I feel your pain of the ModSecurity OWASP false positives. It seems to be that especially with WordPress there are a lot of false positives with different plugins (Probably same reason it always gets hacked). I don't think it is really either a problem with cPanel, or with ModSecurity though.
The OWASP rules for ModSecurity are designed to provide "Generic Attack Detection" so naturally they are going to block out some good web traffic to valid applications too as they are overly secure. In this case they seem to be so secure they create a lot of false positives which is a nightmare for a small business to whitelist.
For us a couple of setups that are working well:
Option 1 - (Commercial rules, with some basic OWASP rules enabled).
1. Buy a subscription to the Trustwave Commercial ModSecurity rules (Or other commercial mod security rule vendor), and run their application specific rules in conjunction with some of the base OWASP rules in anomaly detection mode. For example with these rules loaded in your ModSecurity Vendor Configuration:
modsecurity_crs_10_setup.conf (Set to run in Anomaly Detection Mode by uncommenting that line, and increasing the 255 character limit line to something higher like 512).
rules/REQUEST-01-COMMON-EXCEPTIONS.conf
rules/REQUEST-10-IP-REPUTATION.conf
rules/REQUEST-12-DOS-PROTECTION.conf
rules/REQUEST-13-SCANNER-DETECTION.conf
rules/REQUEST-20-PROTOCOL-ENFORCEMENT.conf
rules/REQUEST-21-PROTOCOL-ATTACK.conf
rules/REQUEST-49-BLOCKING-EVALUATION.conf
rules/RESPONSE-59-BLOCKING-EVALUATION.conf
rules/RESPONSE-80-CORRELATION.conf
2. And enable these commercial rules in the bottom of your /usr/local/apache/conf/modsec2.user.conf file:
* I think this method will always be a better way, because you are basically paying for a commercial rule set that will always have better protection with almost no false positives. (you get what you pay for!)
Option 2 - (Only OWASP Rules Loaded)
1. Enable all of the OWASP rule sets in your ModSecurity Vendors.
2. Create a whitelist repository, and start whitelisting any false positives for each application. (I would strongly recommend setting up an AuditConsole server, as it will really help with this).
I’ve started an OWASP whitelist repository here: /https://github.com/wrender/modsecurity-whitelist-apps If anyone is able to help contribute I think it would be very helpful to anyone running ModSecurity with all of the OWASP rules enabled.
** This is the very labor intensive way, because there are a lot of different false positives depending on which web applications you are running.
The OWASP rules for ModSecurity are designed to provide "Generic Attack Detection" so naturally they are going to block out some good web traffic to valid applications too as they are overly secure. In this case they seem to be so secure they create a lot of false positives which is a nightmare for a small business to whitelist.
For us a couple of setups that are working well:
Option 1 - (Commercial rules, with some basic OWASP rules enabled).
1. Buy a subscription to the Trustwave Commercial ModSecurity rules (Or other commercial mod security rule vendor), and run their application specific rules in conjunction with some of the base OWASP rules in anomaly detection mode. For example with these rules loaded in your ModSecurity Vendor Configuration:
modsecurity_crs_10_setup.conf (Set to run in Anomaly Detection Mode by uncommenting that line, and increasing the 255 character limit line to something higher like 512).
rules/REQUEST-01-COMMON-EXCEPTIONS.conf
rules/REQUEST-10-IP-REPUTATION.conf
rules/REQUEST-12-DOS-PROTECTION.conf
rules/REQUEST-13-SCANNER-DETECTION.conf
rules/REQUEST-20-PROTOCOL-ENFORCEMENT.conf
rules/REQUEST-21-PROTOCOL-ATTACK.conf
rules/REQUEST-49-BLOCKING-EVALUATION.conf
rules/RESPONSE-59-BLOCKING-EVALUATION.conf
rules/RESPONSE-80-CORRELATION.conf
2. And enable these commercial rules in the bottom of your /usr/local/apache/conf/modsec2.user.conf file:
Code:
# Include Trustwave Commercial Modsecurity Rules
Include conf/slr_vuln_rules/modsecurity_slr_10_ip_reputation.conf
Include conf/slr_vuln_rules/modsecurity_slr_46_known_vulns.conf
Include conf/slr_vuln_rules/modsecurity_slr_50_malware_detection.conf
Include conf/slr_vuln_rules/owasp_crs_integration/application_specific/*.conf
Include conf/slr_vuln_rules/botnet_attacks/*.conf
Include conf/slr_vuln_rules/dos_attacks/*.conf
Include conf/slr_vuln_rules/webshell_backdoors/*.confOption 2 - (Only OWASP Rules Loaded)
1. Enable all of the OWASP rule sets in your ModSecurity Vendors.
2. Create a whitelist repository, and start whitelisting any false positives for each application. (I would strongly recommend setting up an AuditConsole server, as it will really help with this).
I’ve started an OWASP whitelist repository here: /https://github.com/wrender/modsecurity-whitelist-apps If anyone is able to help contribute I think it would be very helpful to anyone running ModSecurity with all of the OWASP rules enabled.
** This is the very labor intensive way, because there are a lot of different false positives depending on which web applications you are running.
Last edited:
