22300d7a28
Follow-up measurements showed the first exclusion approach was too broad. ctl:ruleEngine=Off disables the whole Coraza engine for the route, which also turns off the native virtual-patching rules: a .env probe on such a route returned 404 (no WAF) instead of 403. The exclusion now uses ctl:ruleRemoveById=949110,959100 (the CRS inbound and outbound anomaly-score blockers) so the engine stays on and virtual patching keeps firing on the excluded routes. Measured: .env / PHPUnit / .git/config still 403 on those routes, generic SQLi/XSS pass, non-excluded hosts keep full CRS (27 of 41). Rule order relative to the CRS rule no longer matters. Also measured and documented: RemoveInBandRuleByName in a pre_eval hook does nothing to CRS (SQLi stayed 403 globally and per route); a full authenticated Vaultwarden flow (register, login, sync, cipher create) passes under full CRS on the vault host. README traps and numbers updated accordingly.
16 lines
657 B
YAML
16 lines
657 B
YAML
name: selfhostedops/appsec-tuned
|
|
default_remediation: ban
|
|
# ep13: vpatch + generic (nativ) plus OWASP CRS (SecLang). Die lokale Regel
|
|
# crs-route-exclusions entfernt je legitimer Route nur die CRS-Anomalie-
|
|
# Blockregeln (ctl:ruleRemoveById), die native vpatch-Abdeckung bleibt dort
|
|
# erhalten. Reihenfolge zu crowdsecurity/crs ist egal (Phase 1 vor Phase 2),
|
|
# der Uebersicht halber steht die Ausnahme oben.
|
|
inband_rules:
|
|
- crowdsecurity/base-config
|
|
- selfhostedops/crs-route-exclusions
|
|
- crowdsecurity/crs
|
|
- crowdsecurity/vpatch-*
|
|
- crowdsecurity/generic-*
|
|
outofband_rules:
|
|
- crowdsecurity/experimental-*
|
|
- crowdsecurity/appsec-generic-test
|