0

I have compiled nginx latest stable 1.4.3 with modsecurity latest-stable 2.7.5 but while it works i cant get it to recognize my custom rules.I am using the owasp crs 2.2.8(Using the base rules only and Collaborative Detection Blocking). I am appending my modsecurity_crs_15_custom_rules.conf to the modsecurity.conf right after the recommended rules and before the 20-30 rules. A rule like that worked perfectly for example with apache 2.2.22 

SecRule  REQUEST_HEADERS " @contains /REST" "id:111115,phase:1,t:none,nolog,pass,setvar:'tx.allowed_headers=Content-Range/ ask/ additional/ X-Requested-With/ Make/ Content-Type/'"

or this one

SecRule REQUEST_FILENAME " <at> contains /REST" "id:111114,phase:1,t:none,nolog,pass,setvar:'tx.allowed_methods=GET HEAD POST OPTIONS PUT DELETE',setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|text/html|application/javascript|application/json'"

I know its not a long time since support for modsecurity was added to nginx but this one should work. I really love nginx, his speed, modules and the event-based approach, i wont go back. Any hints how to manage this?

user1620572
  • 1
  • 2
  • As a temporary workaround one can edit the base rule with id 900012 and set there some allowed headers or request_content_type, i couldnt get the custom rule to pass phase 1 with many different id's from range 9000** and up – user1620572 Nov 01 '13 at 11:54
  • My bad i hadn't set the default action to pass phase 1 to enable delayed blocking mode(aka anomaly scoring) thought that was enabled by default. Custom rules working nicely – user1620572 Nov 01 '13 at 12:12

0 Answers0