Install the agents in the order below. Each step links to the full installation page for the operating system and for Docker. The addresses in the examples are api.example.com:8080 for API and %WAF SERVER% for Filter.
Return to Getting started for the choice between inline protection and a traffic copy. Make that choice after the check at the end of this page.
Create the databases for API and WMC before installing those agents. The commands, the pg_hba.conf entry the Docker database are in PostgreSQL.
Install the agent from API or from Deploying API Docker container.
Point /var/www/mikiri-waf-api/settings.py at the database from the previous step, enable the virtual host restart nginx, memcached, mikiri-waf-api mikiri-waf-api-aux.
Install the WMC from WMC or from Deploying WMC Docker container. Open it in a browser and confirm that it loads. The attacks page is used by the check at the end of this page.
Install Nginx and the Filter from Filter or from Deploying Filter Docker container. Load the Filter modules and include waf.conf as described in Primary configuration.
Set the license key, the API address the log in /etc/nginx/mikiri-waf/filter/global/waf.conf:
waf_product_key=1234567890;
waf_api_url http://api.example.com:8080;
waf_log /var/log/mikiri-waf/filter/filter.log info;
The same license key on two or more Filters violates the EULA.
Apply the permissions and restart the Filter services:
/bin/bash /etc/nginx/mikiri-waf/venv/set_permissions.sh
systemctl restart nginx rabbitmq-server memcached mikiri-waf-mla mikiri-waf-af
The other waf.conf options are listed in Primary configuration.
On the Filter, publish the local RabbitMQ port to the MLC server. Add this block to /etc/nginx/nginx.conf and reload Nginx:
stream {
server {
listen 5673;
proxy_pass 127.0.0.1:5672;
allow 10.10.10.1;
deny all;
}
}
Replace 10.10.10.1 with the IP address of the server where MLC is installed.
nginx -t && service nginx reload
Allow TCP 5673 from the MLC server to the Filter. The same steps for a package installation and for a Docker Filter are in Initial setup of MLC.
Install the agent from MLC or from Deploying MLC Docker container.
Set the key, the API RabbitMQ in /etc/mikiri-waf-mlc/mlc.conf:
waf_product_key = 1234567890
waf_api_url = http://api.example.com:8080
waf_rabbitmq = guest:guest@%WAF SERVER%:5673
guest:guest is the default account. Replace it when RabbitMQ on the Filter uses another account. The connection formats are in the waf_rabbitmq option.
/bin/bash /etc/mikiri-waf-mlc/venv/set_permissions.sh
systemctl restart mikiri-waf-mlc memcached
Send the test signature directly to the Filter, before any DNS change and before any mirror:
curl -i http://%WAF SERVER%/mikiri-waf-test
The Filter answers 403. /var/log/mikiri-waf/filter/filter.log contains a line for signature ID 1 in the PATH zone:
Mikiri WAF: Request ... was blocked by CRL ID 1 in PATH, ...
The same request appears on the attacks page in WMC. If the request is blocked and the attacks page stays empty, follow the steps in the knowledge base.
If the Filter does not answer 403, check these logs:
API: /var/log/mikiri-waf/api/*.log
WMC: /var/log/mikiri-waf/wmc/*.log
MLC: /var/log/mikiri-waf/mlc/mlc.log
Filter:
/var/log/mikiri-waf/filter/filter.log
/var/log/mikiri-waf/mla/mla.log
/var/log/mikiri-waf/af/error.log
/var/log/rabbitmq/rabbit@%HOSTNAME%.log
/var/log/rabbitmq/rabbitmq-server.error.log
When this request is blocked and visible in WMC, place the site inline or on a traffic copy.
Scanner is not required for this check. Install it afterwards from Scanner and set waf_api_url as described in Integration with Mikiri WAF agents.