ModSecurity VS lua-resty-limit-traffic

Coraza and ModSecurity have a high detection rate, but they are not adapted to reality scenarios, resulting in too many false positives.

Official GitHub: ModSecurity Stars: 8K

SafeLine vs ModSecurity

cd /opt && sudo git clone https://github.com/owasp-modsecurity/ModSecurity.git cd ModSecurity sudo git submodule init sudo git submodule update sudo ./build.sh sudo ./configure sudo make sudo make install

First of all, if you have any experience with Traefik, I'd suggest you to do the reverse proxy stuff with it and install the Crowdsec instance along it. As I didn't have experience using Traefik I went with NPM but now I guess it would have been easier considering the research I had to do... Another reason is, I wanted to implement a geo block and/or another security layer by using ModSecurity (https://github.com/SpiderLabs/ModSecurity ) besides Crowdsec too. Afaik Traefik has a plugin that integrates ModSecurity easily - unless NPM.

I don't know about Blackboard, but Moodle will allow quizzes to be run in popups that block most extensions from working; lockdown browsers will block such extensions; and, if you have access to the server, a modified firewall (e.g., ModSecurity) may\* allow blocking this and similar extensions.

> ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

This might be of interest to some: https://www.modsecurity.org/

> Trustwave is announcing the End-of-Life (EOL) of our support for ModSecurity effective July 1, 2024. We will then hand over the maintenance of ModSecurity code back to the open-source community.

Probably not too big of a deal, though.

Also, this might be useful: https://owasp.org/www-project-modsecurity-core-rule-set/

Though there has been some critique of ModSecurity and that ruleset in the past, as something dated and with false positives.

Anyone have any good alternatives?

Is there a reason no one hasn't made a Docker template for OWASP Coraza (https://github.com/corazawaf/coraza) or ModSecurity (https://github.com/SpiderLabs/ModSecurity) for the use of a reverse proxy?

Openresty with a few Nginx modules and Lua scripts can go a long way for many use-cases mentioned:

- ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

- L7 Rate limiting: https://github.com/openresty/lua-resty-limit-traffic

- Cache: https://github.com/ledgetech/ledge . Or use varnish which gives you VCL for high configurability

- CDN: https://github.com/taythebot/lightpath . This project seems to be a WIP which you can use as a starting point for your needs. You will also need to find good enough "edge" locations for your CDN.

Similarly, HAProxy does a lot of stuff with the correct config and is also extensible using Lua: