Workarounds for "Unable to troubleshoot mod_security blocked requests"

[Antony Bishop (AntonyBishop)]

Hi all. Here is a discussion to look into any potential work arounds to #2714.

This issues is blocked pending a release. However that release looks to have gone stale and there is no obvious date by which this will be addressed (or whether a fix in the next release will actually address the issue).

What are the alternatives as this is blocking services adopting a WAF (which is a security requirement for that service).

Ideas for workarounds. Discuss.

[Razvan Cosma (razvan-moj)]

Option 1: we'd need to evaluate all the changes related to owasp-modsecurity/ModSecurity-nginx#170 and try running a build of whatever is on master now. Not a comfortable choice for a security product

[Razvan Cosma (razvan-moj)]

Option 2: if managed ingress (ALB) can be an option for live-1, we could create a terraform module that makes the "managed rules" available for our users: https://aws.amazon.com/marketplace/solutions/security/waf-managed-rules
One of the companies that sells managed rules on that marketplace is SpiderLabs, the code owners of modsecurity; they might be more willing to fix a paid service

[Antony Bishop (AntonyBishop)]

Thanks Razvan Cosma (@razvan-moj) so what is our current view on managed ingress? What is it that we are waiting for to progress those investigations?

[Razvan Cosma (razvan-moj)]

~1 year later, modsecurity is fixed: #2714