Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- coraza [2026/02/24 11:25]
jango
+++ coraza [2026/04/05 04:22] (aktuell)
jango
@@ Zeile 1: / Zeile 1: @@
-Coraza (WAF)
+Coraza WAF (Web Application [[Firewall]])
+<code>
+journalctl -u coraza -n 30 --no-pager
+</code>
+=====Installation=====
+Ubuntu 24.04
 <code>
 sudo apt update
@@ Zeile 16: / Zeile 22: @@
 cd coraza-spoa
-go run mage.go build
+sudo go run mage.go build
 # binary is in build now
@@ Zeile 31: / Zeile 37: @@
 sudo vi /etc/coraza-spoa/coraza-spoa.yaml
-# testweise starten
-sudo -u coraza-spoa /usr/local/bin/coraza-spoa -config /etc/coraza-spoa/coraza-spoa.yaml
-</code>
-<code>
-[root@vpsv-haproxy1 ~]# cat /etc/haproxy/coraza-spoe.cfg
-[coraza]
-spoe-agent coraza-agent
-    messages coraza-req
-    option var-prefix coraza
-    timeout hello 2s
-    timeout idle 10s
-    timeout processing 5s
-    use-backend coraza-spoa-backend
-spoe-message coraza-req
-    args app=str(sample_app) id=unique-id src_ip=src src_port=src_port dst_ip=dst dst_port=dst_port method=method path=path query=query version=req.ver headers=req.hdrs
-    event on-frontend-http-request
-[root@vpsv-haproxy1 ~]#
 </code>
@@ Zeile 73: / Zeile 59: @@
       Include @coraza.conf-recommended
       Include @crs-setup.conf.example
+      SecRule REQUEST_FILENAME "@streq /Microsoft-Server-ActiveSync" "id:1001001,phase:1,pass,nolog,ctl:ruleRemoveById=920420"
       Include @owasp_crs/*.conf
@@ Zeile 118: / Zeile 107: @@
 root@ubuntuserver:~#
 </code>
+<code>
+# testweise starten
+sudo -u coraza-spoa /usr/local/bin/coraza-spoa -config /etc/coraza-spoa/coraza-spoa.yaml
+</code>
+=====HAProxy Integration=====
+Siehe auch [[HAProxy]]
+<code>
+[root@vpsv-haproxy1 ~]# cat /etc/haproxy/coraza-spoe.cfg
+[coraza]
+spoe-agent coraza-agent
+    messages coraza-req
+    option var-prefix coraza
+    timeout hello 2s
+    timeout idle 10s
+    timeout processing 5s
+    use-backend coraza-spoa-backend
+spoe-message coraza-req
+    args app=str(sample_app) id=unique-id src_ip=src src_port=src_port dst_ip=dst dst_port=dst_port method=method path=path query=query version=req.ver headers=req.hdrs
+    event on-frontend-http-request
+[root@vpsv-haproxy1 ~]#
+</code>
+HAProxy leitet eingehende HTTP-Requests an den Agenten weiter; das eigentliche Blocken passiert danach in HAProxy per http-request deny anhand der von Coraza gesetzten Variablen.
 <code>
@@ Zeile 133: / Zeile 148: @@
         filter spoe engine coraza config /etc/haproxy/coraza-spoe.cfg
         http-response set-header X-Coraza-Action %[var(txn.coraza.action)] if { var(txn.coraza.action) -m found }
+        http-response deny status 404 hdr X-Coraza-Action %[var(txn.coraza.action)] if { var(txn.coraza.action) -m found }
         default_backend outlook
 </code>
+=====Links=====
+  * [[https://coraza.io/docs/tutorials/introduction/|Dokumentation]]

MBCDN

Benutzer-Werkzeuge

Webseiten-Werkzeuge

Unterschiede

Seiten-Werkzeuge