mod-security-users — General discussion about mod_security

Re: [mod-security-users] Variable that holds scheme

[Arlen W. <pu...@ar...>]

Just a couple of thoughts:

You could try looking for the request header for HSTS (Strict-Transport-Security). Won’t catch all browsers, but if you use it on your server it’ll catch most of them. (And why wouldn’t you use it?)

Doesn’t REQUEST_URI_RAW work for this? I thought it gave the full URI as a text string.


Have fun,
Arlen

> On Apr 14, 2022, at 3:12 AM, Ehsan Mahdavi <ehs...@gm...> wrote:
> 
> 
> Hi ervin,
> 
> The env.ssl_cipher or sth like that sounds good, if it works in Nginx. I'll try that and get back to you.
> 
>> On Wed, Apr 13, 2022 at 3:51 PM Ervin Hegedüs <ai...@gm...> wrote:
>> Hi there,
>> 
>> On Wed, Apr 13, 2022 at 12:04:39PM +0100, Andrew Howe wrote:
>> > 
>> > What are you trying to achieve? Are you trying to answer the question
>> > "did this request come in as plain text HTTP or has TLS termination
>> > been performed", and then treat the two cases differently?
>> 
>> may be (the official poster) should try the ENV variable:
>> 
>> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#ENV
>> 
>> See the example:
>> 
>> # Reading an environment variable from other Apache module (mod_ssl)
>> SecRule TX:ANOMALY_SCORE "@gt 0" "phase:5,id:16,msg:'%{env.ssl_cipher}'"
>> 
>> 
>> and the comment below:
>> 
>> Note : Use setenv to set environment variables to be accessed by Apache. 
>> 
>> 
>> As I know, ENV works in libmodsecurity too, but I have no idea
>> how can it set through Nginx (if the server is it).

Re: [mod-security-users] Variable that holds scheme

[Reindl H. <h.r...@th...>]

Am 15.04.22 um 18:24 schrieb Andrew Howe:> Something that only just 
occurred to me: can you not infer the scheme> from the destination port 
in the audit logs? E.g.:
only in very simple setups

we have here at least 4 different ports which are https at the end of 
the day

Re: [mod-security-users] Variable that holds scheme

[Andrew H. <and...@lo...>]

Hi Ehsan,

Something that only just occurred to me: can you not infer the scheme
from the destination port in the audit logs? E.g.:

    ---YERQU2yt---A--
    [15/Apr/2022:16:04:31 +0000] 1650038671 172.20.0.1 44940 172.20.0.3 80

An example of a plain text HTTP request (note port 80 at the very end
of the line).

You could also maybe make use of ModSecurity's SERVER_PORT variable
and do something with that (see
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#server_port).

It's also fairly common practice for reverse proxies to add the
request header "X-Forwarded-Proto", set to either "http" or "https",
when TLS/SSL termination is involved. Maybe you could instruct Nginx
to add such a header (although I don't know how the order of execution
works in Nginx: it might add headers _after_ giving the request to
ModSecurity, so that might not work.)

You could also, if absolutely necessary, put a reverse proxy in front
of your Nginx instance (maybe even just define an Nginx proxy), and
have *that* proxy insert an "X-Forwarded-Proto" header which would
then be passed to your ModSecurity instance. That's probably the
least-good solution, though.

Thanks,
Andrew

--
Andrew Howe
Loadbalancer.org Ltd.
www.loadbalancer.org
+1 888 867 9504 / +44 (0)330 380 1064

Re: [mod-security-users] 回复： Variable that holds scheme

[Ehsan M. <ehs...@gm...>]

Dear huiming, hi

Do you think that there is variable in the config or do you suggest editing
the source codes?

On Fri, Apr 15, 2022 at 6:28 AM huiming via mod-security-users <
mod...@li...> wrote:

>
>
> seems scheme can be get  from ngx_http_request_s->schema
>
>
> ------------------ 原始邮件 ------------------
> *发件人:* "huiming" <877...@qq...>;
> *发送时间:* 2022年4月15日(星期五) 上午9:01
> *收件人:* "mod-security-users"<mod...@li...>;
> *主题:* 回复： [mod-security-users] Variable that holds scheme
>
> seems https://github.com/SpiderLabs/ModSecurity-nginx does not copy
> scheme from nginx to modsecurity.
>
> so mod can not get it.
>
>
> ------------------ 原始邮件 ------------------
> *发件人:* "mod-security-users" <ehs...@gm...>;
> *发送时间:* 2022年4月14日(星期四) 下午4:37
> *收件人:* "mod-security-users"<mod...@li...>;
> *主题:* Re: [mod-security-users] Variable that holds scheme
>
> Hi Andrew
>
> Yes, I am trying to answer the question, but not to treat them
> differently. I just need to log the scheme in the Modsecurity Audit log.
> I have tried different variables like REQUEST_URI
> <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI>,
> REQUEST_URI_RAW
> <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI_RAW> and
> etc. none of them contain the scheme!
>
>
> On Wed, Apr 13, 2022 at 3:38 PM Andrew Howe <and...@lo...>
> wrote:
>
>> Hi Ehsan,
>>
>> > This question might look basic, but I could not find the variable that
>> holds or contains the (http|https) scheme.
>>
>> Where are you trying to pull the scheme from? The scheme isn't
>> typically* transmitted in an HTTP request.
>>
>> A URL will usually be broken up into an HTTP request line and a Host
>> header, which usually looks something like:
>>
>>     GET /docs/ HTTP/2
>>     Host: coreruleset.org
>>
>> No scheme/protocol.
>>
>> What are you trying to achieve? Are you trying to answer the question
>> "did this request come in as plain text HTTP or has TLS termination
>> been performed", and then treat the two cases differently?
>>
>> Thanks,
>> Andrew
>>
>>
>> *You may find request lines containing a full 'absolute URI' which
>> includes the scheme, for example with a proxy server.
>> --
>>
>> Andrew Howe
>> Loadbalancer.org Ltd.
>> www.loadbalancer.org
>> +1 888 867 9504 / +44 (0)330 380 1064
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
>                         regards
>                   Ehsan Mahdavi
>          Computer Engineering Ph.D.
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
                        regards
                  Ehsan Mahdavi
         Computer Engineering Ph.D.

