is nginx build with modsecurity?

[gent99]

I'd like to ask, if nginx modsecurity is included in this project?

Kind regards

[jc21]

This is using a custom built OpenResty instance.

The parameters of the build can be found here.

Though I don't see mod security listed, I'm not sure if it's an internal module or not.

[gent99]

as far as i know, modsecurity has to be build for the nginx version you are using. See here: https://www.nginx.com/blog/compiling-and-installing-modsecurity-for-open-source-nginx/

The goal behind my question actually is: What's behind the setting "Block Common Exploits" in an proxy host?

[l4rm4nd]

You can view the content of block-exploits.conf by yourself. Basically some regex stuff to block well known malicious actors, exploit strings, user agents and stuff.

Location is: /etc/nginx/conf.d/include/block-exploit.conf

[gent99]

integrating modsecurity should be considerated for a new major version of npm, if it's possible. Especially with modsecurity it's kind of easy to include OWASP CRS https://owasp.org/www-project-modsecurity-core-rule-set/ wich could make npm to a fairly robust WAF

[chaptergy]

Feature request: #847