26a7da0495
Measured follow-up to the AppSec section. Virtual patching blocks 7 of 41 probes with near-zero false positives; the OWASP CRS raises that to 27 of 41 but, at default paranoia, blocks six legitimate workflows (git push, Forgejo issues and file contents, Outline documents, ntfy publish, n8n webhooks). crowdsec/appsec-rules/crs-route-exclusions.yaml disables the SecLang/Coraza engine (ctl:ruleEngine=Off) for exactly those application routes, matched by host + URI, so virtual patching still runs there. crowdsec/appsec-configs/ appsec-tuned.yaml wires it in before the CRS rule. Measured with tuning: zero false positives, still 27 of 41 blocked on non-excluded routes, about +2 ms per request, ~15-40 MB more RAM. Trap: RemoveInBandRuleByName in a pre_eval hook does not disable CRS (it is SecLang, not a native rule); ctl:ruleEngine in phase 1 is the working lever, and the exclusion rule must be listed before the CRS rule. The stack runs vpatch+generic by default (zero false positives, no per-app tuning). The CRS recipe ships as a documented opt-in in crowdsec/README.md.
15 lines
595 B
YAML
15 lines
595 B
YAML
name: selfhostedops/appsec-tuned
|
|
default_remediation: ban
|
|
# ep13: vpatch + generic (nativ) plus OWASP CRS (SecLang). Eine lokale
|
|
# SecLang-Regel schaltet die CRS-Engine je legitimer Route ab (ctl:ruleEngine),
|
|
# die native vpatch-Abdeckung bleibt dort erhalten. Die Exclusion-Regel muss
|
|
# VOR crowdsecurity/crs stehen, damit ctl in Phase 1 greift.
|
|
inband_rules:
|
|
- crowdsecurity/base-config
|
|
- selfhostedops/crs-route-exclusions
|
|
- crowdsecurity/crs
|
|
- crowdsecurity/vpatch-*
|
|
- crowdsecurity/generic-*
|
|
outofband_rules:
|
|
- crowdsecurity/experimental-*
|
|
- crowdsecurity/appsec-generic-test
|