Puppet Class: apache::mod::security

Inherits:

apache::params

Defined in:

manifests/mod/security.pp

Summary

Installs and configures `mod_security`.

Overview

Parameters:

• version (Integer) (defaults to: $apache::params::modsec_version) —

  Manage mod_security or mod_security2

• logroot (Stdlib::Absolutepath) (defaults to: $apache::params::logroot) —

  Configures the location of audit and debug logs.

• crs_package (Optional[String]) (defaults to: $apache::params::modsec_crs_package) —

  Name of package that installs CRS rules.

• activated_rules (Array[String]) (defaults to: $apache::params::modsec_default_rules) —

  An array of rules from the modsec_crs_path or absolute to activate via symlinks.

• custom_rules (Boolean) (defaults to: $apache::params::modsec_custom_rules)
• custom_rules_set (Optional[Array[String]]) (defaults to: $apache::params::modsec_custom_rules_set)
• modsec_dir (Stdlib::Absolutepath) (defaults to: $apache::params::modsec_dir) —

  Defines the path where Puppet installs the modsec configuration and activated rules links.

• modsec_secruleengine (String) (defaults to: $apache::params::modsec_secruleengine) —

  Configures the rules engine.

• audit_log_relevant_status (String) (defaults to: '^(?:5|4(?!04))') —

  Configures which response status code is to be considered relevant for the purpose of audit logging.

• audit_log_parts (String) (defaults to: $apache::params::modsec_audit_log_parts) —

  Defines which parts of each transaction are going to be recorded in the audit log. Each part is assigned a single letter; when a letter appears in the list then the equivalent part will be recorded.

• audit_log_type (String) (defaults to: $apache::params::modsec_audit_log_type) —

  Defines the type of audit logging mechanism to be used.

• audit_log_storage_dir (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Defines the directory where concurrent audit log entries are to be stored. This directive is only needed when concurrent audit logging is used.

• secpcrematchlimit (Integer) (defaults to: $apache::params::secpcrematchlimit) —

  Sets the match limit in the PCRE library.

• secpcrematchlimitrecursion (Integer) (defaults to: $apache::params::secpcrematchlimitrecursion) —

  Sets the match limit recursion in the PCRE library.

• allowed_methods (String) (defaults to: 'GET HEAD POST OPTIONS') —

  A space-separated list of allowed HTTP methods.

• content_types (String) (defaults to: 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf') —

  A list of one or more allowed MIME types.

• restricted_extensions (String) (defaults to: '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/') —

  A space-sparated list of prohibited file extensions.

• restricted_headers (String) (defaults to: '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/') —

  A list of restricted headers separated by slashes and spaces.

• secdefaultaction (String) (defaults to: 'deny') —

  Defines the default list of actions, which will be inherited by the rules in the same configuration context.

• inbound_anomaly_threshold (Integer) (defaults to: 5) —

  Sets the scoring threshold level of the inbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set.

• outbound_anomaly_threshold (Integer) (defaults to: 4) —

  Sets the scoring threshold level of the outbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set.

• critical_anomaly_score (Integer) (defaults to: 5) —

  Sets the Anomaly Score for rules assigned with a critical severity.

• error_anomaly_score (Integer) (defaults to: 4) —

  Sets the Anomaly Score for rules assigned with a error severity.

• warning_anomaly_score (Integer) (defaults to: 3) —

  Sets the Anomaly Score for rules assigned with a warning severity.

• notice_anomaly_score (Integer) (defaults to: 2) —

  Sets the Anomaly Score for rules assigned with a notice severity.

• paranoia_level (Integer[1,4]) (defaults to: 1) —

  Sets the paranoia level in the OWASP ModSecurity Core Rule Set.

• executing_paranoia_level (Integer[1,4]) (defaults to: $paranoia_level) —

  Sets the executing paranoia level in the OWASP ModSecurity Core Rule Set. The default is equal to, and cannot be lower than, $paranoia_level.

• secrequestmaxnumargs (Integer) (defaults to: 255) —

  Sets the maximum number of arguments in the request.

