0

From OWASP CRS (modsecurity) related docs (which I can find in the public domain) I can infer that brute force and DOS protection have been taken care of. However, I am not able to find specific details regarding the rules that prevent DOS. Currently, my server is experiencing brute force attacks of the below kind:

  1. Same IP, Same Resource/Page At The Same Time

    aa.bb.cc.dd 2021-04-27T07:01:37

    aa.bb.cc.dd 2021-04-27T07:01:37

    aa.bb.cc.dd 2021-04-27T07:01:37

  2. Different IPs With Same Reverse DNS Host, Same Resource/Page At The Same Time. The first two octets of the IPs remain the same.

    aa.bb.cc.dd 2021-04-27T07:01:37

    aa.bb.ee.ff 2021-04-27T07:01:37

    aa.bb.gg.hh 2021-04-27T07:01:37

Can someone experienced with OWASP CRS let me know if such attacks can be prevented with the CRS?

Update: I am using apache 2.4. Regarding CRS, I am using version 3.3.0

Kannan
  • 123
  • 8

1 Answers1

1

You didn't write what HTTP server you use - that's important.

I think there are more solutions for your first item. CRS has the optional DOS protection, see this section of crs.conf. This can be help you in other cases too, eg. the resources are different.

Most HTTP server provides other solutions too, eg. if you use Apache, check the mod_evasive (most distribution provides this as package). I do not know about similar solution for Nginx.

Your second issue is rather a DDOS, because the IP addresses are different.

It's a bit out of scope, but you can check the fail2ban (also supported by most distro) - may be that can help you too.

airween
  • 6,203
  • 1
  • 14
  • 20
  • Thanks. Regarding web server, I am using apache. I will go through the links you have given. – Kannan Apr 27 '21 at 14:14
  • Regarding CRS, I am using version 3.3.0 – Kannan Apr 27 '21 at 14:22
  • 1
    Thank you. 3.3.0 is the latest stable version, it's fine. – airween Apr 27 '21 at 14:45
  • A doubt. I found the lines you had mentioned in crs.conf. I am using WHM/cPanel enabled server with apache as http server. After un-commenting the lines, should I have to restart apache? (Sorry for troubling. I am new to server security and lack knowledge/experience) – Kannan Apr 27 '21 at 14:49
  • No worries :). Yes, you have to restart the Apache. – airween Apr 27 '21 at 15:16