Skip to content

how to achieve DOS protection? nginx+modlib3.0 #1835

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tdoubley opened this issue Jul 11, 2018 · 2 comments
Closed

how to achieve DOS protection? nginx+modlib3.0 #1835

tdoubley opened this issue Jul 11, 2018 · 2 comments
Assignees
Labels
3.x Related to ModSecurity version 3.x duplicate Ops. Somebody else already hit that bump libmodsec - missing features RIP - libmodsecurity

Comments

@tdoubley
Copy link

Hi!
I want test DOS protection, but I find the aciton expirevar not implement,that‘s mean ModLib not support this function now?

ACTION_EXPIRE_VAR
{
//ACTION_NOT_SUPPORTED("ExpireVar", @0);
ACTION_CONTAINER($$, new actions::Action($1));
}

SecRule IP:DOS_BLOCK "@eq 1"
"chain,
phase:1,
id:912120,
drop,
tag:'application-multi',
tag:'language-multi',
tag:'platform-multi',
tag:'attack-dos',
msg:'Denial of Service (DoS) attack identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)'"
SecRule &IP:DOS_BLOCK_FLAG "@eq 0"
"setvar:ip.dos_block_counter=+1,
setvar:ip.dos_block_flag=1,
expirevar:ip.dos_block_flag=60,
setvar:tx.dos_block_counter=%{ip.dos_block_counter},
setvar:ip.dos_block_counter=0"

@victorhora victorhora self-assigned this Jul 16, 2018
@victorhora victorhora added duplicate Ops. Somebody else already hit that bump RIP - libmodsecurity libmodsec - missing features 3.x Related to ModSecurity version 3.x labels Jul 16, 2018
@victorhora
Copy link
Contributor

Duplicate with #1803 and #1830 and also related with #1754.

Please follow up on #1803. Thanks.

@tdoubley
Copy link
Author

Thank you for your answer @victorhora ,I will follow up on #1803.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.x Related to ModSecurity version 3.x duplicate Ops. Somebody else already hit that bump libmodsec - missing features RIP - libmodsecurity
Projects
None yet
Development

No branches or pull requests

2 participants