hub VS ModSecurity

I use their free plan so I can't tell about any other plan. In order to protect all your services, you just have to deploy Crowdsec once, give it access to the logs of all your existing services and set up the relevant bouncers (reverse proxy and probably Cloudflare). You must also give it the relevant collections from https://hub.crowdsec.net/ such as https://hub.crowdsec.net/author/crowdsecurity/collections/nextcloud

Doesn't work adding it to acquis.yaml. Crowdsec fails to start. If I go to hub.crowdsec.net there are multiple predefined collections, many of which define an acquisition script but don't say where to put it.

The ssh-bf scenario:

We don't have support for them yet, however, if you provide log samples and open an issue with the samples on https://github.com/crowdsecurity/hub. We can work on supporting them.

You find the required contents of the acquis.yaml on the dedicated page of each collection on the hub.

This isn't usable in latest Caddy versions unfortunately. See https://github.com/crowdsecurity/hub/pull/433

I have news. There's a PR for Exchange support. I don't have an ETA for it to be merged, though.

I just submitted a PR for Wireguard support. Feel free to try it out. I haven't been able to test it much. And yes, it's my first PR :-)

Your use case sounds cool. Unfortunately CrowdSec is not very mature on Windows (yet). That being said we have just written a parser for sysmon. It's very much WIP and needs testing. Also there's not any scenarios yet so CrowdSec can't detect anything there yet. That being said we would love to collaborate with you on creating them if you're willing to invest time in it too. A good place to do that would be via our Discord (invite link under the subreddit description) where I will be happy to set up a dedicated channel where you can have direct access to our devs.

Thanks for joining and asking questions :-) sudo cscli metrics gives you an overview of which log sources is being parsed and which attacks has been detected. You add a custom application by creating a parser and scenario or downloading a collection from the hub and adding a suitable data source.

First of all, if you have any experience with Traefik, I'd suggest you to do the reverse proxy stuff with it and install the Crowdsec instance along it. As I didn't have experience using Traefik I went with NPM but now I guess it would have been easier considering the research I had to do... Another reason is, I wanted to implement a geo block and/or another security layer by using ModSecurity (https://github.com/SpiderLabs/ModSecurity ) besides Crowdsec too. Afaik Traefik has a plugin that integrates ModSecurity easily - unless NPM.

I don't know about Blackboard, but Moodle will allow quizzes to be run in popups that block most extensions from working; lockdown browsers will block such extensions; and, if you have access to the server, a modified firewall (e.g., ModSecurity) may\* allow blocking this and similar extensions.

> ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

This might be of interest to some: https://www.modsecurity.org/

> Trustwave is announcing the End-of-Life (EOL) of our support for ModSecurity effective July 1, 2024. We will then hand over the maintenance of ModSecurity code back to the open-source community.

Probably not too big of a deal, though.

Also, this might be useful: https://owasp.org/www-project-modsecurity-core-rule-set/

Though there has been some critique of ModSecurity and that ruleset in the past, as something dated and with false positives.

Anyone have any good alternatives?

Is there a reason no one hasn't made a Docker template for OWASP Coraza (https://github.com/corazawaf/coraza) or ModSecurity (https://github.com/SpiderLabs/ModSecurity) for the use of a reverse proxy?

Since Nginx has different use cases, protecting your application depends on how and where you use it. It's recommended that you have a reliable WAF solution since they block most harmful requests in the first place. In this article, you'll compare three tools—ModSecurity, F5 Nginx App Protect, and open-appsec—based on their active development, advanced security features, and open source commitment to help you figure out which tool is right for you.

I'm currently erring toward ModSecurity & the Nginx connector now that it's been de-Apache'd.

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin.

There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2]'.

The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on).

[1] https://github.com/SpiderLabs/ModSecurity

[2] https://perishablepress.com/7g-firewall/

[3] https://www.wordfence.com/

By Web Firewall did you mean smth like this ?