Configuring ModSecurity

ModSecurity is an open-source Web Application Firewall (WAF) designed to protect web applications from malicious attacks. It is maintained by the open-source community and supports multiple programming languages and web servers. The platform’s Application Load Balancer (ALB) supports configuring ModSecurity, allowing configuration at the Ingress level individually.

Terminology

Operational Steps

Configure ModSecurity by adding annotations to the YAML files of the corresponding resources or by configuring CR.

Method 1: Add Annotations

Add the following annotation to the metadata.annotations field in the corresponding YAML file to configure ModSecurity.

• Ingress-Nginx Compatible Annotations

  Annotation	Type	Applicable Object	Description
  nginx.ingress.kubernetes.io/enable-modsecurity	bool	Ingress	Enable ModSecurity.
  nginx.ingress.kubernetes.io/enable-owasp-core-rules	bool	Ingress	Enable OWASP Core Rule Set.
  nginx.ingress.kubernetes.io/modsecurity-snippet	string	Ingress	Used to identify a unique transaction ID for each request, facilitating logging and debugging.
  nginx.ingress.kubernetes.io/modsecurity-snippet	string	Ingress, ALB, FT, Rule	Allows users to insert custom ModSecurity configurations to meet specific security needs.

• ALB Specific Annotations

  Annotation	Type	Applicable Object	Description
  alb.modsecurity.cpaas.io/use-recommend	bool	Ingress	Enable or disable recommended ModSecurity rules. When set to true, a set of predefined security rules will be applied.
  alb.modsecurity.cpaas.io/cmref	string	Ingress	Reference specific configurations, such as loading custom security configurations by specifying the reference path of a ConfigMap ($ns/$name#$section).

Method 2: Configure CR

1. Open the configuration file for the ALB, FT, or Rule that needs configuration.

2. Add the following fields under spec.config as needed.

   { 
    "modsecurity": {
      "enable": true,   # Enable or disable ModSecurity
      "transactionId": "$xx", # Use ID from Nginx
      "useCoreRules": true,   # Add modsecurity_rules_file /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
      "useRecommend": true,    # Add modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf
      "cmRef": "$ns/$name#$section"  # Add configuration from ConfigMap
    }
   }

3. Save and apply the configuration file.

Additional Information

Override

If ModSecurity is not configured in the Rule, it will attempt to find the configuration in the FT; if not found in the FT, it will use the configuration from the ALB.

Configuration Example

In the example below, an ALB named waf-alb is deployed, along with a demo backend application named hello. Additionally, an Ingress named ing-waf-enable is deployed, which defines the /waf-enable route and has ModSecurity rules configured. Any request containing the query parameter test, with a value that includes the string test, will be blocked.

apiVersion: crd.alauda.io/v2
kind: ALB2
metadata:
  name: waf-alb
  namespace: cpaas-system
spec:
  config:
    loadbalancerName: waf-alb
    projects:
    - ALL_ALL
    replicas: 1
  type: nginx
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/enable-modsecurity: "true"
    nginx.ingress.kubernetes.io/modsecurity-transaction-id: "$request_id"
    nginx.ingress.kubernetes.io/modsecurity-snippet: |
        SecRuleEngine On
        SecRule ARGS:test "@contains test" "id:1234,deny,log"        
  name: ing-waf-enable
spec:
  ingressClassName: waf-alb
  rules:
  - http:
      paths:
      - backend:
          service:
            name: hello
            port:
              number: 80
        path: /waf-enable
        pathType: ImplementationSpecific
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ing-waf-normal
spec:
  ingressClassName: waf-alb
  rules:
  - http:
      paths:
      - backend:
          service:
            name: hello
            port:
              number: 80
        path: /waf-not-enable
        pathType: ImplementationSpecific
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 1
  selector:
    matchLabels:
      service.cpaas.io/name: hello
      service_name: hello
  template:
    metadata:
      labels:
        service.cpaas.io/name: hello
        service_name: hello
    spec:
      containers:
      - name: hello-world
        image: docker.io/hashicorp/http-echo
        imagePullPolicy: IfNotPresent
---
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 5678
  selector:
    service_name: hello
  sessionAffinity: None
  type: ClusterIP