Re: [mod-security-users] IS this firewall code bullet proof

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0089) -->
<HTML><HEAD><TITLE>ModSecurity for Apache User Guide</TITLE>
<META http-equiv=Content-Type content="text/html; charset=ISO-8859-1"><LINK 
href="ModSecurity for Apache User Guide_files/modsecurity-manual.css" 
type=text/css rel=stylesheet>
<META content="Microsoft FrontPage 5.0" name=GENERATOR><LINK 
title="ModSecurity for Apache User Guide" href="#N10001" rel=start><LINK 
title=Introduction href="#01-introduction" rel=next></HEAD>
<BODY text=black vLink=#840084 aLink=#0000ff link=#0000ff bgColor=white>
<DIV 
style="BORDER-TOP: #dddddd 1px solid; BACKGROUND: #f5f5f5; WIDTH: 100%; BORDER-BOTTOM: #dddddd 1px solid">
<DIV class=toc>
<P><B>Table of Contents</B></P>
<DL>
  <DT><SPAN class=section><A 
  href="#01-introduction">Introduction</A></SPAN>
  <DD>
  <DL>
    <DT><SPAN class=section><A 
    href="#N10034">Licensing</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N1004C">Acknowledgements</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N10051">Contact</A></SPAN></DT></DL>
  <DT><SPAN class=section><A 
  href="#02-installation">Installation</A></SPAN>
  <DD>
  <DL>
    <DT><SPAN class=section><A 
    href="#N10064">CVS 
    Access</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N10078">Nightly 
    Snapshot Download</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N10083">Stable 
    Release Download</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N1008C">Installing 
    from source</A></SPAN>
    <DT><SPAN class=section><A 
    href="#N100EB">Installing 
    from binary</A></SPAN></DT></DL>

  <DT><SPAN class=section><A 
  href="#wa-firewall">Web Application Firewall</A></SPAN>
  <DD>
  <DL>
    <DT><SPAN class=section><A 
    href="#waf-bps">Bullet proof strategy</A></SPAN>
    <DT><SPAN class=section><A 
    href="#waf-rt">Rules Template</A></SPAN>
    <DT><SPAN class=section><A 
    href="#waf-rcn">Rule coding notes</A></SPAN>

  </DT></DL>

  </DL>
<DIV class=section lang=en>
<DIV class=section lang=en>
<PRE class=programlisting>&nbsp;</PRE></DIV></DIV></DIV>

<DIV class=section lang=en>
<DIV class=titlepage>
<DIV>
<DIV>
<H2 class=title style="CLEAR: both"><A 
name=wa-firewall></A>Web Application Firewall</H2></DIV></DIV>
<DIV></DIV></DIV>
ModSecurity default usage strategy has been to define the signatures of all 
the known insert attack strings and then use that to scan all remote browser web 
server requests for those signatures. The problem with this strategy is that 
there are all ways new attack strings being developed by un-scrupulous people. 
If an attacker selected an particular&nbsp; web site to study for weakness that 
was already using all the published signature files provided on the 
mod_security web site home page, this would not be sufficient to deny the attacker 
from penetrating the target web application. For this signature strategy to be 
successfully, mod_security would need a dedicated team of full time employees to 
handle the coding deny rules for the new attack strings. In the MS/Windows world this would be 
like what Norton Software does with their customer paid for virus signature 
update service. Mod_security being an open source software product makes a&nbsp; 
virus signature update service unfeasible.

An addition problem with this strategy is it takes a very knowledgeable 
person in the inter-workings of HTTP requests to code an deny rules for new 
signatures. This in most 
cases precludes the majority of the home computer hobbyists and professional web 
server administrators from being able to use this software.

ModSecurity does contain the capabilities for building rules which can bullet 
proof an web application. To accomplish this an different&nbsp; strategy is 
used.

The author of mod_security comes from the Apache security environment and as such 
uses the Apache nomenclatures in the other sections of this manual.&nbsp; The 
word 'Directives' is used in Apache documentation and the word 'Rules' is 
commonly used in Unix firewall documentation. In this section the words 'rules' 
&amp; 'directives' are both used and represent the same thing.

<DIV class=section lang=en>
<DIV class=titlepage>
<DIV>
<DIV>
<H3 class=title><A name=waf-bps></A>Bullet proof strategy</H3></DIV></DIV>
<DIV></DIV></DIV>

This strategy is targeted at providing the home computer hobbyists and 
professional web server administrators with an rule template which demonstrates 
a standard way of coding rules to protect the 4 common types of web server 
requests. This strategy is independent of the programming language used to 
create the web application.

All browser requests contain the file name containing the HTML code and/or the 
dynamic content&nbsp; programming language code to be executed by the server.
The key to the Bullet proof strategy is 
based on the user only having to code rules for each file which gets exchanged 
between the host web server and the remote browser. Any files which are 
included into other files and/or other files which get processed by the logic 
of the web application are excluded from needing mod_security rules.&nbsp; Protection from all malice code insert attempts is achieved by defining&nbsp; what is normally exchanged between the server and the remote browser 
thus closeing the places where malice code can be inserted. This results in any 
request not meeting the mod_secureity&nbsp; enforced standards per the users 
coded rules being denied by default. This 
strategy completely negates the need for using the known insert attack string 
signatures files provided on the mod_security web site.

