Mercurial > repos > other > Puppet
annotate modules/apache/manifests/mod/security.pp @ 478:adf6fe9bbc17
Update Puppet modules to latest versions
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Thu, 29 Aug 2024 18:47:29 +0100 |
parents | b8d6ada284dd |
children |
rev | line source |
---|---|
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
1 # @summary |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
2 # Installs and configures `mod_security`. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
3 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
4 # @param version |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
5 # Manage mod_security or mod_security2 |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
6 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
7 # @param logroot |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
8 # Configures the location of audit and debug logs. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
9 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
10 # @param crs_package |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
11 # Name of package that installs CRS rules. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
12 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
13 # @param activated_rules |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
14 # An array of rules from the modsec_crs_path or absolute to activate via symlinks. |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
15 # |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
16 # @param custom_rules |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
17 # |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
18 # @param custom_rules_set |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
19 # |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
20 # @param modsec_dir |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
21 # Defines the path where Puppet installs the modsec configuration and activated rules links. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
22 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
23 # @param modsec_secruleengine |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
24 # Configures the rules engine. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
25 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
26 # @param audit_log_relevant_status |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
27 # Configures which response status code is to be considered relevant for the purpose of audit logging. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
28 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
29 # @param audit_log_parts |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
30 # Defines which parts of each transaction are going to be recorded in the audit log. Each part is assigned a single letter; when a |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
31 # letter appears in the list then the equivalent part will be recorded. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
32 # |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
33 # @param audit_log_type |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
34 # Defines the type of audit logging mechanism to be used. |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
35 # |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
36 # @param audit_log_storage_dir |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
37 # Defines the directory where concurrent audit log entries are to be stored. This directive is only needed when concurrent audit logging is used. |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
38 # |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
39 # @param secpcrematchlimit |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
40 # Sets the match limit in the PCRE library. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
41 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
42 # @param secpcrematchlimitrecursion |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
43 # Sets the match limit recursion in the PCRE library. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
44 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
45 # @param allowed_methods |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
46 # A space-separated list of allowed HTTP methods. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
47 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
48 # @param content_types |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
49 # A list of one or more allowed MIME types. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
50 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
51 # @param restricted_extensions |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
52 # A space-sparated list of prohibited file extensions. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
53 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
54 # @param restricted_headers |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
55 # A list of restricted headers separated by slashes and spaces. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
56 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
57 # @param secdefaultaction |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
58 # Defines the default list of actions, which will be inherited by the rules in the same configuration context. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
59 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
60 # @param inbound_anomaly_threshold |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
61 # Sets the scoring threshold level of the inbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
62 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
63 # @param outbound_anomaly_threshold |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
64 # Sets the scoring threshold level of the outbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
65 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
66 # @param critical_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
67 # Sets the Anomaly Score for rules assigned with a critical severity. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
68 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
69 # @param error_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
70 # Sets the Anomaly Score for rules assigned with a error severity. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
71 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
72 # @param warning_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
73 # Sets the Anomaly Score for rules assigned with a warning severity. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
74 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
75 # @param notice_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
76 # Sets the Anomaly Score for rules assigned with a notice severity. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
77 # |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
78 # @param paranoia_level |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
79 # Sets the paranoia level in the OWASP ModSecurity Core Rule Set. |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
80 # |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
81 # @param executing_paranoia_level |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
82 # Sets the executing paranoia level in the OWASP ModSecurity Core Rule Set. |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
83 # The default is equal to, and cannot be lower than, $paranoia_level. |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
84 # |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
85 # @param secrequestmaxnumargs |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
86 # Sets the maximum number of arguments in the request. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
87 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
88 # @param secrequestbodylimit |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
89 # Sets the maximum request body size ModSecurity will accept for buffering. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
90 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
91 # @param secrequestbodynofileslimit |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
92 # Configures the maximum request body size ModSecurity will accept for buffering, excluding the size of any files being transported |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
