Skip to content

Commit 03c507f

Browse files
david22swandavid22swan
authored
Merge pull request #2452 from puppetlabs/CAT-1285-security-mod-crs-fix
CAT-1285 - RHEL-8 mode security CRS fix
2 parents 99b4488 + 66b0584 commit 03c507f

File tree

4 files changed

+175
-59
lines changed

4 files changed

+175
-59
lines changed

‎manifests/params.pp

Lines changed: 111 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -116,33 +116,40 @@
116116
$mellon_post_directory = undef
117117
$modsec_version = 1
118118
$modsec_crs_package = 'mod_security_crs'
119-
$modsec_crs_path = '/usr/lib/modsecurity.d'
120119
$modsec_dir = '/etc/httpd/modsecurity.d'
121120
$secpcrematchlimit = 1500
122121
$secpcrematchlimitrecursion = 1500
123122
$modsec_secruleengine = 'On'
124-
$modsec_default_rules = [
125-
'base_rules/modsecurity_35_bad_robots.data',
126-
'base_rules/modsecurity_35_scanners.data',
127-
'base_rules/modsecurity_40_generic_attacks.data',
128-
'base_rules/modsecurity_50_outbound.data',
129-
'base_rules/modsecurity_50_outbound_malware.data',
130-
'base_rules/modsecurity_crs_20_protocol_violations.conf',
131-
'base_rules/modsecurity_crs_21_protocol_anomalies.conf',
132-
'base_rules/modsecurity_crs_23_request_limits.conf',
133-
'base_rules/modsecurity_crs_30_http_policy.conf',
134-
'base_rules/modsecurity_crs_35_bad_robots.conf',
135-
'base_rules/modsecurity_crs_40_generic_attacks.conf',
136-
'base_rules/modsecurity_crs_41_sql_injection_attacks.conf',
137-
'base_rules/modsecurity_crs_41_xss_attacks.conf',
138-
'base_rules/modsecurity_crs_42_tight_security.conf',
139-
'base_rules/modsecurity_crs_45_trojans.conf',
140-
'base_rules/modsecurity_crs_47_common_exceptions.conf',
141-
'base_rules/modsecurity_crs_49_inbound_blocking.conf',
142-
'base_rules/modsecurity_crs_50_outbound.conf',
143-
'base_rules/modsecurity_crs_59_outbound_blocking.conf',
144-
'base_rules/modsecurity_crs_60_correlation.conf',
145-
]
123+
if $facts['os']['family'] == 'RedHat' and versioncmp($facts['os']['release']['major'], '7') <= 0 {
124+
$modsec_crs_path = '/usr/lib/modsecurity.d'
125+
$modsec_default_rules = [
126+
'base_rules/modsecurity_35_bad_robots.data',
127+
'base_rules/modsecurity_35_scanners.data',
128+
'base_rules/modsecurity_40_generic_attacks.data',
129+
'base_rules/modsecurity_50_outbound.data',
130+
'base_rules/modsecurity_50_outbound_malware.data',
131+
'base_rules/modsecurity_crs_20_protocol_violations.conf',
132+
'base_rules/modsecurity_crs_21_protocol_anomalies.conf',
133+
'base_rules/modsecurity_crs_23_request_limits.conf',
134+
'base_rules/modsecurity_crs_30_http_policy.conf',
135+
'base_rules/modsecurity_crs_35_bad_robots.conf',
136+
'base_rules/modsecurity_crs_40_generic_attacks.conf',
137+
'base_rules/modsecurity_crs_41_sql_injection_attacks.conf',
138+
'base_rules/modsecurity_crs_41_xss_attacks.conf',
139+
'base_rules/modsecurity_crs_42_tight_security.conf',
140+
'base_rules/modsecurity_crs_45_trojans.conf',
141+
'base_rules/modsecurity_crs_47_common_exceptions.conf',
142+
'base_rules/modsecurity_crs_49_inbound_blocking.conf',
143+
'base_rules/modsecurity_crs_50_outbound.conf',
144+
'base_rules/modsecurity_crs_59_outbound_blocking.conf',
145+
'base_rules/modsecurity_crs_60_correlation.conf',
146+
]
147+
} else {
148+
$modsec_crs_path = '/usr/share/mod_modsecurity_crs'
149+
$modsec_default_rules = [
150+
'rules/crawlers-user-agents.data',
151+
]
152+
}
146153
$error_log = 'error_log'
147154
$scriptalias = "${httpd_root}/var/www/cgi-bin"
148155
$access_log_file = 'access_log'
@@ -252,33 +259,91 @@
252259
$mellon_post_directory = undef
253260
$modsec_version = 1
254261
$modsec_crs_package = 'mod_security_crs'
255-
$modsec_crs_path = '/usr/lib/modsecurity.d'
256262
$modsec_dir = '/etc/httpd/modsecurity.d'
257263
$secpcrematchlimit = 1500
258264
$secpcrematchlimitrecursion = 1500
259265
$modsec_secruleengine = 'On'
260-
$modsec_default_rules = [
261-
'base_rules/modsecurity_35_bad_robots.data',
262-
'base_rules/modsecurity_35_scanners.data',
263-
'base_rules/modsecurity_40_generic_attacks.data',
264-
'base_rules/modsecurity_50_outbound.data',
265-
'base_rules/modsecurity_50_outbound_malware.data',
266-
'base_rules/modsecurity_crs_20_protocol_violations.conf',
267-
'base_rules/modsecurity_crs_21_protocol_anomalies.conf',
268-
'base_rules/modsecurity_crs_23_request_limits.conf',
269-
'base_rules/modsecurity_crs_30_http_policy.conf',
270-
'base_rules/modsecurity_crs_35_bad_robots.conf',
271-
'base_rules/modsecurity_crs_40_generic_attacks.conf',
272-
'base_rules/modsecurity_crs_41_sql_injection_attacks.conf',
273-
