I have the following setup:

  • Nginx 1.14
  • ModSecurity v3
  • CRS v3
  • ModSecurity nginx connector

I want to be able to specify in every vhost different collection of rules. For example:

vhost1: filter all rules from rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

vhost2: filter all rules from rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf + rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf

vhost3: filter all rules from the above 2 + rules/REQUEST-932-APPLICATION-ATTACK-RCE.con

If I add /usr/local/nginx/conf/owasp-modsecurity-crs/protection_basic.conf for example, containing

include modsecurity.conf
include crs-setup.conf

And then use it in the server block for the vhost I want only those rules with modsecurity_rules_file /usr/local/nginx/conf/owasp-modsecurity-crs/protection_basic.conf it works and filters only the SQLi rules. Then if I add protection_medium.conf that has SQLI + XSS rules for example and add it to another vhost it will filter both types of rules.

The problem here is that if the vhosts start to grow it includes those files for every vhost. For example with around 100 vhosts single restart consumes something like 2-3G of RAM (if there is just one global include for modsecurity_rules_file there is no such load).

Is there another way of doing this? Assigning different rulesets for different vhosts? I've looked into maps but don't think it's possible to use them in this situation?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.