study2study

1. ModSecurity
@n0ts
Naoya Nakazawa
study2study #3
27/04/2011

2. Naoya Nakazawa
@n0ts
http://www.sssg.org/blogs/naoya/ - Carpe Diem

3. NO
SOURCE CODE
※ @smellman

5. ModSecurity

7. Open Source Web
Application Firewall

8. 4 Projects

9. ModSecurity for Apache
Apache
Apache

10. ModSecurity Core
Rule Set
CRS

11. ModProfiler
ModSecurity

12. Overview
HTTP

13. !!!

14. # yum info mod_security
Available Packages
Name : mod_security
Arch : x86_64
Version : 2.5.12
Release : 1.el5
Size : 1.0 M
Repo : epel
Summary : Security module for the Apache HTTP Server
URL : http:/ /www.modsecurity.org/
License : GPLv2
Description: ModSecurity is an open source intrusion detection and
prevention
: engine for web applications. It operates embedded into the web
: server, acting as a powerful umbrella - shielding web
applications
: from attacks.

15. /etc/httpd/modsecurity.d
|-- base_rules ... 28 files
|-- modsecurity_crs_10_config.conf
|-- modsecurity_localrules.conf
`-- optional_rules ... 9files

16. ...

17. modsecurity_crs_10_config.conf
ModSecuriry

18. SecComponentSignature "core ruleset/2.0.5"
ModSecurity

19. SecAction
"phase:1,t:none,pass,nolog,initcol:global=global,initcol:ip=%{remote_addr}"
1
3 SecRule
SecAction action1,action2,action3...
phase1

20. Phase:1
Phase:2
Phase:3
Phase:4
Phase:5

21. SecAction
"phase:1,t:none,pass,nolog,initcol:global=global,initcol:ip=%{remote_addr}"
t:none
pass
nolog
initcol:global=global
global
initcol:ip=%{remote_addr}
ip %{remote_addr} IP

22. SecAction "phase:1,t:none,nolog,pass,setvar:tx.paranoid_mode=0"
SecAction "phase:1,t:none,nolog,pass,setvar:tx.inbound_anomaly_score_level=20"
SecAction "phase:1,t:none,nolog,pass,setvar:tx.outbound_anomaly_score_level=15"
SecAction "phase:1,t:none,nolog,pass,
setvar:tx.critical_anomaly_score=20,
setvar:tx.error_anomaly_score=15,
setvar:tx.warning_anomaly_score=10,
setvar:tx.notice_anomaly_score=5"
SecAction "phase:1,t:none,nolog,pass,setvar:tx.max_num_args=255"
SecAction "phase:1,t:none,nolog,pass,
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS',
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded multipart/form-data
text/xml application/xml',
setvar:'tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1',
setvar:'tx.restricted_extensions=.asa .asax .ascx .axd .backup .bak .bat .cdx .cer .cfg .cmd .com
.config .conf .cs .csproj .csr .dat .db .dbf .dll .dos .htr .htw .ida .idc .idq .inc .ini .key .licx .lnk .log
.mdb .old .pass .pdb .pol .printer .pwd .resources .resx .sql .sys .vb .vbs .vbproj .vsdisco .webinfo .xsd
.xsx',
setvar:'tx.restricted_headers=Proxy-Connection Lock-Token Content-Range Translate via if'"

23. SecDefaultAction "phase:2,pass"
phase:2 pass

24. SecRuleEngine On
On ModSecurity

25. modsecurity_localrules.conf

26. /base_rules
study2study

27. SecAuditEngine On
SecAuditLog On
SecAuditLog logs/mod_security_audit.log

29. Apache

30. END

31. http://sourceforge.net/apps/mediawiki/
mod-security/index.php