-
Notifications
You must be signed in to change notification settings - Fork 61
/
ironbee.conf.example
72 lines (62 loc) · 2.28 KB
/
ironbee.conf.example
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
### Logging
# Log level (standard syslog levels with additional debug2 and debug3)
LogLevel info
### Sensor Info
SensorId 80ECD8CF-318C-4915-A8C2-B3AAE315FB0C
### Load Modules
LoadModule ibmod_htp.so
#LoadModule ibmod_txlog.so
LoadModule ibmod_error_page.so
LoadModule ibmod_pcre.so
#LoadModule ibmod_ee.so
#LoadModule ibmod_geoip.so
LoadModule ibmod_persistence_framework.so
LoadModule ibmod_init_collection.so
LoadModule ibmod_persist.so
#LoadModule ibmod_libinjection.so
#LoadModule ibmod_trusted_proxy.so
LoadModule ibmod_lua.so
LoadModule ibmod_rules.so
#LoadModule ibmod_fast.so
LoadModule ibmod_predicate_core.so
LoadModule ibmod_predicate_rules.so
LoadModule ibmod_xrules.so
### Auditing
AuditEngine RelevantOnly
AuditLogIndex None
AuditLogBaseDir /tmp/ironbee
AuditLogSubDirFormat "%Y%m%d-%H%M"
AuditLogDirMode 0755
AuditLogFileMode 0644
AuditLogParts all
### Buffering
RequestBuffering On
ResponseBuffering On
### Rule Diagnostics Logging
RuleEngineLogData all
RuleEngineLogLevel info
# ===============================================================================
# Rules
# ===============================================================================
# ===============================================================================
### Test Rules
# This rule will block if a "blockme" parameter (with any value) is in the request
Rule ARGS:blockme.count() @ne 0 id:test/blockme rev:1 phase:REQUEST "msg:Test blocking" tag:TestRules event block
### Default Blocking Rules
# These rule detect any advisory blocks and perform the
# actual block.
Rule FLAGS:block @ne 0 id:block/request_header rev:1 phase:REQUEST_HEADER "msg:Blocking request header" tag:BlockingMode block:phase
Rule FLAGS:block @ne 0 id:block/request rev:1 phase:REQUEST "msg:Blocking request" tag:BlockingMode block:phase
Rule FLAGS:block @ne 0 id:block/response_header rev:1 phase:RESPONSE_HEADER "msg:Blocking response header" tag:BlockingMode block:phase
# ===============================================================================
# ===============================================================================
### Sites
# Default
<Site default>
SiteId 0CA1665C-F27F-4763-A3E0-A31A00477497
Service *:*
Hostname *
# Enable rules from the main context
RuleEnable tag:TestRules
RuleEnable tag:BlockingMode
</Site>