I have the following setup:
- Nginx 1.14
- ModSecurity v3
- CRS v3
- ModSecurity nginx connector
I want to be able to specify in every vhost different collection of rules. For example:
vhost1: filter all rules from
vhost2: filter all rules from
vhost3: filter all rules from the above 2 +
If I add
/usr/local/nginx/conf/owasp-modsecurity-crs/protection_basic.conf for example, containing
include modsecurity.conf include crs-setup.conf include rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
And then use it in the
server block for the vhost I want only those rules with
modsecurity_rules_file /usr/local/nginx/conf/owasp-modsecurity-crs/protection_basic.conf it works and filters only the SQLi rules. Then if I add
protection_medium.conf that has SQLI + XSS rules for example and add it to another vhost it will filter both types of rules.
The problem here is that if the vhosts start to grow it includes those files for every vhost. For example with around 100 vhosts single restart consumes something like 2-3G of RAM (if there is just one global include for
modsecurity_rules_file there is no such load).
Is there another way of doing this? Assigning different rulesets for different vhosts? I've looked into maps but don't think it's possible to use them in this situation?