WAF (ModSecurity)

A WAF (Web Application Firewall) is a solution for protecting web applications from malicious attacks. It analyzes HTTP/HTTPS traffic between the client and the server and blocks malicious requests according to specified rules. Ispmanager uses ModSecurity as a WAF.

WAF installation

1. Log in to the panel with a superuser account.
2. Navigate to the Software configuration section → Web server (WWW) and click   Edit.
3. Check the box next to WAF and click Save.

To start using the WAF, enable it for users and sites.

Enabling WAF

For users

1. Log in to ispmanager with an administrator level account or above.
2. Navigate to the Users section.
3. Select a user and click Edit on the toolbar.
4. In the Access section, check the boxes:
   • Can use WAF — the user will be able to enable and disable WAF for their sites. 
     If you check only this box, the administrator ruleset (OWASP by default) will be used for the user's sites.
   • Can change WAF settings — the user will be able to select sets of rules for each site and upload their own.
     The user will be able to directly influence the web server configuration. Give this permission only to trusted users.
5. Click Save.

To start using the WAF, it must be enabled for the site.

For sites

1. Navigate to the Sites section.
2. Select a site and click  Edit on the toolbar.
3. Go to the Optimization and DDoS protection section → WAF and select:
   • Detection only — when the rules are triggered, requests are not blocked, but only recorded in the log. This mode is used to detect WAF false positives without the risk of disrupting the site's functionality. It is recommended to use it temporarily to disable irrelevant rules, and then select the Enabled option.
   • Enabled — requests are blocked when rules are triggered.
4. Click Save.

If a user is only allowed to enable the WAF (without the permissions to change WAF settings), the administrator ruleset will be used for their site by default.

Verification

To ensure that the WAF rules are working, run a "malicious" request to the site. For example:

curl 'https://YOUR_SITE/?foo=/etc/passwd&bar=/bin/sh'

If the WAF works, you will get an error when trying to open the site in the browser (if the WAF is in the Enabled mode), and this request will appear in the log.

WAF configuration

For servers

The rules set for the web server will be used by default for all sites where the WAF is enabled. If you skip this setting, the OWASP ruleset will be used by default.

1. Log in to the panel with a superuser account.
2. Go to the Web server settings section → WAF settings and fill in the fields:
   • Ruleset:
     • OWASP
     • COMODO
     • Load from an external source (via an URL) — custom ruleset as a .conf file or an archive of several .conf files
     • Upload from the local computer — custom ruleset as a .conf file or an archive of several .conf files
   • External source URL (when loading rules from an external source).
   • Update the rules — allows you to update OWASP and COMODO rules, as well as rules loaded from an URL. To update rules uploaded from the local computer, delete them and upload a new version. The rules will be updated for all sites that use the admin ruleset.
   • Rules used — allows you to select which rules from the set will be available for sites. When adding rules from an external source or from a local computer, click Save to load the rules and make them available for selection.
   • Add your own rules to the set — allows you to add rules from your local computer to OWASP, COMODO, or URL-loaded rules. In this case, both sets of rules will apply.
3. Click Save.

For sites

The site-specific configuration allows you to override the ruleset selected at the web server level and add your own rules.

1. Navigate to the Sites section.
2. Select a site and click Edit on the toolbar.
3. If WAF is not yet enabled for the site, enable it, and then fill in the fields in the Optimization and DDoS protection section:
   • Ruleset:
     • Administrator ruleset — a set of rules installed and configured by the administrator in the Web server settings section
     • OWASP
     • COMODO
     • Load from an external source (via an URL) — custom ruleset as a .conf file or an archive of several .conf files
     • Upload from the local computer — custom ruleset as a .conf file or an archive of several .conf files
   • External source URL (when loading rules from an external source).
   • Update the rules — allows you to update URL-loaded rules. To update rules uploaded from the local computer, delete them and upload a new version. The rules will be updated only for the current site.
   • Rules used — allows you to select which rules from the set will be available for the site. When adding rules from an external source or from a local computer, click Save to load the rules and make them available for selection.
   • Add your own rules to the set — allows you to add rules from your local computer to the administrator ruleset, OWASP, COMODO, or URL-loaded rules. In this case, both sets of rules will apply.
4. Click Save.

WAF logging

By default, all requests that trigger WAF rules are added to the log.

To view the log, navigate to the Sites section, click  next to a site, select Logs → SITE.audit.log.

Logging settings can be changed in the configuration file WEB_SERVER_DIRECTORY/vhosts-resources/SITE/modsecurity.conf.

False positive WAF alarms

Some rules may block legitimate requests as malicious. To prevent this, enable the Detection only mode in the WAF settings for the site and disable those rules. To do this:

1. Go to the log.
2. Find the false-positive request and in it — the ID of the rule that was triggered.
   Example

   

   In this case, the rule ID is 932160.

3. Disable this rule for the site:
   1. Navigate to the Sites section, select the required site and click  Edit.
   2. In the Optimization and DDos protection → Used rules section find an ID of the rule and uncheck the box,
   3. Click Save.

WAF rulesets

COMODO

The set of rules from the official COMODO website. Rules are downloaded from ispmanager's own repositories:

• cwaf_2.tgz — ruleset for ModSecurity v2 (Apache)
• cwaf_3.tgz — ruleset for ModSecurity v3 (Nginx, OpenLiteSpeed, LiteSpeed)

The ruleset is stored in the /etc/modsecurity/comodo directory.

OWASP

The set of rules from the official OWASP repository. The ruleset is stored in the /etc/modsecurity/owasp/rules directory.

From an external source (URL-loaded)

The rules loaded by an administrator via the Web server settings form are stored in the /etc/modsecurity/url directory.

The rules loaded by a user via the site creation/editing form are stored in the /etc/modsecurity/SITE_url directory.

From a local computer

The rules uploaded by an administrator via the Web server settings form are stored in the /etc/modsecurity/custom directory.

The rules uploaded by a user via the site creation/editing form are stored in the /etc/modsecurity/SITE_custom directory.

Administrator ruleset

All rules set by the administrator in the Web server settings form are saved in the configuration file /etc/modsecurity/admin/main.conf. This ruleset is set for the site after selecting the Administrator ruleset option on the site creation/editing form.

WAF configuration files

The WAF module uses a hierarchical configuration, where configuration files are connected one to another. Below is a chain of configuration files for a site:

• /etc/modsecurity/RULE_SET>/*.conf(global ModSecurity configuration file with rules files available for a site) →
• /etc/modsecurity/SITE.conf (ModSecurity configuration file for a site with a list of enabled and disabled rules) →
• /WEB_SERVER_DIRECTORY/vhosts-resources/SITE/modsecurity.conf (web server configuration file for ModSecurity with its enabling, operation and logging settings) →
• /WEB_SERVER_DIRECTORY/vhosts/USER/SITE.conf (web server configuration file for a site).

The configuration file /WEB_SERVER_DIRECTORY/vhosts-resources/SITE/modsecurity.conf is generated based on the template /usr/local/mgr5/etc/templates/default/WEB_SERVER_modsecurity.template after changing site settings. To change the structure of the configuration file for all sites, edit the template according to the instructions (available to an administrator level account).

modsecurity on;
modsecurity_rules '
	SecRuleEngine __MODE__
	SecAuditLogParts ABCEFHJZ
	SecAuditEngine RelevantOnly
	SecAuditLog __LOG_PATH__
	SecAuditLogType Serial
';
modsecurity_rules_file __INCLUDE__;