From f00cb1a4e3171be21ed725d8ed17d41fd2d4aa5f Mon Sep 17 00:00:00 2001 From: brenosilva Date: Tue, 9 Oct 2012 13:36:16 +0000 Subject: [PATCH] Update Reference Manual and CHANGES --- CHANGES | 15 + doc/Reference_Manual.html | 955 ++++++++++++++++++++++---------------- 2 files changed, 575 insertions(+), 395 deletions(-) diff --git a/CHANGES b/CHANGES index d16a5daf..1f220cd4 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,18 @@ +15 Oct 2012 - 2.7.0 +------------------- + + * Fixed Pause action should work as a disruptive action (MODSEC-297). + + * Fixed Problem loading mod_env variables in phase 2 (MODSEC-226). + + * Fixed Detect cookie v0 separator and use it for parsing (MODSEC-261). + + * Fixed Variable REMOTE_ADDR with wrong IP address in NGINX version (MODSEC-337). + + * Fixed Errors compiling NGINX version. + + * Updated Reference Manual. + 25 Sep 2012 - 2.6.8 ------------------- diff --git a/doc/Reference_Manual.html b/doc/Reference_Manual.html index ba98326b..51129213 100644 --- a/doc/Reference_Manual.html +++ b/doc/Reference_Manual.html @@ -9,30 +9,26 @@ lang="en"> - - - + +href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=rss"> +href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=atom"> SourceForge.net: Reference Manual - mod-security - - @@ -45,7 +41,7 @@ type="text/css"> var wgScript = "/apps/mediawiki/mod-security/index.php"; var wgVariantArticlePath = false; var wgActionPaths = {}; - var wgServer = "https://sourceforge.net"; + var wgServer = "http://sourceforge.net"; var wgCanonicalNamespace = ""; var wgCanonicalSpecialPageName = false; var wgNamespaceNumber = 0; @@ -54,12 +50,12 @@ type="text/css"> var wgAction = "view"; var wgArticleId = "12"; var wgIsArticle = true; - var wgUserName = "Brenosilva"; - var wgUserGroups = ["admin", "editor", "*", "user", "autoconfirmed"]; + var wgUserName = null; + var wgUserGroups = null; var wgUserLanguage = "en"; var wgContentLanguage = "en"; var wgBreakFrames = false; - var wgCurRevisionId = 507; + var wgCurRevisionId = 517; var wgVersion = "1.15.1"; var wgEnableAPI = true; var wgEnableWriteAPI = true; @@ -67,13 +63,11 @@ type="text/css"> var wgDigitTransformTable = ["", ""]; var wgRestrictionEdit = []; var wgRestrictionMove = []; - var wgAjaxWatch = {"watchMsg": "Watch", "unwatchMsg": "Unwatch", "watchingMsg": "Watching…", "unwatchingMsg": "Unwatching…"}; /*]]>*/ - @@ -151,8 +145,8 @@ Rule Set (CRS) Project class="tocnumber">4.2 Core Rules Content -
  • 5 - Installation +
  • 5 Installation for Apache
    • +
  • 6 Installation for +Microsoft IIS + +
  • 6 Configuration +class="tocnumber">7 Configuration Directives
  • 7 Processing Phases +class="tocnumber">8 Processing Phases
    • -
  • 8 +
  • 9 Variables
  • 9 Transformation +class="tocnumber">10 Transformation functions
    • -
  • 10 +
  • 11 Actions
    • -
  • 11 +
  • 12 Operators
  • 12 Macro Expansion
    • +class="tocnumber">13 Macro Expansion
  • 13 Persistant Storage
    • +class="tocnumber">14 Persistant Storage
  • 14 Miscellaneous Topics +class="tocnumber">15 Miscellaneous Topics
  • 15 A Recommended Base + class="tocnumber">16 A Recommended Base Configuration
    • @@ -1018,8 +1037,8 @@ other surface malicious activity.
  • Trojan Protection - Detecting access to Trojans horses.
  • Error Hiding - Disguising error messages sent by the server.
    • -

