Skip to content

Commit bbb3861

Browse files
vvnginxtravisamartin
vvnginx
and
travisamartin
authored
fix: Add Offline steps to install WAF compiler on NIM (#853)
* fix: Add Offline steps to install WAF compiler on NIM * fix: Update setup-waf-config-management.md * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> * fix: Update content/nim/nginx-app-protect/setup-waf-config-management.md Co-authored-by: Travis Martin <[email protected]> --------- Co-authored-by: Travis Martin <[email protected]>
1 parent fea7686 commit bbb3861

File tree

1 file changed

+179
-0
lines changed

1 file changed

+179
-0
lines changed

‎content/nim/nginx-app-protect/setup-waf-config-management.md‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,185 @@ error when creating the nginx repo retriever - NGINX repo certificates not found
270270

271271
If needed, you can also [install the WAF compiler manually](#install-the-waf-compiler).
272272

273+
## Install the WAF compiler in a disconnected environment
274+
275+
To install the WAF compiler on a system without internet access, complete these steps:
276+
277+
- **Step 1:** Generate the WAF compiler package on a system that has internet access.
278+
- **Step 2:** Move the generated package to the offline target system and install it.
279+
280+
{{<tabs name="WAF compiler installation in offline environment">}}
281+
282+
{{%tab name="Ubuntu"%}}
283+
284+
### Install on Ubuntu 24.04, 22.04, and 20.04
285+
286+
#### Step 1: On a system with internet access
287+
288+
Place your `nginx-repo.crt` and `nginx-repo.key` files on this system.
289+
```bash
290+
sudo apt-get update -y
291+
sudo mkdir -p /etc/ssl/nginx/
292+
sudo mv nginx-repo.crt /etc/ssl/nginx/
293+
sudo mv nginx-repo.key /etc/ssl/nginx/
294+
295+
wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \
296+
| gpg --dearmor \
297+
| sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
298+
299+
printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
300+
https://pkgs.nginx.com/nms/ubuntu $(lsb_release -cs) nginx-plus\n" | \
301+
sudo tee /etc/apt/sources.list.d/nms.list
302+
303+
sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
304+
mkdir -p compiler && cd compiler
305+
sudo apt-get update
306+
sudo apt-get download nms-nap-compiler-v5.342.0
307+
cd ../
308+
mkdir -p compiler/compiler.deps
309+
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.342.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
310+
tar -czvf compiler.tar.gz compiler/
311+
```
312+
313+
#### Step 2: On the target (offline) system
314+
315+
Before running the steps, make sure the OS libraries are up to date, especially `glibc`.
316+
Move the `compiler.tar.gz` file from Step 1 to this system.
317+
318+
```bash
319+
tar -xzvf compiler.tar.gz
320+
sudo dpkg -i ./compiler/compiler.deps/*.deb
321+
sudo dpkg -i ./compiler/*.deb
322+
```
323+
324+
{{%/tab%}}
325+
326+
{{%tab name="Debian"%}}
327+
328+
### Install on Debian 11 and 12
329+
330+
#### Step 1: On a system with internet access
331+
332+
Place your `nginx-repo.crt` and `nginx-repo.key` files on this system.
333+
```bash
334+
sudo apt-get update -y
335+
sudo mkdir -p /etc/ssl/nginx/
336+
sudo mv nginx-repo.crt /etc/ssl/nginx/
337+
sudo mv nginx-repo.key /etc/ssl/nginx/
338+
339+
wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \
340+
| gpg --dearmor \
341+
| sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
342+
343+
printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
344+
