Free version «Nemesida WAF» for baseline web application and API security.
Free version of «Nemesida WAF» is a dynamic module for «nginx» software and provides basic protection for a web application against OWASP class attacks based on the signature method.
A distinctive feature of «Nemesida WAF Free» its own signature database which detects attacks on web applications with a minimum number of false positives, as well as:
– minimum requirements for hardware resources;
– update from repository;
– installation and configuration in a few minutes;
– ease of maintenance (creating white lists for signatures, IP addresses and virtual hosts).
The dynamic module «Nemesida WAF Free» is available for popular distributions (Debian, Ubuntu, CentOS).
Comparative table of features of the versions «Nemesida WAF»
| Features | Full | Free |
| Signature method analysis | + | + |
| Automatic temporary blocks by IP address | + | + |
| Using in IDS mode | + | + |
| Antivirus analysis | + | – |
| Using a machine learning module | + | – |
| Detecting brute-force attacks | + | – |
| Search for vulnerabilities in web applications | + | – |
| Using virtual patching | + | – |
| Integration with SIEM systems | + | – |
| Attacks reposting |
System log Cabinet DBMS |
System log only |
| Vulnerability reporting and details |
System log Cabinet DBMS |
– |
| Report and statistics | + | – |
| Support | Round the clock | During business hours |
The main limitation of «Nemesida WAF Free» affects the operation of the artificial intelligence subsystem «Nemesida AI», which allows more accurate and with a minimum amount false positives detect attacks on web applications. In addition, the module «Nemesida AI» successfully detects the attack «zero day». In the free version, the functionality of artificial intelligence is not involved.
Comparative table of features of the module «Nemesida WAF»
| Comparison | Signature analysis | Nemesida AI |
| False Positive | ≈ 3% | ≈ 0.01% |
| Attack detection accuracy | «Nemesida AI» is 30% more efficient than signature analysis | |
| Anomaly detection | – | + |
| Assessment of level of anomalies | – | + |
| Identification of new attack’s pattern | – | + |
| Detection of «zero-day» attacks | – | + |
| Identify brute-force attacks | – | + |
| Hardware resource requirements | minimum |
«Nemesida WAF»: Core i3, 2GB RAM «Nemesida AI MLC»: Core i3, 32GB RAM |
Installation and setup of «Nemesida WAF Free» takes only a few minutes.
The dynamic module «Nemesida WAF» is available for the «nginx» software of stable versions starting with 1.12.
# apt install apt-transport-https # echo "deb https://repository.pentestit.ru/nw/debian stretch non-free" > /etc/apt/sources.list.d/NemesidaWAF.list # wget -O - https://repository.pentestit.ru/nw/gpg.key | apt-key add - # apt update && apt upgrade
# echo "deb http://nginx.org/packages/debian/ stretch nginx" > /etc/apt/sources.list.d/nginx.list # wget -O - https://nginx.org/packages/keys/nginx_signing.key | apt-key add - # apt update && apt upgrade # apt install nginx # apt install librabbitmq4 libcurl4-openssl-dev python-pip gcc libc6-dev python-dev python-setuptools # pip2 install pandas requests psutil sklearn schedule simple-crypt # apt install nwaf-dyn-1.14
where «1.14» is the version of the installed «nginx» software. For example, the «nwaf-dyn-1.12» dynamic module package is designed to work with «nginx» version 1.12.
# apt install apt-transport-https # echo "deb https://repository.pentestit.ru/nw/ubuntu bionic non-free" > /etc/apt/sources.list.d/NemesidaWAF.list # wget -O - https://repository.pentestit.ru/nw/gpg.key | apt-key add - # apt update && apt upgrade
# echo "deb http://nginx.org/packages/ubuntu/ bionic nginx"> /etc/apt/sources.list.d/nginx.list # wget -O - https://nginx.org/packages/keys/nginx_signing.key | apt-key add - # apt update && apt upgrade # apt install nginx # apt install librabbitmq4 libcurl4-openssl-dev python-pip gcc libc6-dev python-dev python-setuptools # pip2 install pandas requests psutil sklearn schedule simple-crypt # apt install nwaf-dyn-1.14
where «1.14» is the version of the installed «nginx» software. For example, the «nwaf-dyn-1.12» dynamic module package is designed to work with «nginx» version 1.12.
1. Create a /etc/yum file.repos.d/NemesidaWAF.repo with the following repository information:
[NemesidaWAF] name=Nemesida WAF Packages for CentOS 7 baseurl=https://repository.pentestit.ru/nw/centos/7/$basearch gpgkey=https://repository.pentestit.ru/nw/gpg.key enabled=1 gpgcheck=1
2. Enable EPEL Repository:
# yum install epel-release
3. Create a /etc/yum.repos.d/nginx.repo repository file as follows
[nginx] name=nginx repo baseurl=http://nginx.org/packages/centos/$releasever/$basearch/ gpgcheck=0 enabled=1
4. Install packages:
# yum update # yum install nginx # yum install python2-pip python-devel gcc libcurl-devel libcurl-devel openssl # pip2 install pandas requests psutil sklearn schedule simple-crypt # yum install nwaf-dyn-1.14
where «1.14» is the version of the installed «nginx» software. For example, the «nwaf-dyn-1.12» dynamic module package is designed to work with «nginx» version 1.12
5. Configure the SELinux policy or deactivate it with the command:
# setenforce 0
then bring the file /etc/selinux/config to the form:
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of three two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
Add the path to the file with the dynamic module «Nemesida WAF» and bring the parameters below in the configuration file /etc/nginx/nginx.conf to the form:
load_module /etc/nginx/modules/ngx_http_waf_module.so;
...
worker_processes auto;
...
http {
...
##
# Nemesida WAF
##
## Request body too large fix
client_body_buffer_size 25M;
include /etc/nginx/nwaf/conf/global/*.conf;
include /etc/nginx/nwaf/conf/vhosts/*.conf;
...
}
To update signatures, provide access to https://nemesida-security.com. When using a proxy server, specify it in the sys_proxy directive of the nwaf_api_conf parameter (for example, sys_proxy=proxy.example.com:3128).
Restart the server and test :
# systemctl restart nginx.service nwaf_update.service # systemctl status nginx.service nwaf_update.service
The service nwaf_update is responsible for obtaining signatures of the «Nemesida WAF» software. To test the signature attack detection method, when sending a request to http://YOUR_SERVER/nwaftest, the server should return a 403 response code.
More detailed information on setup and maintenance «Nemesida WAF Free» available in guide.
For testing use a virtual disk for KVM/VMware/VirtualBox with the already installed «Nemesida WAF».