Modsecurity + OWASP as an WAF for Sites? [RELEASED]

blackpoint

Hello,

what do you think about adding modsecurity to enhance and add it in a way that you can decide on a per site basis if you want to enable or disable. Modsecurity + OWASP will create a basic protection WAF what will be very helpful for a lot of (wordpress) sites I guess.

Best regards,
Dirk

Zoinkies

Fastly have an agent based WAF you could integrate.

blackpoint

Hello,
sure, I also use CDN77 or SUCURI as an WAF for websites. So far so good. But I saw this as a feature at checkdomains today and I like the idea of integrating a basic WAF based on modsecurity simply as on/off. I think that's a useful feature for customers in this days.
best regards,
Dirk

kyzoeadmin

i totally agree on modsecurity and Owasp rules, we use it on our Directadmin servers, and would be great to have them on enhance, i think it is important to have modsec and owasp, as they are opensource instead of the sucuri and other commercial alternatives.

AdamM

Also OWASP® ModSecurity Core Rule Set (CRS) looks interesting
https://coreruleset.org/

The OWASP® ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The CRS provides protection against many common attack categories, including:

SQL Injection (SQLi)
Cross Site Scripting (XSS)
Local File Inclusion (LFI)
Remote File Inclusion (RFI)
PHP Code Injection
Java Code Injection HTTPoxy
Shellshock
Unix/Windows Shell Injection
Session Fixation
Scripting/Scanner/Bot Detection
Metadata/Error Leakages

Adam

It will be possible to add mod_security rule sets via Enhance in the very near future. As with other service settings you will be able to set a global default and override per-server if required.

craneinteractive

Please could you add this feature to your road map to give an indication of when it may be ready. It's the only remaining blocker preventing me from adopting Enhance!

Thanks,

Ben.

george

ss88us

For a basic firewall (which is actually quite advanced), there's 7G Firewall, and you can add it now to .htaccess on any Apache website.

Adam

You can also now add mod_security rulesets to LiteSpeed through the LiteSpeed admin panel and they will persist.

AdamM

Adam Yes, I have configured and tried to use OWASP but it causes more problems than benefits....
Many WordPress plugins and functions get blocked....
https://coreruleset.org/

Nick

Anyone have a step by step guide on how to setup OWASP with LiteSpeed? I found a guide on the Comodo rule set here: https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:waf:standalone

Aliysa_Enhance

This feature is now available in the 9.9.0 release https://community.enhance.com/d/224-modsecurity-owasp-as-an-waf-for-sites-roadmapped/5

Please check out the accompanying help guide at https://enhance.com/docs/security/modsecurity.html

Andreas

I found a WP plugin that is getting caught by OWASP mod security.
How would we go about fixing that?

Andreas

OK i found this post
https://community.enhance.com/d/851-mod-security-errors

Any plans to be able to do this in CP dashboard in the future?