![\"OWASP](\"https:\/\/lswp.store\/wp-content\/uploads\/2023\/11\/ols-owasp.png\")
<\/p>\n<\/p>\n
Running into difficulty with mod_security? Our support team provided this short list of Frequently Asked Questions. We hope they will help you to be successful using the OWASP<\/a> rule set to secure your OpenLiteSpeed<\/a> server!<\/p>\n OWASP, or Open Web Application Security Project, provides a comprehensive collection of mod_security rules to protect your server. There are three ways to start using OWASP with OpenLiteSpeed (OLS). Choose the method that applies to your configuration.<\/p>\n When your OLS is a cloud image, was installed using ols1clk, or was installed using the LiteSpeed repo, you can set up OWASP with the following command:<\/p>\n If you\u2019re using OLS with Docker, you can use the built-in If you have compiled OLS from source, follow the instructions in our Knowledge Base<\/a> and install OWASP manually.<\/p>\n If the It\u2019s common for configuration syntax to be an issue. Here are a few things to remember:<\/p>\n You can test the effectiveness of an OWASP rule by trying to break it. For example, try some Cross Site Scripting on your domain:<\/p>\n If the OWASP rule is working correctly, the server will return a 403` code, and the following error message will be appended to the server error log:<\/p>\n You can try other simple test cases, such as:<\/p>\n For each test, verify that the appropriate error message was logged.<\/p>\n There is much more to OWASP testing than this, so consider taking a look at OWASP\u2019s official testing guide<\/a> for more ideas.<\/p>\n If you are experiencing false positives, first make sure that you are using the most recent Core Rule Set<\/a> version.<\/p>\n Then, if the false positives continue, you can raise an issue<\/a> on the official Core Rule Set repo.<\/p>\n To keep a particular false positive from impacting access to your site, you might want to comment out the rule to keep it from firing.<\/p>\n For example, let\u2019s say you have the following in your server\u2019s error log, but it is a false positive:<\/p>\n Edit the configuration file found at Restart the server, and that rule will no longer fire.<\/p>\n OpenLiteSpeed and OWASP are a powerful combination for securing your server. If you have a busy server, try the more performant, highly scalable proprietary mod_security engine<\/a> that comes with LiteSpeed Enterprise Web Server.<\/p>\nHow do I set up OWASP with OpenLiteSpeed?<\/h2>\n
bash <( curl -k https:\/\/raw.githubusercontent.com\/litespeedtech\/ols1clk\/master\/ols1clk.sh ) --owasp-enable\n<\/pre>\n
bash bin\/webadmin.sh --mod_secure enable<\/code> feature to enable OWASP.<\/p>\nWhat if mod_security doesn\u2019t exist?<\/h2>\n
\/usr\/local\/lsws\/modules\/mod_security.so<\/code> file doesn\u2019t exist, you can either install it from the repository with the apt-get install ols-modsecurity -y<\/code> command, or build it from source<\/a>.<\/p>\nIs syntax causing my problem?<\/h2>\n
\n
Yes<\/code>, you still need to set Modsecurity<\/strong> ON<\/code>.<\/li>\n`<\/code>)<\/li>\n<\/ul>\nHow do I verify if OWASP works?<\/h2>\n
http:\/\/example.com\/?user=<script>alert(123)<\/script>\n<\/pre>\n
[Module:mod_security] ModSecurity: Warning. detected XSS using libinjection. [file \"\/usr\/local\/lsws\/conf\/owasp\/owasp-modsecurity-crs\/rules\/REQUEST-941-APPLICATION-ATTACK-XSS.conf\"] [line \"38\"] [id \"941100\"]\n<\/pre>\n
\n
http:\/\/www.example.com\/?Username='1' OR '1' = '1' AND Password='1' OR '1' = '1'\n<\/pre>\n<\/li>\n
http:\/\/www.example.com\/?id=10 AND 1=2\n<\/pre>\n<\/li>\n<\/ul>\n
What if I am seeing false positives?<\/h2>\n
[Module:mod_security] ModSecurity: Warning. detected XSS using libinjection. [file \"\/usr\/local\/lsws\/conf\/owasp\/owasp-modsecurity-crs\/rules\/REQUEST-941-APPLICATION-ATTACK-XSS.conf\"] [line \"38\"] [id \"941100\"]\n<\/pre>\n
\/usr\/local\/lsws\/conf\/owasp\/owasp-modsecurity-crs\/rules\/REQUEST-941-APPLICATION-ATTACK-XSS.conf<\/code> and comment out every line of the 941100<\/code> rule, like so:<\/p>\n# SecRule REQUEST_COOKIES|!REQUEST_COOKIES:\/__utm\/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:\/* \"@detectXSS\" \\\n # \"id:941100,\\\n # phase:2,\\\n # block,\\\n # t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n # msg:'XSS Attack Detected via libinjection',\\\n # logdata:'Matched Data: XSS data found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n # tag:'application-multi',\\\n # tag:'language-multi',\\\n # tag:'platform-multi',\\\n # tag:'attack-xss',\\\n # tag:'paranoia-level\/1',\\\n # tag:'OWASP_CRS',\\\n # tag:'capec\/1000\/152\/242',\\\n # ctl:auditLogParts=+E,\\\n # ver:'OWASP_CRS\/3.3.5',\\\n # severity:'CRITICAL',\\\n # setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n # setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n<\/pre>\nConclusion<\/h2>\n