[mod-security-users] 回复： Variable that holds scheme

[<877...@qq...>]

seems scheme can be get  from ngx_http_request_s->schema




------------------ 原始邮件 ------------------
发件人:                                                                                                                        "huiming"                                                                                    <877...@qq...&gt;;
发送时间:&nbsp;2022年4月15日(星期五) 上午9:01
收件人:&nbsp;"mod-security-users"<mod...@li...&gt;;

主题:&nbsp;回复： [mod-security-users] Variable that holds scheme



seems https://github.com/SpiderLabs/ModSecurity-nginx does not copy scheme from nginx to modsecurity.


so mod can not get it.




------------------ 原始邮件 ------------------
发件人:                                                                                                                        "mod-security-users"                                                                                    <ehs...@gm...&gt;;
发送时间:&nbsp;2022年4月14日(星期四) 下午4:37
收件人:&nbsp;"mod-security-users"<mod...@li...&gt;;

主题:&nbsp;Re: [mod-security-users] Variable that holds scheme



Hi Andrew


Yes, I am trying to answer the question, but not to treat them differently. I just need to log the scheme in the Modsecurity Audit log.
I have tried different variables like REQUEST_URI, REQUEST_URI_RAW&nbsp;and etc. none of them contain the scheme!




On Wed, Apr 13, 2022 at 3:38 PM Andrew Howe <and...@lo...&gt; wrote:

Hi Ehsan,
 
 &gt; This question might look basic, but I could not find the variable that holds or contains the (http|https) scheme.
 
 Where are you trying to pull the scheme from? The scheme isn't
 typically* transmitted in an HTTP request.
 
 A URL will usually be broken up into an HTTP request line and a Host
 header, which usually looks something like:
 
 &nbsp; &nbsp; GET /docs/ HTTP/2
 &nbsp; &nbsp; Host: coreruleset.org
 
 No scheme/protocol.
 
 What are you trying to achieve? Are you trying to answer the question
 "did this request come in as plain text HTTP or has TLS termination
 been performed", and then treat the two cases differently?
 
 Thanks,
 Andrew
 
 
 *You may find request lines containing a full 'absolute URI' which
 includes the scheme, for example with a proxy server.
 -- 
 
 Andrew Howe
 Loadbalancer.org Ltd.
 www.loadbalancer.org
 +1 888 867 9504 / +44 (0)330 380 1064
 
 
 _______________________________________________
 mod-security-users mailing list
 mod...@li...
 https://lists.sourceforge.net/lists/listinfo/mod-security-users
 Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
 http://www.modsecurity.org/projects/commercial/rules/
 http://www.modsecurity.org/projects/commercial/support/
 



-- 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; regards
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ehsan Mahdavi
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Computer Engineering Ph.D.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CEO at aspaco.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;http://emahdavi.ece.iut.ac.ir/

[mod-security-users] 回复： Variable that holds scheme

[<877...@qq...>]

seems https://github.com/SpiderLabs/ModSecurity-nginx does not copy scheme from nginx to modsecurity.


so mod can not get it.




------------------ 原始邮件 ------------------
发件人:                                                                                                                        "mod-security-users"                                                                                    <ehs...@gm...&gt;;
发送时间:&nbsp;2022年4月14日(星期四) 下午4:37
收件人:&nbsp;"mod-security-users"<mod...@li...&gt;;

主题:&nbsp;Re: [mod-security-users] Variable that holds scheme



Hi Andrew


Yes, I am trying to answer the question, but not to treat them differently. I just need to log the scheme in the Modsecurity Audit log.
I have tried different variables like&nbsp;REQUEST_URI,&nbsp;REQUEST_URI_RAW&nbsp;and etc. none of them contain the scheme!




On Wed, Apr 13, 2022 at 3:38 PM Andrew Howe <and...@lo...&gt; wrote:

Hi Ehsan,
 
 &gt; This question might look basic, but I could not find the variable that holds or contains the (http|https) scheme.
 
 Where are you trying to pull the scheme from? The scheme isn't
 typically* transmitted in an HTTP request.
 
 A URL will usually be broken up into an HTTP request line and a Host
 header, which usually looks something like:
 
 &nbsp; &nbsp; GET /docs/ HTTP/2
 &nbsp; &nbsp; Host: coreruleset.org
 
 No scheme/protocol.
 
 What are you trying to achieve? Are you trying to answer the question
 "did this request come in as plain text HTTP or has TLS termination
 been performed", and then treat the two cases differently?
 
 Thanks,
 Andrew
 
 
 *You may find request lines containing a full 'absolute URI' which
 includes the scheme, for example with a proxy server.
 -- 
 
 Andrew Howe
 Loadbalancer.org Ltd.
 www.loadbalancer.org
 +1 888 867 9504 / +44 (0)330 380 1064
 
 
 _______________________________________________
 mod-security-users mailing list
 mod...@li...
 https://lists.sourceforge.net/lists/listinfo/mod-security-users
 Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
 http://www.modsecurity.org/projects/commercial/rules/
 http://www.modsecurity.org/projects/commercial/support/
 



-- 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; regards
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ehsan Mahdavi
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Computer Engineering Ph.D.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CEO at aspaco.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;http://emahdavi.ece.iut.ac.ir/

Re: [mod-security-users] Variable that holds scheme

[Ehsan M. <ehs...@gm...>]

Hi ervin,

The env.ssl_cipher or sth like that sounds good, if it works in Nginx. I'll
try that and get back to you.