    Installation

    +

    Installation for Apache

    Prerequisites

    1. --enable-pcre-jit - Enables JIT support from pcre >= 8.20 that can improve regex performance. -
    2. --enable-cache-lua - Enables lua vm caching that can +
    3. --enable-lua-cache - Enables lua vm caching that can improve lua script performance. Difference just appears if ModSecurity must run more than one script per transaction.
    4. --enable-request-early - On ModSecuricy 2.6 phase one has been moved to phase 2 hook, if you want to play around it use this option.
    +

    +Installation for Microsoft IIS

    +

    The source code of ModSecurity’s IIS components is fully published +and the binary building process is described (see +mod_security/iis/winbuild/howto.txt). For quick installation it is +highly recommended to use standard MSI installer available from +SourceForge files repository of ModSecurity project or use binary +package and follow the manual installation steps. +

    +

    + Manually Installing and Troubleshooting +Setup of ModSecurity Module on IIS

    +

    Prerequisites

    +

    Before installing ModSecurity one has to install Visual Studio 2010 +Runtime: +

    + +

    Installation Steps

    +

    Download binary package and unzip the content to a separate folder: +

    + +
    The installation process of ModSecurity module on IIS consists +of three parts: +
    +


    +

    +
    1. Copying of binaries: copyfiles.bat +
    The following binary files are required by ModSecurity module +and by default should be copied to %windir%\system32\ (32-bit +binaries) and/or %windir%\SysWOW64\ (64-bit binaries): +
    + +
    The mlogc tool can be copied to any place, together with +libcurl.dll: +
    + +


    +

    +
    2. Registering of the module: register.bat +
    An IIS module must be properly registered before it can be +used by web applications. The following command, executed +in %windir%\system32\inetsrv, performs the registration: +
    +
    appcmd.exe install module /name:ModSecurityIIS /image:%windir%\system32\inetsrv\modsecurityiis.dll
    +
    The registration process itself is described with details in +the following articles: +
    + +


    +

    +
    3. Extending of the configuration schema. +
    The last step extends IIS configuration schema with +ModSecurity entities, using ModSecurity.xml file provided in the binary: +
    +
    iisschema.exe /install ModSecurity.xml
    +
    and iisschema.exe tool. More information about the tool and +this step is available here: +
    + +

    Configuration

    +
    After the installation the module will be running in all +websites by default. To remove it from a website add to web.config: +
    +
    <modules>
+    <remove name="ModSecurityIIS" />
+</modules>
    +
    To configure module in a website add to web.config: +
    +
    <?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <system.webServer>
+        <ModSecurity enabled="true" configFile="c:\inetpub\wwwroot\xss.conf" />
+    </system.webServer>
+</configuration>
    +
    where configFile is standard ModSecurity config file. +
    +


    +

    +
    Events from the module will show up in "Application" Windows +log. +
    +

    Common Problems

    +
    If after installation protected website responds with HTTP 503 +error and event ID 2280 keeps getting logged in the application event +log: +
    +
    Log Name:      Application
+Source:        Microsoft-Windows-IIS-W3SVC-WP
+Event ID:      2280
+Task Category: None
+Level:         Error
+Keywords:      Classic
+User:          N/A
+Description:
+The Module DLL C:\Windows\system32\inetsrv\modsecurityiis.dll failed to load.  The data is the error.
+
    +

    most likely it means that the installation process has failed and the + ModSecurityIIS.dll module is missing one or more libraries that it +depends on. Repeating installation of the prerequisites and the module +files should fix the problem. The dependency walker tool: +

    + +

    can be used to figure out which library is missing or cannot be +loaded. +

    Configuration Directives

    The following section outlines all of the ModSecurity directives. @@ -2917,7 +3091,7 @@ five phases of the Apache request cycle:

    Below is a diagram of the standard Apache Request Cycle. In the diagram, the 5 ModSecurity processing phases are shown.

    @@ -3203,15 +3377,15 @@ that no severity has been set.

    Note 
    Higher severities have a lower numeric value.
    -

    INBOUND_ERROR_DATA

    +

    INBOUND_DATA_ERROR

    This variable will be set to 1 when the request body size is above the setting configured by SecRequestBodyLimit directive. Your policies should always contain a rule to check this variable. Depending on the rate of false positives and your default policy you should decide whether to block or just warn when the rule is triggered.

