nginx with modsecurity v3

--===============1312453130973230009==
Content-Type: multipart/alternative; boundary="000000000000efae0e063afc08ee"

--000000000000efae0e063afc08ee
Content-Type: text/plain; charset="UTF-8"

Dear Team,

I have Apache running with ModSecurity, and Apache is currently acting as a
reverse proxy. ModSecurity is working correctly in this setup.

Now, I want to migrate from Apache to Nginx. I have installed ModSecurity
version 3 (ModSecurity v3). I would like to log a custom variable from a
ModSecurity rule and use that variable in the Nginx access log.

What is the correct way to achieve this? Please help.

Should I migrate my setup to nginx??

I tried the following approach, but Nginx failed to reload.

Nginx Error while reload###

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File:
/etc/nginx/whitelist.conf. Line: 53. Column: 44. Expecting an action,
got:  ctl:responseHeader=set X-TX-WAF:%{tx.waf},\ in
/etc/nginx/conf.d/932/93258.conf:12


Rule##

SecRule REQUEST_HEADERS:Host "^beta\.site\.net$"
\"id:4737,phase:2,pass,log,t:lowercase,chain"SecRule
ARGS|ARGS_NAMES|REQUEST_BODY|REQUEST_BASENAME|REQUEST_FILENAME|REQUEST_URI
"@rx ." \"setvar:tx.sqli_rule_removed=1,\setvar:tx.waf=0,\setvar:tx.msg1='SQLi
Whitelist for beta',\setvar:tx.id1=942100,\setvar:tx.wlmsg='CWL',\setvar:tx.data1='%{MATCHED_VAR}',\msg:'Removing
SQLi rule 942100 for beta.site.net',\
tag:'WHITELIST_RULE_ID',\severity:'INFO',\ctl:ruleRemoveById=942100"
SecRule TX:WAF "@eq 0" \"id:4738,\phase:4,\pass,\log,\ msg:'Setting
custom log headers for beta',\ctl:responseHeader=set
X-TX-WAF:%{tx.waf},\ctl:responseHeader=set
X-TX-Msg1:%{tx.msg1},\ctl:responseHeader=set
X-TX-Id1:%{tx.id1},\ctl:responseHeader=set
X-TX-Wlmsg:%{tx.wlmsg},\ctl:responseHeader=set X-TX-Data1:%{tx.data1}"



Thanks,
Rakesh Bare

--000000000000efae0e063afc08ee
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>Dear Team,</div><p>I have Apache running with Mo=
dSecurity, and Apache is currently acting as a reverse proxy. ModSecurity i=
s working correctly in this setup.</p>
<p>Now, I want to migrate from Apache to Nginx. I have installed ModSecurit=
y version 3 (ModSecurity v3). I would like to log a custom variable from a =
ModSecurity rule and use that variable in the Nginx access log.</p>
<p>What is the correct way to achieve this? Please help.=C2=A0<br></p><p>Sh=
ould I migrate my setup to nginx??</p>
<p>I tried the following approach, but Nginx failed to reload.</p><br></div=
><div>Nginx Error while reload###</div><div><pre id=3D"gmail-go_default_ter=
m55_pre" class=3D"gmail-=E2=9C=88terminal_pre"><span id=3D"gmail-go_default=
_term55screen" class=3D"gmail-=E2=9C=88screen"><span class=3D"gmail-=E2=9C=
=88termline gmail-go_default_line_51">nginx: [emerg] &quot;modsecurity_rule=
s_file&quot; directive Rules error. File: /etc/nginx/whitelist.conf. Line: =
53. Column: 44. Expecting an action, got:  ctl:responseHeader=3Dset X-TX-WA=
F:%{tx.waf},\ in /etc/nginx/conf.d/932/93258.conf:12
</span></span></pre></div><div><br></div><div>Rule##</div><div><br></div><d=
iv><pre id=3D"gmail-go_default_term55_pre" class=3D"gmail-=E2=9C=88terminal=
_pre"><span id=3D"gmail-go_default_term55screen" class=3D"gmail-=E2=9C=88sc=
reen"><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_27">SecR=
ule REQUEST_HEADERS:Host <span class=3D"gmail-=E2=9C=88f1">&quot;^beta\.sit=
e\.net$&quot;</span> \
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_28">&qu=
ot;id:<span class=3D"gmail-=E2=9C=88f1">4737</span>,phase:<span class=3D"gm=
ail-=E2=9C=88f1">2</span>,pass,log,t:lowercase,chain&quot;
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_29">Sec=
Rule ARGS|ARGS_NAMES|REQUEST_BODY|REQUEST_BASENAME|REQUEST_FILENAME|REQUEST=
_URI <span class=3D"gmail-=E2=9C=88f1">&quot;@rx .&quot;</span> \
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_30">&qu=
ot;setvar:tx.sqli_rule_removed=3D<span class=3D"gmail-=E2=9C=88f1">1</span>=
,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_31">set=
var:tx.waf=3D<span class=3D"gmail-=E2=9C=88f1">0</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_32">set=
var:tx.msg1=3D<span class=3D"gmail-=E2=9C=88f1">&#39;SQLi Whitelist for bet=
a&#39;</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_33">set=
var:tx.id1=3D<span class=3D"gmail-=E2=9C=88f1">942100</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_34">set=
var:tx.wlmsg=3D<span class=3D"gmail-=E2=9C=88f1">&#39;CWL&#39;</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_35">set=
var:tx.data1=3D<span class=3D"gmail-=E2=9C=88f1">&#39;%{MATCHED_VAR}&#39;</=
span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_36">msg=
:&#39;Removing SQLi rule <span class=3D"gmail-=E2=9C=88f1">942100</span> fo=
r <a href=3D"http://beta.site.net">beta.site.net</a>&#39;,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_37"> ta=
g:&#39;WHITELIST_RULE_ID&#39;,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_38">sev=
erity:&#39;INFO&#39;,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_39">ctl=
:ruleRemoveById=3D<span class=3D"gmail-=E2=9C=88f1">942100&quot;</span>
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_40">=20
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_41">=20
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_42"><sp=
an class=3D"gmail-=E2=9C=88f1">SecRule TX:WAF &quot;</span>@eq <span class=
=3D"gmail-=E2=9C=88f1">0&quot; \</span>
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_43"><sp=
an class=3D"gmail-=E2=9C=88f1">&quot;</span>id:<span class=3D"gmail-=E2=9C=
=88f1">4738</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_44">pha=
se:<span class=3D"gmail-=E2=9C=88f1">4</span>,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_45">pas=
s,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_46">log=
,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_47"> ms=
g:&#39;Setting custom log headers for beta&#39;,\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_48"><sp=
an id=3D"gmail-term55cursor" class=3D"gmail-=E2=9C=88cursor">c</span>tl:res=
ponseHeader=3Dset X-TX-WAF:%{tx.waf},\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_49">ctl=
:responseHeader=3Dset X-TX-Msg1:%{tx.msg1},\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_50">ctl=
:responseHeader=3Dset X-TX-Id1:%{tx.id1},\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_51">ctl=
:responseHeader=3Dset X-TX-Wlmsg:%{tx.wlmsg},\
</span><span class=3D"gmail-=E2=9C=88termline gmail-go_default_line_52">ctl=
:responseHeader=3Dset X-TX-Data1:%{tx.data1}<span class=3D"gmail-=E2=9C=88f=
1">&quot;</span>
</span></span></pre><br><br></div><div>Thanks,</div><div>Rakesh Bare</div><=
/div>

--000000000000efae0e063afc08ee--


--===============1312453130973230009==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1312453130973230009==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============1312453130973230009==--