Re: execute a script for all rules
Hans Mayer via mod-security-users <[email protected]> Thu, 21 Mar 2024 17:10:35 +0100
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============6732992016132696930== Content-Type: multipart/alternative; boundary="------------PPHGzgSZRyuGCUeKrbHzDDTG" Content-Language: de-DE, en-GB This is a multi-part message in MIME format. --------------PPHGzgSZRyuGCUeKrbHzDDTG Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Dear Franziska, Many thanks for your hint. It seems to be reasonable for what I want to achieve. Sorry, that I didn't explain well what's my goal. But let me try again. Whenever a rule is triggered then a script should be executed. For example what I have seen several times. Someone does some nasty things and one or more standard rules are blocking this attack. Great. But later on the same IP is looking around. Maybe triggering other rules or not. Therefore I want to block this IP in the firewall for a certain time. I hope this explains better. When you say I should write a rule checking the score then this rule should be available for all Apache virtuell servers. Because I don't want to modify all Apache configs. Till now I wrote rules specific for a server within the Apache config. Is there a location to place a self written rule for all servers ? Any help is welcome. Kind regards Hans -- On 21.03.24 13:07, Franziska Buehler wrote: > Hi Hans! > > To me, it's not clear what you're trying to achieve. > You would probably have to write a new rule that checks whether rules > have matched and therefore the blocking variables inbound or outbound > (e.g. tx.blocking_inbound_anomaly_score) are set. And then you "exec:" > and call your script in this new rule. > You can't test for individual rules, or at least I don't see how that > could work right now. > > Best, > Franziska > # CRS dev-on-duty > > Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via > mod-security-users <[email protected]>: > > > Dear All, > > I am using Apache/2.4.57 on Debian with the modsecurity-crs package > which is Producer ModSecurity for Apache/2.9.3 and Rule Set > OWASP_CRS/3.3.0 > > With self written rules I have the possibility to execute a script > with > the "exec:" statement. > > Is there a way to execute a script for all these predefined rules if > they are triggered ? > > > Kind regards > > Hans > > -- > > > > > > > > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --------------PPHGzgSZRyuGCUeKrbHzDDTG Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p><br> </p> <p>Dear Franziska,</p> <p>Many thanks for your hint. It seems to be reasonable for what I want to achieve. <br> </p> <p>Sorry, that I didn't explain well what's my goal. But let me try again. <br> </p> <p>Whenever a rule is triggered then a script should be executed. For example what I have seen several times. Someone does some nasty things and one or more standard rules are blocking this attack. Great. But later on the same IP is looking around. Maybe triggering other rules or not. Therefore I want to block this IP in the firewall for a certain time. I hope this explains better. <br> </p> <p>When you say I should write a rule checking the score then this rule should be available for all Apache virtuell servers. Because I don't want to modify all Apache configs. Till now I wrote rules specific for a server within the Apache config. Is there a location to place a self written rule for all servers ? <br> </p> <p>Any help is welcome. <br> </p> <p><br> </p> <p>Kind regards <br> </p> <p>Hans <br> </p> <p><br> </p> <p>-- <br> </p> <p><br> </p> <p><br> </p> <p><br> </p> <div class="moz-cite-prefix">On 21.03.24 13:07, Franziska Buehler wrote:<br> </div> <blockquote type="cite" cite="mid:CALrdzmLax_e=M7G3ACXQQF8LH+7TaJoQNh2Zv2PpN+KO5BpSFQ@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div dir="ltr"> <div dir="ltr">Hi Hans! <div><br> </div> <div>To me, it's not clear what you're trying to achieve.</div> <div> <div>You would probably have to write a new rule that checks whether rules have matched and therefore the blocking variables inbound or outbound (e.g. tx.blocking_inbound_anomaly_score) are set. And then you "exec:" and call your script in this new rule. </div> <div>You can't test for individual rules, or at least I don't see how that could work right now.</div> </div> <div><br> </div> <div>Best,</div> <div>Franziska</div> <div># CRS dev-on-duty</div> </div> </div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via mod-security-users <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br> Dear All,<br> <br> I am using Apache/2.4.57 on Debian with the modsecurity-crs package <br> which is Producer ModSecurity for Apache/2.9.3 and Rule Set OWASP_CRS/3.3.0<br> <br> With self written rules I have the possibility to execute a script with <br> the "exec:" statement.<br> <br> Is there a way to execute a script for all these predefined rules if <br> they are triggered ?<br> <br> <br> Kind regards<br> <br> Hans<br> <br> -- <br> <br> <br> <br> <br> <br> <br> <br> _______________________________________________<br> mod-security-users mailing list<br> <a href="mailto:[email protected]" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/mod-security-users" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<br> <a href="http://www.modsecurity.org/projects/commercial/rules/" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">http://www.modsecurity.org/projects/commercial/rules/</a><br> <a href="http://www.modsecurity.org/projects/commercial/support/" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">http://www.modsecurity.org/projects/commercial/support/</a><br> </blockquote> </div> </blockquote> </body> </html> --------------PPHGzgSZRyuGCUeKrbHzDDTG-- --===============6732992016132696930== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============6732992016132696930== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============6732992016132696930==--