Running Apache 2.2.x, modSecurity 2.8.0
I'm trying to get something like this working:
# Default recommended configuration
SecRuleEngine DetectionOnly
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
<Location "/PublicApp/CandidatesPortal">
SecRuleEngine On
</Location>
The SecEngine always stays in Detection mode though even when I hit pages like
http://localhost/PublicApp/CandidatesPortal/MyProfile.cfm
I've also tried LocaitonMatch in case it was an apache config issue.
<LocationMatch "CandidatesPortal">
I see plenty of ways to 'disable' it per directory, but that's not what I'm looking for in our testing process.
Is there not a way to increase the SecRuleEngine setting per directory without whitelisting everything except for the directory I want scanned?
---Update Fri, Mar24@10:49am
So, per recommendation by @BazzaDP I've changed the config to look like
LoadFile bin\libxml2.dll
LoadFile bin\pcre.dll
LoadFile bin\libcurl.dll
LoadFile bin\yajl.dll
LoadModule security2_module modules\mod_security2.so
<IfModule !mod_unique_id.c>
LoadModule unique_id_module modules/mod_unique_id.so
</IfModule>
<IfModule mod_security2.c>
# ModSecurity Core Rules Set configuration
Include conf/modsecurity.d/*.conf
Include conf/modsecurity.d/activated_rules/*.conf
# Default recommended configuration
SecRuleEngine On
# Settings options: DetectionOnly,On,Off
# Only enable full security on candidate facing pages.
SecRule REQUEST_URI "@beginsWith /PublicApp/CandidatesPortal" "phase:1,id:12346,ctl:ruleEngine=On,pass"
SecRule REQUEST_URI "@beginsWith /" "phase:1,id:12345,ctl:ruleEngine=Off,pass"
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body \
failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess Off
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog logs/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecTmpDir C:\web\Apache2.2\mod_security
SecDataDir C:\web\Apache2.2\mod_security
`
Notice, I still need to whitelist the whole rest of the site except for inside that singular directory where I want 'ruleEngine=On'.
Based on what I'm understanding I can't change SecRuleEngine to Off and then have the @beginswith command enable it dynamically.
BTW the above solution does not work. What am I still missing? I'm clearly misunderstanding how this rules system works.
Just tried:
SecRule REQUEST_URI "^(?!\/PublicApp\/CandidatesPortal\/).*$" "id:10001,phase:1,allow,log"
which also seems to not be working.
--- Update 2017/3/24 @ 4:47pm.
got it working by putting
SecRule REQUEST_HEADERS:REFERER "^(?!.*\/PublicApp\/CandidatesPortal).*$" "id:10001,phase:1,allow"
in a new rules file called
modsecurity_crs_15_customrules.conf