'base_rules/modsecurity_crs_41_xss_attacks.conf',
274-
'base_rules/modsecurity_crs_42_tight_security.conf',
275-
'base_rules/modsecurity_crs_45_trojans.conf',
276-
'base_rules/modsecurity_crs_47_common_exceptions.conf',
277-
'base_rules/modsecurity_crs_49_inbound_blocking.conf',
278-
'base_rules/modsecurity_crs_50_outbound.conf',
279-
'base_rules/modsecurity_crs_59_outbound_blocking.conf',
280-
'base_rules/modsecurity_crs_60_correlation.conf',
281-
]
266+
if $facts['os']['family'] == 'RedHat' and versioncmp($facts['os']['release']['major'], '7') <= 0 {
267+
$modsec_crs_path = '/usr/lib/modsecurity.d'
268+
$modsec_default_rules = [
269+
'base_rules/modsecurity_35_bad_robots.data',
270+
'base_rules/modsecurity_35_scanners.data',
271+
'base_rules/modsecurity_40_generic_attacks.data',
272+
'base_rules/modsecurity_50_outbound.data',
273+
'base_rules/modsecurity_50_outbound_malware.data',
274+
'base_rules/modsecurity_crs_20_protocol_violations.conf',
275+
'base_rules/modsecurity_crs_21_protocol_anomalies.conf',
276+
'base_rules/modsecurity_crs_23_request_limits.conf',
277+
'base_rules/modsecurity_crs_30_http_policy.conf',
278+
'base_rules/modsecurity_crs_35_bad_robots.conf',
279+
'base_rules/modsecurity_crs_40_generic_attacks.conf',
280+
'base_rules/modsecurity_crs_41_sql_injection_attacks.conf',
281+
'base_rules/modsecurity_crs_41_xss_attacks.conf',
282+
'base_rules/modsecurity_crs_42_tight_security.conf',
283+
'base_rules/modsecurity_crs_45_trojans.conf',
284+
'base_rules/modsecurity_crs_47_common_exceptions.conf',
285+
'base_rules/modsecurity_crs_49_inbound_blocking.conf',
286+
'base_rules/modsecurity_crs_50_outbound.conf',
287+
'base_rules/modsecurity_crs_59_outbound_blocking.conf',
288+
'base_rules/modsecurity_crs_60_correlation.conf',
289+
]
290+
} else {
291+
$modsec_crs_path = '/usr/share/mod_modsecurity_crs'
292+
$modsec_default_rules = [
293+
'rules/crawlers-user-agents.data',
294+
'rules/iis-errors.data',
295+
'rules/java-classes.data',
296+
'rules/java-code-leakages.data',
297+
'rules/java-errors.data',
298+
'rules/lfi-os-files.data',
299+
'rules/php-config-directives.data',
300+
'rules/php-errors.data',
301+
'rules/php-function-names-933150.data',
302+
'rules/php-function-names-933151.data',
303+
'rules/php-variables.data',
304+
'rules/REQUEST-901-INITIALIZATION.conf',
305+
'rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf',
306+
'rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf',
307+
'rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf',
308+
'rules/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf',
309+
'rules/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf',
310+
'rules/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf',
311+
'rules/REQUEST-905-COMMON-EXCEPTIONS.conf',
312+
'rules/REQUEST-910-IP-REPUTATION.conf',
313+
'rules/REQUEST-911-METHOD-ENFORCEMENT.conf',
314+
'rules/REQUEST-912-DOS-PROTECTION.conf',
315+
'rules/REQUEST-913-SCANNER-DETECTION.conf',
316+
'rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf',
317+
'rules/REQUEST-921-PROTOCOL-ATTACK.conf',
318+
'rules/REQUEST-922-MULTIPART-ATTACK.conf',
319+
'rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf',
320+
'rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf',
321+
'rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf',
322+
'rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf',
323+
'rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf',
324+
'rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf',
325+
'rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf',
326+
'rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf',
327+
'rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf',
328+
'rules/REQUEST-949-BLOCKING-EVALUATION.conf',
329+
'rules/RESPONSE-950-DATA-LEAKAGES.conf',
330+
'rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf',
331+
'rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf',
332+
'rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf',
333+
'rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf',
334+
'rules/RESPONSE-959-BLOCKING-EVALUATION.conf',
335+
'rules/RESPONSE-980-CORRELATION.conf',
336+
'rules/restricted-files.data',
337+
'rules/restricted-upload.data',
338+
'rules/scanners-headers.data',
339+
'rules/scanners-urls.data',
340+
'rules/scanners-user-agents.data',
341+
'rules/scripting-user-agents.data',
342+
'rules/sql-errors.data',
343+
'rules/unix-shell.data',
344+
'rules/windows-powershell-commands.data',
345+
]
346+
}
282347
$error_log = 'error_log'
283348
$scriptalias = '/var/www/cgi-bin'
284349
$access_log_file = 'access_log'

