43 lines
2.2 KiB
Plaintext
43 lines
2.2 KiB
Plaintext
SecDefaultAction "log,deny,auditlog,phase:2,status:403"
|
|
# http://www.atomicorp.com/
|
|
# Atomicorp (Gotroot.com) ModSecurity rules
|
|
# Application Security Rules for modsec 2.x
|
|
#
|
|
# Copyright 2005-2016 by Atomicorp, Inc. all rights reserved.
|
|
# Redistribution is strictly prohibited in any form, including whole or in part.
|
|
#
|
|
# Distribution of this work or derivative of this work in any form is
|
|
# prohibited unless prior written permission is obtained from the
|
|
# copyright holder.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS
|
|
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
|
|
# THE POSSIBILITY OF SUCH DAMAGE.
|
|
#
|
|
#---ASL-CONFIG-FILE---
|
|
#
|
|
|
|
# Do not edit this file!
|
|
# This file is generated and changes will be overwritten.
|
|
#
|
|
# If you need to make changes to the rules, please follow the procedure here:
|
|
# http://www.atomicorp.com/wiki/index.php/Mod_security
|
|
#SecAction "phase:1,t:none,pass,nolog,initcol:global=global,initcol:ip=%{remote_addr}"
|
|
|
|
|
|
|
|
|
|
SecRule REQUEST_HEADERS:X-Forwarded-For "^\b\d{1,3}(?<!192|127|10)\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" "chain,phase:1,severity:2,id:'356137',t:none,capture,block,rev:'2.2.6',msg:'Atomicorp.com WAF Rules: Potential Open Proxy Abuse - GeoIP Country Code Mismatch of X-Forwarded-For Request Header and Client REMOTE_ADDR',logdata:'IP Country is: %{geo.country_code} and X-Forwarded-For is: %{tx.geo_x-forwarded-for}'"
|
|
SecRule TX:0 "@geoLookup" "chain,setvar:tx.geo_x-forwarded-for=%{geo.country_code}"
|
|
SecRule REMOTE_ADDR "@geoLookup" "chain,t:none"
|
|
SecRule GEO:COUNTRY_CODE "!@streq %{tx.geo_x-forwarded-for}" "t:none"
|
|
|