Re: [mod-security-users] compatibility between apache module and OWASP_CRS

[Hans M. <mo...@ma...>]

Hey Christian,

Many thanks for your valuable information.

Best regards,

Hans


-- 



On 28.03.24 10:40, Christian Folini wrote:
> Hey Hans,
>
> This is all a bit complicated.
>
> ModSecurity has a 2.9.x release line as well as a ModSecurity 3.0.x release
> line.
>
> 2.9.x is aimed for Apache, 3.0.x for Nginx. But expanding the 3.0 support to
> other webservers is a priority for the OWASP ModSecurity project.
>
> CRS favors the use of ModSec 2.9 on Apache since ModSecurity 3 has a few
> implementation gaps and a performance problem. This is also being addressed
> this year.
>
> Best regards,
>
> Christian
>
>
>
> On Tue, Mar 26, 2024 at 10:18:09PM +0100, Hans Mayer via mod-security-users wrote:
>> Hi Christian,
>>
>> many thanks for your swift reply. I will give it a try.
>>
>> So, 2.9 is the latest production ready modsec.
>>
>> For version 3 at
>> https://github.com/owasp-modsecurity/ModSecurity-apache/tree/master I see
>> the recommendation to use v 2.9.x
>>
>> I am wondering because V 3 is also several years old.
>>
>>
>> Best,
>>
>> Hans
>>
>> -- 
>>
>>
>>
>> On 26.03.24 08:44, Christian Folini wrote:
>>> Good morning Hans,
>>>
>>> On Mon, Mar 25, 2024 at 10:12:50PM +0100, Hans Mayer via mod-security-users wrote:
>>>> I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs
>>>> package.
>>>>
>>>> In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5
>>>>
>>>> At github there is already version 4 available from the coreruleset.
>>>>
>>>> Would this work with the existing /usr/lib/apache2/modules/mod_security2.so
>>> Yes it would.
>>>
>>> More documentation at
>>> https://coreruleset.org/20240214/let-crs-4-be-your-valentine/
>>>
>>> Please be aware that this is a major new release and the transition takes
>>> a bit of planning and testing. There will be new false positives usually.
>>>
>>> Best,
>>>
>>> Christian
>>>
>>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/