ModSecurity - Efficient and Free WAF Component for Mid- and Small-Scale Webmasters

Original Author: Lei Xi
According to posting requirements, an "@" must be added in front of all http links.

Introduction

ModSecurity is a free open source host WAF software (@http://www.modsecurity.org/). The newest version on the official website is 2.9.1. It supports nginx/apache/iis (32 and 64 bits). It mainly acts as an extension module of web applications, recognizes malicious external web attacks according to related rule files, and further discards them.

Installation

nginx/apache

In Linux, if your application is nginx/apache, you have to compile nginx/apache and add the ModSecurity source code as a module.

1. Preparations

• nginx ： @http://nginx.org/
• modsecurity for Nginx: @https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz
• OWASP rule set： @https://github.com/SpiderLabs/owasp-modsecurity-crs

2. Dependencies

Nginx Dependencies: (Pcre, zlib, and openssl are available in centos 6.5 and above) yum install zlib zlib-devel opensslopenssl-devel pcre pcre-devel
ModSecurity Dependencies: pcre @httpd-devellibxml2 apr
yum install @httpd-devel apr apr-util-develapr-devel pcre pcre-devel libxml2 libxml2-devel

3. Enable and Compile Standalone Module
Download and unzip modsecurity fornginx, and execute the following directories after entering unzipping:

./autogen.sh
./configure --enable-standalone-module--disable-mlogc
make

4. Add ModSecurity module to nginx

After compiling Standalone, add the ModSecurity module via "--add-module" during nginx compilation:

./configure--add-module=/root/modsecurity-2.9.1/nginx/modsecurity/  --prefix=/opt/tengine
make && make install

5. Add Rules

ModSecurity is intended to filter and stop web hazards. Its power comes from its rules. Rules provided by OWASP are maintained by volunteers, and are called core rules (CRS). They are reliable and powerful, but they can also be customized to meet different requirements.

a. Download OWASP rules:

git clone ~@https://github.com/SpiderLabs/owasp-modsecurity-crs

mv owasp-modsecurity-crs /opt/tengine/conf/
cd/opt/tengine/conf/owasp-modsecurity-crs && mvmodsecurity_crs_10_setup.conf.example modsecurity_crs_10_setup.conf

b. Enable OWASP rules:

Copy modsecurity.conf-recommended and unicode.mapping under the ModSecurity source code directory to the nginx conf subdirectory, and rename modsecurity.conf-recommended to modsecurity.conf.

Edit the file modsecurity.conf and set SecRuleEngine to On. The default value DetectOnly is the observation mode. It is recommended that you use this mode by default during installation, and observe whether it has an unexpected influence on the website and server.

There are a lot of folders for storing rules in owasp-modsecurity-crs such as base_rules, experimental_rules, optional_rules, and slr_rules. You can enable the rules you need by including them in modsecurity.conf

Includeowasp-modsecurity-crs/modsecurity_crs_10_setup.conf
Includeowasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Include owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf
Includeowasp-modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf
Include owasp-modsecurity-crs/base_rules /modsecurity_crs_45_trojans.confwebshell

//Considering the probable impact on the performance of the host, it is recommended you only add defense rules for critical vulnerabilities to defend against the most current critical web attacks.

For the details of the overall rules, please refer to @[url]http://www.2cto.com/Article/201409/334251.html[/url]. You can add rules based on your website's individual requirements.

Note: nginx parses the @http request in a different way from apache. Therefore, some rules cannot be used in nginx. For more details, please refer to
nginxmodule :more_set_headers (@http://comments.gmane.org/gmane.comp.apache.mod-security.owasp-crs/962)

6. Configure nginx

Add the following lines to the location of the ModSecurity host that needs to be enabled:
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
The following are example configurations of PHP virtual host conf or the vhost file:

server {
     listen      80;
     server_name xxx.com www.xxx.com;
     location ~ \.php$ {
     ModSecurityEnabled on;  
     ModSecurityConfig modsecurity.conf;
     root /web/webroot;
     index index.php index.html index.htm;
     fastcgi_pass   127.0.0.1:9000;
     fastcgi_index  index.php;
      fastcgi_param  SCRIPT_FILENAME  $Document_root$fastcgi_script_name;
     include        fastcgi_params;
     }
  }

IIS

The IIS official website provides the MSI installation file. Download and install it.

1. Preparations

• ModSecurity V2.9.1 for IIS MSI Install-32、64bits @http://www.modsecurity.org/download.html
• Microsoft VisualC++ 2013 Redistributable Package @https://www.microsoft.com/en-gb/download/details.aspx?id=40784

2. Installation

1. Install the package above.
2. Find the ModSecurity line in C:WindowsSystem32inetsrvconfigapplicationHost.config, and change it to <sectionname="ModSecurity" overrideModeDefault="Allow"allowDefinition="Everywhere" /></sectionGroup>
3. Find modsecurity.conf under the installation directory ModSecurity IIS of ModSecurrity, and change "SecRuleEngine" to "On".
4. Add the following configurations to the file web.config under the root directory of the web <?xmlversion="1.0" encoding="UTF-8"?> <configuration> d. <system.webServer> <ModSecurityenabled="true" configFile=" C:ProgramFilesModSecurity IISmodsecurity_iis.conf " /> </system.webServer> </configuration>
5. Reload the website.

Results

Systems that have been tested so far include Centos6 and Windows Server2008/2012. They have been tested and installed successfully. The installation processes on other systems are similar to those described above. It is recommended that you update to the newest stable version of the operating system. The newest version of some operating systems may make significant changes to operational performance, which could potentially cause unforeseen errors during the installation process.

The interception rate was quite high for test scripts, satisfying expectations for intercepting high threat attacks like XSS, SQL injection, file inclusion, and command execution.
As far as other WAF products currently on the market go, Safedog is quite good but some problems still exist in its usability. It lacks adequate Windows compatibility, for example, and some website functionality is unavailable after deployment. Furthermore its defense capabilities in Linux simply don't hold up to ModSecurity.

User maintenance and operation

1. All external attacks that match security rulles will be logged in the Modsecurity_audit.log file. You can use this file to audit defense records.
2. The location of the log is defined in SecAuditLog in the modsecurity.conf file. In linux this location is /var/log/modesec_audit.log by dafault, but you need to set the location yourself in Windwos.
3. ModSecurity provides its own WAF syntax for custom rule creation. If you want to add a custom rule, just add it to the modsecurity.conf file.