30 lines
1.4 KiB
Diff
30 lines
1.4 KiB
Diff
|
diff --git a/rules/REQUEST-913-SCANNER-DETECTION.conf b/rules/REQUEST-913-SCANNER-DETECTION.conf
|
||
|
|
index 2b21cef..335dad2 100644
|
||
|
|
--- a/rules/REQUEST-913-SCANNER-DETECTION.conf
|
||
|
|
+++ b/rules/REQUEST-913-SCANNER-DETECTION.conf
|
||
|
|
@@ -31,6 +31,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:913012,phase:2,pass,nolog,skipAf
|
||
|
|
# 913101 - scripting/generic HTTP clients (data file scripting-user-agents.data)
|
||
|
|
# 913102 - web crawlers/bots (data file crawlers-user-agents.data)
|
||
|
|
#
|
||
|
|
+# Chained rule is doing whitelist for YUM package manager of CentOS / Fedore.
|
||
|
|
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
|
||
|
|
"id:913100,\
|
||
|
|
phase:2,\
|
||
|
|
@@ -49,10 +50,12 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
|
||
|
|
tag:'PCI/6.5.10',\
|
||
|
|
ver:'OWASP_CRS/3.3.4',\
|
||
|
|
severity:'CRITICAL',\
|
||
|
|
- setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
|
||
|
|
- setvar:'ip.reput_block_flag=1',\
|
||
|
|
- setvar:'ip.reput_block_reason=%{rule.msg}',\
|
||
|
|
- expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'"
|
||
|
|
+ chain"
|
||
|
|
+ SecRule MATCHED_VARS "!@rx ^urlgrabber/[0-9\.]+ yum/[0-9\.]+$" \
|
||
|
|
+ "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
|
||
|
|
+ setvar:'ip.reput_block_flag=1',\
|
||
|
|
+ setvar:'ip.reput_block_reason=%{rule.msg}',\
|
||
|
|
+ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'"
|
||
|
|
|
||
|
|
SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \
|
||
|
|
"id:913110,\
|