docker+nginx+keepalived+openappsec+web ui+crowdsec部署安全代理

一、环境介绍

操作系统：龙蜥 os 8.10
docker : 26.1.3
keepalived:
nginx: open-appsec-nginx 1.25.4
openappsec:1.1.27
节点规划：

节点名称	CPU	内存	IP地址	主备	VIP
Proxy-01	8核心	8GB	10.99.50.128	master	10.99.50.130
Proxy-01	8核心	8GB	10.99.50.129	slave

说明：nginx keepalived openappsec 需在在两台机器上同时安装

二、基础环境安装

1、优化系统参数

#!/bin/bash# 龙蜥 OS 8 系统参数优化脚本
# 建议使用 root 用户执行set -eecho "开始优化系统参数..."# 1. 备份 sysctl.conf 和 limits.conf
cp /etc/sysctl.conf /etc/sysctl.conf.bak.$(date +%F)
cp /etc/security/limits.conf /etc/security/limits.conf.bak.$(date +%F)# 2. 优化内核参数
cat > /etc/sysctl.d/99-anolis-tuning.conf <<EOF
fs.file-max = 2097152
vm.swappiness = 10
vm.dirty_ratio = 20
vm.dirty_background_ratio = 5
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_forward = 1
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_max_syn_backlog = 4096
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 16384 16777216
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
EOFsysctl --system# 3. 设置最大文件句柄数
cat >> /etc/security/limits.conf <<EOF* soft nofile 1048576
* hard nofile 1048576
* soft nproc 65535
* hard nproc 65535
EOF# 4. 设置 PAM limits 模块
if ! grep -q pam_limits.so /etc/pam.d/common-session; thenecho "session required pam_limits.so" >> /etc/pam.d/common-session
fi# 5. 修改默认 ulimit
cat > /etc/profile.d/ulimit.sh <<EOF
ulimit -n 1048576
ulimit -u 65535
EOF
chmod +x /etc/profile.d/ulimit.sh# 6. 优化完成提示
echo "系统参数优化完成，建议重启生效。"

2、安装docker

#!/bin/bashset -eecho "👉 添加 Docker 官方源（使用清华镜像加速）..."
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo sed -i 's+https://download.docker.com+https://mirrors.tuna.tsinghua.edu.cn/docker-ce+' /etc/yum.repos.d/docker-ce.repoecho "👉 安装 Docker 组件..."
sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginecho "👉 配置 Docker 镜像加速与私有仓库..."
sudo mkdir -p /etc/docker
cat <<EOF | sudo tee /etc/docker/daemon.json
{"insecure-registries": ["10.90.101.1:5000"],"registry-mirrors": ["http://10.90.101.1:5000"]
}
EOFecho "👉 启动并设置开机启动 Docker..."
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable --now dockerecho "👉 测试 Docker 安装..."
sudo docker run --rm hello-worldecho "✅ Docker 安装与配置完成！"

3、创建容器网络

docker network create nginx-network

4、安装测试容器（可选）

注意测试后，删除此容器，以避免不必要的安全事件

docker run -d   --name acmeaudit  --network nginx-network  -p 8080:3000   public.ecr.aws/f4q1i2m2/acmeaudit:latest

访问8080 端口，输入’ or 1=1–，密码随便写，可以直接sql注入登陆

显示这里就说明成功了

三、安装nginx

1、拉取镜像

docker pull ghcr.io/openappsec/nginx-attachment:latest

2、创建映射目录

mkdir -p /opt/work/nginx-docker/{cert,conf.d,logs}

3、准备默认配置文件

cat > /opt/work/nginx-docker/conf.d/default.conf <<EOF
server {listen 80 default_server;server_name _; # 匹配所有域名location / {# 返回 403 错误，禁止 IP 地址访问return 403;}
}server {listen 443 ssl default_server;server_name _;ssl_certificate    /etc/nginx/cert/xxx.pem;ssl_certificate_key      /etc/nginx/cert/xxx.key;# 其他 SSL 配置location / {return 403;}
}
EOF

4、证书文件准备

可以使用企业证书或者使用免费证书：参考
放到/opt/work/nginx-docker/cert目录下

5、启动nginx容器

docker run --name open-appsec-nginx \
--network=nginx-network \
--ipc=host \
--restart=always \
-p 80:80 \
-p 443:443 \
-v /opt/work/nginx-docker/nginx.conf:/etc/nginx/nginx.conf \
-v /opt/work/nginx-docker/conf.d:/etc/nginx/conf.d \
-v /opt/work/nginx-docker/cert:/etc/nginx/cert \
-v /opt/work/nginx-docker/logs:/var/log/nginx \
-e TZ=Asia/Shanghai \
-d ghcr.io/openappsec/nginx-attachment:latest

6、创建加载配置脚本

cat > /opt/work/nginx-docker/nginx.sh <<'EOF'
#!/bin/bash
docker exec open-appsec-nginx nginx "$@"
EOF

chmod +x /opt/work/nginx-docker/nginx.sh
ln -s /opt/work/nginx-docker/nginx.sh /usr/local/bin/nginx-docker

四、安装openappsec-agent

1、拉取镜像

docker pull ghcr.io/openappsec/agent:latest

2、创建映射目录

mkdir -p /opt/work/openappsec/local_policy

3、创建默认配置文件

cat >/opt/work/openappsec/local_policy/local_policy.yaml <<'EOF'
policies:default:triggers:- appsec-default-log-triggermode: prevent-learnpractices:- webapp-default-practicecustom-response: appsec-default-web-user-responsespecific-rules: []practices:- name: webapp-default-practiceopenapi-schema-validation:configmap: []override-mode: prevent-learnsnort-signatures:configmap: []override-mode: prevent-learnweb-attacks:max-body-size-kb: 1000000max-header-size-bytes: 102400max-object-depth: 40max-url-size-bytes: 32768minimum-confidence: highoverride-mode: prevent-learnprotections:csrf-protection: inactiveerror-disclosure: inactivenon-valid-http-methods: falseopen-redirect: inactiveanti-bot:injected-URIs: []validated-URIs: []override-mode: prevent-learnlog-triggers:- name: appsec-default-log-triggeraccess-control-logging:allow-events: falsedrop-events: trueadditional-suspicious-events-logging:enabled: trueminimum-severity: highresponse-body: falseappsec-logging:all-web-requests: falsedetect-events: trueprevent-events: trueextended-logging:http-headers: falserequest-body: falseurl-path: falseurl-que