ModSec Rules - Update

Update of ModSec Rules

1. Download from https://waf.comodo.com/user/cwaf_revisions

2. Go to a temporary (or your own) directory:

mkdir cwaf_rules_<ver>
cd cwaf_rules_<ver>
tar xvzf ../tar xvzf ../cwaf_rules-<ver>.tgz

3. Comment out rules with mentioned IDs within those files:

02_Global_Agents.conf:
210830

07_XSS_XSS.conf:
212660
212510
212540
212750
213020
212800

25_Apps_Joomla.conf:
220240

31_Apps_OtherApps.conf:
222131

20_Outgoing_FilterInFrame.conf:
214530

21_Outgoing_FiltersEnd.conf:
214940

16_Outgoing_FilterPHP.conf:
214420

28_Apps_WPPlugin.conf:
226680

4. Change standard error code (because fail2ban watches for this status code for modsec action):

sed -i 's|status:403|status:510|g' *

Attention: Comment our whole Block sticking together, like this:

#SecRule REQUEST_METHOD "@streq POST" \
#   "id:220240,chain,msg:'COMODO WAF: found CVE 2013-5576 attack',phase:2,deny,status:403,log"
#SecRule ARGS_GET:option "@streq com_media" \
#   "chain"
#SecRule ARGS_GET:task "@rx ^file\.upload$" \
#   "chain"
#SecRule ARGS_GET:tmpl "@streq component" \
#   "chain"
#SecRule FILES_NAMES "@rx ^Filedata\[\]$" \
#   "chain"
#SecRule MULTIPART_FILENAME "@rx \..+\.$"