93 # in the request. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
94 # |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
95 # @param secrequestbodyinmemorylimit |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
96 # Configures the maximum request body size that ModSecurity will store in memory. |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
97 # |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
98 # @param secrequestbodyaccess |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
99 # Toggle SecRequestBodyAccess On or Off |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
100 # |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
101 # @param secrequestbodylimitaction |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
102 # Controls what happens once a request body limit, configured with |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
103 # SecRequestBodyLimit, is encountered |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
104 # |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
105 # @param secresponsebodyaccess |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
106 # Toggle SecResponseBodyAccess On or Off |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
107 # |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
108 # @param secresponsebodylimitaction |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
109 # Controls what happens once a response body limit, configured with |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
110 # SecResponseBodyLimitAction, is encountered. |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
111 # |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
112 # @param manage_security_crs |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
113 # Toggles whether to manage ModSecurity Core Rule Set |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
114 # |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
115 # @param enable_dos_protection |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
116 # Toggles the optional OWASP ModSecurity Core Rule Set DOS protection rule |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
117 # (rule id 900700) |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
118 # |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
119 # @param dos_burst_time_slice |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
120 # Configures time in which a burst is measured for the OWASP ModSecurity Core Rule Set DOS protection rule |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
121 # (rule id 900700) |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
122 # |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
123 # @param dos_counter_threshold |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
124 # Configures the amount of requests that can be made within dos_burst_time_slice before it is considered a burst in |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
125 # the OWASP ModSecurity Core Rule Set DOS protection rule (rule id 900700) |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
126 # |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
127 # @param dos_block_timeout |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
128 # Configures how long the client should be blocked when the dos_counter_threshold is exceeded in the OWASP |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
129 # ModSecurity Core Rule Set DOS protection rule (rule id 900700) |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
130 # |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
131 # @see https://github.com/SpiderLabs/ModSecurity/wiki for additional documentation. |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
132 # @see https://coreruleset.org/docs/ for addional documentation |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
133 # |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
134 class apache::mod::security ( |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
135 Stdlib::Absolutepath $logroot = $apache::params::logroot, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
136 Integer $version = $apache::params::modsec_version, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
137 Optional[String] $crs_package = $apache::params::modsec_crs_package, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
138 Array[String] $activated_rules = $apache::params::modsec_default_rules, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
139 Boolean $custom_rules = $apache::params::modsec_custom_rules, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
140 Optional[Array[String]] $custom_rules_set = $apache::params::modsec_custom_rules_set, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
141 Stdlib::Absolutepath $modsec_dir = $apache::params::modsec_dir, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
142 String $modsec_secruleengine = $apache::params::modsec_secruleengine, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
143 String $audit_log_relevant_status = '^(?:5|4(?!04))', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
144 String $audit_log_parts = $apache::params::modsec_audit_log_parts, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
145 String $audit_log_type = $apache::params::modsec_audit_log_type, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
146 Optional[Stdlib::Absolutepath] $audit_log_storage_dir = undef, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
147 Integer $secpcrematchlimit = $apache::params::secpcrematchlimit, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
148 Integer $secpcrematchlimitrecursion = $apache::params::secpcrematchlimitrecursion, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
149 String $allowed_methods = 'GET HEAD POST OPTIONS', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
150 String $content_types = 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
151 String $restricted_extensions = '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
152 String $restricted_headers = '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
153 String $secdefaultaction = 'deny', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
154 Integer $inbound_anomaly_threshold = 5, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
155 Integer $outbound_anomaly_threshold = 4, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
156 Integer $critical_anomaly_score = 5, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
157 Integer $error_anomaly_score = 4, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
158 Integer $warning_anomaly_score = 3, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
159 Integer $notice_anomaly_score = 2, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
160 Integer $secrequestmaxnumargs = 255, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
161 Integer $secrequestbodylimit = 13107200, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
162 Integer $secrequestbodynofileslimit = 131072, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
163 Integer $secrequestbodyinmemorylimit = 131072, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
164 Integer[1,4] $paranoia_level = 1, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
165 Integer[1,4] $executing_paranoia_level = $paranoia_level, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
166 Apache::OnOff $secrequestbodyaccess = 'On', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
167 Apache::OnOff $secresponsebodyaccess = 'Off', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
168 Enum['Reject', 'ProcessPartial'] $secrequestbodylimitaction = 'Reject', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
169 Enum['Reject', 'ProcessPartial'] $secresponsebodylimitaction = 'ProcessPartial', |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
170 Boolean $manage_security_crs = true, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
171 Boolean $enable_dos_protection = true, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
172 Integer[1, default] $dos_burst_time_slice = 60, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
173 Integer[1, default] $dos_counter_threshold = 100, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
174 Integer[1, default] $dos_block_timeout = 600, |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
175 ) inherits apache::params { |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
