Difference between revisions of "Modsecurity crs 10 config.conf"

From OWASP
Jump to: navigation, search
(Created page with '# The directives within this file can be included within # Virtual Host containers. # # Configuration contained in this file should be customized # for your specific requirements…')
 
Line 1: Line 1:
# The directives within this file can be included within
+
The data within this conf file may be specified within Apache virtual host containers. The following ModSecurity directives are set within this file -
# Virtual Host containers.
+
 
#
+
SecRuleEngine
# Configuration contained in this file should be customized
+
SecRequestBodyAccess
# for your specific requirements before deployment.
+
SecResponseBodyAccess
#
+
SecResponseBodyMimeType
# Next to each rule there is a description of what it does. Each
+
SecResponseBodyLimit
# location where customization is needed is marked with "TODO". It
+
  SecResponseBodyLimitAction
# is recommended that you:
+
SecDefaultAction
#
+
SecUploadDir
# 1) Keep a copy of the original file. This will allow you to use
+
SecUploadKeepFiles
#    the "diff" command to quickly see the changes. It will also
+
  SecAuditEngine
#    make upgrades to future rule sets easier.
+
SecAuditLogRelevantStatus
#
+
SecAuditLogType
# 2) Document your changes thoroughly.
+
SecAuditLog
#
+
SecAuditLogParts
# You are advised to start with ModSecurity in detection mode only.
+
SecCookieFormat
# Switch to protection when you are comfortable with your rule set.
+
SecRequestBodyInMemoryLimit
# For maximum protection monitor your logs on daily basis (or
+
SecDebugLog
# better).
+
SecDebugLogLevel
#
+
SecTmpDir
 +
 
 +
See the [[http://www.modsecurity.org/documentation/modsecurity-apache/2.5.9/modsecurity2-apache-reference.html | ModSecurity Reference Manual]] for directive documentation.

Revision as of 11:09, 6 August 2009

The data within this conf file may be specified within Apache virtual host containers. The following ModSecurity directives are set within this file -

SecRuleEngine
SecRequestBodyAccess
SecResponseBodyAccess
SecResponseBodyMimeType
SecResponseBodyLimit
SecResponseBodyLimitAction
SecDefaultAction
SecUploadDir
SecUploadKeepFiles
SecAuditEngine
SecAuditLogRelevantStatus
SecAuditLogType
SecAuditLog
SecAuditLogParts
SecCookieFormat
SecRequestBodyInMemoryLimit
SecDebugLog
SecDebugLogLevel
SecTmpDir

See the [| ModSecurity Reference Manual] for directive documentation.