GUI editor to tame mod_security rules

βŒˆβŒ‹ βŽ‡ branch:  modseccfg


Artifact [5039698403]

Artifact 5039698403362f2d9797f1d8d18ae14621590df41f671350b754ffaa073ddc4a:

Wiki page [modseccfg] by mario 2020-12-14 07:56:34.
D 2020-12-14T07:56:34.552
L modseccfg
N text/x-markdown
P 98fdfb58b77599ef83ca58ac67d446d2dde04c77166389266f44e21655f61807
U mario
W 2637
## mod_security config GUI

 * GUI to define SecRuleRemoveById settings on a vhost-basis
 * Tries to suggest false positives from error and audit logs
 * And configure mod_security and CoreRuleSet variables.
 * Runs locally, via `ssh -X` forwarding, or per [`modseccfg ssh:/`
   remoting](wiki/remoting).

<img src="raw/80ea9c62eece1?=image/gif" width=600 height=440 style="margin:10pt">


<blockquote style="background:#fdc; padding: 20pt; border-radius: 10pt; border: 5pt solid #eba;">
 <b>WARNING: THIS IS ALPHA STAGE QUALITY AND WILL MOST CERTAINLY DELETE YOUR APACHE CONFIGURATION</b> - It doesn't, but: no warranty and such. - Also, hasn't many features yet.
</blockquote>


## Installation

 * You can install this package locally or on a server:

        pip3 install -U modseccfg

 * And your distro must provide a full Python installaton and mod_security:

        sudo apt install python3-tk ttf-unifont libapache2-mod-security2

## Start options

 * To run the GUI locally / on test setups:

        modseccfg


 * Or to [connect to a remote](wiki/remoting) server:
    
        modseccfg root@vps5:/

   Takes a bit longer on startup, but is heaps better than X11 forwarding.


## Usage

You obviously should have Apache + mod_security + CRS set up
and running already (in DetectionOnly mode initially), to allow for log
inspection and adapting rules.

 1. Start modseccfg (`python3 -m modseccfg`)
 2. Select a configuration/vhost file to inspect + work on.
 3. Pick the according error.log
 4. Inspect the rules with a high error count.
 5. [Disable] offending rules
     * **Don't just go by the error count however!**
     * Make sure you don't disable essential or heuristic rules.
     * Compare error with access log details.
     * Else craft an exception rule ([Modify] or β†’Recipes).
 6. Thenceforth restart Apache (after testing changes: `apache2ctl -t`).


See also:

  * [usage](wiki/usage)
  * [remoting](wiki/remoting)
  * [preconf setup](wiki/preconf) and [recipes](wiki/recpie)
  * [log scripts/](wiki/scripts)
  * or the ["FAQ"](doc/trunk/FAQ.md)


### Notes

 * Preferrably do not edit default `/etc/apache*` files
 * Work on separated `/srv/web/conf.d/*` configuration, if available
 * And keep vhost settings in e.g. `vhost.*.dir` files, rather than
   multiple `<VirtualHost>` in one `*.conf` (else only the first section
   will be augmented).
 * Use the editor (F4) to verify more complex settings.

### Missing features

 * Rule [modify] is still unimplemented.
 * Recipes are not worth using yet.
 * No sudo usage.


Z e80f83286e3a5ac9bd46257f7d910443