ModSecurity Handbook: Getting Started - Bad Request

Recommendations

Info

Preface to the Free Edition Welcome to ModSecurity Handbook: Getting Started. This is a special free version that consists of the first 4 chapters of the full book. Since ModSecurity Handbook went into print— slightly over 2 years ago—I realized that there were many new users of ModSecurity who were not yet interested in mastering this tool (and wouldn’t consider buying a book), but could benefit from having access to better documentation. This version offers exactly that, with an introduction to ModSecurity in Chapter 1, and coverage of installation and configuration in Chapters 2, 3, and 4. Enjoy. xix
Preface I didn’t mean to write this book, I really didn’t. Several months ago I started to work on the second edition of Apache Security, deciding to rewrite the ModSecurity chapter first. A funny thing happened: the ModSecurity chapter kept growing and growing. It hit 40 pages. It hit 80 pages. And then I realized that I was nowhere near the end. That was all the excuse I needed to put Apache Security aside—for the time being—and focus on a ModSecurity book instead. I admit that I couldn’t be happier, although it was an entirely emotional decision. After spending years working on ModSecurity, I knew it had so much more to offer, yet the documentation wasn’t there to show the way. But it is now, I am thrilled to say. The package is complete: you have an open source tool that is able to compete with the best commercial products out there, and you have the documentation to match. With this book I am also trying something completely new—continuous writing and publishing. You see, I had published my first book with a major publisher, but I never quite liked the process. It was too slow. You write a book pretty much in isolation, you publish it, and then you never get to update it. I was never happy with that, and that’s why I decided to do things differently this time. Simply said, ModSecurity Handbook is a living book. Every time I make a change, a new digital version is made available to you. If I improve the book based on your feedback, you get the improvements as soon as I make them. If you prefer a paper book, you can still get it of course, through the usual channels. Although I can’t do anything about updating the paper version of the book, we can narrow the gap slightly by pushing out book updates even between editions. That means that, even when you get the paper version (as most people seem to prefer to), it is never going to be too much behind the digital version. Scope and Audience This book exists to document every single aspect of ModSecurity and to teach you how to use it. It is as simple as that. ModSecurity is a fantastic tool, but it is let down by the poor quality of the documentation. As a result, the adoption is not as good as it could be; application security is difficult on its own and you don’t really want to struggle with poorly documented tools xxi
Page 1 and 2: MODSECURITY HANDBOOK The Complete G
Page 3 and 4: ModSecurity Handbook Ivan Ristić
Page 5 and 6: Table of Contents Preface to the Fr
Page 7 and 8: Advanced Logging Configuration 66 I
Page 9 and 10: Initializing Records 122 Controllin
Page 11 and 12: Rule per Keyword Approach 194 Combi
Page 13 and 14: SecRequestBodyInMemoryLimit 263 Sec
Page 15 and 16: REQUEST_BODY 287 REQUEST_BODY_LENGT
Page 17 and 18: eplaceComments 304 replaceNulls 304
Page 19: streq 330 validateByteRange 330 val
Page 23 and 24: chapter goes under the hood of ModS
Page 25 and 26: open source, you can extend it dire
Page 27 and 28: I User Guide This part, with its 14
Page 29 and 30: eleased in November 2002, but a few
Page 31 and 32: similar restrictions, either direct
Page 33 and 34: Embedded Because ModSecurity is an
Page 35 and 36: Request header transformation Apach
Page 37 and 38: invoke the rules specified to work
Page 39 and 40: what was read. The fourth message t
Page 41 and 42: In the example traces, you’ve obs
Page 43 and 44: Rule writing Rule writing is an ess
Page 45 and 46: minor) version. Before reporting an
Page 47 and 48: 2 Installation Before you can insta
Page 49 and 50: gpg: Signature made Wed 12 Aug 2009
Page 51 and 52: Once you have determined the locati
Page 53 and 54: Compile-Time Options The configurat
Page 55 and 56: # yum install mod_security On CentO
Page 57 and 58: 3 Configuration Now that you have M
Page 59 and 60: Audit logs /opt/modsecurity/var/aud
Page 61 and 62: file, I refer to any other ModSecur
Page 63 and 64: SecRequestBodyAccess On Once this f
Page 65 and 66: Note To instruct ModSecurity to ins
Page 67 and 68: For now, we also assume that you wi
Page 69 and 70: The SecArgumentSeparator directive
Page 71 and 72:
DA %{MULTIPART_DATA_AFTER}, \ HF %{
Page 73 and 74:
4 Logging This section covers the l
Page 75 and 76:
One way to make debugging easier is
Page 77 and 78:
the use of multiple segments is to
Page 79 and 80:
Concurrent Audit Log Initially, Mod
Page 81 and 82:
How Remote Logging Works Remote log
Page 83 and 84:
Activating Remote Logging You will
Page 85 and 86:
That’s basically all you need to
Page 87 and 88:
Note Storage of intercepted files c
Page 89 and 90:
print "$output\n"; Note If you need
Page 91 and 92:
Dynamically Altering Logging Config
Page 93 and 94:
Now you need to add a phase rule th
Page 95 and 96:
Index A Action part H header, 343 a
Page 97 and 98:
adding new variable, 235 extension
Page 99 and 100:
performance comparing rule sets, 18
Page 101 and 102:
SecChrootDir directive, 252 SecColl
Page 103:
WebApp-Info part H header, 346 web
show all

ModSecurity Handbook: Getting Started - Bad Request

Create successful ePaper yourself

Delete template?

Save as template?