On Wed, Apr 13, 2022 at 3:51 PM Ervin Hegedüs <ai...@gm...> wrote:

> Hi there,
>
> On Wed, Apr 13, 2022 at 12:04:39PM +0100, Andrew Howe wrote:
> >
> > What are you trying to achieve? Are you trying to answer the question
> > "did this request come in as plain text HTTP or has TLS termination
> > been performed", and then treat the two cases differently?
>
> may be (the official poster) should try the ENV variable:
>
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#ENV
>
> See the example:
>
> # Reading an environment variable from other Apache module (mod_ssl)
> SecRule TX:ANOMALY_SCORE "@gt 0" "phase:5,id:16,msg:'%{env.ssl_cipher}'"
>
>
> and the comment below:
>
> Note : Use setenv to set environment variables to be accessed by Apache.
>
>
> As I know, ENV works in libmodsecurity too, but I have no idea
> how can it set through Nginx (if the server is it).
>
>
>
> a.
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
                        regards
                  Ehsan Mahdavi
         Computer Engineering Ph.D.

Re: [mod-security-users] Variable that holds scheme

[Ehsan M. <ehs...@gm...>]

Hi Andrew

Yes, I am trying to answer the question, but not to treat them differently.
I just need to log the scheme in the Modsecurity Audit log.
I have tried different variables like REQUEST_URI
<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI>
, REQUEST_URI_RAW
<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI_RAW>
and
etc. none of them contain the scheme!


On Wed, Apr 13, 2022 at 3:38 PM Andrew Howe <and...@lo...>
wrote:

> Hi Ehsan,
>
> > This question might look basic, but I could not find the variable that
> holds or contains the (http|https) scheme.
>
> Where are you trying to pull the scheme from? The scheme isn't
> typically* transmitted in an HTTP request.
>
> A URL will usually be broken up into an HTTP request line and a Host
> header, which usually looks something like:
>
>     GET /docs/ HTTP/2
>     Host: coreruleset.org
>
> No scheme/protocol.
>
> What are you trying to achieve? Are you trying to answer the question
> "did this request come in as plain text HTTP or has TLS termination
> been performed", and then treat the two cases differently?
>
> Thanks,
> Andrew
>
>
> *You may find request lines containing a full 'absolute URI' which
> includes the scheme, for example with a proxy server.
> --
>
> Andrew Howe
> Loadbalancer.org Ltd.
> www.loadbalancer.org
> +1 888 867 9504 / +44 (0)330 380 1064
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
                        regards
                  Ehsan Mahdavi
         Computer Engineering Ph.D.
               CEO at aspaco.org
         http://emahdavi.ece.iut.ac.ir/

Re: [mod-security-users] Variable that holds scheme

[Ervin H. <ai...@gm...>]

Hi there,

On Wed, Apr 13, 2022 at 12:04:39PM +0100, Andrew Howe wrote:
> 
> What are you trying to achieve? Are you trying to answer the question
> "did this request come in as plain text HTTP or has TLS termination
> been performed", and then treat the two cases differently?

may be (the official poster) should try the ENV variable:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#ENV

See the example:

# Reading an environment variable from other Apache module (mod_ssl)
SecRule TX:ANOMALY_SCORE "@gt 0" "phase:5,id:16,msg:'%{env.ssl_cipher}'"


and the comment below:

Note : Use setenv to set environment variables to be accessed by Apache. 


As I know, ENV works in libmodsecurity too, but I have no idea
how can it set through Nginx (if the server is it).



a.
 

Re: [mod-security-users] Variable that holds scheme

[Andrew H. <and...@lo...>]

Hi Ehsan,

> This question might look basic, but I could not find the variable that holds or contains the (http|https) scheme.

Where are you trying to pull the scheme from? The scheme isn't
typically* transmitted in an HTTP request.

A URL will usually be broken up into an HTTP request line and a Host
header, which usually looks something like:

    GET /docs/ HTTP/2
    Host: coreruleset.org

No scheme/protocol.

What are you trying to achieve? Are you trying to answer the question
"did this request come in as plain text HTTP or has TLS termination
been performed", and then treat the two cases differently?

Thanks,
Andrew


*You may find request lines containing a full 'absolute URI' which
includes the scheme, for example with a proxy server.
-- 

Andrew Howe
Loadbalancer.org Ltd.
www.loadbalancer.org
+1 888 867 9504 / +44 (0)330 380 1064

[mod-security-users] 回复： Variable that holds scheme

[<877...@qq...>]

I had ever find scheme, but not found




------------------ 原始邮件 ------------------
发件人:                                                                                                                        "mod-security-users"                                                                                    <ehs...@gm...&gt;;
发送时间:&nbsp;2022年4月12日(星期二) 晚上7:43
收件人:&nbsp;"mod-security-users"<mod...@li...&gt;;

主题:&nbsp;[mod-security-users] Variable that holds scheme



Hi folks

This question might look basic, but I could not find the variable that holds or contains the (http|https) scheme.
Any ideas?


P.S. Using libmodsecurity&nbsp;+ nginx


-- 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; regards
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ehsan Mahdavi
&nbsp; &nbsp;

[mod-security-users] Variable that holds scheme

[Ehsan M. <ehs...@gm...>]

Hi folks

This question might look basic, but I could not find the variable that
holds or contains the (http|https) scheme.
Any ideas?

P.S. Using libmodsecurity + nginx

-- 
                        regards
                  Ehsan Mahdavi

Re: [mod-security-users] Use of Modsec variable in apache access log

[Christian F. <chr...@ne...>]

Thanks for the updates. I do not immediately see why it's not working
completely. But glad you have a working solution.