<P>From the sample code provided even an novice with no programming knowledge 
should be able to cut and past the rules to suit their web application.</p>

The template starts with the mandatory directives section. This section 
specifies the default rule values necessary for this template to function. The 
user should have no need to change these rules and should use then as is.

After the mandatory directives section are the rules to protect the standard 
4 HTTP request types. All the user has to do is copy the sample rule and modify 
it to meet their needs. Basically that means changing the request file names to 
ones in his web application and the post argument names to their own.

Type 1. is the most commonly used request type. This covers the normal 
vanilla HTML display static content on the users remote browser.

Type 2. covers the use of HTML forms being processed by the very popular php 
programming language. Using a different programming language for dynamic content 
would only affect the file suffix. (i.e.&nbsp; .php&nbsp; to&nbsp; .pl&nbsp;&nbsp; for perl, ect).

Type 3. covers string parameter content attached to the requested file.

Type 4. covers the use of cookies

<DIV class=section lang=en>
<DIV class=titlepage>
<DIV>
<DIV>
<H3 class=title><A name=waf-rt></A>Rules Template</H3></DIV></DIV>
<DIV></DIV></DIV>

############# Start of mandatory directives ################### 
# Turn the filtering engine on or off 
secfilterengine on 
 
# Normalize cookie support 
SecFilterNormalizeCookies On 
 
# Enable version 1 (RFC 2965) cookies 
SecFilterCookieFormat 1 
 
# Check that url encoding is valid 
secfiltercheckurlencoding on 
 
# Unicode encoding check 
secfiltercheckunicodeencoding off 
 
# Only allow bytes from this range 
secfilterforcebyterange 1 255 
 
# Should forms post payloads be inspected 
secfilterscanpost on 
 
# The default setting sends the most important messages 
# (errors and warnings) to the Apache /var/log/httpd-error.log 
# only if there is no debug or custom log specified. 
SecFilterDefaultAction deny,log,status:404 
 
############# End of mandatory directives ################### 
 
# This is just for use during development to observe what happens. 
# In production the following 2 rules should be commented out. 
# You can change the unix path and log name to anything you want 
SecFilterDebugLog&nbsp; /var/log/modsec_debug_log 
SecFilterDebugLevel 9 
 
 
# Rule type 1. 
# Most heavily used files go first 
SecFilterSelective REQUEST_URI &quot;^/web_style_sheet.css$&quot;&nbsp;&nbsp;&nbsp; allow 
 
 
# Rule type 1. 
# This services the sample application frame home page 
SecFilterSelective REQUEST_URI &quot;^/index.htm$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
allow 
SecFilterSelective REQUEST_URI &quot;^/Header.htm$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
allow 
SecFilterSelective REQUEST_URI &quot;^/home_page.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
allow 
SecFilterSelective REQUEST_URI &quot;^/products.htm$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow 
SecFilterSelective REQUEST_URI &quot;^/powered_by_FreeBSD.gif$&quot;&nbsp;&nbsp; allow 
SecFilterSelective REQUEST_URI &quot;^/powered_by_apache.gif$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
allow 
 
# Rule type 2. 
# The&nbsp; logon membership process 
# Here the show form and process form functions are in separate files. 
# Need one rule to allow the show form function 
# The process form function file needs 2 rules, 1 for the file name &amp;&nbsp; 
# 1 for the POST_PAYLOAD rule. 
 
SecFilterSelective REQUEST_URI &quot;^/logon_showform.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow 
 
SecFilterSelective REQUEST_URI &quot;^/logon_processform.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
chain 
SecFilterSelective POST_PAYLOAD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&quot;^id=[0-9a-z]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;pw=[0-9a-z]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; 
&amp;submit=Submit$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
allow
 
# This could also be coded this way 
SecFilterSelective REQUEST_URI &quot;^/logon_processform.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;chain 
SecFilterSelective POST_PAYLOAD 
&quot;^id=[0-9a-z]{15,}$&amp;pw=[0-9a-z]{15,}$&amp;submit=Submit$&quot;&nbsp;allow 
 
 
# Rule type 2. 
# The sign up membership process 
# This single script contains both the show form and process form functions. 
# Need one rule to allow the show form function 
# and second rule chained to the POST_PAYLOAD rule for 
# the process form function. 
 
