Integrasi ModSecurity dengan rule OWASP dan CWAF

Supaya nyambung, silakan ikut tulisan sebelumnya; Instal Nginx dengan Module ModSecurity dan More Header di Ubuntu Server

1. Integrasi Rule OWASP ModeSecurity di NGINX

Konfigurasi Rules OWASP

cd /usr/local/src && cp ModSecurity/modsecurity.conf-recommended /etc/nginx/conf/modsecurity.conf
cd /usr/local/src && git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
cd /usr/local/src && cp -R owasp-modsecurity-crs/rules/ /etc/nginx/conf/
cd /usr/local/src && cp -R owasp-modsecurity-crs/crs-setup.conf.example /etc/nginx/conf/crs-setup.conf

Buka file dengan cara: nano /etc/nginx/conf/modsecurity.conf

Paste di baling bawah:

#Load OWASP Config
Include crs-setup.conf
#Load all other Rules
Include rules/*.conf
#Disable rule by ID from error message
#SecRuleRemoveById 920350

Integrasi Rules OWASP

Load konfigurasi dan rules di server blok Nginx, nano /etc/nginx/sites-enabled/default

Atur:

server {
.....
	modsecurity on;
location / {
	modsecurity_rules_file /etc/nginx/conf/modsecurity.conf;
.....
	}
}

2. Integrasi rules Comodo WAF dengan ModSecurity Menggunakan CWAF Agent

Instalasi CWAF Agent

Unduh file cwaf_client_install.sh. Pastikan sudah mendaftar akun di https://waf.comodo.com karena nanti akan diminta login ketika menjalankan bash cwaf_client_install.sh.

cd /usr/local/src && wget https://waf.comodo.com/cpanel/cwaf_client_install.sh && bash cwaf_client_install.sh

Baca dengan seksama dan ikuti langkah-langkahnya, lihat gambar di bawah, terakhir test dan restart nginx

Konfigurasi CWAF

cd /usr/local/src && cp ModSecurity/modsecurity.conf-recommended /etc/nginx/conf/modsecurity-cwaf.conf

Buka dengan cara nano /etc/nginx/conf/modsecurity.conf, kemudian paste di baris paling bawah: Include /usr/local/src/cwaf/etc/cwaf.conf

Integrasi Rules CWAF

Load konfigurasi dan rules di server blok Nginx, nano /etc/nginx/sites-enabled/default

Atur:

server {
.....
	modsecurity on;
location / {
	modsecurity_rules_file /etc/nginx/conf/modsecurity-cwaf.conf;
.....
	}
}

Catatan

• Pilih salah satu rules; owasp atau cwaf di implementasi di server block/location nginx
• modsecurity_rules_file /etc/nginx/conf/modsecurity.conf; untuk rules owasp
• modsecurity_rules_file /etc/nginx/conf/modsecurity-cwaf.conf; untuk rules cwaf