Best,

Christian

On Fri, Mar 25, 2022 at 01:59:38PM +0530, homesh joshi wrote:
> Dear Christian,
> 
> I added setvar:tx.rule=1 in each rule and then added the following rule,
> post which I am able to get 1 written in access logs ( via the %{waf} ) for
> the transactions which got blocked by Modsec. for other transactions it is
> missing and hence getting - in the logs. I was not able to directly set the
> WAF=1 in the rules via setenv:waf=1
> 
> SecRule TX:rule "@eq 1" "phase:5,pass,setenv:waf=1,id:'9001'"
> 
> Will test this any update incase I face any challenge.
> 
> Thanks,
> Homesh
> 
> 
> On Thu, Mar 24, 2022 at 6:35 PM Christian Folini <
> chr...@ne...> wrote:
> 
> > I suggest you add this to every rule that detects / blocks something.
> > Thus not a SecAction, but attach the setenv to your existing SecRules
> > where you want to see the flag.
> >
> > Alternatively, you can do a SecRule in phase 5 where you test the
> > HTTP status and if it's 403, then you set the env.
> >
> > Good luck!
> >
> > Christian
> >
> > On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote:
> > > Dear Christian,
> > >
> > > Thanks. I think this will work for me. However, can you please explain
> > it a
> > > bit more on how this works.
> > > from your tutorial if i set up following rule
> > >
> > > # === ModSec performance calculations and variable export (ids: 90100 -
> > 90199)
> > >
> > > SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=1"
> > >
> > > then for every access I see "1" in the access log.
> > >
> > > I think I will need to understand it more in order to use it.
> > >
> > > Kindly explain
> > > 1) the configuration required for setenv by modifying each rule
> > >
> > > 2) the configuration required for more complicated scheme which you
> > > are referring to
> > >
> > > Thanks,
> > >
> > > Homesh
> > >
> > >
> > > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini <
> > > chr...@ne...> wrote:
> > >
> > > > Hi there,
> > > >
> > > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote:
> > > > > Thanks for the clarification.
> > > > > I have already gone through excellent netnea.com tutorials. I have
> > > > already
> > > > > used some of the configuration from tutorial.I do not use crs.
> > > >
> > > > Thank you very much.
> > > >
> > > > > My objective here is that I want to get a flag in access log line if
> > > > modsec
> > > > > has taken any action on the transaction say simply it can be a field
> > like
> > > > > modsec=1 or modsec=0. This wi help me in separating transactions
> > which
> > > > are
> > > > > allowed.(modsec=0) So then it is easy to show these transactions in
> > the
> > > > > reporting system.
> > > >
> > > > I'd do a setenv then in the rules.
> > > >
> > > > ... "setenv:modsec=1"
> > > >
> > > > Similar to the way I set th various env variables in phase 5. You can
> > > > simply
> > > > add this to every rule you have. Or you set up a more complicated
> > scheme
> > > > and do it in the end in phase 5.
> > > >
> > > > Best,
> > > >
> > > > Christian
> > > >
> > > > >
> > > > > Kindly suggest.
> > > > >
> > > > > Thanks,
> > > > > Homesh
> > > > >
> > > > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> > > > > chr...@ne...> wrote:
> > > > >
> > > > > > HelloHomesh,
> > > > > >
> > > > > > Unfortunately, this is not how this works.
> > > > > >
> > > > > > A ModSecuriy variable is not automatically an environment variable.
> > > > > > And on top, the ModSec variable "rule" is only available during the
> > > > > > execution of the very rule (and there might be many, many rules).
> > > > > >
> > > > > > I suggest you read up on my free tutorials published at netnea.com
> > .
> > > > > > The one on logging and the ones on the Core Rule Set are proposing
> > > > > > ways to achieve something along these lines.
> > > > > >
> > > > > > Best,
> > > > > >
> > > > > > Christian
> > > > > >
> > > > > >
> > > > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > > > > > > Hi All,
> > > > > > >
> > > > > > > Hope you all are well.
> > > > > > >
> > > > > > > I want to add the modsecurity variable e.g "rule.id"in the
> > apache
> > > > access
> > > > > > > log via the extended format.
> > > > > > > I set the following line in /etc/apache2/apache.conf
> > > > > > >
> > > > > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
> > > > \"%{User-Agent}i\"
> > > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> > > > > > >
> > > > > > > However I am not getting the rule.id value in the access log
> > line.
> > > > > > >
> > > > > > > Kindly suggest.
> > > > > > >
> > > > > > > Thanks,
> > > > > > > Homesh
> > > > > >
> > > > > >
> > > > > > > _______________________________________________
> > > > > > > mod-security-users mailing list
> > > > > > > mod...@li...
> > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > > > Commercial ModSecurity Rules and Support from Trustwave's
> > SpiderLabs:
> > > > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > > > http://www.modsecurity.org/projects/commercial/support/
> > > > > >
> > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > mod-security-users mailing list
> > > > > > mod...@li...
> > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > > Commercial ModSecurity Rules and Support from Trustwave's
> > SpiderLabs:
> > > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > > http://www.modsecurity.org/projects/commercial/support/
> > > > > >
> > > >
> > > >
> > > > > _______________________________________________
> > > > > mod-security-users mailing list
> > > > > mod...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Use of Modsec variable in apache access log

[homesh j. <ho...@gm...>]

Dear Christian,

I added setvar:tx.rule=1 in each rule and then added the following rule,
post which I am able to get 1 written in access logs ( via the %{waf} ) for
the transactions which got blocked by Modsec. for other transactions it is
missing and hence getting - in the logs. I was not able to directly set the
WAF=1 in the rules via setenv:waf=1

SecRule TX:rule "@eq 1" "phase:5,pass,setenv:waf=1,id:'9001'"

Will test this any update incase I face any challenge.

