Status: Experimentell
Last Update: 14.08.2005
Neu: http://www.modsecurity.org/projects/rules/ (Offizielle ModSecurity Rules)
Siehe auch: http://rootiewiki.de/index.php?pagename ... rityRegeln
Referenz und Quelle für das Rules-Set:
- http://www.modsecurity.org/documentatio ... mples.html
- http://www.modsecurity.org/documentatio ... -rules.txt
- http://www.gotroot.com/downloads/ftp/mod_security/
- http://www.eth0.us/?q=mod_security
Offtopic Anmerkungen zu ModSecurity:
- http://www.rootforum.org/forum/viewtopic.php?t=13531
- http://www.rootforum.org/forum/viewtopic.php?t=34213
Offizielle Dokumentation und weiterführende Links: http://www.modsecurity.org/documentation/index.html
Rules-Set (filter.conf):
Code: Select all
# (bewusst Zeilenumbrüche eingebaut damit es das Boardlayout nicht sprengt.)
# -----------------------------------------------------------------------------
# Start Rules (Gerneric)
# -----------------------------------------------------------------------------
# Enforce proper HTTP requests
SecFilterSelective THE_REQUEST "!HTTP/(0.9|1.0|1.1)$"
# check for bad meta characters in User-Agent field
SecFilterSelective HTTP_USER_AGENT ".*'"
# Require Content-Length to be provided with every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"
# Don't accept transfer encodings we know we don't handle (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"
# Don't accept chunked encodings
SecFilterSelective HTTP_Transfer-Encoding "chunked"
# must have a useragent string
SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"
# Again, this is better protected by removing these functions in php.ini
SecFilterSelective ARGS "(system|exec|passthru|popen|shell_exec|proc_open|fopen|fwrite)s*("
# Prevent path traversal (..) attacks
SecFilter "../"
# generic recursion signature
SecFilterSelective THE_REQUEST "../../"
# generic attack sig
SecFilterSelective THE_REQUEST "cdx20*;(cd|;|echo|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|
wget|id|uname|cvs|svn|(s|r)(cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g++|./)"
# generic filter to prevent SQL injection attacks
SecFilter "[[:space:]]+(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|
describe)[[:space:]]+[A-Z|a-z|0-9|*| |,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|*| |,]"
# generic PHP remote file inclusion attack
SecFilter ".php?" chain
SecFilter "(http|https|ftp):/" chain
SecFilter "cmd=(cd|;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|id|
uname|cvs|svn|(s|r)(cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g++|./)"
# generic sig for more bad PHP functions
SecFilterSelective THE_REQUEST "chr(([0-9]{1,3}))"
SecFilterSelective THE_REQUEST "chr([0-9a-fA-Fx]+)"
# SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"
# SQL injection in cookies
SecFilterSelective COOKIE_sessionid ".*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|
describe)[[:space:]]+[A-Z|a-z|0-9|*||,]+[[:space:]]+(from|into|table|database|index|view)"
# -----------------------------------------------------------------------------
# Start Rules (experimental)
# -----------------------------------------------------------------------------
# experimental generic remote download sig foo IP or FQDN or foo http/https/ftp://whatever
SecFilterSelective THE_REQUEST "(perl|t?ftp|links|elinks|lynx|ncftp|(s|r)(cp|sh)|wget|curl|cvs|svn).*x20((http|https|ftp):/|
[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}|.*[A-Za-z|0-9].[a-zA-Z]{2,4}/)"
SecFilterSelective THE_REQUEST "( |;|/|'|,|&|=|.)((s|r)(sh|cp)) *(.*@.*|(http|https|ftp):/|[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}|.*[A-Za-z|
0-9].[a-zA-Z]{2,4}/)"
# XSS atacks (HTML/Javascript injection)
# SecFilter "<(.|n)+>"
# deactivated since it causes problems with Serendipity when creating new entries
# this is the error message: mod_security-message: Access denied with code 406. Pattern match "<(.|n)+>" at POST_PAYLOAD.
# ff@nodomain.cc, 02.08.2005
# (bewusst Zeilenumbrüche eingebaut damit es das Boardlayout nicht sprengt.)Code: Select all
<IfModule mod_security.c>
# Only inspect dynamic requests
# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
# SecFilterEngine DynamicOnly
# Turn the filtering engine On or Off
SecFilterEngine On
# Reject requests with status 404
SecFilterDefaultAction "deny,log,status:404"
# Some sane defaults
SecServerResponseToken Off
SecFilterScanPOST Off
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding Off
# If you want to scan the output, uncomment these
# SecFilterScanOutput On
# SecFilterOutputMimeTypes "(null) text/html text/plain"
# Accept almost all byte values
SecFilterForceByteRange 1 255
# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/apache/audit_log
# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog /var/log/apache/modsec_debug_log
# Include rules
Include /etc/apache/modsecurity/filter.conf
</IfModule>e1: kleinen Fehler hier sowohl im Wiki korrigiert. :oops:
e2: XSS atacks (HTML/Javascript injection) Regelsatz vorerst als 'experimental' eingestuft, weil es anscheinend bei dem ein oder anderen Probleme gab/gibt.
e3: Modul configuration und Link zum RootieWiki hinzugefügt.
e4: Struktur des Beitrags geändert und Links hinzugefügt, entfernt und korrigiert.