• secrequestbodylimit (Integer) (defaults to: 13107200) —

  Sets the maximum request body size ModSecurity will accept for buffering.

• secrequestbodynofileslimit (Integer) (defaults to: 131072) —

  Configures the maximum request body size ModSecurity will accept for buffering, excluding the size of any files being transported in the request.

• secrequestbodyinmemorylimit (Integer) (defaults to: 131072) —

  Configures the maximum request body size that ModSecurity will store in memory.

• secrequestbodyaccess (Apache::OnOff) (defaults to: 'On') —

  Toggle SecRequestBodyAccess On or Off

• secrequestbodylimitaction (Enum['Reject', 'ProcessPartial']) (defaults to: 'Reject') —

  Controls what happens once a request body limit, configured with SecRequestBodyLimit, is encountered

• secresponsebodyaccess (Apache::OnOff) (defaults to: 'Off') —

  Toggle SecResponseBodyAccess On or Off

• secresponsebodylimitaction (Enum['Reject', 'ProcessPartial']) (defaults to: 'ProcessPartial') —

  Controls what happens once a response body limit, configured with SecResponseBodyLimitAction, is encountered.

• manage_security_crs (Boolean) (defaults to: true) —

  Toggles whether to manage ModSecurity Core Rule Set

• enable_dos_protection (Boolean) (defaults to: true) —

  Toggles the optional OWASP ModSecurity Core Rule Set DOS protection rule (rule id 900700)

• dos_burst_time_slice (Integer[1, default]) (defaults to: 60) —

  Configures time in which a burst is measured for the OWASP ModSecurity Core Rule Set DOS protection rule (rule id 900700)

• dos_counter_threshold (Integer[1, default]) (defaults to: 100) —

  Configures the amount of requests that can be made within dos_burst_time_slice before it is considered a burst in the OWASP ModSecurity Core Rule Set DOS protection rule (rule id 900700)

• dos_block_timeout (Integer[1, default]) (defaults to: 600) —

  Configures how long the client should be blocked when the dos_counter_threshold is exceeded in the OWASP ModSecurity Core Rule Set DOS protection rule (rule id 900700)

See Also:

• for additional documentation.
• for addional documentation

# File 'manifests/mod/security.pp', line 134

class apache::mod::security (
  Stdlib::Absolutepath $logroot                                = $apache::params::logroot,
  Integer $version                                             = $apache::params::modsec_version,
  Optional[String] $crs_package                                = $apache::params::modsec_crs_package,
  Array[String] $activated_rules                               = $apache::params::modsec_default_rules,
  Boolean $custom_rules                                        = $apache::params::modsec_custom_rules,
  Optional[Array[String]] $custom_rules_set                    = $apache::params::modsec_custom_rules_set,
  Stdlib::Absolutepath $modsec_dir                             = $apache::params::modsec_dir,
  String $modsec_secruleengine                                 = $apache::params::modsec_secruleengine,
  String $audit_log_relevant_status                            = '^(?:5|4(?!04))',
  String $audit_log_parts                                      = $apache::params::modsec_audit_log_parts,
  String $audit_log_type                                       = $apache::params::modsec_audit_log_type,
  Optional[Stdlib::Absolutepath] $audit_log_storage_dir        = undef,
  Integer $secpcrematchlimit                                   = $apache::params::secpcrematchlimit,
  Integer $secpcrematchlimitrecursion                          = $apache::params::secpcrematchlimitrecursion,
  String $allowed_methods                                      = 'GET HEAD POST OPTIONS',
  String $content_types                                        = 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf',
  String $restricted_extensions                                = '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/',
  String $restricted_headers                                   = '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/',
  String $secdefaultaction                                     = 'deny',
  Integer $inbound_anomaly_threshold                           = 5,
  Integer $outbound_anomaly_threshold                          = 4,
  Integer $critical_anomaly_score                              = 5,
  Integer $error_anomaly_score                                 = 4,
  Integer $warning_anomaly_score                               = 3,
  Integer $notice_anomaly_score                                = 2,
  Integer $secrequestmaxnumargs                                = 255,
  Integer $secrequestbodylimit                                 = 13107200,
  Integer $secrequestbodynofileslimit                          = 131072,
  Integer $secrequestbodyinmemorylimit                         = 131072,
  Integer[1,4] $paranoia_level                                 = 1,
  Integer[1,4] $executing_paranoia_level                       = $paranoia_level,
  Apache::OnOff $secrequestbodyaccess                          = 'On',
  Apache::OnOff $secresponsebodyaccess                         = 'Off',
  Enum['Reject', 'ProcessPartial'] $secrequestbodylimitaction  = 'Reject',
  Enum['Reject', 'ProcessPartial'] $secresponsebodylimitaction = 'ProcessPartial',
  Boolean $manage_security_crs                                 = true,
  Boolean $enable_dos_protection                               = true,
  Integer[1, default] $dos_burst_time_slice                    = 60,
  Integer[1, default] $dos_counter_threshold                   = 100,
  Integer[1, default] $dos_block_timeout                       = 600,
) inherits apache::params {
  include apache

