仅为特定目录启用 modsecurity SecRuleEngine On

2024-5-31 • tag-icon

运行 Apache 2.2.x、modSecurity 2.8.0

我正在尝试让这样的事情发挥作用：

# Default recommended configuration
  SecRuleEngine DetectionOnly 
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
  <Location "/PublicApp/CandidatesPortal">
     SecRuleEngine On
  </Location>

即使我点击以下页面，SecEngine 也始终处于检测模式 http://localhost/PublicApp/CandidatesPortal/MyProfile.cfm

我还尝试了 LocaitonMatch，以防它是 apache 配置问题。

<LocationMatch "CandidatesPortal">

我看到了很多在每个目录中“禁用”它的方法，但这不是我在我们的测试过程中所寻找的。

有没有办法增加每个目录的 SecRuleEngine 设置，而无需将我想要扫描的目录之外的所有内容列入白名单？

---更新星期五, 3 月 24 日@10:49am

因此，根据 @BazzaDP 的建议，我将配置更改为如下形式

LoadFile bin\libxml2.dll
LoadFile bin\pcre.dll
LoadFile bin\libcurl.dll
LoadFile bin\yajl.dll

LoadModule security2_module modules\mod_security2.so

<IfModule !mod_unique_id.c>
     LoadModule unique_id_module modules/mod_unique_id.so
</IfModule>
<IfModule mod_security2.c>
# ModSecurity Core Rules Set configuration
Include conf/modsecurity.d/*.conf
Include conf/modsecurity.d/activated_rules/*.conf

# Default recommended configuration
SecRuleEngine On
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
SecRule REQUEST_URI "@beginsWith /PublicApp/CandidatesPortal" "phase:1,id:12346,ctl:ruleEngine=On,pass"
SecRule REQUEST_URI "@beginsWith /" "phase:1,id:12345,ctl:ruleEngine=Off,pass"
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body \
failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"

SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

SecRule TX:/^MSC_/ "!@streq 0" \
        "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

SecResponseBodyAccess Off
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog logs/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecTmpDir C:\web\Apache2.2\mod_security
SecDataDir C:\web\Apache2.2\mod_security

请注意，除了我想要“ruleEngine = On”的单个目录之外，我仍然需要将整个网站的其余部分列入白名单。

根据我的理解，我无法将 SecRuleEngine 更改为 Off，然后让 @beginswith 命令动态启用它。

顺便说一句，上述解决方案不起作用。我还遗漏了什么？我显然误解了这个规则系统的工作原理。

刚刚尝试过：

SecRule REQUEST_URI "^(?!\/PublicApp\/CandidatesPortal\/).*$" "id:10001,phase:1,allow,log"

这似乎也不起作用。

--- 更新于 2017/3/24 @ 下午 4:47。

通过放置来工作

SecRule REQUEST_HEADERS:REFERER "^(?!.*\/PublicApp\/CandidatesPortal).*$" "id:10001,phase:1,allow"

在名为

modsecurity_crs_15_customrules.conf

答案1

类似这个答案：https://stackoverflow.com/questions/42829492/how-to-add-mod-security-exception/42832490#42832490

SecRuleEngine 无法像这样动态指定，因此您应该使用 MdSecurity 规则来启动 ModSecurity 模式。例如：

SecRule REQUEST_URI "@beginsWith /PublicApp/CandidatesPortal" "phase:1,id:12345,ctl:ruleEngine=On,pass"

答案2

--- 更新于 2017/3/24 @ 下午 4:47。

通过放置来工作

SecRule REQUEST_HEADERS:REFERER "^(?!.*\/PublicApp\/CandidatesPortal).*$" "id:10001,phase:1,allow"

在名为

modsecurity_crs_15_customrules.conf

答案1

答案2

相关内容