2024-09-15 15:04:08 +00:00
<!doctype html> < html lang = en class = no-js > < head > < meta charset = utf-8 > < meta name = viewport content = "width=device-width,initial-scale=1" > < link href = https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/modsecurity/ rel = canonical > < link href = ../../tls/ rel = prev > < link href = ../opentelemetry/ rel = next > < link rel = icon href = ../../../assets/images/favicon.png > < meta name = generator content = "mkdocs-1.5.3, mkdocs-material-9.4.5" > < title > ModSecurity Web Application Firewall - Ingress-Nginx Controller< / title > < link rel = stylesheet href = ../../../assets/stylesheets/main.6a10b989.min.css > < link rel = stylesheet href = ../../../assets/stylesheets/palette.356b1318.min.css > < link rel = preconnect href = https://fonts.gstatic.com crossorigin > < link rel = stylesheet href = "https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback" > < style > : root { --md-text-font : "Roboto" ; --md-code-font : "Roboto Mono" } < / style > < link rel = stylesheet href = ../../../extra.css > < script > _ _md _scope = new URL ( "../../.." , location ) , _ _md _hash = e => [ ... e ] . reduce ( ( e , _ ) => ( e << 5 ) - e + _ . charCodeAt ( 0 ) , 0 ) , _ _md _get = ( e , _ = localStorage , t = _ _md _scope ) => JSON . parse ( _ . getItem ( t . pathname + "." + e ) ) , _ _md _set = ( e , _ , t = localStorage , a = _ _md _scope ) => { try { t . setItem ( a . pathname + "." + e , JSON . stringify ( _ ) ) } catch ( e ) { } } < / script > < / head > < body dir = ltr data-md-color-scheme = default data-md-color-primary = teal data-md-color-accent = green > < input class = md-toggle data-md-toggle = drawer type = checkbox id = __drawer autocomplete = off > < input class = md-toggle data-md-toggle = search type = checkbox id = __search autocomplete = off > < label class = md-overlay for = __drawer > < / label > < div data-md-component = skip > < a href = #modsecurity-web-application-firewall class = md-skip > Skip to content < / a > < / div > < div data-md-component = announce > < / div > < header class = "md-header md-header--shadow md-header--lifted" data-md-component = header > < nav class = "md-header__inner md-grid" aria-label = Header > < a href = ../../.. title = "Ingress-Nginx Controller" class = "md-header__button md-logo" aria-label = "Ingress-Nginx Controller" data-md-component = logo > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" > < path d = "M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z" / > < / svg > < / a > < label class = "md-header__button md-icon" for = __drawer > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" > < path d = "M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2Z" / > < / svg > < / label > < div class = md-header__title data-md-component = header-title > < div class = md-header__ellipsis > < div class = md-header__topic > < span class = md-ellipsis > Ingress-Nginx Controller < / span > < / div > < div class = md-header__topic data-md-component = header-topic > < span class = md-ellipsis > ModSecurity Web Application Firewall < / span > < / div > < / div > < / div > < label class = "md-header__button md-icon" for = __search > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" > < path d = "M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z" / > < / svg > < / label > < div class = md-search data-md-component = search role = dialog > < label class = md-search__overlay for = __search > < / label > < div class = md-search__inner role = search > < form class = md-search__form name = search > < input type = text class = md-search__input name = query aria-label = Search placeholder = Search autocapitalize = off autocorrect = off autocomplete = off spellcheck = false data-md-component = search-query required > < label class = "md-search__icon md-icon" for = __search > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" > < path d = "M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z" / > < / svg > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" > < path d = "M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12Z" / > < / svg > < /lab
2024-07-01 09:06:04 +00:00
< span class = nt > kind< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ConfigMap< / span >
< span class = nt > metadata< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = nt > name< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > modsecurity-plugins< / span >
< span class = nt > data< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = nt > empty-after.conf< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "p p-Indicator" > |< / span >
< span class = w > < / span > < span class = no > # no data< / span >
< span class = w > < / span > < span class = nt > empty-before.conf< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "p p-Indicator" > |< / span >
< span class = w > < / span > < span class = no > # no data< / span >
< span class = w > < / span > < span class = nt > empty-config.conf< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "p p-Indicator" > |< / span >
< span class = w > < / span > < span class = no > # no data< / span >
< span class = w > < / span > < span class = nt > nextcloud-rule-exclusions-before.conf< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = c1 > # this is just a snippet< / span >
< span class = w > < / span > < span class = c1 > # find the full file at https://github.com/coreruleset/nextcloud-rule-exclusions-plugin< / span >
< span class = w > < / span > < span class = c1 > #< / span >
< span class = w > < / span > < span class = c1 > # [ File Manager ]< / span >
< span class = w > < / span > < span class = c1 > # The web interface uploads files, and interacts with the user.< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > SecRule REQUEST_FILENAME " @contains /remote.php/webdav" \< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > " id:9508102,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > phase:1,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > pass,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > t:none,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > nolog,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ver:' nextcloud-rule-exclusions-plugin/1.2.0' ,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveById=920420,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveById=920440,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveById=941000-942999,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveById=951000-951999,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveById=953100-953130,\< / span >