176 include apache |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
177 |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
178 $_secdefaultaction = $secdefaultaction ? { |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
179 /log/ => $secdefaultaction, # it has log or nolog,auditlog or log,noauditlog |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
180 default => "${secdefaultaction},log", |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
181 } |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
182 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
183 if $facts['os']['family'] == 'FreeBSD' { |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
184 fail('FreeBSD is not currently supported') |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
185 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
186 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
187 if ($facts['os']['family'] == 'Suse' and versioncmp($facts['os']['release']['major'], '11') < 0) { |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
188 fail('SLES 10 is not currently supported.') |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
189 } |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
190 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
191 if ($executing_paranoia_level < $paranoia_level) { |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
192 fail('Executing paranoia level cannot be lower than paranoia level') |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
193 } |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
194 |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
195 case $version { |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
196 1: { |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
197 $mod_name = 'security' |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
198 $mod_conf_name = 'security.conf' |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
199 } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
200 2: { |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
201 $mod_name = 'security2' |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
202 $mod_conf_name = 'security2.conf' |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
203 } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
204 default: { |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
205 fail('Unsuported version for mod security') |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
206 } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
207 } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
208 ::apache::mod { $mod_name: |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
209 id => 'security2_module', |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
210 lib => 'mod_security2.so', |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
211 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
212 |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
213 ::apache::mod { 'unique_id': |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
214 id => 'unique_id_module', |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
215 lib => 'mod_unique_id.so', |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
216 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
217 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
218 if $crs_package { |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
219 package { $crs_package: |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
220 ensure => 'installed', |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
221 before => [ |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
222 File[$apache::confd_dir], |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
223 File[$modsec_dir], |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
224 ], |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
225 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
226 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
227 |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
228 # Template uses: |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
229 # - logroot |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
230 # - $modsec_dir |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
231 # - $audit_log_parts |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
232 # - $audit_log_type |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
233 # - $audit_log_storage_dir |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
234 # - secpcrematchlimit |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
235 # - secpcrematchlimitrecursion |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
236 # - secrequestbodylimit |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
237 # - secrequestbodynofileslimit |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
238 # - secrequestbodyinmemorylimit |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
239 # - secrequestbodyaccess |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
240 # - secresponsebodyaccess |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
241 # - secrequestbodylimitaction |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
242 # - secresponsebodylimitaction |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
243 $security_conf_parameters = { |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
244 'modsec_secruleengine' => $modsec_secruleengine, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
245 'secrequestbodyaccess' => $secrequestbodyaccess, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
246 'custom_rules' => $custom_rules, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
247 'modsec_dir' => $modsec_dir, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
248 'secrequestbodylimit' => $secrequestbodylimit, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
249 'secrequestbodynofileslimit' => $secrequestbodynofileslimit, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
250 'secrequestbodyinmemorylimit' => $secrequestbodyinmemorylimit, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
251 'secrequestbodylimitaction' => $secrequestbodylimitaction, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
252 'secpcrematchlimit' => $secpcrematchlimit, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
253 'secpcrematchlimitrecursion' => $secpcrematchlimitrecursion, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
254 'secresponsebodyaccess' => $secresponsebodyaccess, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
255 'secresponsebodylimitaction' => $secresponsebodylimitaction, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
256 'audit_log_relevant_status' => $audit_log_relevant_status, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
257 'audit_log_parts' => $audit_log_parts, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
258 'audit_log_type' => $audit_log_type, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
259 'audit_log_storage_dir' => $audit_log_storage_dir, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
260 'logroot' => $logroot, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
261 } |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
262 |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
263 file { 'security.conf': |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
264 ensure => file, |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
265 content => epp('apache/mod/security.conf.epp', $security_conf_parameters), |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
266 mode => $apache::file_mode, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
267 path => "${apache::mod_dir}/${mod_conf_name}", |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
268 owner => $apache::params::user, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
269 group => $apache::params::group, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
270 require => Exec["mkdir ${apache::mod_dir}"], |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
271 before => File[$apache::mod_dir], |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
272 notify => Class['apache::service'], |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
273 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
274 |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
275 file { $modsec_dir: |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
276 ensure => directory, |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
