64 lines
3.3 KiB
Plaintext
64 lines
3.3 KiB
Plaintext
#---------------------------------------------------------------
|
|
# Core ModSecurity Rule Set ver.2.2.9
|
|
# Copyright (C) 2006-2012 Trustwave All rights reserved.
|
|
#
|
|
# The OWASP ModSecurity Core Rule Set is distributed under
|
|
# Apache Software License (ASL) version 2
|
|
# Please see the enclosed LICENCE file for full details.
|
|
# ---------------------------------------------------------------
|
|
|
|
|
|
#
|
|
# Anti-Automation Rule for specific Pages (Brute Force Protection)
|
|
# This is a rate-limiting rule set and does not directly correlate whether the
|
|
# authentication attempt was successful or not.
|
|
#
|
|
|
|
#
|
|
# Enforce an existing IP address block and log only 1-time/minute
|
|
# We don't want to get flooded by alerts during an attack or scan so
|
|
# we are only triggering an alert once/minute. You can adjust how often
|
|
# you want to receive status alerts by changing the expirevar setting below.
|
|
#
|
|
SecRule IP:BRUTE_FORCE_BLOCK "@eq 1" "chain,phase:1,id:'981036',block,msg:'Brute Force Attack Identified from %{tx.real_ip} (%{tx.brute_force_block_counter} hits since last alert)',setvar:ip.brute_force_block_counter=+1"
|
|
SecRule &IP:BRUTE_FORCE_BLOCK_FLAG "@eq 0" "setvar:ip.brute_force_block_flag=1,expirevar:ip.brute_force_block_flag=60,setvar:tx.brute_force_block_counter=%{ip.brute_force_block_counter},setvar:ip.brute_force_block_counter=0"
|
|
|
|
#
|
|
# Block and track # of requests but don't log
|
|
SecRule IP:BRUTE_FORCE_BLOCK "@eq 1" "phase:1,id:'981037',block,nolog,setvar:ip.brute_force_block_counter=+1"
|
|
|
|
#
|
|
# skipAfter Checks
|
|
# There are different scenarios where we don't want to do checks -
|
|
# 1. If the user has not defined any URLs for Brute Force Protection in the 10 config file
|
|
# 2. If the current URL is not listed as a protected URL
|
|
# 3. If the current IP address has already been blocked due to high requests
|
|
# In these cases, we skip doing the request counts.
|
|
#
|
|
SecRule &TX:BRUTE_FORCE_PROTECTED_URLS "@eq 0" "phase:5,id:'981038',t:none,nolog,pass,skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
|
|
SecRule REQUEST_FILENAME ".*" "chain,phase:5,id:'981039',t:none,nolog,pass,setvar:'tx.filename=#%{request_filename}#',skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
|
|
SecRule TX:FILENAME "!@within %{tx.brute_force_protected_urls}"
|
|
SecRule IP:BRUTE_FORCE_BLOCK "@eq 1" "phase:5,id:'981040',t:none,nolog,pass,skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
|
|
|
|
#
|
|
# Brute Force Counter
|
|
# Count the number of requests to these resoures
|
|
#
|
|
SecAction "phase:5,id:'981041',t:none,nolog,pass,setvar:ip.brute_force_counter=+1"
|
|
|
|
#
|
|
# Check Brute Force Counter
|
|
# If the request count is greater than or equal to 50 within 5 mins,
|
|
# we then set the burst counter
|
|
#
|
|
SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}" "phase:5,id:'981042',t:none,nolog,pass,t:none,setvar:ip.brute_force_burst_counter=+1,expirevar:ip.brute_force_burst_counter=%{tx.brute_force_burst_time_slice},setvar:!ip.brute_force_counter"
|
|
|
|
#
|
|
# Check Brute Force Burst Counter and set Block
|
|
# Check the burst counter - if greater than or equal to 2, then we set the IP
|
|
# block variable for 5 mins and issue an alert.
|
|
#
|
|
SecRule IP:BRUTE_FORCE_BURST_COUNTER "@ge 2" "phase:5,id:'981043',t:none,log,pass,msg:'Potential Brute Force Attack from %{tx.real_ip} - # of Request Bursts: %{ip.brute_force_burst_counter}',setvar:ip.brute_force_block=1,expirevar:ip.brute_force_block=%{tx.brute_force_block_timeout}"
|
|
|
|
SecMarker END_BRUTE_FORCE_PROTECTION_CHECKS
|