SecFilterSelective REQUEST_URI &quot;^/signup.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow 
 
SecFilterSelective REQUEST_URI &quot;^/signup.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain 
SecFilterSelective POST_PAYLOAD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&quot;^id=[0-9a-z]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;pw=[0-9a-z]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;pw2=[0-9a-z]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;email=[0-9a-zA-Z\.-_]{45,}$&nbsp;&nbsp; \ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
firstname=[a-zA-Z]{30,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;lastname=[a-zA-Z]{30,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;add1=[a-zA-Z -]{30,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;add2=[a-zA-Z -]{30,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;city=[a-zA-Z -]{20,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;state=[a-zA-Z -]{20,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;zip=[0-9-]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;phone_home=[0-9-]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;phone_office=[0-9-]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;phone_cell=[0-9-]{15,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
mothers_maiden_name=[a-zA-Z]{30,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;userdigit=[0-9a-z]{5,}$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
\ 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&amp;submit=Submit$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow 
 
 
# Rule type 1. &amp;&nbsp; Rule type 4. 
# After user logs in php session control is started so now cookies are passed 
around 
# The&nbsp; membership menu process 
SecFilterSelective REQUEST_URI &quot;^/menu.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain 
SecFilterSelective COOKIE_PHPSESSID &quot;^[0-9a-fA-F]{32}$&quot;&nbsp;&nbsp;&nbsp; allow 
SecFilterSelective REQUEST_URI &quot;^/terminate_member.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain 
SecFilterSelective COOKIE_PHPSESSID &quot;^[0-9a-fA-F]{32}$&quot;&nbsp;&nbsp;&nbsp; allow 
SecFilterSelective REQUEST_URI &quot;^/std_exit.php$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain 
SecFilterSelective COOKIE_PHPSESSID &quot;^[0-9a-fA-F]{32}$&quot;&nbsp;&nbsp;&nbsp; allow 
 
 
# Rule type 3. 
# Handles this kind of request string 
#&nbsp;&nbsp; /mls_verifyemail.php?hash=content 
SecFilterSelective REQUEST_URI &quot;^/verifyemail.php&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain 
SecFilterSelective ARG_hash &quot;^[0-9a-zA-Z=]+$&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow 
 
# The catch-all deny rule to block all requests except 
# those above with allow option. 
SecFilter &quot;.&quot; 
&nbsp;

<DIV class=section lang=en>
<DIV class=titlepage>
<DIV>
<DIV>
<H3 class=title><A name=waf-rcn></A>Rule codings notes</H3></DIV></DIV>
<DIV></DIV></DIV>

<DL>

Mod_security rules selection is coded using regexp notation. If your regexp is as bad as 
mine then the following will be helpfull. 
&nbsp;1. The $ is an anchor. Appending a $ to the end of the file name or a regexp notation as in [0-9a-z]{15,}$ 
&nbsp;&nbsp;&nbsp;&nbsp;means no arguments are allowed to follow. This denies all malice code insert attempts a location 
&nbsp;&nbsp;&nbsp;&nbsp;in the string arguments to insert their code into. 
&nbsp;2. [0-9a-fA-F]{32} means upper &amp; lower case Alpha-Numeric characters are tested for and may 
&nbsp;&nbsp;&nbsp;&nbsp;
occur multiple times in the 32 character field size. 
&nbsp;3. [0-9a-zA-Z\.-_]{45,}&nbsp;&nbsp; this also allows a period, a dash, and a underscore 
&nbsp;4. [a-zA-Z -]{30,}&nbsp;&nbsp;&nbsp; this also allows a blank, and a dash 
&nbsp;5. [0-9-]{15,}&nbsp;&nbsp;&nbsp;&nbsp; this allows all digits and a dash 
&nbsp;6. [0-9a-zA-Z]&nbsp;&nbsp;&nbsp; here the field size is unknown, means only accept 1 char in this list (0-9a-zA-Z) 
&nbsp;7. [0-9a-zA-Z]?&nbsp; means accept blank or 1 char in this list (0-9a-zA-Z) 
&nbsp;8. [0-9a-zA-Z]+&nbsp; means accept 1 or more char(s) in this list (0-9a-zA-Z) 
&nbsp;9. [0-9a-zA-Z]*&nbsp; means accept 0 or more chars in this list (0-9a-zA-Z) meaning empty is ok. 
10. Long regexp notation can be continued to the next line using the \ char 
11. COOKIE_PHPSESSID &quot;^[0-9a-fA-F]{32}$&quot; protects the default php session cookie. 
12. The chain command can be though of like creating a compound IF statement. 
13. The use of the &quot;allow&quot; command completely changes the default logic of mod_security. 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Allow means if rule is true them let it pass. 
14. Use of the debug log function results in a kind of logic trace of the loop processing 
of he coded rules. 
&nbsp;&nbsp;&nbsp;&nbsp; 
That will greatly increase your understanding of what is happening. 
15. I found it very helpful to view the Apache httpd-access.log after doing a complete test of the web 
 &nbsp;&nbsp;&nbsp;&nbsp; application to determine what files were being exchanged with the remote browser. 
16. Use of the mod...@li... question list is well supported by experienced members. 
17. All search engine robots do not issue get requests the same way. So watch the httpd-access.log to see 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;what that do and add rules to accommodate them if you want to be indexed by 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;every search engine that finds your site. 
18. When you have your rules tested and ready for production you should monitor their effect by changing 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
SecFilterDefaultAction deny,log,status:404&nbsp;&nbsp;&nbsp;&nbsp; to 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
SecFilterDefaultAction pass,log,status:404

</p>

</DIV>
</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</dl>

</DIV>
</dl>

</BODY></HTML>