Re: SecRuleUpdateActionById
Franziska Buehler <[email protected]> Fri, 2 May 2025 11:15:22 +0200
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CALrdzm+iv1G_f-Xy=pJQrSYndMyoSNoEEdgy5=CBh4ZdTd++fQ@mail.gmail.com> |
--===============1037724199544132173== Content-Type: multipart/alternative; boundary="000000000000aefbf3063423975d" --000000000000aefbf3063423975d Content-Type: text/plain; charset="UTF-8" Hi! It's not a good idea to edit the rule files directly, as you've noticed. The following directive works for me if I add it AFTER the CRS rules include: SecRuleUpdateActionById 920210 "noauditlog". I've tested it. You can, for example, rename the file rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example to rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf and add the directive there. You can also use an include in your Apache config after the CRS rules include. Why do you need a nolog for 949110 and 980130? This will make you completely blind to which requests were blocked. Otherwise, you can probably achieve it with the same directive as above. Please also read our excellent documentation on these topics: https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/#directly-modifying-crs-rules https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/#rule-exclusions https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/#placement-of-rule-exclusions Best, Franziska, CRS Dev-on-Duty Am Do., 1. Mai 2025 um 23:27 Uhr schrieb CM via mod-security-users < [email protected]>: > I previously added "noauditlog" to rule 920210 by editing REQUEST-920-PROTOCOL-ENFORCEMENT.conf > (and modified some other rules similarly) but I'm tired of the file getting > overwritten by upgrades, I want to be able to manage my rule modifications > centrally > > tried this first (too good to be true): > > SecRuleUpdateActionById 920210 "noauditlog" > > didn't work, I guess I'm overwriting everything that's there instead of > just adding > > so I copied everything from the rule (except ID and phase) and added > "nolog" to it, ending up with this: > > SecRuleUpdateActionById 920210 "block, noauditlog, t:none, > msg:'Multiple/Conflicting Connection Header Data Found', > logdata:'%{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', > tag:'platform-multi', tag:'attack-protocol', tag:'paranoia-level/1', > tag:'OWASP_CRS', tag:'capec/1000/210/272', ver:'OWASP_CRS/3.3.5', > severity:'WARNING', > setvar:'tx.anomaly_score_pl1=+%{tx.warning_anomaly_score}'" > > that did sorta work but also it resulted in the anomaly score being > applied twice, causing requests to be blocked that shouldn't have been > > so I tried removing just the anomaly score thing: > > SecRuleUpdateActionById 920210 "block, noauditlog, t:none, > msg:'Multiple/Conflicting Connection Header Data Found', > logdata:'%{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', > tag:'platform-multi', tag:'attack-protocol', tag:'paranoia-level/1', > tag:'OWASP_CRS', tag:'capec/1000/210/272', ver:'OWASP_CRS/3.3.5', > severity:'WARNING'" > > and that does seem to work but do I really need all that? > > what's the absolute minimum I can do here to add "noauditlog" without > breaking functionality of the rule? > > I also need to add "nolog" to rule 949110 and 980130, so what's the > simplest possible SecRuleUpdateActionById that would do this without > breaking them? > > also I noticed I can't do this in my modsecurity.conf (because it's > loaded before the rules), I had to put it in one of my Apache > configurations that's loaded after the rules > > any possible way to make modsecurity.conf process after the rules files > are loaded so I can use SecRuleUpdateActionById in it instead of in my > Apache configs? > > apache2/mods-enabled/security2.conf contains the following: > > IncludeOptional /etc/modsecurity/*.conf > IncludeOptional /usr/share/modsecurity-crs/*.load > > if I swapped the order of these, would it break anything? > > Sent with Proton Mail <https://proton.me/mail/home> secure email. > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --000000000000aefbf3063423975d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi!<div><br></div><div>It's not a good idea to edit th= e rule files directly, as you've noticed.