ModSec Rules - Update
Aus HS Syswiki
(Unterschied zwischen Versionen)
Mrh (Diskussion | Beiträge) (→Update of ModSec Rules) |
Mrh (Diskussion | Beiträge) (→Update of ModSec Rules) |
||
Zeile 49: | Zeile 49: | ||
'''Attention:''' Comment our whole Block sticking together, like this: | '''Attention:''' Comment our whole Block sticking together, like this: | ||
<pre> | <pre> | ||
+ | #<LocationMatch "/index\.php$"> | ||
#SecRule REQUEST_METHOD "@streq POST" \ | #SecRule REQUEST_METHOD "@streq POST" \ | ||
# "id:220240,chain,msg:'COMODO WAF: found CVE 2013-5576 attack',phase:2,deny,status:403,log" | # "id:220240,chain,msg:'COMODO WAF: found CVE 2013-5576 attack',phase:2,deny,status:403,log" | ||
Zeile 60: | Zeile 61: | ||
# "chain" | # "chain" | ||
#SecRule MULTIPART_FILENAME "@rx \..+\.$" | #SecRule MULTIPART_FILENAME "@rx \..+\.$" | ||
+ | #</LocationMatch> | ||
</pre> | </pre> |
Version vom 12. August 2015, 11:36 Uhr
Update of ModSec Rules
1. Download from https://waf.comodo.com/user/cwaf_revisions
2. Go to a temporary (or your own) directory:
mkdir cwaf_rules_<ver> cd cwaf_rules_<ver> tar xvzf ../tar xvzf ../cwaf_rules-<ver>.tgz
3. Comment out rules with mentioned IDs within those files:
02_Global_Agents.conf: 210830 07_XSS_XSS.conf: 212660 212510 212540 212750 213020 212800 25_Apps_Joomla.conf: 220240 31_Apps_OtherApps.conf: 222131 20_Outgoing_FilterInFrame.conf: 214530 21_Outgoing_FiltersEnd.conf: 214940 16_Outgoing_FilterPHP.conf: 214420 28_Apps_WPPlugin.conf: 226680
4. Change standard error code (because fail2ban watches for this status code for modsec action):
sed -i 's|status:403|status:510|g' *
Attention: Comment our whole Block sticking together, like this:
#<LocationMatch "/index\.php$"> #SecRule REQUEST_METHOD "@streq POST" \ # "id:220240,chain,msg:'COMODO WAF: found CVE 2013-5576 attack',phase:2,deny,status:403,log" #SecRule ARGS_GET:option "@streq com_media" \ # "chain" #SecRule ARGS_GET:task "@rx ^file\.upload$" \ # "chain" #SecRule ARGS_GET:tmpl "@streq component" \ # "chain" #SecRule FILES_NAMES "@rx ^Filedata\[\]$" \ # "chain" #SecRule MULTIPART_FILENAME "@rx \..+\.$" #</LocationMatch>