How can we control malicious calls to a web application with Nginx modsecurity module?

Question

There is much commercial software(Akamai, Cloudflare, etc) to control the malicious calls/attacks (XSS, injection, DDOS, etc). Although, can we use ModSecurity with Nginx ? How to write custom rules in Lua to avoid major vulnerabilities for my web application. May i get some guidance on this? is there any opensource templates to follow?

Answer 1

ModSecurity Core Rule Set Developer on Duty here. First of all, ModSecurity rules are written in "SecLang", a domain-specific language used to express ModSecurity rules and logic. It is also possible to write Lua scripts to provide extremely custom behaviour, but in practice this is very rarely necessary.

If you want to start with a great set of ModSecurity WAF rules to protect web applications, take a look at the Core Rule Set (CRS), which can be found at coreruleset.org. CRS is the de facto set of free and open-source WAF/ModSecurity rules, and it's used by some very big WAF vendors and service providers.

There are lots of great resources available to help get you started with Nginx + ModSecurity. I'll run few some of them here:

• Pre-made Docker images of Nginx + ModSecurity, as well as Apache + ModSecurity (https://github.com/coreruleset/modsecurity-docker)
• Pre-made Docker images of Nginx + ModSecurity + Core Rule Set (CRS), the de facto free and open-source WAF rule set (https://github.com/coreruleset/modsecurity-crs-docker)
• Christian Folini's tutorial series over at netnea on building your own Nginx + ModSecurity setup from scratch (https://www.netnea.com/cms/nginx-modsecurity-tutorials/)
• The ModSecurity (v3) Reference Manual (https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v3.x%29)
• The ModSecurity Handbook from Feisty Duck, which is worth every penny if you're going to be using ModSecurity for real world applications (https://www.feistyduck.com/books/modsecurity-handbook/)
• The official Core Rule Set documentation, for CRS-specific information (https://coreruleset.org/docs/)