![仅为特定目录启用 modsecurity SecRuleEngine On](https://linux22.com/image/701256/%E4%BB%85%E4%B8%BA%E7%89%B9%E5%AE%9A%E7%9B%AE%E5%BD%95%E5%90%AF%E7%94%A8%20modsecurity%20SecRuleEngine%20On.png)
运行 Apache 2.2.x、modSecurity 2.8.0
我正在尝试让这样的事情发挥作用:
# Default recommended configuration
SecRuleEngine DetectionOnly
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
<Location "/PublicApp/CandidatesPortal">
SecRuleEngine On
</Location>
即使我点击以下页面,SecEngine 也始终处于检测模式
http://localhost/PublicApp/CandidatesPortal/MyProfile.cfm
我还尝试了 LocaitonMatch,以防它是 apache 配置问题。
<LocationMatch "CandidatesPortal">
我看到了很多在每个目录中“禁用”它的方法,但这不是我在我们的测试过程中所寻找的。
有没有办法增加每个目录的 SecRuleEngine 设置,而无需将我想要扫描的目录之外的所有内容列入白名单?
---更新 星期五, 3 月 24 日@10:49am
因此,根据 @BazzaDP 的建议,我将配置更改为如下形式
LoadFile bin\libxml2.dll
LoadFile bin\pcre.dll
LoadFile bin\libcurl.dll
LoadFile bin\yajl.dll
LoadModule security2_module modules\mod_security2.so
<IfModule !mod_unique_id.c>
LoadModule unique_id_module modules/mod_unique_id.so
</IfModule>
<IfModule mod_security2.c>
# ModSecurity Core Rules Set configuration
Include conf/modsecurity.d/*.conf
Include conf/modsecurity.d/activated_rules/*.conf
# Default recommended configuration
SecRuleEngine On
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
SecRule REQUEST_URI "@beginsWith /PublicApp/CandidatesPortal" "phase:1,id:12346,ctl:ruleEngine=On,pass"
SecRule REQUEST_URI "@beginsWith /" "phase:1,id:12345,ctl:ruleEngine=Off,pass"
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body \
failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess Off
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog logs/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecTmpDir C:\web\Apache2.2\mod_security
SecDataDir C:\web\Apache2.2\mod_security
`
请注意,除了我想要“ruleEngine = On”的单个目录之外,我仍然需要将整个网站的其余部分列入白名单。
根据我的理解,我无法将 SecRuleEngine 更改为 Off,然后让 @beginswith 命令动态启用它。
顺便说一句,上述解决方案不起作用。我还遗漏了什么?我显然误解了这个规则系统的工作原理。
刚刚尝试过:
SecRule REQUEST_URI "^(?!\/PublicApp\/CandidatesPortal\/).*$" "id:10001,phase:1,allow,log"
这似乎也不起作用。
--- 更新于 2017/3/24 @ 下午 4:47。
通过放置来工作
SecRule REQUEST_HEADERS:REFERER "^(?!.*\/PublicApp\/CandidatesPortal).*$" "id:10001,phase:1,allow"
在名为
modsecurity_crs_15_customrules.conf
答案1
类似这个答案:https://stackoverflow.com/questions/42829492/how-to-add-mod-security-exception/42832490#42832490
SecRuleEngine 无法像这样动态指定,因此您应该使用 MdSecurity 规则来启动 ModSecurity 模式。例如:
SecRule REQUEST_URI "@beginsWith /PublicApp/CandidatesPortal" "phase:1,id:12345,ctl:ruleEngine=On,pass"
答案2
--- 更新于 2017/3/24 @ 下午 4:47。
通过放置来工作
SecRule REQUEST_HEADERS:REFERER "^(?!.*\/PublicApp\/CandidatesPortal).*$" "id:10001,phase:1,allow"
在名为
modsecurity_crs_15_customrules.conf