2005-05-19 03:39:17 +02:00
|
|
|
# Example configuration file for the mod_security Apache module
|
|
|
|
|
|
2007-04-01 11:57:48 +02:00
|
|
|
LoadFile LIBDIR/libxml2.so.2
|
2007-03-13 10:20:35 +01:00
|
|
|
|
|
|
|
|
LoadModule security2_module modules/mod_security2.so
|
2007-04-01 11:57:48 +02:00
|
|
|
LoadModule unique_id_module modules/mod_unique_id.so
|
2007-03-13 10:20:35 +01:00
|
|
|
|
|
|
|
|
<IfModule mod_security2.c>
|
|
|
|
|
# This is the ModSecurity Core Rules Set.
|
|
|
|
|
|
|
|
|
|
# Basic configuration goes in here
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_10_config.conf
|
|
|
|
|
|
|
|
|
|
# Protocol violation and anomalies.
|
|
|
|
|
# These are disabled as there's a bug in REQUEST_FILENAME handling
|
|
|
|
|
# causing the "+" character to be incorrectly handled.
|
|
|
|
|
|
|
|
|
|
# Include modsecurity.d/modsecurity_crs_20_protocol_violations.conf
|
|
|
|
|
# Include modsecurity.d/modsecurity_crs_21_protocol_anomalies.conf
|
|
|
|
|
|
|
|
|
|
# HTTP policy rules
|
|
|
|
|
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_30_http_policy.conf
|
|
|
|
|
|
|
|
|
|
# Here comes the Bad Stuff...
|
|
|
|
|
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_35_bad_robots.conf
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_40_generic_attacks.conf
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_45_trojans.conf
|
|
|
|
|
Include modsecurity.d/modsecurity_crs_50_outbound.conf
|
|
|
|
|
|
|
|
|
|
# Search engines and other crawlers. Only useful if you want to track
|
|
|
|
|
# Google / Yahoo et. al.
|
|
|
|
|
|
|
|
|
|
# Include modsecurity.d/modsecurity_crs_55_marketing.conf
|
|
|
|
|
|
|
|
|
|
# Put your local rules in here.
|
|
|
|
|
# The existing example is for the CVE-2007-1359 vulnerability
|
|
|
|
|
|
|
|
|
|
Include modsecurity.d/modsecurity_localrules.conf
|
2005-07-09 02:41:23 +02:00
|
|
|
</IfModule>
|