<br><br>The following directiv= e works for me if I add it AFTER the CRS rules include:<br>SecRuleUpdateAct= ionById 920210 "noauditlog".=C2=A0</div><div>I've tested it.<= br><br>You can, for example, rename the file rules/RESPONSE-999-EXCLUSION-R= ULES-AFTER-CRS.conf.example to rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS= .conf and add the directive there.<br>You can also use an include in your A= pache config after the CRS rules include.<br><br>Why do you need a nolog fo= r 949110 and 980130? This will make you completely blind to which requests = were blocked. Otherwise, you can probably achieve it with the same directiv= e as above.<br></div><div><br></div><div>Please also read our excellent doc= umentation on these topics:<br><a href=3D"https://coreruleset.org/docs/2-ho= w-crs-works/2-3-false-positives-and-tuning/#directly-modifying-crs-rules">h= ttps://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/= #directly-modifying-crs-rules</a></div><div><a href=3D"https://coreruleset.= org/docs/2-how-crs-works/2-3-false-positives-and-tuning/#rule-exclusions">h= ttps://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/= #rule-exclusions</a></div><div><a href=3D"https://coreruleset.org/docs/2-ho= w-crs-works/2-3-false-positives-and-tuning/#placement-of-rule-exclusions">h= ttps://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/= #placement-of-rule-exclusions</a><br></div><div><br></div><div>Best,</div><= div>Franziska,</div><div>CRS Dev-on-Duty</div></div><br><div class=3D"gmail= _quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">Am Do.,= 1. Mai 2025 um 23:27=C2=A0Uhr schrieb CM via mod-security-users <<a hre= f=3D"mailto:[email protected]">mod-security-users@li= sts.sourceforge.net</a>>:<br></div><blockquote class=3D"gmail_quote" sty= le=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:soli= d;border-left-color:rgb(204,204,204);padding-left:1ex"><div style=3D"font-f= amily:Arial,sans-serif;font-size:14px">I previously added "noauditlog&= quot; to rule <span>920210</span> by editing <span>REQUEST-920-PROTOCOL-ENF= ORCEMENT.conf=C2=A0=C2=A0 (and modified some other rules similarly) but I&#= 39;m tired of the file getting overwritten by upgrades, I want to be able t= o manage my rule modifications centrally<br></span></div><div style=3D"font= -family:Arial,sans-serif;font-size:14px"><span><br></span></div><div style= =3D"font-family:Arial,sans-serif;font-size:14px"><span>tried this first (to= o good to be true):</span></div><div style=3D"font-family:Arial,sans-serif;= font-size:14px"><span><br></span></div><div style=3D"font-family:Arial,sans= -serif;font-size:14px"><span><span>SecRuleUpdateActionById 920210 "noa= uditlog"</span><br></span></div><div style=3D"font-family:Arial,sans-s= erif;font-size:14px"><span><br></span></div><div style=3D"font-family:Arial= ,sans-serif;font-size:14px"><span>didn't work, I guess I'm overwrit= ing everything that's there instead of just adding</span></div><div sty= le=3D"font-family:Arial,sans-serif;font-size:14px"><span><br></span></div><= div style=3D"font-family:Arial,sans-serif;font-size:14px"><span>so I copied= everything from the rule (except ID and phase) and added "nolog"= to it, ending up with this:</span></div><div style=3D"font-family:Arial,sa= ns-serif;font-size:14px"><span><br></span></div><div style=3D"font-family:A= rial,sans-serif;font-size:14px"><span><span>SecRuleUpdateActionById 920210 = "block, noauditlog, t:none, msg:'Multiple/Conflicting Connection H= eader Data Found', logdata:'%{MATCHED_VAR}', tag:'applicati= on-multi', tag:'language-multi', tag:'platform-multi', = tag:'attack-protocol', tag:'paranoia-level/1', tag:'OWA= SP_CRS', tag:'capec/1000/210/272', ver:'OWASP_CRS/3.3.5'= ;, severity:'WARNING', setvar:'tx.anomaly_score_pl1=3D+%{tx.war= ning_anomaly_score}'"</span><br></span></div><div style=3D"font-fa= mily:Arial,sans-serif;font-size:14px"><span><br></span></div><div style=3D"= font-family:Arial,sans-serif;font-size:14px"><span>that did sorta work but = also it resulted in the anomaly score being applied twice, causing requests= to be blocked that shouldn't have been</span></div><div