62 lines
3.9 KiB
YAML
62 lines
3.9 KiB
YAML
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: coraza-waf
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "gestion-traefik.labels" . | nindent 4 }}
|
|
spec:
|
|
plugin:
|
|
coraza-traefik:
|
|
directives:
|
|
# -------------------------------------------------------
|
|
# Moteur et body inspection
|
|
# -------------------------------------------------------
|
|
- "SecRuleEngine On"
|
|
- "SecRequestBodyAccess On"
|
|
- "SecRequestBodyLimit 104857600"
|
|
- "SecRequestBodyInMemoryLimit 131072"
|
|
- "SecResponseBodyAccess Off"
|
|
- "SecDebugLogLevel 0"
|
|
|
|
# -------------------------------------------------------
|
|
# OWASP CRS — inclus dans le plugin Coraza
|
|
# -------------------------------------------------------
|
|
- "Include @coraza.conf-recommended"
|
|
- "Include @crs-setup.conf.example"
|
|
- "Include @owasp_crs/*.conf"
|
|
|
|
# -------------------------------------------------------
|
|
# Niveau de paranoia {{ .Values.waf.paranoia }}
|
|
# -------------------------------------------------------
|
|
- "SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level={{ .Values.waf.paranoia }}\""
|
|
- "SecAction \"id:900001,phase:1,nolog,pass,t:none,setvar:tx.inbound_anomaly_score_threshold={{ .Values.waf.anomalyInbound }}\""
|
|
- "SecAction \"id:900002,phase:1,nolog,pass,t:none,setvar:tx.outbound_anomaly_score_threshold={{ .Values.waf.anomalyOutbound }}\""
|
|
|
|
# -------------------------------------------------------
|
|
# Suppressions CRS pour les routes légitimes
|
|
# -------------------------------------------------------
|
|
- "SecRuleRemoveById 932235"
|
|
- "SecRuleRemoveById 911100"
|
|
|
|
- "SecRule REQUEST_URI \"@streq /api/v2/admin/protected/products\" \"id:399001,phase:2,nolog,pass,ctl:ruleRemoveById=932235\""
|
|
- "SecRule REQUEST_URI \"@streq /api/v2/admin/protected/products\" \"id:399002,phase:2,nolog,pass,ctl:ruleRemoveById=920120,ctl:ruleRemoveById=920121\""
|
|
- "SecRule REQUEST_URI \"@streq /api/v1/panier/remove\" \"id:399010,phase:1,nolog,pass,ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350\""
|
|
- "SecRule REQUEST_URI \"@streq /api/v1/panier/clear\" \"id:399011,phase:1,nolog,pass,ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350\""
|
|
|
|
# Désactiver le WAF sur les uploads (fichiers statiques en lecture)
|
|
- "SecRule REQUEST_URI \"@beginsWith /uploads/\" \"id:1000,phase:1,pass,nolog,ctl:ruleEngine=Off\""
|
|
|
|
# -------------------------------------------------------
|
|
# IP banning automatique sur attaques détectées
|
|
# Note : en-mémoire par pod — pour un ban distribué utiliser Redis + Coraza persistence
|
|
# -------------------------------------------------------
|
|
- "SecRule TX:SQL_INJECTION_SCORE \"@ge 5\" \"id:100001,phase:2,deny,status:403,log,msg:'SQL Injection detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
|
|
- "SecRule TX:XSS_SCORE \"@ge 5\" \"id:100010,phase:2,deny,status:403,log,msg:'XSS detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
|
|
- "SecRule TX:RCE_SCORE \"@ge 5\" \"id:100020,phase:2,deny,status:403,log,msg:'RCE detected',setvar:'ip.banned=1',expirevar:'ip.banned=259200'\""
|
|
- "SecRule TX:LFI_SCORE \"@ge 5\" \"id:100030,phase:2,deny,status:403,log,msg:'LFI detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
|
|
- "SecRule TX:INBOUND_ANOMALY_SCORE \"@ge 20\" \"id:100060,phase:2,deny,status:403,log,msg:'Critical anomaly score',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
|
|
|
|
- "SecRule IP:BANNED \"@eq 1\" \"id:100000,phase:1,deny,status:403,log,msg:'IP is banned'\""
|
|
- "SecRule IP:REPUTATION_SCORE \"@ge 100\" \"id:100099,phase:1,deny,status:403,log,msg:'Critical reputation score',setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'\""
|