Write documentation about how to write security rules

[williamdes]

See: coreruleset/coreruleset#1951

Needed:

• a list of the endpoints
• a list of static files
• a list of cache for ever files favicon.ico and robots.txt for example

Related to: #12435

[williamdes]

After that, update all possible configurations:

• nginx config for Selenium tests
• https://salsa.debian.org/phpmyadmin-team/phpmyadmin/-/blob/debian/latest/debian/conf/apache.conf
• https://salsa.debian.org/phpmyadmin-team/phpmyadmin/-/blob/debian/latest/debian/conf/lighttpd.conf

[williamdes]

Current nginx rule-set: coreruleset/coreruleset#1951 (comment)

[dune73]

Thank you for taking this upstream @williamdes.

Adding a bit of CRS context: A software like phpmyadmin necessarily triggers false positive with the OWASP ModSecurity Core Rule Set (an open source Web Application Firewall).

A standard response is to turn off the WAF, but that's obviously not the best approach from a security perspective. A better alternative is to tune the rule set by excluding those rules that typically trigger false positives. Usually you can leave CRS fully intact for > 90% of the application.

We are supporting our users with this approach by providing rule exclusion packages: e.g. Install the phpmyadmin rule exclusion package and you should be fine running CRS in front with no more systematic false positives.

One problem that we face is that we can not easily restrict the rule exclusions to PhpMyAdmin, since we do not want to disable a lot of the rules just because the filename happens to be index.php. Here is the wordpress rule exclusion package to give you an idea how we restrict rule exclusions there: Link

[williamdes]

Google App Engine rules could also be documented: #16496 (comment)

[williamdes]

Also an apparmor file to document ?
https://nordisch.org/posts/php-fpm-apparmor/

Edit: it is #12436

[azurit]

Linking here: coreruleset/coreruleset#2394