style=3D"font-= family:Arial,sans-serif;font-size:14px"><span><br></span></div><div style= =3D"font-family:Arial,sans-serif;font-size:14px"><span>so I tried removing = just the anomaly score thing:</span></div><div style=3D"font-family:Arial,s= ans-serif;font-size:14px"><span><br></span></div><div style=3D"font-family:= Arial,sans-serif;font-size:14px"><span><span>SecRuleUpdateActionById 920210= "block, noauditlog, t:none, msg:'Multiple/Conflicting Connection = Header Data Found', logdata:'%{MATCHED_VAR}', tag:'applicat= ion-multi', tag:'language-multi', tag:'platform-multi',= tag:'attack-protocol', tag:'paranoia-level/1', tag:'OW= ASP_CRS', tag:'capec/1000/210/272', ver:'OWASP_CRS/3.3.5= 9;, severity:'WARNING'"</span><br></span></div><div style=3D"f= ont-family:Arial,sans-serif;font-size:14px"><span><br></span></div><div sty= le=3D"font-family:Arial,sans-serif;font-size:14px"><span>and that does seem= to work but do I really need all that?</span></div><div style=3D"font-fami= ly:Arial,sans-serif;font-size:14px"><span><br></span></div><div style=3D"fo= nt-family:Arial,sans-serif;font-size:14px"><span>what's the absolute mi= nimum I can do here to add "noauditlog" without breaking function= ality of the rule?</span></div><div style=3D"font-family:Arial,sans-serif;f= ont-size:14px"><span><br></span></div><div style=3D"font-family:Arial,sans-= serif;font-size:14px"><span>I also need to add "nolog" to rule <s= pan>949110</span> and <span>980130</span>, so what's the simplest possi= ble <span>SecRuleUpdateActionById</span> that would do this without breakin= g them?<br></span></div><div style=3D"font-family:Arial,sans-serif;font-siz= e:14px"><span><br></span></div><div style=3D"font-family:Arial,sans-serif;f= ont-size:14px"><span>also I noticed I can't do this in my <span>modsecu= rity.conf</span> (because it's loaded before the rules), I had to put i= t in one of my Apache configurations that's loaded after the rules</spa= n></div><div style=3D"font-family:Arial,sans-serif;font-size:14px"><span><b= r></span></div><div style=3D"font-family:Arial,sans-serif;font-size:14px"><= span>any possible way to make <span>modsecurity.conf</span> process after t= he rules files are loaded so I can use <span><span>SecRuleUpdateActionById<= /span></span> in it instead of in my Apache configs?</span></div><div style= =3D"font-family:Arial,sans-serif;font-size:14px"><span><span><br></span></s= pan></div><div style=3D"font-family:Arial,sans-serif;font-size:14px"><span>= <span>apache2/mods-enabled/security2.conf</span> contains the following:</s= pan></div><div style=3D"font-family:Arial,sans-serif;font-size:14px"><span>= <br></span></div><div style=3D"font-family:Arial,sans-serif;font-size:14px"= ><span><span>IncludeOptional /etc/modsecurity/*.conf</span><br></span></div= ><div style=3D"font-family:Arial,sans-serif;font-size:14px"><span><span>Inc= ludeOptional /usr/share/modsecurity-crs/*.load</span><br></span></div><div = style=3D"font-family:Arial,sans-serif;font-size:14px"><span><br></span></di= v><div style=3D"font-family:Arial,sans-serif;font-size:14px"><span>if I swa= pped the order of these, would it break anything?<br></span></div><div styl= e=3D"font-family:Arial,sans-serif;font-size:14px"><br></div> <div style=3D"font-family:Arial,sans-serif;font-size:14px"> <div> =20 </div> =20 <div> Sent with <a href=3D"https://proton.me/mail/home" target=3D"_blank"= >Proton Mail</a> secure email. </div> </div> _______________________________________________<br> mod-security-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"= rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l= istinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<b= r> <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no= referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/= rules/</a><br> <a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"= noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia= l/support/</a><br> </blockquote></div> --000000000000aefbf3063423975d-- --===============1037724199544132173== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1037724199544132173== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============1037724199544132173==--