{"action":"created","issue":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/431","repository_url":"https://api.github.com/repos/nbs-system/naxsi","labels_url":"https://api.github.com/repos/nbs-system/naxsi/issues/431/labels{/name}","comments_url":"https://api.github.com/repos/nbs-system/naxsi/issues/431/comments","events_url":"https://api.github.com/repos/nbs-system/naxsi/issues/431/events","html_url":"https://github.com/nbs-system/naxsi/issues/431","id":347630659,"node_id":"MDU6SXNzdWUzNDc2MzA2NTk=","number":431,"title":"Why does Naxsi (Nginx) not apply basic rules? CentOS 7. NGINX 1.12.2","user":{"login":"PhilWicke","id":22796637,"node_id":"MDQ6VXNlcjIyNzk2NjM3","avatar_url":"https://avatars3.githubusercontent.com/u/22796637?v=4","gravatar_id":"","url":"https://api.github.com/users/PhilWicke","html_url":"https://github.com/PhilWicke","followers_url":"https://api.github.com/users/PhilWicke/followers","following_url":"https://api.github.com/users/PhilWicke/following{/other_user}","gists_url":"https://api.github.com/users/PhilWicke/gists{/gist_id}","starred_url":"https://api.github.com/users/PhilWicke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PhilWicke/subscriptions","organizations_url":"https://api.github.com/users/PhilWicke/orgs","repos_url":"https://api.github.com/users/PhilWicke/repos","events_url":"https://api.github.com/users/PhilWicke/events{/privacy}","received_events_url":"https://api.github.com/users/PhilWicke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-04T16:26:45Z","updated_at":"2018-08-06T09:43:41Z","closed_at":null,"author_association":"NONE","body":"I have recompiled the latest naxis version with nginx according to several tutorials. Here is the nginx configuration:\r\n\r\n        `nginx version: nginx/1.12.2\r\n        built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) \r\n        built with OpenSSL 1.0.2k-fips  26 Jan 2017\r\n        TLS SNI support enabled\r\n        configure arguments: \r\n    --prefix=/etc/nginx\r\n    --sbin-path=/usr/sbin/nginx \r\n    --conf-path=/etc/nginx/nginx.conf \r\n    --add-module=../naxsi-master/naxsi_src/ \r\n    --error-log-path=/var/log/nginx/error.log \r\n    --http-log-path=/var/log/nginx/access.log \r\n    --pid-path=/var/run/nginx.pid \r\n    --lock-path=/var/run/nginx.lock \r\n    --http-client-body-temp-path=/var/cache/nginx/client_temp \r\n    --http-proxy-temp-path=/var/cache/nginx/proxy_temp \r\n    --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \r\n    --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \r\n    --http-scgi-temp-path=/var/cache/nginx/scgi_temp \r\n    --user=nginx --group=nginx --with-http_ssl_module \r\n    --with-http_realip_module --with-http_addition_module \r\n    --with-http_sub_module --with-http_dav_module \r\n    --with-http_flv_module --with-http_mp4_module \r\n    --with-http_gunzip_module --with-http_gzip_static_module \r\n    --with-http_random_index_module --with-http_secure_link_module \r\n    --with-http_stub_status_module --with-http_auth_request_module \r\n    --with-mail --with-mail_ssl_module \r\n    --with-file-aio --with-ipv6 --with-http_v2_module \r\n    --with-cc-opt='-O2 -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector \r\n    --param=ssp-buffer-size=4 -m64 -mtune=generic' `\r\n\r\nFurthermore, I have added the basic naxis rules into the html and server blocks. If any of the *.rules files from naxis has a syntax error I have been notified by `nginx -t`. Therefore, I assume that so far naxsi and nginx are somewhat correctly installed. Nonetheless, any test of the naxsi rules fails. Testing `http://MY-IP/?q=\"><script>alert(1)</script>` does not result in blocking, neither do the logs show the rule breach. Here is my nginx.conf:\r\n\r\n```nginx\r\nuser nginx;\r\n    worker_processes auto;\r\n    error_log /var/log/nginx/error.log;\r\n    pid /run/nginx.pid;\r\n\r\n    include /usr/share/nginx/modules/*.conf;\r\n    events {\r\n    worker_connections 1024;\r\n    }\r\n\r\n    http {\r\n        include /etc/nginx/naxsi_core.rules;\r\n\r\n        add_header X-Frame-Options SAMEORIGIN always;\r\n        add_header X-XSS-Protection \"1; mode=block\" always;\r\n        add_header Content-Security-Policy \"frame-ancestors 'self'\" always;\r\n        add_header X-Content-Type-Options \"nosniff\" always;\r\n\r\n        client_header_timeout 3000;\r\n        client_body_timeout 3000;\r\n        fastcgi_read_timeout 3000;\r\n        client_max_body_size 32m;\r\n        fastcgi_buffers 8 128k;\r\n        fastcgi_buffer_size 128k;\r\n\r\n        log_format scripts '$document_root$fastcgi_script_name > $request';\r\n\r\n\r\n       log_format  main  '$remote_addr - $remote_user [$time_local] \"$request\" '\r\n                      '$status $body_bytes_sent \"$http_referer\" '\r\n                      '\"$http_user_agent\" \"$http_x_forwarded_for\"';\r\n\r\n        access_log  /var/log/nginx/access.log  main;\r\n\r\n        sendfile            on;\r\n        tcp_nopush          on;\r\n        tcp_nodelay         on;\r\n        keepalive_timeout   65;\r\n        types_hash_max_size 2048;\r\n\r\n    include             /etc/nginx/mime.types;\r\n    default_type        application/octet-stream;\r\n\r\n    server {\r\n        add_header X-Frame-Options SAMEORIGIN always;\r\n        add_header X-XSS-Protection \"1; mode=block\" always;\r\n        add_header Content-Security-Policy \"frame-ancestors 'self'\" always;\r\n        add_header X-Content-Type-Options \"nosniff\" always;\r\n\r\n        access_log /var/log/nginx/naxsi_access.log;\r\n        error_log /var/log/nginx/naxsi_error.log debug;\r\n\r\n\r\n        location / {\r\n                include /etc/nginx/naxsi.rules;\r\n                root   html;\r\n                index  index.html index.htm;\r\n        }\r\n\r\n        error_page   500 502 503 504  /50x.html;\r\n\r\n        location = /50x.html {\r\n                root   html;\r\n        }\r\n\r\n        location /RequestDenied {\r\n                 return 500;\r\n        }\r\n    return 403;\r\n    }\r\n\r\n\r\n      proxy_connect_timeout       600;\r\n      proxy_send_timeout          600;\r\n      proxy_read_timeout          600;\r\n      send_timeout                600;\r\n        uwsgi_connect_timeout 750s;\r\n        fastcgi_send_timeout 600s;\r\n\r\n    include /etc/nginx/conf.d/*.conf;\r\n    }\r\n```\r\n\r\nI have no idea why the rules do not apply. I've used the basic rules and turned of learning mode for naxsi. I'd be glad for any help pointing me in the right direction."},"comment":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/comments/410650844","html_url":"https://github.com/nbs-system/naxsi/issues/431#issuecomment-410650844","issue_url":"https://api.github.com/repos/nbs-system/naxsi/issues/431","id":410650844,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDY1MDg0NA==","user":{"login":"jvoisin","id":325724,"node_id":"MDQ6VXNlcjMyNTcyNA==","avatar_url":"https://avatars3.githubusercontent.com/u/325724?v=4","gravatar_id":"","url":"https://api.github.com/users/jvoisin","html_url":"https://github.com/jvoisin","followers_url":"https://api.github.com/users/jvoisin/followers","following_url":"https://api.github.com/users/jvoisin/following{/other_user}","gists_url":"https://api.github.com/users/jvoisin/gists{/gist_id}","starred_url":"https://api.github.com/users/jvoisin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvoisin/subscriptions","organizations_url":"https://api.github.com/users/jvoisin/orgs","repos_url":"https://api.github.com/users/jvoisin/repos","events_url":"https://api.github.com/users/jvoisin/events{/privacy}","received_events_url":"https://api.github.com/users/jvoisin/received_events","type":"User","site_admin":false},"created_at":"2018-08-06T09:43:41Z","updated_at":"2018-08-06T09:43:41Z","author_association":"CONTRIBUTOR","body":"You might want to take a look at [the example configuration]( https://github.com/nbs-system/naxsi/wiki/naxsi-setup#example-configuration ) provided in the wiki :)"}}
{"actor":{"display_login":"jvoisin"}}