49 lines
1.6 KiB
Plaintext
49 lines
1.6 KiB
Plaintext
# Exclure le corps des requêtes/réponses de l'audit log pour garder des
|
|
# lignes de taille raisonnable.
|
|
SecAuditLogParts ABIFHZ
|
|
|
|
SecRule IP:BANNED "@eq 1" \
|
|
"id:100000,phase:1,deny,status:403,log,\
|
|
msg:'IP is banned'"
|
|
|
|
SecRule IP:REPUTATION_SCORE "@ge 100" \
|
|
"id:100099,phase:1,deny,status:403,log,\
|
|
msg:'Critical reputation score',\
|
|
setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
|
|
|
|
SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
|
|
"id:100001,phase:2,deny,status:403,log,\
|
|
msg:'SQL Injection detected',\
|
|
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
|
|
|
|
SecRule TX:XSS_SCORE "@ge 5" \
|
|
"id:100010,phase:2,deny,status:403,log,\
|
|
msg:'XSS detected',\
|
|
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
|
|
|
|
SecRule TX:RCE_SCORE "@ge 5" \
|
|
"id:100020,phase:2,deny,status:403,log,\
|
|
msg:'RCE detected',\
|
|
setvar:'ip.banned=1',expirevar:'ip.banned=259200'"
|
|
|
|
SecRule TX:LFI_SCORE "@ge 5" \
|
|
"id:100030,phase:2,deny,status:403,log,\
|
|
msg:'LFI detected',\
|
|
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
|
|
|
|
SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
|
|
"id:100060,phase:2,deny,status:403,log,\
|
|
msg:'Critical anomaly score',\
|
|
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
|
|
|
|
# Rate limit basique par IP (indépendant du RateLimit Go déjà en place sur
|
|
# /auth/login côté control-plane — celui-ci protège tout le reste).
|
|
SecAction \
|
|
"id:400161,phase:1,nolog,pass,\
|
|
setvar:'ip.request_window_1sec=+1',\
|
|
expirevar:'ip.request_window_1sec=1'"
|
|
|
|
SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
|
|
"id:400160,phase:1,deny,status:429,log,\
|
|
msg:'Too many requests'"
|