Traefik Modsecurity Plugin

this is a fork of the original: https://github.com/acouvreur/traefik-modsecurity-plugin

This fork introduces alpine images, and a custom http.transport, and a caching layer once mod-security has processed a request

see: https://github.com/traefik/plugindemo#troubleshooting

Traefik plugin to proxy requests to owasp/modsecurity-crs:apache

Traefik Modsecurity Plugin

Demo

Demo with WAF intercepting relative access in query param.

Usage (docker-compose.yml)

See docker-compose.yml

docker-compose up
Go to http://localhost/website, the request is received without warnings
Go to http://localhost/website?test=../etc, the request is intercepted and returned with 403 Forbidden by owasp/modsecurity
You can you bypass the WAF and check attacks at http://localhost/bypass?test=../etc

How it works

This is a very simple plugin that proxies the query to the owasp/modsecurity apache container.

The plugin checks that the response from the waf container hasn't an http code > 400 before forwarding the request to the real service.

If it is > 400, then the error page is returned instead.

The dummy service is created so the waf container forward the request to a service and respond with 200 OK all the time.

NEW: Caching modsecurity responses helps to minimize the overhead of processing every request and improves performance. By generating cache keys based on various factors like the request method, host, request URI, headers, and remote address, we can ensure that different requests are treated uniquely, while similar requests can be served from the plugins modsecurity response cache. This approach helps in reducing the load on the modsecurity instance and improves response times for requests. You can tune this to your liking but we recommend the following options:

Configuration

This plugin supports these configuration:

modSecurityUrl: (mandatory) it's the URL for the owasp/modsecurity container.
timeoutMillis: (optional) timeout in milliseconds for the http client to talk with modsecurity container. (default 2 seconds)
maxBodySize: (optional) it's the maximum limit for requests body size. Requests exceeding this value will be rejected using HTTP 413 Request Entity Too Large. The default value for this parameter is 10MB. Zero means "use default value".
cacheConditionsMethods: (optional) An array of HTTP methods for which caching is allowed. (default ["GET"])
cacheConditionsNoBody: (optional) Specifies if requests with no body (content-length of 0) should be cached. ( default true)
cacheKeyIncludeHost: (optional) Specifies if the host should be included in the cache key. (default true)
cacheKeyIncludeRemoteAddress: (optional) Speifics if the remote request address should be included in the cache key (default true)
cacheKeyIncludeHeaders: (optional) Specifies if the headers should be included in the cache key. (default true)
cacheKeyHeaders: (optional) An array of specific headers to be included in the cache key when CacheKeyIncludeHeaders is true. (ie: the default ["User-Agent"])

Note: some headers are ALWAYS blacklisted, and even if you list them here, they will still not be cached:

Authorization: *, Set-Cookie: *, Cache-Control: no-store, Pragma: no-cache, Expires: -1 (date in the past)

Note: body of every (non-cached) request will be buffered in memory while the request is in-flight (i.e.: during the security check and during the request processing by traefik and the backend), so you may want to tune maxBodySize depending on how much RAM you have.

Local development (docker-compose.local.yml)

See docker-compose.local.yml

docker-compose -f docker-compose.local.yml up to load the local plugin

Plugin crash with Nextcloud

Hi,

Successfully got the plugin working, but as soon as I try to login within nextcloud it crashes.
It doesn't forward the query to modsecurity-crs container.
I've tried with cache disable but got the same error.

traefik config:

commands:

      # Enabling WAF module
      - '--experimental.plugins.traefik-modsecurity-plugin.modulename=github.com/madebymode/traefik-modsecurity-plugin'
      - '--experimental.plugins.traefik-modsecurity-plugin.version=v1.4.5'

labels:

      # WAF enable (This is a very simple plugin that proxies the query to the owasp/modsecurity apache container, and checks in its answer if it has detected something in the query (>400 response) or not). Set max body size to inspect to 1GB.
      - traefik.http.middlewares.waf.plugin.traefik-modsecurity-plugin.modSecurityUrl=http://waf:80
      - traefik.http.middlewares.waf.plugin.traefik-modsecurity-plugin.maxBodySize=1073741824
      - traefik.http.middlewares.waf.plugin.traefik-modsecurity-plugin.cacheEnabled=true

nextcloud labels (waf middleware here):

      - "traefik.http.routers.nextcloud.middlewares=other,nextcloud-redirectregex,security-and-proxy-headers,waf"

modescurity config (added allowed methods especially for Nextcloud):

  # WAF ModSecurity https://plugins.traefik.io/plugins/644d9a72ebafd55c9c740848/mx-m-owasp-crs-modsecurity-plugin / https://github.com/madebymode/traefik-modsecurity-plugin
  # You need to have an always on web service as backend, like a dummy whoami one
  waf:
    image: owasp/modsecurity-crs:apache-alpine
    restart: always
    depends_on:
      - traefik
      - waf_dummy_whoami_for_modsecurity
    # 2 replicas as critical service (needs to be in swarm mode)
    deploy:
      mode: replicated
      replicas: 2
      endpoint_mode: vip
    networks:
      - security_services
    environment:
      - PARANOIA=1
      - ANOMALY_INBOUND=10
      - ANOMALY_OUTBOUND=5
      - BACKEND=http://waf_dummy_whoami_for_modsecurity
      - SERVER_NAME=waf
      - REMOTEIP_INT_PROXY=traefik
      #Native/JSON : Native better parsed from CrowdSec modsecurity parser
      - MODSEC_AUDIT_LOG_FORMAT=Native
      # Nextcloud uses a lot of methods
      - ALLOWED_METHODS=MKCOL GET HEAD POST PUT OPTIONS PROPFIND
  # The dummy whoami for modsecurity
  waf_dummy_whoami_for_modsecurity:
    image: containous/whoami
    security_opt:
      - no-new-privileges:true
    restart: always
    deploy:
      mode: replicated
      replicas: 2
      endpoint_mode: vip
    networks:
      - security_services

Ask me anything you need for further debug if you wish.

madebymode / traefik-modsecurity-plugin Goto Github PK