Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:server_preparation_tmp [2020/03/24 08:15] urbanl |
tutorial:adm:server_preparation_tmp [2020/06/18 13:18] urbanl [Disabling mod_security rules] |
||
---|---|---|---|
Line 1: | Line 1: | ||
<note important> | <note important> | ||
- | This tutorial is in development | + | **This tutorial is under development, DO NOT USE.** |
Author: Ludek Urban | Author: Ludek Urban | ||
Line 30: | Line 30: | ||
yum install -y epel-release | yum install -y epel-release | ||
yum update -y | yum update -y | ||
- | # check installed packages. It's recommanded to have them installed. | ||
- | yum list installed | ||
# other recommended packages installation | # other recommended packages installation | ||
- | yum install -y mc haveged nmap screen sysstat telnet | + | yum install -y mc haveged nmap screen sysstat telnet |
# enable haveged after OS start | # enable haveged after OS start | ||
systemctl start haveged.service | systemctl start haveged.service | ||
Line 104: | Line 102: | ||
Change SELINUX labels: | Change SELINUX labels: | ||
< | < | ||
- | chcon -Rt postgresql_db_t pgsql/ | + | chcon -Rt postgresql_db_t |
chcon -Rt postgresql_log_t / | chcon -Rt postgresql_log_t / | ||
</ | </ | ||
Line 210: | Line 208: | ||
useradd -r -s / | useradd -r -s / | ||
getent passwd tomcat | getent passwd tomcat | ||
- | tomcat: | + | #tomcat: |
</ | </ | ||
Line 388: | Line 386: | ||
* Make Tomcat listen only on localhost: | * Make Tomcat listen only on localhost: | ||
* In the ''/ | * In the ''/ | ||
- | | + | |
+ | * Set the '' | ||
+ | * In the ''/ | ||
+ | |||
+ | | ||
< | < | ||
Line 567: | Line 569: | ||
* Audit log: ''/ | * Audit log: ''/ | ||
* Directory with activated rules: ''/ | * Directory with activated rules: ''/ | ||
- | * basic configuration file for mod\_security: | + | * basic configuration file for mod\_security: |
* The file for chosen rules deactivation: | * The file for chosen rules deactivation: | ||
Line 581: | Line 583: | ||
==== Disabling mod_security rules ==== | ==== Disabling mod_security rules ==== | ||
+ | |||
+ | These rules are disabled for modsec_crs 3.0. | ||
In the file ''/ | In the file ''/ | ||
+ | |||
<code xml> | <code xml> | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | | ||
+ | | ||
# Allow Czech signs | # Allow Czech signs | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
| | ||
# Too restrictive for login format | # Too restrictive for login format | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | |||
# Needed by Websockets | # Needed by Websockets | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
</ | </ | ||
| | ||
- | # These break Certificate Authority module | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
- | # Modsec can throw false positives on some files due to multipart boundary check | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
# do not log request/ | # do not log request/ | ||
SecAuditLogParts ABFHZ | SecAuditLogParts ABFHZ |