Thanks,
Homesh


On Thu, Mar 24, 2022 at 6:35 PM Christian Folini <
chr...@ne...> wrote:

> I suggest you add this to every rule that detects / blocks something.
> Thus not a SecAction, but attach the setenv to your existing SecRules
> where you want to see the flag.
>
> Alternatively, you can do a SecRule in phase 5 where you test the
> HTTP status and if it's 403, then you set the env.
>
> Good luck!
>
> Christian
>
> On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote:
> > Dear Christian,
> >
> > Thanks. I think this will work for me. However, can you please explain
> it a
> > bit more on how this works.
> > from your tutorial if i set up following rule
> >
> > # === ModSec performance calculations and variable export (ids: 90100 -
> 90199)
> >
> > SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=1"
> >
> > then for every access I see "1" in the access log.
> >
> > I think I will need to understand it more in order to use it.
> >
> > Kindly explain
> > 1) the configuration required for setenv by modifying each rule
> >
> > 2) the configuration required for more complicated scheme which you
> > are referring to
> >
> > Thanks,
> >
> > Homesh
> >
> >
> > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini <
> > chr...@ne...> wrote:
> >
> > > Hi there,
> > >
> > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote:
> > > > Thanks for the clarification.
> > > > I have already gone through excellent netnea.com tutorials. I have
> > > already
> > > > used some of the configuration from tutorial.I do not use crs.
> > >
> > > Thank you very much.
> > >
> > > > My objective here is that I want to get a flag in access log line if
> > > modsec
> > > > has taken any action on the transaction say simply it can be a field
> like
> > > > modsec=1 or modsec=0. This wi help me in separating transactions
> which
> > > are
> > > > allowed.(modsec=0) So then it is easy to show these transactions in
> the
> > > > reporting system.
> > >
> > > I'd do a setenv then in the rules.
> > >
> > > ... "setenv:modsec=1"
> > >
> > > Similar to the way I set th various env variables in phase 5. You can
> > > simply
> > > add this to every rule you have. Or you set up a more complicated
> scheme
> > > and do it in the end in phase 5.
> > >
> > > Best,
> > >
> > > Christian
> > >
> > > >
> > > > Kindly suggest.
> > > >
> > > > Thanks,
> > > > Homesh
> > > >
> > > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> > > > chr...@ne...> wrote:
> > > >
> > > > > HelloHomesh,
> > > > >
> > > > > Unfortunately, this is not how this works.
> > > > >
> > > > > A ModSecuriy variable is not automatically an environment variable.
> > > > > And on top, the ModSec variable "rule" is only available during the
> > > > > execution of the very rule (and there might be many, many rules).
> > > > >
> > > > > I suggest you read up on my free tutorials published at netnea.com
> .
> > > > > The one on logging and the ones on the Core Rule Set are proposing
> > > > > ways to achieve something along these lines.
> > > > >
> > > > > Best,
> > > > >
> > > > > Christian
> > > > >
> > > > >
> > > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > > > > > Hi All,
> > > > > >
> > > > > > Hope you all are well.
> > > > > >
> > > > > > I want to add the modsecurity variable e.g "rule.id"in the
> apache
> > > access
> > > > > > log via the extended format.
> > > > > > I set the following line in /etc/apache2/apache.conf
> > > > > >
> > > > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
> > > \"%{User-Agent}i\"
> > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> > > > > >
> > > > > > However I am not getting the rule.id value in the access log
> line.
> > > > > >
> > > > > > Kindly suggest.
> > > > > >
> > > > > > Thanks,
> > > > > > Homesh
> > > > >
> > > > >
> > > > > > _______________________________________________
> > > > > > mod-security-users mailing list
> > > > > > mod...@li...
> > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > > Commercial ModSecurity Rules and Support from Trustwave's
> SpiderLabs:
> > > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > > http://www.modsecurity.org/projects/commercial/support/
> > > > >
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > mod-security-users mailing list
> > > > > mod...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > Commercial ModSecurity Rules and Support from Trustwave's
> SpiderLabs:
> > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > http://www.modsecurity.org/projects/commercial/support/
> > > > >
> > >
> > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > >
> > >
> > >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Use of Modsec variable in apache access log

[Christian F. <chr...@ne...>]

I suggest you add this to every rule that detects / blocks something.
Thus not a SecAction, but attach the setenv to your existing SecRules
where you want to see the flag.

Alternatively, you can do a SecRule in phase 5 where you test the
HTTP status and if it's 403, then you set the env.

Good luck!

Christian

On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote:
> Dear Christian,
> 
> Thanks. I think this will work for me. However, can you please explain it a
> bit more on how this works.
> from your tutorial if i set up following rule
> 
> # === ModSec performance calculations and variable export (ids: 90100 - 90199)
> 
> SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=1"
> 
> then for every access I see "1" in the access log.
> 
> I think I will need to understand it more in order to use it.
> 
> Kindly explain
> 1) the configuration required for setenv by modifying each rule
> 
> 2) the configuration required for more complicated scheme which you
> are referring to
> 
> Thanks,
> 
> Homesh
> 
> 
> On Thu, Mar 24, 2022 at 11:52 AM Christian Folini <
> chr...@ne...> wrote:
> 
> > Hi there,
> >
> > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote:
> > > Thanks for the clarification.
> > > I have already gone through excellent netnea.com tutorials. I have
> > already
> > > used some of the configuration from tutorial.I do not use crs.
> >
> > Thank you very much.
> >
> > > My objective here is that I want to get a flag in access log line if
> > modsec
> > > has taken any action on the transaction say simply it can be a field like
> > > modsec=1 or modsec=0. This wi help me in separating transactions which
> > are
> > > allowed.(modsec=0) So then it is easy to show these transactions in the
> > > reporting system.
> >
> > I'd do a setenv then in the rules.
> >
> > ... "setenv:modsec=1"
> >
> > Similar to the way I set th various env variables in phase 5. You can
> > simply
> > add this to every rule you have. Or you set up a more complicated scheme
> > and do it in the end in phase 5.
> >
> > Best,
> >
> > Christian
> >
> > >
> > > Kindly suggest.
> > >
> > > Thanks,
> > > Homesh
> > >
> > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> > > chr...@ne...> wrote:
> > >
> > > > HelloHomesh,
> > > >
> > > > Unfortunately, this is not how this works.
> > > >
> > > > A ModSecuriy variable is not automatically an environment variable.
> > > > And on top, the ModSec variable "rule" is only available during the
> > > > execution of the very rule (and there might be many, many rules).
> > > >
> > > > I suggest you read up on my free tutorials published at netnea.com.
> > > > The one on logging and the ones on the Core Rule Set are proposing
> > > > ways to achieve something along these lines.
> > > >
> > > > Best,
> > > >
> > > > Christian
> > > >
> > > >
> > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > > > > Hi All,
> > > > >
> > > > > Hope you all are well.
> > > > >
> > > > > I want to add the modsecurity variable e.g "rule.id"in the apache
> > access
> > > > > log via the extended format.
> > > > > I set the following line in /etc/apache2/apache.conf
> > > > >
> > > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
> > \"%{User-Agent}i\"
> > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> > > > >
> > > > > However I am not getting the rule.id value in the access log line.
> > > > >
> > > > > Kindly suggest.
> > > > >
> > > > > Thanks,
> > > > > Homesh
> > > >
> > > >
> > > > > _______________________________________________
> > > > > mod-security-users mailing list
> > > > > mod...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Use of Modsec variable in apache access log

