"SecCollectionTimeout is not yet supported" 在 WAF owasp modsecurity crs 中与 NGINX

Question

我用 WAF 安装 nginx（使用 Docker）

    mkdir -p /usr/src \
    && cd /usr/src/ \
    && git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity \
    && cd ModSecurity \
    && git submodule init \
    && git submodule update \
    && ./build.sh \
    && ./configure \
    && make -j$(getconf _NPROCESSORS_ONLN) \
    && make install

    ... previous commands to install nginx from source...

    && cd /usr/src \
    && git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git \
    && cd /usr/src/nginx-$NGINX_VERSION \
    && ./configure --with-compat --add-dynamic-module=../ModSecurity-nginx \
    && make modules \
    && cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules \
    && mkdir /etc/nginx/modsec \
    && wget -P /etc/nginx/modsec/ https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended \
    && mv /etc/nginx/modsec/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf \
    && sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsec/modsecurity.conf \
    && sed -i 's/SecRequestBodyInMemoryLimit 131072//' /etc/nginx/modsec/modsecurity.conf \
    && sed -i 's#SecAuditLog /var/log/modsec_audit.log#SecAuditLog /var/log/nginx/modsec_audit.log#' /etc/nginx/modsec/modsecurity.conf \
    && mkdir /opt \
    && cd /opt \
    && git clone -b v3.0/master --single-branch https://github.com/SpiderLabs/owasp-modsecurity-crs.git \
    && cd owasp-modsecurity-crs/ \
    && cp /opt/owasp-modsecurity-crs/crs-setup.conf.example /opt/owasp-modsecurity-crs/crs-setup.conf

但是突然开始标记这个错误：

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /opt/owasp-modsecurity-crs/crs-setup.conf. Line: 96. Column: 43. SecCollectionTimeout is not yet supported.

在documentation中：

==============

#
# -- [[ Collection timeout ]] --------------------------------------------------
#
# Set the SecCollectionTimeout directive from the ModSecurity default (1 hour)
# to a lower setting which is appropriate to most sites.
# This increases performance by cleaning out stale collection (block) entries.
#
# This value should be greater than or equal to:
# tx.reput_block_duration (see section "Blocking Based on IP Reputation") and
# tx.dos_block_timeout (see section "Anti-Automation / DoS Protection").
#
# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecCollectionTimeout

# Please keep this directive uncommented.
# Default: 600 (10 minutes)
SecCollectionTimeout 600

==============

我通过将此行添加到命令（禁用规则）来解决它：

&& sed -i 's/SecCollectionTimeout 600/# SecCollectionTimeout 600/' /opt/owasp-modsecurity-crs/crs-setup.conf

但我不知道它有什么后果，或者它是否是正确的应用方式。

一些可以指导我的例子？

Answer 1

我认为您需要重新配置 WAF OWASP 才能解决该问题。检查 link 是否...

我的朋友上次解决该问题以重新配置它...

https://support.cloudflare.com/hc/en-us/articles/115000223771-How-do-I-configure-the-WAF-

Answer 2

我自动回复：

来源： https://github.com/SpiderLabs/ModSecurity/issues/1705

it happens due the fact that the SecCollectionTimeout directive is not currently configurable on libModSecurity (aka v3) as stated on the reference manual.

Commenting out the SecCollectionTimeout directive on crs-setup.conf solves the problem without side effects.

A change to the parser to avoid the error is underway here. You can also choose to apply this change on the code for now as well. It's already being merged to main.

有趣的是，我 20 天前在 Whosebug 中做的问题......这个问题是 22 天前在 github 上提出的，寻找一些与 "SecCollectionTimeout" 相关的问题，那里没有任何关系...在那一刻

简而言之，您提供的代码是完全可用的，因此为他服务的代码，我唯一做的就是重新编译图像，以便它确实拉入 https://github.com/SpiderLabs/ModSecurity 的存储库准备就绪

"SecCollectionTimeout is not yet supported" 在 WAF owasp modsecurity crs 中与 NGINX

"SecCollectionTimeout is not yet supported" in WAF owasp modsecurity crs with NGINX

nginx

mod-security

owasp

server