  $_secdefaultaction = $secdefaultaction ? {
    /log/   => $secdefaultaction, # it has log or nolog,auditlog or log,noauditlog
    default => "${secdefaultaction},log",
  }

  if $facts['os']['family'] == 'FreeBSD' {
    fail('FreeBSD is not currently supported')
  }

  if ($facts['os']['family'] == 'Suse' and versioncmp($facts['os']['release']['major'], '11') < 0) {
    fail('SLES 10 is not currently supported.')
  }

  if ($executing_paranoia_level < $paranoia_level) {
    fail('Executing paranoia level cannot be lower than paranoia level')
  }

  case $version {
    1: {
      $mod_name = 'security'
      $mod_conf_name = 'security.conf'
    }
    2: {
      $mod_name = 'security2'
      $mod_conf_name = 'security2.conf'
    }
    default: {
      fail('Unsuported version for mod security')
    }
  }
  ::apache::mod { $mod_name:
    id  => 'security2_module',
    lib => 'mod_security2.so',
  }

  ::apache::mod { 'unique_id':
    id  => 'unique_id_module',
    lib => 'mod_unique_id.so',
  }

  if $crs_package {
    package { $crs_package:
      ensure => 'installed',
      before => [
        File[$apache::confd_dir],
        File[$modsec_dir],
      ],
    }
  }

  # Template uses:
  # - logroot
  # - $modsec_dir
  # - $audit_log_parts
  # - $audit_log_type
  # - $audit_log_storage_dir
  # - secpcrematchlimit
  # - secpcrematchlimitrecursion
  # - secrequestbodylimit
  # - secrequestbodynofileslimit
  # - secrequestbodyinmemorylimit
  # - secrequestbodyaccess
  # - secresponsebodyaccess
  # - secrequestbodylimitaction
  # - secresponsebodylimitaction
  $security_conf_parameters = {
    'modsec_secruleengine'        => $modsec_secruleengine,
    'secrequestbodyaccess'        => $secrequestbodyaccess,
    'custom_rules'                => $custom_rules,
    'modsec_dir'                  => $modsec_dir,
    'secrequestbodylimit'         => $secrequestbodylimit,
    'secrequestbodynofileslimit'  => $secrequestbodynofileslimit,
    'secrequestbodyinmemorylimit' => $secrequestbodyinmemorylimit,
    'secrequestbodylimitaction'   => $secrequestbodylimitaction,
    'secpcrematchlimit'           => $secpcrematchlimit,
    'secpcrematchlimitrecursion'  => $secpcrematchlimitrecursion,
    'secresponsebodyaccess'       => $secresponsebodyaccess,
    'secresponsebodylimitaction'  => $secresponsebodylimitaction,
    'audit_log_relevant_status'   => $audit_log_relevant_status,
    'audit_log_parts'             => $audit_log_parts,
    'audit_log_type'              => $audit_log_type,
    'audit_log_storage_dir'       => $audit_log_storage_dir,
    'logroot'                     => $logroot,
  }

