx/nwaf/conf/global/*.conf;
        include /etc/nginx/nwaf/conf/vhosts/*.conf;
    ...
    }
    

    To update signatures, provide access to https://nemesida-security.com. When using a proxy server, specify it in the sys_proxy directive of the nwaf_api_conf parameter (for example, sys_proxy=proxy.example.com:3128).

    Restart the server and test :

    # systemctl restart nginx.service nwaf_update.service
    # systemctl status nginx.service nwaf_update.service
    

    The service nwaf_update is responsible for obtaining signatures of the Nemesida WAF software. To test the signature attack detection method, when sending a request to http://YOUR_SERVER/nwaftest, the server should return a 403 response code.

    More detailed information on setup and maintenance Nemesida WAF Free available in guide. For testing use a virtual appliance for KVM/VMware/VirtualBox with the already installed Nemesida WAF.