‎spec/acceptance/mod_security_spec.rb

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper_acceptance'
4+
apache_hash = apache_settings_hash
5+
6+
describe 'apache::mod::security class', if: mod_supported_on_platform?('apache::mod::security') do
7+
context 'default mod security config' do
8+
pp = <<-MANIFEST
9+
class { 'apache': }
10+
class { 'apache::mod::security': }
11+
MANIFEST
12+
it 'succeeds in puppeting mod security' do
13+
apply_manifest(pp, catch_failures: true)
14+
end
15+
end
16+
17+
context 'with vhost config' do
18+
pp = <<-MANIFEST
19+
class { 'apache': }
20+
class { 'apache::mod::security': }
21+
apache::vhost { 'modsecurity.example.com':
22+
port => 80,
23+
docroot => '#{apache_hash['doc_root']}',
24+
}
25+
host { 'modsecurity.example.com': ip => '127.0.0.1', }
26+
MANIFEST
27+
it 'succeeds in puppeting mod security' do
28+
apply_manifest(pp, catch_failures: true)
29+
end
30+
end
31+
end

‎spec/classes/mod/security_spec.rb

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -73,14 +73,25 @@
7373
)
7474
}
7575

76-
it { is_expected.to contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') }
76+
if facts[:os]['release']['major'].to_i <= 7
77+
it { is_expected.to contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') }
7778

78-
it {
79-
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(
80-
path: '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data',
81-
target: '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data',
82-
)
83-
}
79+
it {
80+
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(
81+
path: '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data',
82+
target: '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data',
83+
)
84+
}
85+
else
86+
it { is_expected.to contain_apache__security__rule_link('rules/crawlers-user-agents.data') }
87+
88+
it {
89+
expect(subject).to contain_file('crawlers-user-agents.data').with(
90+
path: '/etc/httpd/modsecurity.d/activated_rules/crawlers-user-agents.data',
91+
target: '/usr/share/mod_modsecurity_crs/rules/crawlers-user-agents.data',
92+
)
93+
}
94+
end
8495

8596
describe 'with parameters' do
8697
let :params do

‎spec/defines/modsec_link_spec.rb

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,21 @@ class { "apache::mod::security": activated_rules => [] }
2323

2424
case facts[:os]['family']
2525
when 'RedHat'
26-
it {
27-
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(
28-
path: '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data',
29-
target: '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data',
30-
)
31-
}
26+
if facts[:os]['release']['major'].to_i <= 7
27+
it {
28+
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(
29+
path: '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data',
30+
target: '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data',
31+
)
32+
}
33+
else
34+
it {
35+
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(
36+
path: '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data',
37+
target: '/usr/share/mod_modsecurity_crs/base_rules/modsecurity_35_bad_robots.data',
38+
)
39+
}
40+
end
3241
when 'Debian'
3342
it {
3443
expect(subject).to contain_file('modsecurity_35_bad_robots.data').with(

0 commit comments

Comments
 (0)