50 lines
1.2 KiB
Markdown
50 lines
1.2 KiB
Markdown
# ModSecurity for Nginx Reverse Proxy (CRS Paranoia Level 4)
|
|
|
|
This repository now includes a prepared ModSecurity ruleset under:
|
|
|
|
- `nginx/modsecurity/main.conf`
|
|
- `nginx/modsecurity/crs-setup/custom-pl4.conf`
|
|
- `nginx/modsecurity/custom-rules.conf`
|
|
|
|
## 1) Prerequisites
|
|
|
|
Your reverse proxy Nginx must have the ModSecurity v3 connector enabled (`modsecurity-nginx`).
|
|
A stock `nginx:alpine` image does not include this module.
|
|
|
|
## 2) Mount the rules into your reverse proxy
|
|
|
|
Mount the directory into the proxy container, for example:
|
|
|
|
```yaml
|
|
volumes:
|
|
- ./nginx/modsecurity:/etc/nginx/modsecurity:ro
|
|
```
|
|
|
|
Your proxy image should also provide:
|
|
|
|
- `/etc/nginx/modsecurity/modsecurity.conf`
|
|
- `/etc/nginx/modsecurity/owasp-crs/rules/*.conf`
|
|
|
|
## 3) Enable ModSecurity in the virtual host
|
|
|
|
Inside the `server` block (or per `location`):
|
|
|
|
```nginx
|
|
modsecurity on;
|
|
modsecurity_rules_file /etc/nginx/modsecurity/main.conf;
|
|
```
|
|
|
|
## 4) Reload and verify
|
|
|
|
```bash
|
|
nginx -t
|
|
nginx -s reload
|
|
```
|
|
|
|
Then send test payloads and confirm ModSecurity audit/error logs show rule matches.
|
|
|
|
## Notes
|
|
|
|
- PL4 is intentionally strict and can produce false positives.
|
|
- If production traffic is noisy, start with `SecRuleEngine DetectionOnly`, tune exclusions, then switch to `On`.
|