蜷缩的蜗牛

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 进入规则目录
cd /usr/share/modsecurity-crs

# 拉取最新规则集更新
git pull origin main

# 查看变更日志
cat CHANGELOG.md

# 重启Web服务器应用新规则
sudo systemctl restart apache2

1
2
3
4
5
6
7
8

# 查看Git提交历史记录
git log

# 回滚到指定版本
git reset --hard <commit-hash>

# 重启Web服务器应用旧规则
sudo systemctl restart apache2

1
2
3
4
5
6
7
8

// 完全移除特定规则
SecRuleRemoveById 942100

// 对特定参数排除SQL注入检测
SecRuleUpdateTargetById 942100 !ARGS:search

// 对特定路径禁用JSON解析
SecRule REQUEST_URI "^/api/v1/safe-endpoint" "id:100,phase:1,t:none,pass,nolog,setenv:NO_JSON_PROCESSING=1"

1
2
3
4
5
6
7
8

// 统计各阶段规则数量
grep -r "phase:" /etc/modsecurity/rules/ | awk '{print $2}' | sort | uniq -c

// 分析规则匹配耗时
awk '/^--/ {if ($5 > 100) print}' /var/log/modsec_debug.log

// 查看高频触发规则
awk '{if ($1 == "Matched") print $3}' /var/log/modsec_audit.log | sort | uniq -c | sort -nr | head -n 20

1
2
3
4
5
6
7
8
9

feat(rules): add API rate limiting rule

Add new rule to prevent API abuse by limiting request rate to 100 requests per minute.
Related to #1234 security enhancement task.

perf(rules): optimize SQL injection detection regex

Improve performance of SQL injection rules by adding prefix matching and reducing backtracking.
Reduce CPU usage by 40% in benchmark tests.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

=== ModSecurity Rule Test ===
Testing SQL Injection Rules...
Test Cases: 20
Success Rate: 100%
False Positives: 0
False Negatives: 0

Testing XSS Rules...
Test Cases: 25
Success Rate: 98%
False Positives: 1 (update rule 3004)
False Negatives: 0

Testing File Inclusion Rules...
Test Cases: 15
Success Rate: 93%
False Positives: 0
False Negatives: 1 (add pattern to rule 4002)