< span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > ctl:ruleRemoveByTag=attack-injection-php" < / span >
< / code > < / pre > < / div > < p > If you're using the helm chart, you can pass in the following parameters in your < code > values.yaml< / code > :< / p > < div class = highlight > < pre > < span > < / span > < code > < span class = nt > controller< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = nt > config< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = c1 > # Enables Modsecurity< / span >
< span class = w > < / span > < span class = nt > enable-modsecurity< / span > < span class = p > :< / span > < span class = w > < / span > < span class = s > " true" < / span >
< span class = w > < / span > < span class = c1 > # Update ModSecurity config and rules< / span >
< span class = w > < / span > < span class = nt > modsecurity-snippet< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "p p-Indicator" > |< / span >
< span class = w > < / span > < span class = no > # this enables the mod security nextcloud plugin< / span >
< span class = w > < / span > < span class = no > Include /etc/nginx/owasp-modsecurity-crs/plugins/nextcloud-rule-exclusions-before.conf< / span >
< span class = w > < / span > < span class = no > # this enables the default OWASP Core Rule Set< / span >
< span class = w > < / span > < span class = no > Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf< / span >
< span class = w > < / span > < span class = no > # Enable prevention mode. Options: DetectionOnly,On,Off (default is DetectionOnly)< / span >
< span class = w > < / span > < span class = no > SecRuleEngine On< / span >
< span class = w > < / span > < span class = no > # Enable scanning of the request body< / span >
< span class = w > < / span > < span class = no > SecRequestBodyAccess On< / span >
< span class = w > < / span > < span class = no > # Enable XML and JSON parsing< / span >
< span class = w > < / span > < span class = no > SecRule REQUEST_HEADERS:Content-Type " (?:text|application(?:/soap\+|/)|application/xml)/" \< / span >
< span class = w > < / span > < span class = no > " id:200000,phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" < / span >
< span class = w > < / span > < span class = no > SecRule REQUEST_HEADERS:Content-Type " application/json" \< / span >
< span class = w > < / span > < span class = no > " id:200001,phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON" < / span >
< span class = w > < / span > < span class = no > # Reject if larger (we could also let it pass with ProcessPartial)< / span >
< span class = w > < / span > < span class = no > SecRequestBodyLimitAction Reject< / span >
< span class = w > < / span > < span class = no > # Send ModSecurity audit logs to the stdout (only for rejected requests)< / span >
< span class = w > < / span > < span class = no > SecAuditLog /dev/stdout< / span >
< span class = w > < / span > < span class = no > # format the logs in JSON< / span >
< span class = w > < / span > < span class = no > SecAuditLogFormat JSON< / span >
< span class = w > < / span > < span class = no > # could be On/Off/RelevantOnly< / span >
< span class = w > < / span > < span class = no > SecAuditEngine RelevantOnly< / span >
< span class = w > < / span > < span class = c1 > # Add a volume for the plugins directory< / span >
< span class = w > < / span > < span class = nt > extraVolumes< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = "p p-Indicator" > -< / span > < span class = w > < / span > < span class = nt > name< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > plugins< / span >
< span class = w > < / span > < span class = nt > configMap< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = nt > name< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > modsecurity-plugins< / span >
< span class = w > < / span > < span class = c1 > # override the /etc/nginx/enable-owasp-modsecurity-crs/plugins with your ConfigMap< / span >
< span class = w > < / span > < span class = nt > extraVolumeMounts< / span > < span class = p > :< / span >
< span class = w > < / span > < span class = "p p-Indicator" > -< / span > < span class = w > < / span > < span class = nt > name< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > plugins< / span >
< span class = w > < / span > < span class = nt > mountPath< / span > < span class = p > :< / span > < span class = w > < / span > < span class = "l l-Scalar l-Scalar-Plain" > /etc/nginx/owasp-modsecurity-crs/plugins< / span >
< / code > < / pre > < / div > < / article > < / div > < / div > < / main > < footer class = md-footer > < div class = "md-footer-meta md-typeset" > < div class = "md-footer-meta__inner md-grid" > < div class = md-copyright > Made with < a href = https://squidfunk.github.io/mkdocs-material/ target = _blank rel = noopener > Material for MkDocs < / a > < / div > < / div > < / div > < / footer > < / div > < div class = md-dialog data-md-component = dialog > < div class = "md-dialog__inner md-typeset" > < / div > < / div > < script id = __config type = application/json > { "base" : "../../.." , "features" : [ "navigation.tabs" , "navigation.tabs.sticky" , "navigation.instant" , "navigation.sections" ] , "search" : "../../../assets/javascripts/workers/search.f886a092.min.js" , "translations" : { "clipboard.copied" : "Copied to clipboard" , "clipboard.copy" : "Copy to clipboard" , "search.result.more.one" : "1 more on this page" , "search.result.more.other" : "# more on this page" , "search.result.none" : "No matching documents" , "search.result.one" : "1 matching document" , "search.result.other" : "# matching documents" , "search.result.placeholder" : "Type to start searching" , "search.result.term.missing" : "Missing" , "select.version" : "Select version" } } < / script > < script src = ../../../assets/javascripts/bundle.aecac24b.min.js > < / script > < / body > < / html >
