salt
/
apache-formula
sforkowany z ExternalMirrors/apache-formula
Obserwuj 1
Polub 0
Forkuj 0
Kod Wydania 0 Aktywność
Saltstack Official Apache Formula
Nie możesz wybrać więcej, niż 25 tematów Tematy muszą się zaczynać od litery lub cyfry, mogą zawierać myślniki ('-') i mogą mieć do 35 znaków.
384 Commity
1 Gałąź
Drzewo: d3110f93f6
Gałęzie Tagi
${ item.name }
Utwórz gałąź ${ searchTerm }
z 'd3110f93f6'
${ noResults }
apache-formula/apache/files/RedHat/modsecurity.conf.jinja

76 lines
3.4KB
Czysty Wina Historia 

  1. {%- set apache = pillar.get('apache', {}) %}

  2. {%- set modsec = apache.get('mod_security', {}) %}

  3. {%- set sec_rule_engine = modsec.get('sec_rule_engine', 'DetectionOnly' ) -%}

  4. {%- set sec_request_body_access = modsec.get('sec_request_body_access', 'On' ) -%}

  5. {%- set sec_request_body_limit = modsec.get('sec_request_body_limit', 13107200 ) -%}

  6. {%- set sec_request_body_no_files_limit = modsec.get('sec_request_body_no_files_limit', 131072 ) -%}

  7. {%- set sec_request_body_in_memory_limit = modsec.get('sec_request_body_in_memory_limit', 131072 ) -%}

  8. {%- set sec_request_body_limit_action = modsec.get('sec_request_body_limit_action', 'Reject' ) -%}

  9. {%- set sec_pcre_match_limit = modsec.get('sec_pcre_match_limit', 1000 ) -%}

  10. {%- set sec_pcre_match_limit_recursion = modsec.get('sec_pcre_match_limit_recursion', 1000 ) -%}

  11. {%- set sec_debug_log_level = modsec.get('sec_debug_log_level', 0 ) -%}

  12. #

  13. # This file is managed/autogenerated by salt.

  14. # Modify the salt pillar that generates this file instead

  15. #

  16. 

  17. LoadModule security2_module modules/mod_security2.so

  18. 

  19. <IfModule !mod_unique_id.c>

  20.     LoadModule unique_id_module modules/mod_unique_id.so

  21. </IfModule>

  22. <IfModule mod_security2.c>

  23.     # ModSecurity Core Rules Set configuration

  24. 	Include modsecurity.d/*.conf

  25. 	Include modsecurity.d/activated_rules/*.conf

  26.     

  27.     # Default recommended configuration

  28.     SecRuleEngine {{ sec_rule_engine }}

  29.     SecRequestBodyAccess {{ sec_request_body_access }}

  30.     SecRule REQUEST_HEADERS:Content-Type "text/xml" \

  31.          "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"

  32.     SecRequestBodyLimit {{ sec_request_body_limit }}

  33.     SecRequestBodyNoFilesLimit {{ sec_request_body_no_files_limit }}

  34.     SecRequestBodyInMemoryLimit {{ sec_request_body_in_memory_limit }}

  35.     SecRequestBodyLimitAction {{ sec_request_body_limit_action }}

  36.     SecRule REQBODY_ERROR "!@eq 0" \

  37.     "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

  38.     SecRule MULTIPART_STRICT_ERROR "!@eq 0" \

  39.     "id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body \

  40.     failed strict validation: \

  41.     PE %{REQBODY_PROCESSOR_ERROR}, \

  42.     BQ %{MULTIPART_BOUNDARY_QUOTED}, \

  43.     BW %{MULTIPART_BOUNDARY_WHITESPACE}, \

  44.     DB %{MULTIPART_DATA_BEFORE}, \

  45.     DA %{MULTIPART_DATA_AFTER}, \

  46.     HF %{MULTIPART_HEADER_FOLDING}, \

  47.     LF %{MULTIPART_LF_LINE}, \

  48.     SM %{MULTIPART_MISSING_SEMICOLON}, \

  49.     IQ %{MULTIPART_INVALID_QUOTING}, \

  50.     IP %{MULTIPART_INVALID_PART}, \

  51.     IH %{MULTIPART_INVALID_HEADER_FOLDING}, \

  52.     FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

  53. 

  54.     SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \

  55.     "id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"

  56. 

  57.     SecPcreMatchLimit {{ sec_pcre_match_limit }}

  58.     SecPcreMatchLimitRecursion {{ sec_pcre_match_limit_recursion }}

  59. 

  60.     SecRule TX:/^MSC_/ "!@streq 0" \

  61.             "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

  62. 

  63.     SecResponseBodyAccess Off

  64.     SecDebugLog /var/log/httpd/modsec_debug.log

  65.     SecDebugLogLevel {{ sec_debug_log_level }}

  66.     SecAuditEngine RelevantOnly

  67.     SecAuditLogRelevantStatus "^(?:5|4(?!04))"

  68.     SecAuditLogParts ABIJDEFHZ

  69.     SecAuditLogType Serial

  70.     SecAuditLog /var/log/httpd/modsec_audit.log

  71.     SecArgumentSeparator &

  72.     SecCookieFormat 0

  73.     SecTmpDir /var/lib/mod_security

  74.     SecDataDir /var/lib/mod_security

  75. </IfModule>