[homesh j. <ho...@gm...>]

Dear Christian,

Thanks. I think this will work for me. However, can you please explain it a
bit more on how this works.
from your tutorial if i set up following rule

# === ModSec performance calculations and variable export (ids: 90100 - 90199)

SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=1"

then for every access I see "1" in the access log.

I think I will need to understand it more in order to use it.

Kindly explain
1) the configuration required for setenv by modifying each rule

2) the configuration required for more complicated scheme which you
are referring to

Thanks,

Homesh


On Thu, Mar 24, 2022 at 11:52 AM Christian Folini <
chr...@ne...> wrote:

> Hi there,
>
> On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote:
> > Thanks for the clarification.
> > I have already gone through excellent netnea.com tutorials. I have
> already
> > used some of the configuration from tutorial.I do not use crs.
>
> Thank you very much.
>
> > My objective here is that I want to get a flag in access log line if
> modsec
> > has taken any action on the transaction say simply it can be a field like
> > modsec=1 or modsec=0. This wi help me in separating transactions which
> are
> > allowed.(modsec=0) So then it is easy to show these transactions in the
> > reporting system.
>
> I'd do a setenv then in the rules.
>
> ... "setenv:modsec=1"
>
> Similar to the way I set th various env variables in phase 5. You can
> simply
> add this to every rule you have. Or you set up a more complicated scheme
> and do it in the end in phase 5.
>
> Best,
>
> Christian
>
> >
> > Kindly suggest.
> >
> > Thanks,
> > Homesh
> >
> > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> > chr...@ne...> wrote:
> >
> > > HelloHomesh,
> > >
> > > Unfortunately, this is not how this works.
> > >
> > > A ModSecuriy variable is not automatically an environment variable.
> > > And on top, the ModSec variable "rule" is only available during the
> > > execution of the very rule (and there might be many, many rules).
> > >
> > > I suggest you read up on my free tutorials published at netnea.com.
> > > The one on logging and the ones on the Core Rule Set are proposing
> > > ways to achieve something along these lines.
> > >
> > > Best,
> > >
> > > Christian
> > >
> > >
> > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > > > Hi All,
> > > >
> > > > Hope you all are well.
> > > >
> > > > I want to add the modsecurity variable e.g "rule.id"in the apache
> access
> > > > log via the extended format.
> > > > I set the following line in /etc/apache2/apache.conf
> > > >
> > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
> \"%{User-Agent}i\"
> > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> > > >
> > > > However I am not getting the rule.id value in the access log line.
> > > >
> > > > Kindly suggest.
> > > >
> > > > Thanks,
> > > > Homesh
> > >
> > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > >
> > >
> > >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Use of Modsec variable in apache access log

[<az...@po...>]

No, you can set it for all rules using SecDefaultAction (it's  
one-liner setting).





Citát homesh joshi <ho...@gm...>:

> Hi Azurit,
>
> Thank you for your reply. In that case I will have to ensure all the rules
> which are currently using either 403 or 501 need to be changed to something
> say 408.
> Instead I just need to set the flag in the access log which I can use in
> the reporting to sort the allowed transactions. Ideally if there is any
> variable for modsec final action  say blocked or allowed then nothing like
> it.
>
> Thanks,
> Homesh
>
> On Thu, Mar 24, 2022 at 9:53 AM <az...@po...> wrote:
>
>> Hi Homesh,
>>
>> if all you need is to distinguish between blocked/passed requests then
>> what about using different HTTP code used by modsecurity for blocking?
>> There are lot's of HTTP codes which can fit. You can set it using
>> SecDefaultAction.
>>
>> azurit
>>
>>
>>
>>
>> Citát homesh joshi <ho...@gm...>:
>>
>> > Dear Christian,
>> >
>> > Thanks for the clarification.
>> > I have already gone through excellent netnea.com tutorials. I have
>> already
>> > used some of the configuration from tutorial.I do not use crs.
>> > My objective here is that I want to get a flag in access log line if
>> modsec
>> > has taken any action on the transaction say simply it can be a field like
>> > modsec=1 or modsec=0. This wi help me in separating transactions which
>> are
>> > allowed.(modsec=0) So then it is easy to show these transactions in the
>> > reporting system.
>> >
>> > Kindly suggest.
>> >
>> > Thanks,
>> > Homesh
>> >
>> > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
>> > chr...@ne...> wrote:
>> >
>> >> HelloHomesh,
>> >>
>> >> Unfortunately, this is not how this works.
>> >>
>> >> A ModSecuriy variable is not automatically an environment variable.
>> >> And on top, the ModSec variable "rule" is only available during the
>> >> execution of the very rule (and there might be many, many rules).
>> >>
>> >> I suggest you read up on my free tutorials published at netnea.com.
>> >> The one on logging and the ones on the Core Rule Set are proposing
>> >> ways to achieve something along these lines.
>> >>
>> >> Best,
>> >>
>> >> Christian
>> >>
>> >>
>> >> On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
>> >> > Hi All,
>> >> >
>> >> > Hope you all are well.
>> >> >
>> >> > I want to add the modsecurity variable e.g "rule.id"in the apache
>> access
>> >> > log via the extended format.
>> >> > I set the following line in /etc/apache2/apache.conf
>> >> >
>> >> > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
>> \"%{User-Agent}i\"
>> >> > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
>> >> >
>> >> > However I am not getting the rule.id value in the access log line.
>> >> >
>> >> > Kindly suggest.
>> >> >
>> >> > Thanks,
>> >> > Homesh
>> >>
>> >>
>> >> > _______________________________________________
>> >> > mod-security-users mailing list
>> >> > mod...@li...
>> >> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> >> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> >> > http://www.modsecurity.org/projects/commercial/rules/
>> >> > http://www.modsecurity.org/projects/commercial/support/
>> >>
>> >>
>> >>
>> >> _______________________________________________
>> >> mod-security-users mailing list
>> >> mod...@li...
>> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> >> http://www.modsecurity.org/projects/commercial/rules/
>> >> http://www.modsecurity.org/projects/commercial/support/
>> >>
>>
>>
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>