277 owner => 'root', |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
278 group => 'root', |
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
279 mode => '0755', |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
280 purge => true, |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
281 force => true, |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
282 recurse => true, |
257
675c1cc61eaf
Update Apache module to get CentOS 8 support
IBBoard <dev@ibboard.co.uk>
parents:
36
diff
changeset
|
283 require => Package['httpd'], |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
284 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
285 |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
286 file { "${modsec_dir}/activated_rules": |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
287 ensure => directory, |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
288 owner => $apache::params::user, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
289 group => $apache::params::group, |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
290 mode => '0555', |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
291 purge => true, |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
292 force => true, |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
293 recurse => true, |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
294 notify => Class['apache::service'], |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
295 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
296 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
297 if $custom_rules { |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
298 # Template to add custom rule and included in security configuration |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
299 file { "${modsec_dir}/custom_rules": |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
300 ensure => directory, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
301 owner => $apache::params::user, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
302 group => $apache::params::group, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
303 mode => $apache::file_mode, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
304 require => File[$modsec_dir], |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
305 } |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
306 |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
307 file { "${modsec_dir}/custom_rules/custom_01_rules.conf": |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
308 ensure => file, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
309 owner => $apache::params::user, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
310 group => $apache::params::group, |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
311 mode => $apache::file_mode, |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
312 content => epp('apache/mod/security_custom.conf.epp', { 'custom_rules_set' => $custom_rules_set, }), |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
313 require => File["${modsec_dir}/custom_rules"], |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
314 notify => Class['apache::service'], |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
315 } |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
316 } |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
317 |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
318 if $manage_security_crs { |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
319 # Template uses: |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
320 # - $_secdefaultaction |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
321 # - $critical_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
322 # - $error_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
323 # - $warning_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
324 # - $notice_anomaly_score |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
325 # - $inbound_anomaly_threshold |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
326 # - $outbound_anomaly_threshold |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
327 # - $paranoia_level |
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
328 # - $executing_paranoia_level |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
329 # - $allowed_methods |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
330 # - $content_types |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
331 # - $restricted_extensions |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
332 # - $restricted_headers |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
333 # - $secrequestmaxnumargs |
478
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
334 # - $enable_dos_protection |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
335 # - $dos_burst_time_slice |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
336 # - $dos_counter_threshold |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
337 # - $dos_block_timeout |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
338 $security_crs_parameters = { |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
339 '_secdefaultaction' => $_secdefaultaction, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
340 'critical_anomaly_score' => $critical_anomaly_score, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
341 'error_anomaly_score' => $error_anomaly_score, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
342 'warning_anomaly_score' => $warning_anomaly_score, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
343 'notice_anomaly_score' => $notice_anomaly_score, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
344 'inbound_anomaly_threshold' => $inbound_anomaly_threshold, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
345 'outbound_anomaly_threshold' => $outbound_anomaly_threshold, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
346 'secrequestmaxnumargs' => $secrequestmaxnumargs, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
347 'allowed_methods' => $allowed_methods, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
348 'content_types' => $content_types, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
349 'restricted_extensions' => $restricted_extensions, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
350 'restricted_headers' => $restricted_headers, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
351 'paranoia_level' => $paranoia_level, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
352 'executing_paranoia_level' => $executing_paranoia_level, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
353 'enable_dos_protection' => $enable_dos_protection, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
354 'dos_burst_time_slice' => $dos_burst_time_slice, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
355 'dos_counter_threshold' => $dos_counter_threshold, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
356 'dos_block_timeout' => $dos_block_timeout, |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
357 } |
adf6fe9bbc17
Update Puppet modules to latest versions
IBBoard <dev@ibboard.co.uk>
parents:
437
diff
changeset
|
358 |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
359 file { "${modsec_dir}/security_crs.conf": |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
360 ensure => file, |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
361 content => template('apache/mod/security_crs.conf.erb'), |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
362 require => File[$modsec_dir], |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
363 notify => Class['apache::service'], |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
364 } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
365 |
437
b8d6ada284dd
Update Apache module to latest version
IBBoard <dev@ibboard.co.uk>
parents:
275
diff
changeset
|
366 unless $facts['os']['name'] == 'SLES' or $facts['os']['name'] == 'Debian' or $facts['os']['name'] == 'Ubuntu' { |
275
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
367 apache::security::rule_link { $activated_rules: } |
d9352a684e62
Mass update of modules to remove deprecation warnings
IBBoard <dev@ibboard.co.uk>
parents:
257
diff
changeset
|
368 } |
36
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
369 } |
37675581a273
Update Puppet module for Apache (pulls in concat module)
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
370 } |