☰

mod_security 无法添加 OWASP CRS - CentOS 7

tag-icon • tag-icon apache-2.4 mod-security
mod_security 无法添加 OWASP CRS - CentOS 7

自从我设置虚拟服务器并安装 WordPress 以来，我的网站一直受到黑客的不断攻击。我能够安装 mod_security，但是无法添加 OWASP CSR。我一直在关注这个教程：https://devops.profitbricks.com/tutorials/how-to-configure-modsecurity-and-mod_evasive-for-apache-on-centos-7/

一切都进行得相当顺利，直到我应该在我的 apache 配置文件（httpd.conf）末尾添加以下内容：

<IfModule security2_module>
Include /etc/httpd/crs/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Include /etc/httpd/crs/owasp-modsecurity-crs/base_rules/*.conf
</IfModule>

当我将上述代码添加到我的 Apache 配置文件并重新启动我的 Apache 服务器时，我的网站仅显示 Apache 测试屏幕 - 表示某种错误。如能得到任何帮助，我将不胜感激！（我使用的是 Apache 2.4）

mod_security.conf 文件：

LoadModule security2_module modules/mod_security2.so
<IfModule mod_security2.c>
# ModSecurity Core Rules Set configuration
IncludeOptional modsecurity.d/*.conf
IncludeOptional modsecurity.d/activated_rules/*.conf
# Default recommended configuration
SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body \
failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"

SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

SecRule TX:/^MSC_/ "!@streq 0" \
        "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

SecResponseBodyAccess Off
SecDebugLog /var/log/httpd/modsec_debug.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/httpd/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecTmpDir /var/lib/mod_security
SecDataDir /var/lib/mod_security
</IfModule>

答案1

什么是 mod_security.conf？这是您的 Apache 的自定义包含吗？

无论如何，我建议从 OWASP 下载一份新的规则副本 -https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project）

请查看以下指南：https://www.linode.com/docs/websites/apache-tips-and-tricks/modsecurity-on-apache

相关内容