bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CU-cyk0dp cleaned up modsecurity, added whitelisting

Browse Source
This commit is contained in:
Bastian de Byl
2020-10-01 00:26:09 -04:00
parent 798c3bbb80
commit fec4bab487
2 changed files with 23 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ansible/roles/http/defaults/main.yml
View File

@@ -5,6 +5,9 @@ deps: [
nginx-mod-modsecurity nginx-mod-modsecurity
] ]
ci_server_name: ci.bdebyl.net
install_path: /usr/share
nginx_path: /etc/nginx nginx_path: /etc/nginx
nginx_conf_path: "{{ nginx_path }}/conf" nginx_conf_path: "{{ nginx_path }}/conf"
modsec_rules_path: "{{ nginx_conf_path }}/rules" modsec_rules_path: "{{ nginx_conf_path }}/rules"
@@ -12,14 +15,17 @@ modsec_crs_before_rule_conf:
"{{ modsec_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf" "{{ modsec_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf"
modsec_crs_after_rule_conf: modsec_crs_after_rule_conf:
"{{ modsec_rules_path }}/REQUEST-999-EXCLUSION-RULES-AFTER-CRS.conf" "{{ modsec_rules_path }}/REQUEST-999-EXCLUSION-RULES-AFTER-CRS.conf"
ci_server_name: ci.bdebyl.net
install_path: /usr/share
modsec_path: "{{ install_path }}/modsecurity" modsec_path: "{{ install_path }}/modsecurity"
crs_path: "{{ install_path }}/coreruleset" crs_path: "{{ install_path }}/coreruleset"
crs_rules_path: "{{ crs_path }}/rules" crs_rules_path: "{{ crs_path }}/rules"
modsec_whitelist_local_re: >-
^SecRule.*REMOTE_ADDR.*192\.168\.1\.1/24.*$
modsec_whitelist_local: >-
SecRule REMOTE_ADDR "@ipMatch 192.168.1.1/24"
"id:1,phase:1,nolog,allow,ctl:ruleEngine=Off"
modsec_git_urls: modsec_git_urls:
- src: "https://github.com/coreruleset/coreruleset.git" - src: "https://github.com/coreruleset/coreruleset.git"
dest: "{{ crs_path }}" dest: "{{ crs_path }}"
@@ -35,9 +41,11 @@ modsec_conf_links:
dest: "{{ nginx_path }}/unicode.mapping" dest: "{{ nginx_path }}/unicode.mapping"
- src: "{{ crs_path }}/crs-setup.conf.example" - src: "{{ crs_path }}/crs-setup.conf.example"
dest: "{{ nginx_conf_path }}/crs-setup.conf" dest: "{{ nginx_conf_path }}/crs-setup.conf"
- src: "{{ crs_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example" - src:
"{{ crs_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example"
dest: "{{ modsec_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf" dest: "{{ modsec_rules_path }}/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf"
- src: "{{ crs_rules_path }}/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example" - src:
"{{ crs_rules_path }}/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example"
dest: "{{ modsec_rules_path }}/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf" dest: "{{ modsec_rules_path }}/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf"
crs_rule_links: crs_rule_links:

28
ansible/roles/http/tasks/modsec.yml
View File

@@ -68,25 +68,15 @@
notify: restart_nginx notify: restart_nginx
tags: modsec, modsec_rules tags: modsec, modsec_rules
# name: fetch core rule set files for mod-security - name: whitelist local ip addresses
# become: true become: true
# get_url: lineinfile:
# url: "{{ item.url }}" path: "{{ nginx_path }}/modsecurity.conf"
# dest: "{{ item.dest }}" regexp: "{{ modsec_whitelist_local_re }}"
# mode: 0644 line: "{{ modsec_whitelist_local }}"
# with_items: mode: 0644
# - {"url": "{{ modsec_conf_url }}", notify: restart_nginx
# "dest": "{{ nginx_path }}/modsecurity.conf"} tags: modsec, modsec_rules, modsec_whitelist
# - {"url": "{{ modsec_unicode_url }}",
# "dest": "{{ nginx_path }}/unicode.mapping"}
# - {"url": "{{ crs_setup_url }}",
# "dest": "{{ nginx_conf_path }}/crs-setup.conf"}
# - {"url": "{{ crs_before_url }}",
# "dest": "{{ modsec_crs_before_rule_conf }}"}
# - {"url": "{{ crs_after_url }}",
# "dest": "{{ modsec_crs_after_rule_conf }}"}
# notify: restart_nginx
# tags: modsec
- name: activate mod-security - name: activate mod-security
become: true become: true