1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

version: '3'
services:
  waf:
    image: owasp/modsecurity-crs:nginx
    container_name: waf
    ports:
      - "80:80"  # 將容器的80端口映射到主機的80端口
      - "443:443"  # 如果需要 HTTPS，也可以映射443端口
#      - "12081:8080"
    volumes:
      - /etc/localtime:/etc/localtime
      - ./nginx.conf.template:/etc/nginx/templates/nginx.conf.template:rw  # 掛載自定義的 Nginx 配置文件
      - ./main.conf:/etc/nginx/templates/main.conf:rw
#      - ./conf.d:/etc/nginx/conf.d  # 可選：掛載自定義的 ModSecurity 配置文件
      - ./mysite:/etc/nginx/mysite:rw
      - ./ssl/domain:/etc/ssl/domain:ro
      - ./crs:/etc/modsecurity.d/owasp-crs/crs:rw
    environment:
      - PARANOIA=1  # 設置 paranoia level, 默認是 PL1
    restart: always

1

docker compose exec waf bash

1

/etc/modsecurity.d/modsecurity.conf

1

/etc/modsecurity.d/owasp-crs/rules

1

/etc/modsecurity.d/owasp-crs/plugins

1
2
3

server {
modsecurity on;
modsecurity_rules_file /etc/modsecurity.d/owasp-crs/crs/cloud.conf;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 覆蓋請求限制
# 限制有檔名的文件最大上傳 10GB = 131072000
SecRequestBodyLimit 10737418240
# 超過設置的拒絕
SecRequestBodyLimitAction Reject
# 限制沒有檔名的文件最大上傳 256k
SecRequestBodyNoFilesLimit 262144
# 為Localhost-nginx編譯連結器版本根據docker結構編修

Include /etc/modsecurity.d/owasp-crs/crs/nextcloud-rule-exclusions-plugin/exclude.conf
Include /etc/modsecurity.d/owasp-crs/crs/nextcloud-rule-exclusions-plugin/nextcloud-rule-exclusions-before.conf
Include /etc/modsecurity.d/owasp-crs/crs/nextcloud-rule-exclusions-plugin/nextcloud-rule-exclusions-config.conf
Include /etc/modsecurity.d/modsecurity.conf
Include /etc/modsecurity.d/owasp-crs/crs-setup.conf
Include /etc/modsecurity.d/owasp-crs/rules/*.conf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

SecRule &TX:nextcloud-rule-exclusions-plugin_enabled "@eq 0" \
    "id:9508010,\
    phase:1,\
    pass,\
    nolog,\
    ver:'nextcloud-rule-exclusions-plugin/1.2.0',\
    setvar:'tx.nextcloud-rule-exclusions-plugin_enabled=1'"

# 有些檔名會被封鎖 排除目錄規則 id=930130 在特定目錄下的應用
SecRule REQUEST_URI "@beginsWith /remote.php/dav/files/username1/blog/" \
     "id:10001,phase:1,nolog,pass,t:none,ctl:ruleRemoveById=930130"
# 說明：
# - id:10001 是這條規則的 ID，您可以使用不同的 ID 來區分。
# - phase:1 指定規則在哪個階段執行（通常在第 1 階段應用）。
# - nolog 和 pass 指示當匹配時不記錄日志並允許請求繼續。
# - ctl:ruleRemoveById=930130 表示在匹配到此 URI 時排除規則 930130 的應用。
# 使用正則表達式匹配多個目錄
#SecRule REQUEST_URI "@rx ^/remote\.php/dav/files/(username1/blog|username2/projects|username3/documents)/" \
#    "id:10004,phase:1,nolog,pass,t:none,ctl:ruleRemoveById=930130"

# 放寬文件上傳限制
SecRule REQUEST_FILENAME "@rx /(?:remote\.php|index\.php)/" \
    "id:10002,phase:2,t:none,nolog,pass,setvar:'tx.restricted_extensions=.bak/ .config/ .conf/'"

1
2
3
4
5

# 增加上傳 16GB = 17179869184
RUN echo "LimitRequestBody 17179869184" >> /etc/apache2/apache2.conf

# 重啟 Apache 載入新設定
RUN apachectl restart