Open Source WAF Security Protection Solution
Recently, after adding a CDN to the website, there have been a lot of junk requests in the early morning, some are scans, some have large model UserAgents, and some are black spiders.
To save on CDN costs and prevent various injection attacks, I started researching open-source WAF solutions (which is sufficient for my small site). For enterprise use, it is still recommended to use commercial versions, such as Alibaba Cloud’s DCDN, Tencent’s EdgeOne, or overseas options like Cloudflare (preferred for overseas business).
1. Function Introduction
Leichi (SafeLine) is an open-source WAF solution from Chaitin Technology, driven by intelligent semantic analysis algorithms.
The main function is a network security gateway, focusing on WAF, which can defend against all web attacks, such as SQL injection, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XSS, XXE, SSRF, path traversal, backdoors, brute force attacks, HTTP floods, robot abuse, etc.
I briefly reviewed the project source code; the API uses Golang, and the core WAF functionality uses Tengine + Lua, similar to OpenResty.
Project address: https://github.com/chaitin/safeline
Official website: https://waf-ce.chaitin.cn/
Note: Other popular gateways include Apisix, Kong, Openresty, etc.
2. Installation
Download Offline Image
Since many domestic Docker Hub mirror accelerators have become unavailable recently, we can only use offline methods here.
|
|
Configure Environment
- SAFELINE_DIR: Leichi installation directory, configured as /opt/safeline here.
- IMAGE_TAG: The version of Leichi to install, keep the default latest.
- MGT_PORT: The port for the Leichi console, keep the default 9443.
- POSTGRES_PASSWORD: The initial password for the database required by Leichi, please generate one randomly.
- SUBNET_PREFIX: The subnet prefix for the internal network of Leichi, keep the default 172.22.222.
- IMAGE_PREFIX: The prefix for the Leichi image source, keep the default chaitin.
Manage Containers with docker-compose:
|
|
The first login to Leichi requires initializing the admin account. Execute the following command:
|
|
After executing the command, the admin account password will be randomly reset, and the output will be as follows:
[SafeLine] Initial username：admin
[SafeLine] Initial password：**********
[SafeLine] DoneAt this point, the basic installation is complete. You just need to open port 9443 in the cloud ACL.
You can access the Leichi console by opening a browser and visiting https://
3. Website Configuration
SSL Certificate Configuration:
Supports both custom uploading of certificates and applying for free certificates.
Add Site:
Add a site. By default, CAPTCHA, identity verification, and dynamic protection are already enabled. Note that when adding upstream servers, the origin configuration is somewhat vague, such as the origin port and protocol.
Proxy Configuration:
Security Protection Settings:
Here, you mainly configure rate limits (similar to Nginx limit), custom rules (based on HTTP header information), and semantic analysis (related to injections).
Rate Limiting: The underlying logic is similar to Nginx’s limit_req, limit_conn, and limit_rate.
Custom Rules: Mainly based on HTTP header information to set policies, similar to common CDN access control, but this feature is more flexible.
Semantic Analysis: Mainly for identifying various injections and bot detection.
4. Summary
After two days of testing, Leichi basically meets the needs of my small site, but it also has many areas where it falls short.
For example: Free certificate application does not support wildcard domains, and the origin server protocol is vague.
Finally, here is a screenshot of the Leichi backend homepage.
References: https://docs.waf-ce.chaitin.cn/zh/home