0

I have Apache configured with mod_security and GeoIP2. GeoLite2-Country.mmdb is being downloaded by geoipupdate triggered by cron every week. My /etc/modsecurity/modsecurity.conf configuration looks like:

SecRuleEngine On
SecRule ARGS:modsecparam "@contains test" "id:4321,deny,status:403,msg:'ModSecurity test rule has triggered'"

SecRule REMOTE_ADDR "@geoLookup" "chain,id:20000,deny,status:403,msg:'NON PL IP addresses'"
SecRule GEO:COUNTRY_CODE "!@streq PL"
...

my /etc/modsecurity/crs-setup.conf points to GeoIP db:

SecGeoLookupDB /etc/modsecurity/GeoLite2-Country.mmdb

Running curl from my local machine: curl 'https://host/login/index.html?modsecparam=test' leaves the trace in the log:

...
SecRule "TX:EXECUTING_PARANOIA_LEVEL" "@lt 2" "phase:1,auditlog,id:980013,nolog,skipAfter:END-RESPONSE-980-CORRELATION"

SecRule "ARGS:modsecparam" "@contains test" "phase:2,log,auditlog,id:4321,deny,status:403,msg:'ModSecurity test rule has triggered'"

SecRule "&TX:dos_burst_time_slice" "@eq 0" "phase:5,auditlog,id:912110,t:none,nolog,ver:OWASP_CRS/3.2.0,chain,skipAfter:END-DOS-PROTECTION-CHECKS"
SecRule "&TX:dos_counter_threshold" "@eq 0" "chain"
SecRule "&TX:dos_block_timeout" "@eq 0"
...

However from some reason it won't block countries other than PL. What I am doing wrong?

DisplayName
  • 479
  • 2
  • 7
  • 20
  • Sorry for the ask but the content after the "leaves the trace in the log" is not the log content, they are rules. Can you show us the debug.log content? – airween Apr 26 '21 at 05:45

1 Answers1

0

Please take a look at the crs-setup.conf example, where we explain depending on which version you are using, the file type you should use for geodb.

Probably the core is:

# There are two formats for the GeoIP database. ModSecurity v2 uses GeoLite (.dat files),
# and ModSecurity v3 uses GeoLite2 (.mmdb files).
...
# Therefore, if you use ModSecurity v2, you need to regenerate updated .dat files
# from CSV files first.
#
# You can achieve this using https://github.com/sherpya/geolite2legacy
# Pick the zip files from maxmind site:
# https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip
#
# Follow the guidelines for installing the tool and run:
# ./geolite2legacy.py -i GeoLite2-Country-CSV.zip \
#                     -f geoname2fips.csv -o /usr/share/GeoliteCountry.dat

As you mentioned apache, probably you need .dat files.

Felipe. ModSecurity Dev-on-duty project

Felipe
  • 86
  • 4