What is a WAF
A WAF is a web application firewall. A Web Application Firewall protects HTTP applications (eg websites) using a set of rules to protect against various common attacks, such as SQL Injection and Cross site scripting (XSS).
Mod Security Web Application Firewall
Mod_Security is an apache (and IIS) module which provides an interface to apply rules to protect your HTTP applications. There are various providers of ModSecurity rules, both free and paid. Mod Security Web Application Firewall is open source.
Mod Security in plesk
Installing Mod Security Web Application Firewall in Plesk is very easy:
Tools & Settings > Updates and Upgrades > Add/Remove Components > Web hosting group
Check the box for ‘ModSecurity‘
Once installed, go to
Tools & Settings > Web Application Firewall (ModSecurity)
You can choose between On, Off and Detection Only
On: The rules are enforced and connections will be terminated when matching rules are found.
Detect Only: The rules are enforced and connections will be logged when matching rules are found. Not traffic will be dropped.
Off: Rules are not enforced.
Mod Security in Apache
Install mod security (assuming centos and EPEL repo)
yum install mod_security mod_security_crs
edit the /etc/httpd/conf.d/mod_security.conf and change the SecRuleEngine option. You can choose between On, Off and Detection Only.
On: The rules are enforced and connections will be terminated when matching rules are found.
Detect Only: The rules are enforced and connections will be logged when matching rules are found. Not traffic will be dropped.
Off: Rules are not enforced.
Restart apache
service httpd restart
Mod Security Rulesets
Atomic Basic ModSecurity
OWASP ModSecurity Core Rule Set (CRS)
Advanced ModSecurity Rules by Atomicorp
Comodo ModSecurity Rule Set (Linux)
Centos Mod Security file locations
Mod Security Config File – /etc/httpd/conf.d/mod_security.conf
Debug Log – /var/log/httpd/modsec_debug.log
Audit log – /var/log/httpd/modsec_audit.log
Rules – /etc/httpd/modsecurity.d/activated_rules
CloudFlare WAF
Cloudflare is a SAAS provider who offer a free tier, which includes a WAF as standard. Cloudflare is configured by setting the DNS for your site (you use cloudflare as name-servers and all traffic is then proxied through cloudflare servers, where it is checked and blocked if needed)
Sources:
https://www.modsecurity.org/
https://docs.plesk.com/en-US/onyx/administrator-guide/server-administration/web-application-firewall-modsecurity.73383/
https://tecadmin.net/install-modsecurity-with-apache-on-centos-rhel/