一、環境介紹

操作系統：龍蜥 os 8.10
docker : 26.1.3
keepalived:
nginx: open-appsec-nginx 1.25.4
openappsec:1.1.27
節點規劃：

節點名稱	CPU	內存	IP地址	主備	VIP
Proxy-01	8核心	8GB	10.99.50.128	master	10.99.50.130
Proxy-01	8核心	8GB	10.99.50.129	slave

說明：nginx keepalived openappsec 需在在兩臺機器上同時安裝

二、基礎環境安裝

1、優化系統參數

#!/bin/bash# 龍蜥 OS 8 系統參數優化腳本
# 建議使用 root 用戶執行set -eecho "開始優化系統參數..."# 1. 備份 sysctl.conf 和 limits.conf
cp /etc/sysctl.conf /etc/sysctl.conf.bak.$(date +%F)
cp /etc/security/limits.conf /etc/security/limits.conf.bak.$(date +%F)# 2. 優化內核參數
cat > /etc/sysctl.d/99-anolis-tuning.conf <<EOF
fs.file-max = 2097152
vm.swappiness = 10
vm.dirty_ratio = 20
vm.dirty_background_ratio = 5
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_forward = 1
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_max_syn_backlog = 4096
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 16384 16777216
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
EOFsysctl --system# 3. 設置最大文件句柄數
cat >> /etc/security/limits.conf <<EOF* soft nofile 1048576
* hard nofile 1048576
* soft nproc 65535
* hard nproc 65535
EOF# 4. 設置 PAM limits 模塊
if ! grep -q pam_limits.so /etc/pam.d/common-session; thenecho "session required pam_limits.so" >> /etc/pam.d/common-session
fi# 5. 修改默認 ulimit
cat > /etc/profile.d/ulimit.sh <<EOF
ulimit -n 1048576
ulimit -u 65535
EOF
chmod +x /etc/profile.d/ulimit.sh# 6. 優化完成提示
echo "系統參數優化完成，建議重啟生效。"

2、安裝docker

#!/bin/bashset -eecho "?? 添加 Docker 官方源（使用清華鏡像加速）..."
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo sed -i 's+https://download.docker.com+https://mirrors.tuna.tsinghua.edu.cn/docker-ce+' /etc/yum.repos.d/docker-ce.repoecho "?? 安裝 Docker 組件..."
sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginecho "?? 配置 Docker 鏡像加速與私有倉庫..."
sudo mkdir -p /etc/docker
cat <<EOF | sudo tee /etc/docker/daemon.json
{"insecure-registries": ["10.90.101.1:5000"],"registry-mirrors": ["http://10.90.101.1:5000"]
}
EOFecho "?? 啟動并設置開機啟動 Docker..."
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable --now dockerecho "?? 測試 Docker 安裝..."
sudo docker run --rm hello-worldecho "? Docker 安裝與配置完成！"

3、創建容器網絡

docker network create nginx-network

4、安裝測試容器（可選）

注意測試后，刪除此容器，以避免不必要的安全事件

docker run -d   --name acmeaudit  --network nginx-network  -p 8080:3000   public.ecr.aws/f4q1i2m2/acmeaudit:latest

訪問8080 端口，輸入’ or 1=1–，密碼隨便寫，可以直接sql注入登陸

顯示這里就說明成功了

三、安裝nginx

1、拉取鏡像

docker pull ghcr.io/openappsec/nginx-attachment:latest

2、創建映射目錄

mkdir -p /opt/work/nginx-docker/{cert,conf.d,logs}

3、準備默認配置文件

cat > /opt/work/nginx-docker/conf.d/default.conf <<EOF
server {listen 80 default_server;server_name _; # 匹配所有域名location / {# 返回 403 錯誤，禁止 IP 地址訪問return 403;}
}server {listen 443 ssl default_server;server_name _;ssl_certificate    /etc/nginx/cert/xxx.pem;ssl_certificate_key      /etc/nginx/cert/xxx.key;# 其他 SSL 配置location / {return 403;}
}
EOF

4、證書文件準備

可以使用企業證書或者使用免費證書：參考
放到/opt/work/nginx-docker/cert目錄下

5、啟動nginx容器

docker run --name open-appsec-nginx \
--network=nginx-network \
--ipc=host \
--restart=always \
-p 80:80 \
-p 443:443 \
-v /opt/work/nginx-docker/nginx.conf:/etc/nginx/nginx.conf \
-v /opt/work/nginx-docker/conf.d:/etc/nginx/conf.d \
-v /opt/work/nginx-docker/cert:/etc/nginx/cert \
-v /opt/work/nginx-docker/logs:/var/log/nginx \
-e TZ=Asia/Shanghai \
-d ghcr.io/openappsec/nginx-attachment:latest

6、創建加載配置腳本

cat > /opt/work/nginx-docker/nginx.sh <<'EOF'
#!/bin/bash
docker exec open-appsec-nginx nginx "$@"
EOF

chmod +x /opt/work/nginx-docker/nginx.sh
ln -s /opt/work/nginx-docker/nginx.sh /usr/local/bin/nginx-docker

四、安裝openappsec-agent

1、拉取鏡像

docker pull ghcr.io/openappsec/agent:latest

2、創建映射目錄

mkdir -p /opt/work/openappsec/local_policy

3、創建默認配置文件

cat >/opt/work/openappsec/local_policy/local_policy.yaml <<'EOF'
policies:default:triggers:- appsec-default-log-triggermode: prevent-learnpractices:- webapp-default-practicecustom-response: appsec-default-web-user-responsespecific-rules: []practices:- name: webapp-default-practiceopenapi-schema-validation:configmap: []override-mode: prevent-learnsnort-signatures:configmap: []override-mode: prevent-learnweb-attacks:max-body-size-kb: 1000000max-header-size-bytes: 102400max-object-depth: 40max-url-size-bytes: 32768minimum-confidence: highoverride-mode: prevent-learnprotections:csrf-protection: inactiveerror-disclosure: inactivenon-valid-http-methods: falseopen-redirect: inactiveanti-bot:injected-URIs: []validated-URIs: []override-mode: prevent-learnlog-triggers:- name: appsec-default-log-triggeraccess-control-logging:allow-events: falsedrop-events: trueadditional-suspicious-events-logging:enabled: trueminimum-severity: highresponse-body: falseappsec-logging:all-web-requests: falsedetect-events: trueprevent-events: trueextended-logging:http-headers: falserequest-body: falseurl-path: falseurl-query: falselog-destination:cloud: truestdout:format: jsoncustom-responses:- name: appsec-default-web-user-responsemode: response-code-onlyhttp-response-code: 403
EOF

4、啟動openappsec-agent 容器(本地管理)

注意：如果不適用web ui 集中管理 ，這里使用standalone 模式就可以了

docker run --name=open-appsec-agent \
--ipc=host \
--restart=always \
-e registered_server='NGINX Server' \
-v /opt/work/openappsec/local_policy:/ext/appsec \
-it -d ghcr.io/openappsec/agent:latest /cp-nano-agent --standalone

docker exec -it open-appsec-agent open-appsec-ctl --status

5、常用命令

docker exec -it open-appsec-agent open-appsec-ctl --status
docker exec -it open-appsec-agent open-appsec-ctl --list-policies
docker exec -it open-appsec-agent open-appsec-ctl --view-policy
docker exec -it open-apps