mod security
   HOME

TheInfoList



OR:

ModSecurity, sometimes called Modsec, is an
open-source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...
web application firewall A web application firewall (WAF) is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service. By inspecting HTTP traffic, it can prevent attacks exploiting a web application's known vul ...
(WAF). Originally designed as a module for the
Apache HTTP Server The Apache HTTP Server ( ) is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. Apache is developed and maintained by an open community of developers under the auspices of the Apache So ...
, it has evolved to provide an array of
Hypertext Transfer Protocol The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, ...
request and response filtering capabilities along with other security features across a number of different platforms including
Apache HTTP Server The Apache HTTP Server ( ) is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. Apache is developed and maintained by an open community of developers under the auspices of the Apache So ...
,
Microsoft Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washing ...
IIS and
Nginx Nginx (pronounced "engine x" ) is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. The software was created by Igor Sysoev and publicly released in 2004. Nginx is free and open-source software ...
. It is a
free software Free software or libre software is computer software distributed under terms that allow users to run the software for any purpose as well as to study, change, and distribute it and any adapted versions. Free software is a matter of liberty, no ...
released under the Apache license 2.0. The platform provides a rule configuration language known as 'SecRules' for real-time monitoring, logging, and filtering of
Hypertext Transfer Protocol The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, ...
communications based on user-defined rules. Although not its only configuration, ModSecurity is most commonly deployed to provide protections against generic classes of vulnerabilities using the OWASP ModSecurity Core Rule Set (CRS). This is an
open-source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...
set of rules written in ModSecurity's SecRules language. The project is part of
OWASP The Open Web Application Security Project (OWASP) is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. The OWASP provides free and open ...
, the Open Web Application Security Project. Several other rule sets are also available. To detect threats, the ModSecurity engine is deployed embedded within the webserver or as a proxy server in front of a web application. This allows the engine to scan incoming and outgoing
HTTP The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, ...
communications to the endpoint. Dependent on the rule configuration the engine will decide how communications should be handled which includes the capability to pass, drop, redirect, return a given status code, execute a script, and more.


History

ModSecurity was first developed by
Ivan Ristić Ivan Ristić (Serbian Cyrillic alphabet, Serbian Cyrillic: Иван Ристић; born 10 January 1975) is a Serbian Association football, football manager and former player. Playing career Born in Serbia he was playing with FK Jedinstvo Paraćin ...
, who wrote the module with the end goal of monitoring application traffic on the
Apache HTTP Server The Apache HTTP Server ( ) is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. Apache is developed and maintained by an open community of developers under the auspices of the Apache So ...
. The first version was released in November 2002 which supported
Apache HTTP Server The Apache HTTP Server ( ) is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. Apache is developed and maintained by an open community of developers under the auspices of the Apache So ...
1.3.x. Starting in 2004 Ivan created Thinking Stone to continue work on the project full-time. While working on the version 2.0 rewrite Thinking Stone was bought by Breach Security, an American-Israeli security company, in September 2006. Ivan stayed on continuing the development of version 2.0 which was subsequently released in summer 2006. Ristić and Breach Security released another major rewrite, version 2.5, with major syntactic changes in February 2008. In 2009 Ivan left Breach to found SSL Labs. Shortly after Ivan's departure from Breach Security,
Trustwave Holdings Trustwave Holdings is an American standalone business unit cybersecurity independent subsidiary and brand of multinational telecommunications company Singtel Group Enterprise. It focuses on providing managed detection and response (MDR), managed ...
acquired Breach in June 2010 and relicensed ModSecurity under the Apache license. Development continued and the new license allowed easier integration of ModSecurity into other products. As a result of this there was steady adoption of ModSecurity by various commercial products. The license change also precipitated easier porting of the software. Hence,
Microsoft Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washing ...
contributed an IIS port in August 2012 and the port for
Nginx Nginx (pronounced "engine x" ) is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. The software was created by Igor Sysoev and publicly released in 2004. Nginx is free and open-source software ...
was released at
Black Hat Briefings Black Hat Briefings (commonly referred to as Black Hat) is a computer security conference that provides security consulting, training, and briefings to hackers, corporations, and government agencies around the world. Black Hat brings together a ...
in 2012. 2017 saw the second edition of the handbook released, written by
Christian Folini Christians () are people who follow or adhere to Christianity, a monotheistic Abrahamic religion based on the life and teachings of Jesus Christ. The words ''Christ'' and ''Christian'' derive from the Koine Greek title ''Christós'' (Χρι ...
and Ivan Ristić. It covers ModSecurity up to version 2.9.2. Being originally an Apache module, porting ModSecurity to other platforms was time-consuming and had high maintenance costs. As a result of this, a complete rewrite was started in December 2015. This new iteration, libmodsecurity, changes the underlying architecture, separating ModSecurity into a standalone engine that communicates with the web server via an API. This modular architecture-based WAF, which was announced for public use in January 2018, became libmodsecurity (ModSecurity version 3.0) and has supported connectors for Nginx and Apache. In 2021,
Trustwave Holdings Trustwave Holdings is an American standalone business unit cybersecurity independent subsidiary and brand of multinational telecommunications company Singtel Group Enterprise. It focuses on providing managed detection and response (MDR), managed ...
, announce the End-of-Sale (EOS) of Trustwave support for ModSecurity effective August 1, 2021 and the End-of-Life (EOL) of support effective July 1, 2024. The maintenance of the ModSecurity code is given to the open-source community.


Former Lynx browser blocking

The default rules shipped with most ModSecurity distributions are the OWASP ModSecurity Core Rule Set (CRS). These rules used to block the
Lynx A lynx is a type of wild cat. Lynx may also refer to: Astronomy * Lynx (constellation) * Lynx (Chinese astronomy) * Lynx X-ray Observatory, a NASA-funded mission concept for a next-generation X-ray space observatory Places Canada * Lynx, Ontar ...
browser as an "automated tool", returning a "406 Not Acceptable" to it unless its
user-agent string In computing, the User-Agent header is an HTTP header intended to identify the user agent responsible for making a given HTTP request. Whereas the character sequence User-Agent comprises the name of the header itself, the header value that a g ...
was changed. This blog must be incorrect to say the motivation for the Lynx block was to stop the web server running a "Linux command", since the command to invoke Lynx does not start with a capital L as does the default user-agent string (and the block is case-sensitive). This inconvenienced users with
blindness Visual impairment, also known as vision impairment, is a medical definition primarily measured based on an individual's better eye visual acuity; in the absence of treatment such as correctable eyewear, assistive devices, and medical treatment ...
who work in Lynx. However, with the release of Core Rule Set 3.0 (CRS3), a Lynx user agent does not trigger any rules anymore.


References


External links

* {{Official website
Official ModSecurity documentationHow To Set Up mod_security with Apache on Debian/UbuntuLinux ModSecurity Introduction and Install guideSearchsecurity.techtarget.com
Free web server software Firewall software Lua (programming language)-scriptable software