mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 13:56:01 +03:00
94 lines
7.3 KiB
Plaintext
94 lines
7.3 KiB
Plaintext
Core Rule Set Quick Setup
|
|
=========================
|
|
|
|
To activate the rules for your web server installation:
|
|
|
|
1) Copy the modsecurity_crs_10_config.conf.example file to modsecurity_crs_10_config.conf
|
|
and customize the settings for your local environment.
|
|
|
|
The modsecurity_crs_10_config.conf file includes management rules and directives
|
|
that can control important CRS functions. Pay attention to
|
|
the SecRuleEngine setting (On by default) and that the SecDefaultAction
|
|
directive is set to "pass". The 49 inbound blocking and 59 outbound blocking
|
|
rules files use the "block" action which
|
|
inherits this setting. This effectively means that you can toggle the
|
|
SecDefaultAction setting to decide if you would like to deny on an
|
|
anomaly scoring/correlation match.
|
|
|
|
Update the PARANOID_MODE variable setting if you want to become more
|
|
aggressive in your detection. Caution - this will cause more false positives.
|
|
|
|
Update the appropriate anomaly scoring levels that will be propagated
|
|
to the inbound/outbound blocking files.
|
|
|
|
Update the TX policy settings for allowed Request Methods, File Extensions, etc...
|
|
|
|
2) Enable the CRS rules files you want to use by creating symlinks under the
|
|
"activated_rules" directory location. You will want to create symlinks for the
|
|
following:
|
|
|
|
1) The main modsecurity_crs_10_config.conf file
|
|
2) Any rules from the base_rules directory
|
|
3) Any remaining rules from the optional_rules, slr_rules or experimental_rules directories
|
|
|
|
$ pwd
|
|
/usr/local/apache/conf/crs
|
|
$ ls
|
|
CHANGELOG app_sensor modsecurity_crs_10_config.conf slr_rules
|
|
LICENSE base_rules modsecurity_crs_10_config.conf.example util
|
|
README experimental_rules modsecurity_crs_15_customrules.conf
|
|
activated_rules lua optional_rules
|
|
$ sudo ln -s /usr/local/apache/conf/crs/modsecurity_crs_10_config.conf activated_rules/modsecurity_crs_10_config.conf
|
|
$ for f in `ls base_rules/` ; do sudo ln -s /usr/local/apache/conf/crs/base_rules/$f activated_rules/$f ; done
|
|
$ for f in `ls optional_rules/ | grep comment_spam` ; do sudo ln -s /usr/local/apache/conf/crs/optional_rules/$f activated_rules/$f ; done
|
|
$ ls -l activated_rules
|
|
total 216
|
|
lrwxr-xr-x 1 root wheel 52 May 17 14:01 GsbMalware.dat -> /usr/local/apache/conf/crs/base_rules/GsbMalware.dat
|
|
lrwxr-xr-x 1 root wheel 68 May 17 14:01 modsecurity_35_bad_robots.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_35_bad_robots.data
|
|
lrwxr-xr-x 1 root wheel 66 May 17 14:01 modsecurity_35_scanners.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_35_scanners.data
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_40_generic_attacks.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_40_generic_attacks.data
|
|
lrwxr-xr-x 1 root wheel 79 May 17 14:01 modsecurity_41_sql_injection_attacks.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_41_sql_injection_attacks.data
|
|
lrwxr-xr-x 1 root wheel 74 May 17 14:14 modsecurity_42_comment_spam.data -> /usr/local/apache/conf/crs/optional_rules/modsecurity_42_comment_spam.data
|
|
lrwxr-xr-x 1 root wheel 66 May 17 14:01 modsecurity_50_outbound.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_50_outbound.data
|
|
lrwxr-xr-x 1 root wheel 74 May 17 14:01 modsecurity_50_outbound_malware.data -> /usr/local/apache/conf/crs/base_rules/modsecurity_50_outbound_malware.data
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_crs_14_customrules.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_14_customrules.conf
|
|
lrwxr-xr-x 1 root wheel 57 May 17 14:22 modsecurity_crs_10_config.conf -> /usr/local/apache/conf/crs/modsecurity_crs_10_config.conf
|
|
lrwxr-xr-x 1 root wheel 81 May 17 14:01 modsecurity_crs_20_protocol_violations.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_20_protocol_violations.conf
|
|
lrwxr-xr-x 1 root wheel 80 May 17 14:01 modsecurity_crs_21_protocol_anomalies.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf
|
|
lrwxr-xr-x 1 root wheel 76 May 17 14:01 modsecurity_crs_23_request_limits.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_23_request_limits.conf
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_crs_30_http_policy.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_30_http_policy.conf
|
|
lrwxr-xr-x 1 root wheel 72 May 17 14:01 modsecurity_crs_35_bad_robots.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_35_bad_robots.conf
|
|
lrwxr-xr-x 1 root wheel 77 May 17 14:01 modsecurity_crs_40_generic_attacks.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_40_generic_attacks.conf
|
|
lrwxr-xr-x 1 root wheel 83 May 17 14:01 modsecurity_crs_41_sql_injection_attacks.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_crs_41_xss_attacks.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_41_xss_attacks.conf
|
|
lrwxr-xr-x 1 root wheel 78 May 17 14:14 modsecurity_crs_42_comment_spam.conf -> /usr/local/apache/conf/crs/optional_rules/modsecurity_crs_42_comment_spam.conf
|
|
lrwxr-xr-x 1 root wheel 76 May 17 14:01 modsecurity_crs_42_tight_security.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_42_tight_security.conf
|
|
lrwxr-xr-x 1 root wheel 69 May 17 14:01 modsecurity_crs_45_trojans.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_45_trojans.conf
|
|
lrwxr-xr-x 1 root wheel 79 May 17 14:01 modsecurity_crs_47_common_exceptions.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_47_common_exceptions.conf
|
|
lrwxr-xr-x 1 root wheel 86 May 17 14:01 modsecurity_crs_48_local_exceptions.conf.example -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_48_local_exceptions.conf.example
|
|
lrwxr-xr-x 1 root wheel 78 May 17 14:01 modsecurity_crs_49_inbound_blocking.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_49_inbound_blocking.conf
|
|
lrwxr-xr-x 1 root wheel 70 May 17 14:01 modsecurity_crs_50_outbound.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_50_outbound.conf
|
|
lrwxr-xr-x 1 root wheel 79 May 17 14:01 modsecurity_crs_59_outbound_blocking.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_59_outbound_blocking.conf
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_crs_60_correlation.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_60_correlation.conf
|
|
lrwxr-xr-x 1 root wheel 73 May 17 14:01 modsecurity_crs_60_customrules.conf -> /usr/local/apache/conf/crs/base_rules/modsecurity_crs_60_customrules.conf
|
|
|
|
|
|
3) Add the following line to your httpd.conf (assuming
|
|
you've placed the rule files into conf/crs/):
|
|
|
|
<IfModule security2_module>
|
|
Include conf/crs/modsecurity_crs_10_config.conf
|
|
Include conf/crs/activated_rules/*.conf
|
|
</IfModule>
|
|
|
|
3) Restart web server.
|
|
|
|
4) Make sure your web sites are still running fine.
|
|
|
|
5) Simulate an attack against the web server. Then check
|
|
the attack was correctly logged in the Apache error log,
|
|
ModSecurity debug log (if you enabled it) and ModSecurity
|
|
audit log (if you enabled it).
|
|
|
|
|