:):):) Comodo WAF rules update required :):):)

[Starburst]

I've tried different ways, just can't get OWASP to talk to CSF, even using the documentation.
It 'should' work, I see it in the logs, but CSF refuses to add the IP's and send notifications.

[Netino]

I've tried different ways, just can't get OWASP to talk to CSF, even using the documentation.
It 'should' work, I see it in the logs, but CSF refuses to add the IP's and send notifications.

Are you referring to the lfd rules?
It may just be a matter of getting the regex right.

Here are some rules that work for me:
In file '/etc/csf/csf.conf':

Code Select Expand

CUSTOM4_LOG = "/usr/local/cwpsrv/logs/*_log"

In file '/usr/local/csf/bin/regex.custom.pm':

Code Select Expand

if (($lgfile eq $config{CUSTOM4_LOG}) and ($line =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\-\s+\-\s+\[\S+\/\S+\/\S+:\S+:\S+\s+\-\d{4}\].*\/login\/index\.php\?login\=failed/)) {
$ip = $1; $ip =~ s/:\w+//;
return ("Login Failed access of forbidden resource",$ip,"forbiddenmatch","5","80,82,443,8181,8443","1");
}

# CWP Failed Login Protection
if (($lgfile eq $config{CUSTOM4_LOG}) and ($line =~ /^\d{4}\/\d{2}\/\d{2}\s([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\s\[error\]\s\d+#\d+:\s\*\d+\suser\s\"\w+\":\spassword\smismatch,\sclient:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),\sserver:\slocalhost,\srequest:\s\"(POST|GET)\s.*/)) {
$ip = $2; $ip =~ s/:\w+//;
return ("Login Failed access of forbidden resource",$ip,"forbiddenmatch","5","80,82,443,8181,8443","1");
}

## CWP Failed Login Protection
if (($lgfile eq $config{CUSTOM4_LOG}) and ($line =~ /^\d{4}\/\d{2}\/\d{2}\s([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\s\[error\]\s\d+#\d+:\s\*\d+\suser\s\"\w+\"\swas\snot\sfound\sin\s\"\/usr\/local\/cwpsrv\/conf\/htpasswd\",\sclient:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),\sserver:\slocalhost,\srequest:\s\"(POST|GET)\s.*/)) {
$ip = $2; $ip =~ s/:\w+//;
return ("Login Failed access of forbidden resource",$ip,"forbiddenmatch","5","80,82,443,8181,8443","1");
}


[Starburst]

The defaults are:

HTACCESS_LOG = "/usr/local/apache/logs/error_log"
MODSEC_LOG = "/usr/local/apache/logs/error_log"
SSHD_LOG = "/var/log/secure"
SU_LOG = "/var/log/secure"
SUDO_LOG = "/var/log/secure"
FTPD_LOG = "/var/log/messages"
SMTPAUTH_LOG = "/var/log/maillog"
POP3D_LOG = "/var/log/dovecot-info.log"
IMAPD_LOG = "/var/log/dovecot-info.log"
IPTABLES_LOG = "/var/log/messages"
SUHOSIN_LOG = "/var/log/messages"
BIND_LOG = "/var/log/messages"
SYSLOG_LOG = "/var/log/messages"
WEBMIN_LOG = "/var/log/secure"
CWP_LOG = "/var/log/cwp_client_login.log"

CUSTOM1_LOG = "/var/log/cwp_client_login.log"
CUSTOM2_LOG = "/usr/local/apache/domlogs/*.log"

I followed the OWASP docs, and changed MODSEC_LOG to MODSEC_LOG = "/usr/local/apache/logs/modsec_audit.log"
When that failed, I added it to the next empty custom entry CUSTOM3_LOG, still no joy.

I've put another paid ticket in to CWP.
They argued the last ticket that didn't solve the problem was closed as being 'resolved'

What's weird is that the OWASP old ruleset works OK, but if you select OWASP latest it breaks everything.
You still see it stop attacks if your view the ModSecurity log.

Just added "/usr/local/cwpsrv/logs/*_log" to CUSTOM3_LOG, which was empty.
Will see if that works.

Also have a virtual meeting with Xcitium (company who bought Comodo) next week, to find out what there plans are for the future of that ruleset.
Because of right now it's dead.

Hopefully this will get resolved.

I'm not sure about anyone else, but this simple thing has turned into a large cluster.