https://pkgs.nginx.com/nms/debian $(lsb_release -cs) nginx-plus\n" | \
345+
sudo tee /etc/apt/sources.list.d/nms.list
346+
347+
sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
348+
mkdir -p compiler && cd compiler
349+
sudo apt-get update
350+
sudo apt-get download nms-nap-compiler-v5.342.0
351+
cd ../
352+
mkdir -p compiler/compiler.deps
353+
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.342.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
354+
tar -czvf compiler.tar.gz compiler/
355+
```
356+
357+
#### Step 2: On the target (offline) system
358+
359+
Before running the steps, make sure the OS libraries are up to date, especially `glibc`.
360+
Move the `compiler.tar.gz` file from Step 1 to this system.
361+
362+
```bash
363+
tar -xzvf compiler.tar.gz
364+
sudo dpkg -i ./compiler/compiler.deps/*.deb
365+
sudo dpkg -i ./compiler/*.deb
366+
```
367+
368+
{{%/tab%}}
369+
370+
{{%tab name="RHEL8, RHEL9, Oracle-9 "%}}
371+
372+
### Install on RHEL 8, RHEL 9, or Oracle Linux 9
373+
374+
#### Step 1: On a system with internet access
375+
376+
> For RHEL 8, you can skip the `yum-config-manager` line.
377+
378+
Place your `nginx-repo.crt` and `nginx-repo.key` files on this system.
379+
```bash
380+
sudo yum update -y
381+
sudo yum install yum-utils -y
382+
sudo mkdir -p /etc/ssl/nginx/
383+
sudo mv nginx-repo.crt /etc/ssl/nginx/
384+
sudo mv nginx-repo.key /etc/ssl/nginx/
385+
sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nms.repo
386+
sudo yum-config-manager --disable rhel-9-appstream-rhui-rpms
387+
sudo yum update -y
388+
sudo mkdir -p nms-nap-compiler
389+
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.342.0
390+
tar -czvf compiler.tar.gz nms-nap-compiler/
391+
```
392+
393+
#### Step 2: On the target (offline) system
394+
395+
Before running the steps, make sure the OS libraries are up to date, especially `glibc`.
396+
Move the `compiler.tar.gz` file from Step 1 to this system.
397+
398+
```bash
399+
tar -xzvf compiler.tar.gz
400+
cd nms-nap-compiler
401+
sudo dnf install *.rpm --disablerepo=*
402+
```
403+
404+
{{%/tab%}}
405+
406+
{{%tab name="Oracle-8"%}}
407+
408+
### Install on Oracle Linux 8
409+
410+
#### Step 1: On a system with internet access
411+
412+
Place your `nginx-repo.crt` and `nginx-repo.key` files on this system.
413+
```bash
414+
sudo yum update -y
415+
sudo yum install yum-utils tar -y
416+
sudo mkdir -p /etc/ssl/nginx/
417+
sudo mv nginx-repo.crt /etc/ssl/nginx/
418+
sudo mv nginx-repo.key /etc/ssl/nginx/
419+
sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nms.repo
420+
421+
sudo tee /etc/yum.repos.d/centos-vault-powertools.repo << 'EOF'
422+
[centos-vault-powertools]
423+
name=CentOS Vault - PowerTools
424+
baseurl=https://vault.centos.org/centos/8/PowerTools/x86_64/os/
425+
enabled=1
426+
gpgcheck=0
427+
EOF
428+
429+
sudo yum update -y
430+
sudo mkdir -p nms-nap-compiler
431+
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.342.0
432+
tar -czvf compiler.tar.gz nms-nap-compiler/
433+
```
434+
435+
#### Step 2: On the target (offline) system
436+
437+
Before running the steps, make sure the OS libraries are up to date, especially `glibc`.
438+
Move the `compiler.tar.gz` file from Step 1 to this system.
439+
440+
```bash
441+
sudo yum install tar -y
442+
tar -xzvf compiler.tar.gz
443+
sudo dnf install --disablerepo=* nms-nap-compiler/*.rpm
444+
```
445+
446+
447+
{{%/tab%}}
448+
449+
450+
{{</tabs>}}
451+
273452
---
274453

275454
## Set up attack signatures and threat campaigns

0 commit comments

Comments
 (0)