ModSecurity

ModSecurity

Stable release	2.9.1 / 9 March 2016 (2016-03-09)

Repository	https://github.com/SpiderLabs/ModSecurity
Available in	English
License	Apache License 2.0
Website	modsecurity.org

ModSecurity, sometimes called Modsec, is a popular Open-source Web application firewall (WAF). Originally designed as a module for the Apache HTTP Server, it has evolved to provide an array of Hypertext Transfer Protocol request and response filtering capabilities along with other security features across a number of different platforms including Apache HTTP Server, Microsoft IIS and NGINX. It is a free software released under the Apache license 2.0.

ModSecurity's Open Source availability has resulted in it becoming one of the world's most popular Web application firewalls. The platform itself provides a rule configuration language known as 'SecRules' for real-time monitoring, logging, and filtering of Hypertext Transfer Protocol communications based on user-defined rules.

Although not its only configuration, ModSecurity is most commonly deployed to provide protections against generic classes of vulnerabilities using the OWASP Core Rule Set (CRS), an Open-source set of rules written in ModSecurity's SecRules language. Several other rule sets are also available for ModSecurity.

To detect threats, the ModSecurity engine is deployed embedded within the webserver or as a proxy server in front of a web application. This allows the engine to scan incoming and outgoing HTTP communications to the endpoint. Dependent on the rule configuration the engine will decide how communications should be handled which includes the capability to pass, drop, redirect, return a given status code, execute a user script, and more. ModSecurity is known to have the following capabilities:

Security monitoring and access control
Virtual patching
Full HTTP traffic logging
Security assessment
Web application hardening
Passive security assessment
Simple request or Regular expression based Filtering
URL Encoding Validation
Auditing
IP Reputation
Null byte attack prevention
Server identity masking
Uploads memory limits
etc.

History

ModSecurity was first developed by Ivan Ristić, who wrote the module with the end goal of monitor application traffic on the Apache HTTP Server. The first version was released in November 2002 which supported Apache HTTP Server 1.3.x. Starting in 2004 Ivan created Thinking Stone to continue work on the project full-time. While working on the version 2.0 rewrite Thinking Stone was bought by Breach Security, an American-Israeli security company, in September 2006. Ivan stayed on continuing development of version 2.0 which was subsequently released in summer 2006.

Ristic and Breach Security released another major rewrite, version 2.5, with major syntactic changes in February 2008. In 2009 Ivan left Breach to found SSLLabs. Shortly after Ivan's departure from Breach Security, Trustwave Holdings acquired Breach in June 2010 and relicensed ModSecurity under the Apache license. Development continued and the new license allowed easier integration of ModSecurity into other products. As a result of this there was steady adoption of ModSecurity by various commercial products.The license change also precipitated easier porting of the software. Hence, Microsoft contributed an IIS port in August 2012 and the port for Nginx was released at Black Hat Briefings in 2012.

Being originally an Apache module, porting ModSecurity to other platforms was time consuming and had high maintenance costs. As a result of this a complete rewrite was started in December 2015. This new iteration, libmodsecurity, changes the underlying architecture, separating ModSecurity into a standalone engine that will communicate with the web server via an API. This daemon, which is in a functional alpha stage now, will eventually become libmodsecurity (ModSecurity version 3.0).

Lynx browser blocking

The default rules shipped with most ModSecurity distributions are the OWASP ModSecurity Core Rule Set (CRS).^[1] These rules block the Lynx browser as an "automated tool", returning a "406 Not Acceptable" to it unless its user-agent string is changed.^[2] This inconveniences users with blindness who work in Lynx. Server administrators who install mod_security without knowing how to change the rules have had problems with this.^[3]

External links

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.