Atomicorp no longer provides a free delayed version of its ModSecurity Rule set

[quizknows]

Sounded like there had to be a catch. Sounds to me like they want to get you using their plug-in and then sell you additional services.

Has anybody tried the plug-in yet?

I downloaded the rules, the comments basically say they're "modified or changed from the CRS." Take that as you will; the rule ID numbers are still in the 200,000 to 299,999 range which is reserved for the CRS / Modsecurity.org rules.

I didn't try the plug-in since I wasn't impressed with the content of the rule set. I agree they're probably just trying to get their name out more to sell people additional services.

 

[ThinIce]

There is a fairly long thread on WHT on these rules https://www.webhostingtalk.com/showthread.php?t=1334902 and there is comodo's own forum at Free Modsecurity rules - Comodo Web Application Firewall

I'm on the fence with these, the cPanel plugin originally seems to have been crap but is now in a semi-usable state and it would be nice if they could provide comment on what they're attempting to do with the core rule set (i.e. provide some sort of additional curation or whatever)

 

[kernow]

From Comdo staff:

Comodo has own rules, at this phase they are contains reprocessed core rules with reduced False Positives as CWAF rules part.

 

[quizknows]

If they're their own rules why do the files state they are just modified from the CRS? And why are the rule ID's in the reserved ID range for modsecurity.org?

I'm not "buying" it.

 

[kernow]

We asked them that:

We are using proper IDs range reserved for COMODO, you can check it here:
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#id

 

[quizknows]

OK, looks like the rule ranges were re-allocated. Thanks for the link. Previously, according to https://documentation.cpanel.net/display/EA/Apache+Module:+ModSecurity , 200,000–299,999 was reserved for rules published at modsecurity.org.

 

[Solokron]

We have been working with Comodo for a long time and I am pretty hesitant to use them with anything marked "free". There is always a catch.
This looks intriguing but I am wondering what happens after the first free year? Can the license be used on more than one server?

Try https://waf.comodo.com.


Free and includes cPanel addon.

 

[complexi]

I'm doing a free and independent plugin for the Trustwave Rules (see screenshot) that manages this for you and more. I get great support from Trustwave on this as well. I hope to have this out in a week or so. If anyone is using cPanel and Trustwave, feel free to contact me and i'll send you the install instructions

whitedog,
we're curious about your cpanel/trustwave tech. are you still working on it? we'd like to install it and test trustwave's waf ruleset.

thx,
complexi

 

[Solokron]

I would be on board with getting a new plugin going that actually works with RUID2 and its rising usage.

 

[quizknows]

There are a lot of nice changes for modsecurity management via WHM in 11.46 with more to come in 11.48. I can't say much more than that, but 3rd party plugins for managing modsec will probably become a thing of the past for most people.