ModSecurity Rule for joomla!

[konlungkao]

everybody if you have Rule for ModSecurity2 please share

[elta68]

use rules from gotroot.com (http://www.gotroot.com/)
the default are ok, I use an old mod_security 1.9.4 with these rules

my /etc/apache2/conf.d/mod_security.conf look like this:

LoadModule security_module /usr/lib/apache2/mod_security.so
SecFilterEngine On

# Reject requests with status 500
SecFilterDefaultAction "deny,log,status:500"

# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding Off
SecFilterNormalizeCookies On
# enable version 1 (RFC 2965) cookies
SecFilterCookieFormat 1

SecServerResponseToken Off

#If you want to scan the output, uncomment these
#SecFilterScanOutput On
#SecFilterOutputMimeTypes "(null) text/html text/plain"

# Accept almost all byte values
SecFilterForceByteRange 1 255

# Server masking is optional
#fake server banner - NOYB used - no one needs to know what we are using
SecServerSignature "NOYB"

#SecUploadDir /tmp
#SecUploadKeepFiles Off

# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/apache2/audit_log

# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog /var/log/apache2/modsec_debug_log

#Include /etc/apache2/modsecurity_rules/modsecurity-general.conf
#Include /etc/apache2/modsecurity_rules/modsecurity-hardening.conf
#Include /etc/apache2/modsecurity_rules/modsecurity-php.conf
#Include /etc/apache2/modsecurity_rules/modsecurity-output.conf

#rules set found at http://www.gotroot.com/tiki-index.php?p ... rity+rules

Include /etc/apache2/modsecurity_rules/exclude.conf

Include /etc/apache2/modsecurity_rules/apache2-rules.conf
#Include /etc/apache2/modsecurity_rules/badips.conf
#Include /etc/apache2/modsecurity_rules/blacklist2.conf
#Include /etc/apache2/modsecurity_rules/blacklist.conf
#Include /etc/apache2/modsecurity_rules/jitp.conf

#Include /etc/apache2/modsecurity_rules/proxy.conf
#Include /etc/apache2/modsecurity_rules/recons.conf
Include /etc/apache2/modsecurity_rules/rootkits.conf
Include /etc/apache2/modsecurity_rules/rules.conf
Include /etc/apache2/modsecurity_rules/useragents.conf


As you see not all rules are active, it suck otherwise too much power for my server (athlon64, 1GB ram)

I would say that you secure to the max, if a rule block one component, try to change code in the component first before making an exception in list of rule.

[konlungkao]

thank you elta68