[Netino]

The defaults are:
(...)
What's weird is that the OWASP old ruleset works OK, but if you select OWASP latest it breaks everything.
You still see it stop attacks if your view the ModSecurity log.

What is your corerulet version, ModSecurity version, and ModSecurity-nginx version?

(...)
Just added "/usr/local/cwpsrv/logs/*_log" to CUSTOM3_LOG, which was empty.
Will see if that works.

Must be noted here too, that the OWASP rules I have posted will work with CWP because is based in 'nginx' server(see the path is /usr/local/cwpsrv/logs/), that will work only with ModSecurity 3.0.x and ModSecurity-nginx connector v1.0.3-24-gef64996. I have placed an issue in ModSecurity-nginx website, because for some reason, it is not working with newer versions, and that bug is opened up to this date.

Also have a virtual meeting with Xcitium (company who bought Comodo) next week, to find out what there plans are for the future of that ruleset.
Because of right now it's dead.

Hopefully this will get resolved.

I'm not sure about anyone else, but this simple thing has turned into a large cluster.

Very, very good.
This is what we need, a few simple impressions for that company, to not begin a coding marathon to workaround the problem.

[Starburst]

We use Apache, and not Nginx.

There is more script support for Apache, and the performance benefit of Nginx is negatable.

OWASP old & Comodo both work fine, which is the odd thing.

If Xcitium did kill the free Comodo ruleset, that only leave OWASP of being free for users to choose.

[overseer]

I suppose a year is the breakpoint to say that Comodo WAF is dead. It might just be something Xcitium is neglecting in favor of their enterprise products (more lucrative). Time to press on...

[Starburst]

Well looks like I got OWASP ruleset 4.11.0 working OK with ModSecurity on AL9.

Which is good, considering I activated it on a live production server, after I noticed I wasn't logged into my test box on my desk.   

I'll be posting a KB article later today.

But yea, when they split the company both halves started offering their own paid  'ruleset'.
The 'new' endpoint doesn't see CWP, only cPanel, DA, and Plesk and installs as a standalone, which doesn't play well with CWP.

[Starburst]

Morning Y'all.

Have 2 new KB Articles on how to update ModSecurity for Apache in CWP under AL8 & AL9 and use the latest OWASP CRS ruleset:

https://kb.starburstservices.com/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-modsecurity-running-cwp-and-apache-on-almalinux-8-9/

https://kb.starburstservices.com/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-to-owasp-crs-ruleset-running-cwp-and-apache-on-almalinux-8-9/

Any feedback, let me know.

[overseer]

Appreciated, keep 'em coming!

[Starburst]

And it works for both CWPfree and CWPpro. 

[venty]

And it works for both CWPfree and CWPpro. 

Hi,

it really works...

When I replaced the line "/usr/local/apache/modsecurity-owasp-latest/coreruleset-4.11.0/owasp.conf" when updating the rules, in the configuration file it is in red, I guess it should be like this?

With the two ModSecurity and the rules updates, could I do something in the future to update them, check their sites, and follow similar steps?

BR
Venty

[Starburst]

The only thing left is to:

nano crs-setup.conf

Code Select Expand

# SecDefaultAction "phase:1,log,auditlog,pass"
# SecDefaultAction "phase:2,log,auditlog,pass"


Uncomment:

Code Select Expand

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"

[venty]

The only thing left is to:

nano crs-setup.conf

Code Select Expand

# SecDefaultAction "phase:1,log,auditlog,pass"
# SecDefaultAction "phase:2,log,auditlog,pass"


Uncomment:

Code Select Expand

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"

Hi,

thank you very much....

and that's all, will they update?

BR
Venty

[Starburst]

The other never auto updated either for some reason, but this manually update won't.

Path names would all change to the new version, so I'm not sure how a script might do this or not.

[venty]

Hi,

I sincerely thank Starburst for the good article..

https://kb.starburstservices.com/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-to-owasp-crs-ruleset-running-cwp-and-apache-on-almalinux-8-9/


but I saw that there is a new one:

https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/owasp-crs-ruleset-update-to-4-12-0-running-cwp-and-apache-on-almalinux-8-9/

Given that I have completed the first one verbatim, do I now have to complete everything from the second one?

And also - the link provided does not work, please help:

https://prnt.sc/itInIPhlID4o

Thanks in advance!

BR
Venty