73 lines
2.1 KiB
Plaintext
73 lines
2.1 KiB
Plaintext
# Example configuration file for the mod_security Apache module
|
|
# This is a minimal setup. You should add some extra entries here.
|
|
|
|
LoadModule security_module modules/mod_security.so
|
|
|
|
<IfModule mod_security.c>
|
|
|
|
# Turn the filtering engine On or Off
|
|
SecFilterEngine On
|
|
|
|
# The audit engine works independently and
|
|
# can be turned On of Off on the per-server or
|
|
# on the per-directory basis
|
|
SecAuditEngine RelevantOnly
|
|
|
|
# Make sure that URL encoding is valid
|
|
SecFilterCheckURLEncoding On
|
|
|
|
# Unicode encoding check
|
|
SecFilterCheckUnicodeEncoding On
|
|
|
|
# Only allow bytes from this range
|
|
SecFilterForceByteRange 1 255
|
|
|
|
# Cookie format checks.
|
|
SecFilterCheckCookieFormat On
|
|
|
|
# The name of the audit log file
|
|
SecAuditLog logs/audit_log
|
|
|
|
# Should mod_security inspect POST payloads
|
|
SecFilterScanPOST On
|
|
|
|
# Default action set
|
|
SecFilterDefaultAction "deny,log,status:406"
|
|
|
|
# Simple example filter
|
|
# SecFilter 111
|
|
|
|
# Prevent path traversal (..) attacks
|
|
SecFilter "\.\./"
|
|
|
|
# Weaker XSS protection but allows common HTML tags
|
|
SecFilter "<( |\n)*script"
|
|
|
|
# Prevent XSS atacks (HTML/Javascript injection)
|
|
SecFilter "<(.|\n)+>"
|
|
|
|
# Very crude filters to prevent SQL injection attacks
|
|
SecFilter "delete[[:space:]]+from"
|
|
SecFilter "insert[[:space:]]+into"
|
|
SecFilter "select.+from"
|
|
|
|
# Require HTTP_USER_AGENT and HTTP_HOST headers
|
|
SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"
|
|
|
|
# Only accept request encodings we know how to handle
|
|
# we exclude GET requests from this because some (automated)
|
|
# clients supply "text/html" as Content-Type
|
|
SecFilterSelective REQUEST_METHOD "!^GET$" chain
|
|
SecFilterSelective HTTP_Content-Type "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"
|
|
|
|
# Require Content-Length to be provided with
|
|
# every POST request
|
|
SecFilterSelective REQUEST_METHOD "^POST$" chain
|
|
SecFilterSelective HTTP_Content-Length "^$"
|
|
|
|
# Don't accept transfer encodings we know we don't handle
|
|
# (and you don't need it anyway)
|
|
SecFilterSelective HTTP_Transfer-Encoding "!^$"
|
|
|
|
</IfModule>
|