Re: [mod-security-users] Use of Modsec variable in apache access log

[Christian F. <chr...@ne...>]

Hi there,

On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote:
> Thanks for the clarification.
> I have already gone through excellent netnea.com tutorials. I have already
> used some of the configuration from tutorial.I do not use crs.

Thank you very much.

> My objective here is that I want to get a flag in access log line if modsec
> has taken any action on the transaction say simply it can be a field like
> modsec=1 or modsec=0. This wi help me in separating transactions which are
> allowed.(modsec=0) So then it is easy to show these transactions in the
> reporting system.

I'd do a setenv then in the rules.

... "setenv:modsec=1"

Similar to the way I set th various env variables in phase 5. You can simply
add this to every rule you have. Or you set up a more complicated scheme
and do it in the end in phase 5.

Best,

Christian

> 
> Kindly suggest.
> 
> Thanks,
> Homesh
> 
> On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> chr...@ne...> wrote:
> 
> > HelloHomesh,
> >
> > Unfortunately, this is not how this works.
> >
> > A ModSecuriy variable is not automatically an environment variable.
> > And on top, the ModSec variable "rule" is only available during the
> > execution of the very rule (and there might be many, many rules).
> >
> > I suggest you read up on my free tutorials published at netnea.com.
> > The one on logging and the ones on the Core Rule Set are proposing
> > ways to achieve something along these lines.
> >
> > Best,
> >
> > Christian
> >
> >
> > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > > Hi All,
> > >
> > > Hope you all are well.
> > >
> > > I want to add the modsecurity variable e.g "rule.id"in the apache access
> > > log via the extended format.
> > > I set the following line in /etc/apache2/apache.conf
> > >
> > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
> > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> > >
> > > However I am not getting the rule.id value in the access log line.
> > >
> > > Kindly suggest.
> > >
> > > Thanks,
> > > Homesh
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Use of Modsec variable in apache access log

[homesh j. <ho...@gm...>]

Hi Azurit,

Thank you for your reply. In that case I will have to ensure all the rules
which are currently using either 403 or 501 need to be changed to something
say 408.
Instead I just need to set the flag in the access log which I can use in
the reporting to sort the allowed transactions. Ideally if there is any
variable for modsec final action  say blocked or allowed then nothing like
it.

Thanks,
Homesh

On Thu, Mar 24, 2022 at 9:53 AM <az...@po...> wrote:

> Hi Homesh,
>
> if all you need is to distinguish between blocked/passed requests then
> what about using different HTTP code used by modsecurity for blocking?
> There are lot's of HTTP codes which can fit. You can set it using
> SecDefaultAction.
>
> azurit
>
>
>
>
> Citát homesh joshi <ho...@gm...>:
>
> > Dear Christian,
> >
> > Thanks for the clarification.
> > I have already gone through excellent netnea.com tutorials. I have
> already
> > used some of the configuration from tutorial.I do not use crs.
> > My objective here is that I want to get a flag in access log line if
> modsec
> > has taken any action on the transaction say simply it can be a field like
> > modsec=1 or modsec=0. This wi help me in separating transactions which
> are
> > allowed.(modsec=0) So then it is easy to show these transactions in the
> > reporting system.
> >
> > Kindly suggest.
> >
> > Thanks,
> > Homesh
> >
> > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> > chr...@ne...> wrote:
> >
> >> HelloHomesh,
> >>
> >> Unfortunately, this is not how this works.
> >>
> >> A ModSecuriy variable is not automatically an environment variable.
> >> And on top, the ModSec variable "rule" is only available during the
> >> execution of the very rule (and there might be many, many rules).
> >>
> >> I suggest you read up on my free tutorials published at netnea.com.
> >> The one on logging and the ones on the Core Rule Set are proposing
> >> ways to achieve something along these lines.
> >>
> >> Best,
> >>
> >> Christian
> >>
> >>
> >> On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> >> > Hi All,
> >> >
> >> > Hope you all are well.
> >> >
> >> > I want to add the modsecurity variable e.g "rule.id"in the apache
> access
> >> > log via the extended format.
> >> > I set the following line in /etc/apache2/apache.conf
> >> >
> >> > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\"
> \"%{User-Agent}i\"
> >> > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> >> >
> >> > However I am not getting the rule.id value in the access log line.
> >> >
> >> > Kindly suggest.
> >> >
> >> > Thanks,
> >> > Homesh
> >>
> >>
> >> > _______________________________________________
> >> > mod-security-users mailing list
> >> > mod...@li...
> >> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> > http://www.modsecurity.org/projects/commercial/rules/
> >> > http://www.modsecurity.org/projects/commercial/support/
> >>
> >>
> >>
> >> _______________________________________________
> >> mod-security-users mailing list
> >> mod...@li...
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> >>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Use of Modsec variable in apache access log

[<az...@po...>]

Hi Homesh,

if all you need is to distinguish between blocked/passed requests then  
what about using different HTTP code used by modsecurity for blocking?  
There are lot's of HTTP codes which can fit. You can set it using  
SecDefaultAction.