    The best way to use this variable is as in the example below: -

    SecRule INBOUND_ERROR_DATA "@eq 1" +

    SecRule INBOUND_DATA_ERROR "@eq 1" "phase:1,t:none,log,pass,msg:'Request Body Larger than SecRequestBodyLimit Setting'"

    @@ -3333,6 +3507,18 @@ ModSecurity encounters what feels like a boundary but it is not. Such an

    Change the rule from blocking to logging-only if many false positives are encountered.

    +

    OUTBOUND_DATA_ERROR

    +

    This variable will be set to 1 when the response body size is above +the setting configured by SecResponseBodyLimit directive. Your policies + should always contain a rule to check this variable. Depending on the +rate of false positives and your default policy you should decide +whether to block or just warn when the rule is triggered. +

    The best way to use this variable is as in the example below: +

    SecRule OUTBOUND_DATA_ERROR "@eq 1" +"phase:1,t:none,log,pass,msg:'Response Body Larger than +SecResponseBodyLimit Setting'" +

    PATH_INFO

    Contains the extra request URI information, also known as path info. @@ -4237,6 +4423,12 @@ zeroed. urlEncode

    Encodes input string using URL encoding.

    +

    utf8toUnicode

    +

    Converts all UTF-8 characters sequences to Unicode. This help input +normalization specially for non-english languages minimizing +false-positives and false-negatives. (available with 2.7.0) +

    sha1

    Calculates a SHA1 hash from the input string. The computed hash is in a raw binary form and may need encoded into text to be printed (or @@ -4448,9 +4640,9 @@ AND. The disruptive actions specified in the first portion of the chained rule will be triggered only if all of the variable checks return positive hits. If any one aspect of a chained rule comes back negative, then the entire rule chain will fail to match. Also note that -disruptive actions, execution phases, metadata actions (id, rev, msg), -skip, and skipAfter actions can be specified only by the chain starter -rule. +disruptive actions, execution phases, metadata actions (id, rev, msg, +tag, severity, logdata), skip, and skipAfter actions can be specified +only by the chain starter rule.

    The following directives can be used in rule chains:

    @@ -4788,10 +4980,10 @@ SecRule ARGS "test" "phase:2,log,pass,setvar:TX.test=+1"

    Description: Pauses transaction processing for the specified number of milliseconds. Starting with ModSecurity 2.7 this feature also supports macro expansion. -

    Action Group: Non-disruptive +

    Action Group: Disruptive

    Example:

    -
    SecRule REQUEST_HEADERS:User-Agent "Test" "log,deny,status:403,pause:5000"
+
    SecRule REQUEST_HEADERS:User-Agent "Test" "log,pause:5000"
 
    
 
     Warning 
     This feature can be of limited benefit 
 for slowing down brute force authentication attacks, but use with care. 
@@ -5064,6 +5256,9 @@ SecRule TX:SESSIONID "!(?i:\;? ?httponly;?)" "phase:3,t:none,setenv:httponl
 
 Header set Set-Cookie "%{httponly_cookie}e; HTTPOnly" env=httponly_cookie
    +
    Note 
    When used in a chain this action will be +execute when an individual rule matches and not the entire chain. +

    setvar

    Description: Creates, removes, or updates a variable. Variable names are case-insensitive. @@ -5083,6 +5278,9 @@ block,msg:'Blind SQL Injection Attack',id:'959517',tag:'WEB_ATTACK/SQL_INJECTION tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, \ setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}" +

    Note 
    When used in a chain this action will be +execute when an individual rule matches and not the entire chain. +

    skip

    Description: Skips one or more rules (or chains) on successful match. @@ -6233,16 +6431,16 @@ SecCookieFormat 0 - +

    Retrieved from "https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    +href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual">http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    @@ -6255,30 +6453,18 @@ href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Refere @@ -6288,24 +6474,6 @@ href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Refere
    @@ -6313,7 +6481,7 @@ contributions @@ -6322,24 +6490,24 @@ href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Main_P
    @@ -6364,25 +6532,22 @@ value="Search" title="Search the pages for this text" type="submit">
    @@ -6394,15 +6559,15 @@ href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Refere src="Reference_Manual_files/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki"> - +