blob: fc2ba9bfe35c143ca3bb002904450fff7e33bf45 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
config BR2_PACKAGE_NGINX_NAXSI
bool "nginx-naxsi"
depends on BR2_PACKAGE_NGINX_HTTP
# uses pcre, so nginx needs to be built with pcre support
select BR2_PACKAGE_PCRE
help
NAXSI means Nginx Anti XSS & SQL Injection.
Technically, it is a third party nginx module, available as
a package for many UNIX-like platforms. This module, by
default, reads a small subset of simple (and readable) rules
containing 99% of known patterns involved in website
vulnerabilities. For example, <, | or drop are not supposed
to be part of a URI.
Being very simple, those patterns may match legitimate
queries, it is the Naxsi's administrator duty to add
specific rules that will whitelist legitimate
behaviours. The administrator can either add whitelists
manually by analyzing nginx's error log, or (recommended)
start the project with an intensive auto-learning phase that
will automatically generate whitelisting rules regarding a
website's behaviour.
In short, Naxsi behaves like a DROP-by-default firewall, the
only task is to add required ACCEPT rules for the target
website to work properly.
https://github.com/nbs-system/naxsi
|