  file { 'security.conf':
    ensure  => file,
    content => epp('apache/mod/security.conf.epp', $security_conf_parameters),
    mode    => $apache::file_mode,
    path    => "${apache::mod_dir}/${mod_conf_name}",
    owner   => $apache::params::user,
    group   => $apache::params::group,
    require => Exec["mkdir ${apache::mod_dir}"],
    before  => File[$apache::mod_dir],
    notify  => Class['apache::service'],
  }

  file { $modsec_dir:
    ensure  => directory,
    owner   => 'root',
    group   => 'root',
    mode    => '0755',
    purge   => true,
    force   => true,
    recurse => true,
    require => Package['httpd'],
  }

  file { "${modsec_dir}/activated_rules":
    ensure  => directory,
    owner   => $apache::params::user,
    group   => $apache::params::group,
    mode    => '0555',
    purge   => true,
    force   => true,
    recurse => true,
    notify  => Class['apache::service'],
  }

  if $custom_rules {
    # Template to add custom rule and included in security configuration
    file { "${modsec_dir}/custom_rules":
      ensure  => directory,
      owner   => $apache::params::user,
      group   => $apache::params::group,
      mode    => $apache::file_mode,
      require => File[$modsec_dir],
    }

    file { "${modsec_dir}/custom_rules/custom_01_rules.conf":
      ensure  => file,
      owner   => $apache::params::user,
      group   => $apache::params::group,
      mode    => $apache::file_mode,
      content => epp('apache/mod/security_custom.conf.epp', { 'custom_rules_set'  => $custom_rules_set, }),
      require => File["${modsec_dir}/custom_rules"],
      notify  => Class['apache::service'],
    }
  }

  if $manage_security_crs {
    # Template uses:
    # - $_secdefaultaction
    # - $critical_anomaly_score
    # - $error_anomaly_score
    # - $warning_anomaly_score
    # - $notice_anomaly_score
    # - $inbound_anomaly_threshold
    # - $outbound_anomaly_threshold
    # - $paranoia_level
    # - $executing_paranoia_level
    # - $allowed_methods
    # - $content_types
    # - $restricted_extensions
    # - $restricted_headers
    # - $secrequestmaxnumargs
    # - $enable_dos_protection
    # - $dos_burst_time_slice
    # - $dos_counter_threshold
    # - $dos_block_timeout
    $security_crs_parameters = {
      '_secdefaultaction'           => $_secdefaultaction,
      'critical_anomaly_score'      => $critical_anomaly_score,
      'error_anomaly_score'         => $error_anomaly_score,
      'warning_anomaly_score'       => $warning_anomaly_score,
      'notice_anomaly_score'        => $notice_anomaly_score,
      'inbound_anomaly_threshold'   => $inbound_anomaly_threshold,
      'outbound_anomaly_threshold'  => $outbound_anomaly_threshold,
      'secrequestmaxnumargs'        => $secrequestmaxnumargs,
      'allowed_methods'             => $allowed_methods,
      'content_types'               => $content_types,
      'restricted_extensions'       => $restricted_extensions,
      'restricted_headers'          => $restricted_headers,
      'paranoia_level'              => $paranoia_level,
      'executing_paranoia_level'    => $executing_paranoia_level,
      'enable_dos_protection'       => $enable_dos_protection,
      'dos_burst_time_slice'        => $dos_burst_time_slice,
      'dos_counter_threshold'       => $dos_counter_threshold,
      'dos_block_timeout'           => $dos_block_timeout,
    }

    file { "${modsec_dir}/security_crs.conf":
      ensure  => file,
      content => template('apache/mod/security_crs.conf.erb'),
      require => File[$modsec_dir],
      notify  => Class['apache::service'],
    }

    unless $facts['os']['name'] == 'SLES' or $facts['os']['name'] == 'Debian' or $facts['os']['name'] == 'Ubuntu' {
      apache::security::rule_link { $activated_rules: }
    }
  }
}