azurit




Citát homesh joshi <ho...@gm...>:

> Dear Christian,
>
> Thanks for the clarification.
> I have already gone through excellent netnea.com tutorials. I have already
> used some of the configuration from tutorial.I do not use crs.
> My objective here is that I want to get a flag in access log line if modsec
> has taken any action on the transaction say simply it can be a field like
> modsec=1 or modsec=0. This wi help me in separating transactions which are
> allowed.(modsec=0) So then it is easy to show these transactions in the
> reporting system.
>
> Kindly suggest.
>
> Thanks,
> Homesh
>
> On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
> chr...@ne...> wrote:
>
>> HelloHomesh,
>>
>> Unfortunately, this is not how this works.
>>
>> A ModSecuriy variable is not automatically an environment variable.
>> And on top, the ModSec variable "rule" is only available during the
>> execution of the very rule (and there might be many, many rules).
>>
>> I suggest you read up on my free tutorials published at netnea.com.
>> The one on logging and the ones on the Core Rule Set are proposing
>> ways to achieve something along these lines.
>>
>> Best,
>>
>> Christian
>>
>>
>> On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
>> > Hi All,
>> >
>> > Hope you all are well.
>> >
>> > I want to add the modsecurity variable e.g "rule.id"in the apache access
>> > log via the extended format.
>> > I set the following line in /etc/apache2/apache.conf
>> >
>> > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
>> > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
>> >
>> > However I am not getting the rule.id value in the access log line.
>> >
>> > Kindly suggest.
>> >
>> > Thanks,
>> > Homesh
>>
>>
>> > _______________________________________________
>> > mod-security-users mailing list
>> > mod...@li...
>> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> > http://www.modsecurity.org/projects/commercial/rules/
>> > http://www.modsecurity.org/projects/commercial/support/
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>

Re: [mod-security-users] Use of Modsec variable in apache access log

[homesh j. <ho...@gm...>]

Dear Christian,

Thanks for the clarification.
I have already gone through excellent netnea.com tutorials. I have already
used some of the configuration from tutorial.I do not use crs.
My objective here is that I want to get a flag in access log line if modsec
has taken any action on the transaction say simply it can be a field like
modsec=1 or modsec=0. This wi help me in separating transactions which are
allowed.(modsec=0) So then it is easy to show these transactions in the
reporting system.

Kindly suggest.

Thanks,
Homesh

On Thu, 24 Mar, 2022, 12:04 am Christian Folini, <
chr...@ne...> wrote:

> HelloHomesh,
>
> Unfortunately, this is not how this works.
>
> A ModSecuriy variable is not automatically an environment variable.
> And on top, the ModSec variable "rule" is only available during the
> execution of the very rule (and there might be many, many rules).
>
> I suggest you read up on my free tutorials published at netnea.com.
> The one on logging and the ones on the Core Rule Set are proposing
> ways to achieve something along these lines.
>
> Best,
>
> Christian
>
>
> On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> > Hi All,
> >
> > Hope you all are well.
> >
> > I want to add the modsecurity variable e.g "rule.id"in the apache access
> > log via the extended format.
> > I set the following line in /etc/apache2/apache.conf
> >
> > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
> > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> >
> > However I am not getting the rule.id value in the access log line.
> >
> > Kindly suggest.
> >
> > Thanks,
> > Homesh
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Use of Modsec variable in apache access log

[Christian F. <chr...@ne...>]

HelloHomesh,

Unfortunately, this is not how this works.

A ModSecuriy variable is not automatically an environment variable.
And on top, the ModSec variable "rule" is only available during the
execution of the very rule (and there might be many, many rules).

I suggest you read up on my free tutorials published at netnea.com.
The one on logging and the ones on the Core Rule Set are proposing
ways to achieve something along these lines.

Best,

Christian


On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote:
> Hi All,
> 
> Hope you all are well.
> 
> I want to add the modsecurity variable e.g "rule.id"in the apache access
> log via the extended format.
> I set the following line in /etc/apache2/apache.conf
> 
> LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
> %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended
> 
> However I am not getting the rule.id value in the access log line.
> 
> Kindly suggest.
> 
> Thanks,
> Homesh


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Use of Modsec variable in apache access log

[homesh j. <ho...@gm...>]

Hi All,

Hope you all are well.

I want to add the modsecurity variable e.g "rule.id"in the apache access
log via the extended format.
I set the following line in /etc/apache2/apache.conf

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"
%{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended

However I am not getting the rule.id value in the access log line.

Kindly suggest.

Thanks,
Homesh

[mod-security-users] ModSecurity based backdoor

[<az...@po...>]

Hi!

This is a proof-of-concept of malicious software running inside of  
ModSecurity WAF:
https://github.com/azurit/modsecurity-backdoor

azurit

Re: [mod-security-users] Rate Limiting Apache: Units associated with "burst_rate_limit" ?

[Andrew H. <and...@lo...>]

Hi Patrick,

> Upstream we actually have a pool of Citrix Netscalers – but when we tried making use of the Citrix recommended DoS features, we found that we ended up hitting up many false positives (just due to the legitimate “background noise” that individual users generated). Perhaps there is a way for the Netscalers to handle URL based rules (with counters), but the Netscalers seem to be more focused on protection against massive DoS style events.

The Netscalers will 100% support the logic to filter out a subset of
requests by URL (probably using a regular expression) and apply a rate
limit only to those.

Alternatively, you could try filtering out the requests in question
and sending them to a separate virtual service: one with a low
"maximum connections" limit to force connections to queue if there's a
sudden spike in traffic.

Not sure what the exact Citrix terminology would be or which buttons
you'd need to press (I work for a competing vendor ;) ), but I'd be
surprised if those scenarios aren't supported.

Thanks,
Andrew

-- 

Andrew Howe
Loadbalancer.org Ltd.
www.loadbalancer.org
+1 888 867 9504 / +44 (0)330 380 1064