bunkerity / bunkerity/bunkerweb
Refactor of custom configurations
- Dominant language
- Python
- Stars
- 10.9k
- Forks
- 643
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 42
Description
**Description**
Templator.py fails to include custom modsec confs on multisite when using autoconf
**How to reproduce**
I've reproduced this from scratch several times now so I'm fairly confident it's a bug. If not, I must be making the same silly mistake each time. In the process of my troubleshooting, I came up with PR 172 fixing the wordpress example ([updated](https://github.com/bunkerity/bunkerized-nginx/pull/172)).
I adapted the wordpress example into a multisite docker-compose.yml with an identical docker-compose-autoconf.yml version for comparison. They both use the same custom rules and parameters, all of which work properly (including WordPress Site Health Status) but not when using autoconf. The only workaround is to disable ModSecurity.
My test repo can be cloned from
https://github.com/AquaeAtrae/bunkerized-multisite-autoconf-test
Templator.py should detect (is_custom_conf) and include both
/confs/site/modsecurity-rules.conf#L65 and L77
At one point, I believe I saw L65 but not L77 with the same docker-compose-autoconf.yml which makes me wonder if this isn't some kind of race condition. I don't understand autoconf well enough yet to say really.
**Logs**
After starting docker-compose-autoconf.yml and browsing to http://app2.localhost/wp-admin/site-health.php I find the results blocked (ModSecurity false positives) despite the exemption provided in /modsec-confs/app2.localhost/wordpress.conf When I inspect the site's modsecurity-rules.conf, I see the Templator failed to actually include these custom rules.
```➜ bunkerized-multisite-autoconf-test git:(main) docker exec -it bunkerized-multisite-autoconf-test_mywww_1 tail -25 /etc/nginx/app2.localhost/modsecurity-rules.conf
# enable response body checks
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml application/json
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
# log usefull stuff
SecAuditEngine RelevantOnly
SecAuditLogType Serial
SecAuditLog /var/log/nginx/modsec_audit.log
# include OWASP CRS configuration
include /opt/owasp/crs.conf
# custom CRS configurations before loading rules (exclusions)
# include OWASP CRS rules
include /opt/owasp/crs/*.conf
# custom rules after loading the CRS```
Contributor guide
Assessment
This issue has not been assessed yet.