ModSecurity With The OWASP Core Rule Set, Pinned

modsecurity-crs

ModSecurity from EPEL in Apache httpd, with the OWASP Core Rule Set 4.30.0 from the project's own release: the rules' tarball pinned by the SHA-256 of the copy whose signature checked out, the engine refusing by CRS's anomaly score at paranoia level 1, every change checked inside a copy of the whole httpd configuration before it lands, and httpd on loopback until you open it. Original role for EL 10, live-tested with podman on Rocky Linux 10.

Two sources. EL 10 packages the engine (mod_security 2.9.9, in EPEL) but not the rules: there is no Core Rule Set package for it (measured). The role installs httpd, mod_security and tar by name, and the rules from their GitHub release. CRS publishes no checksum file for that tarball, only a PGP signature, so the signature was checked once, by hand, against the key coreruleset.org publishes (36006F0E 0BA16783 21588211 38EEACA1 AB8A6E72: a good signature, and a bad one for a tampered copy), and the SHA-256 of that copy is pinned beside the version. get_url refuses anything else. A new version is a new pair, checked the same way.

The distribution's httpd, a rule file of ours. EPEL's mod_security.conf turns the engine On and then includes modsecurity.d/*.conf; the role's file there sets the engine mode, the paranoia level and the anomaly thresholds, includes the rules, and switches off the rule IDs you name. httpd cannot check one file alone, so each change is checked by httpd -t inside a copy of the whole tree with that file replaced - which refuses an invalid engine value, a missing rules directory and a duplicate rule ID (measured) - and applied with a graceful reload. The package's listener is *:80; the role narrows it to 127.0.0.1:80, and that one change restarts httpd, because a graceful reload after a Listen change left httpd failed (measured). With this catalogue's httpd-tls role on the same host, set modsecurity_crs_manage_listen: false and let it own the listeners: the rules apply to every site httpd serves.

Proven by attacks. The live test asks for a page plainly (200) and with a SQL injection, a script tag, a scanner's user agent and a path traversal: each is refused with 403 by the anomaly score (rule 949110) and traced in httpd's error log to its own rule (942100, 941100, 913100, 930100). A double-encoded quote, which only paranoia level 2 refuses (920230), is served, so level 1 is the one in force, and the audit log names the rules' version. Measured on the way: DetectionOnly serves every one of these, an inbound threshold of 1000 serves them all, and removing rule 942100 serves that injection, so each switch does what it says. EPEL's file leaves response bodies uninspected (SecResponseBodyAccess Off) and this role keeps it so: the outbound threshold scores headers, not pages.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.