Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:server_preparation_tmp [2020/03/27 14:31] urbanl [Tomcat] |
tutorial:adm:server_preparation_tmp [2020/07/24 07:56] fiserp [Server preparation - Linux - CentOS8] |
||
---|---|---|---|
Line 1: | Line 1: | ||
<note important> | <note important> | ||
- | This tutorial is in development | + | **This tutorial is under development, DO NOT USE.** |
Author: Ludek Urban | Author: Ludek Urban | ||
Line 11: | Line 11: | ||
{{tag> | {{tag> | ||
- | This tutorial shows how to prepare the server for test or production | + | This tutorial shows how to prepare the server for test or production |
===== Basic system setup ===== | ===== Basic system setup ===== | ||
Line 386: | Line 386: | ||
* Make Tomcat listen only on localhost: | * Make Tomcat listen only on localhost: | ||
* In the ''/ | * In the ''/ | ||
- | | + | |
+ | * Set the '' | ||
+ | * In the ''/ | ||
+ | |||
+ | | ||
< | < | ||
Line 565: | Line 569: | ||
* Audit log: ''/ | * Audit log: ''/ | ||
* Directory with activated rules: ''/ | * Directory with activated rules: ''/ | ||
- | * basic configuration file for mod\_security: | + | * basic configuration file for mod\_security: |
* The file for chosen rules deactivation: | * The file for chosen rules deactivation: | ||
Line 579: | Line 583: | ||
==== Disabling mod_security rules ==== | ==== Disabling mod_security rules ==== | ||
+ | |||
+ | These rules are disabled for modsec_crs 3.0. | ||
In the file ''/ | In the file ''/ | ||
+ | |||
<code xml> | <code xml> | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | | ||
+ | | ||
# Allow Czech signs | # Allow Czech signs | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
| | ||
# Too restrictive for login format | # Too restrictive for login format | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | |||
# Needed by Websockets | # Needed by Websockets | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
</ | </ | ||
| | ||
- | # These break Certificate Authority module | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
- | # Modsec can throw false positives on some files due to multipart boundary check | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
# do not log request/ | # do not log request/ | ||
SecAuditLogParts ABFHZ | SecAuditLogParts ABFHZ | ||
Line 620: | Line 616: | ||
==== mod_security configuration - CentOS8 | ==== mod_security configuration - CentOS8 | ||
- | In the file / | + | In the file / |
- | Whole rules after the changes looks like this: | + | |
+ | * find the rule 900200 and add methods | ||
< | < | ||
Line 631: | Line 628: | ||
nolog,\ | nolog,\ | ||
setvar:' | setvar:' | ||
+ | </ | ||
+ | * find the rule 900220 and add support for content\_type=application/ | ||
+ | |||
+ | < | ||
# Default HTTP policy: allowed_request_content_type (rule 900220) | # Default HTTP policy: allowed_request_content_type (rule 900220) | ||
SecRule & | SecRule & |