OWASP ModSec CRS Paranoia Mode Sibling 981049 - Revision history

Zino: /* 981049 : Potential Denial of Service (DoS) */

2016-03-10T07:21:44Z

‎981049 : Potential Denial of Service (DoS)

Dune73 at 07:16, 8 March 2016

2016-03-08T07:16:33Z

Zino: /* 981049 : Potential Denial of Service (DoS) */

2016-02-10T11:04:51Z

‎981049 : Potential Denial of Service (DoS)

Zino: Created page with "''This page contains a proposal for a stricter rule-clone for ModSecurity CRS Paranoia Mode.'' == 981049 : Potential Denial of Service (DoS..."

2016-02-10T11:02:55Z

Created page with "''This page contains a proposal for a stricter rule-clone for ModSecurity CRS Paranoia Mode.'' == 981049 : Potential Denial of Service (DoS..."

New page

''This page contains a proposal for a stricter rule-clone for [[OWASP_ModSec_CRS_Paranoia_Mode|ModSecurity CRS Paranoia Mode]].''

== 981049 : Potential Denial of Service (DoS) ==

{|- class="wikitable"
| '''Original ID (2.2.x)'''
| '''Change'''
| '''Whitelisting'''
|-
| 981049
| Operator match decreased form 2 to 1.<br>''optional: change tx.dos_burst_time_slice, tx.dos_counter_threshold and/or tx.dos_block_timeout''
| None
|}

#
# -=[ Potential Denial of Service (DoS) ]=-
#
# This is a paranoid sibling to 2.2.9 Experimental Rule 981049.
# The rule now triggers after the first burst instead of the second.
#
SecRule IP:DOS_BURST_COUNTER "@ge 1"
"phase:logging,\
rev:'1',\
ver:'OWASP_CRS/3.0.0',\
maturity:'X',\
accuracy:'Y',\
t:none,\
log,\
msg:'Potential Denial of Service (DoS) Attack from %{tx.real_ip} - # of Request Bursts:%{ip.dos_burst_counter}',\
id:'XXXXXX',\
tag:'FIXME Filler for attacktype',\
tag:'Paranoia rule on level Z',\
setvar:ip.dos_block=1,\
expirevar:ip.dos_block=%{tx.dos_block_timeout},\
pass"

=== Notes ===

This rule can not be implemented as is. Rules 981044 - 981048 from ''owasp-modsecurity-crs/experimental_rules/modsecurity_crs_11_dos_protection.conf'' need to be integrated to allow proper blocking. There should be no need to adjust these rules for desired effects.

Also note that more Paranoia tuning can be done by adjusting the DoS Protection variable values in your main configuration (e.g. modsecurity_crs_10_setup.conf).

#
# -- <nowiki>[[ DoS Protection ]]</nowiki> ----------------------------------------------------------------
#
# This is a Paranoia Mode Clone.
# Adjust the following variables to fine tune paranoia level.
#
# - Burst Time Slice Interval: time interval window to monitor for bursts
# - Request Threshold: request # threshold to trigger a burst
# - Block Period: temporary block timeout
#
SecAction \
"id:XXXXXX',\
phase:request,\
t:none,\
setvar:'tx.dos_burst_time_slice=90',\
setvar:'tx.dos_counter_threshold=50',\
setvar:'tx.dos_block_timeout=600',\
nolog,\
pass"

← Older revision		Revision as of 07:16, 8 March 2016
Line 60:		Line 60:
	nolog,\		nolog,\
	pass"		pass"
		+
		+	[[Category:OWASP ModSecurity Core Rule Set Project]]

@@ Line 4: / Line 4: @@
 {|- class="wikitable"
-  | '''Original ID (2.2.x)'''
+  | '''RuleID 2.2.x'''
   | '''Change'''
   | '''Whitelisting'''
 |-
   | 981049
   | Operator match decreased form 2 to 1.<br>''Optional: change tx.dos_burst_time_slice, tx.dos_counter_threshold and/or tx.dos_block_timeout''
   | None
@@ Line 18: / Line 22: @@
    # This is a paranoid sibling to 2.2.9 Experimental Rule 981049.
    # The rule now triggers after the first burst instead of the second.
+   #
    SecRule IP:DOS_BURST_COUNTER "@ge 1"