Community Edition | Nemesida WAF

Default parameter

Description of the parameter

nwaf_license_key

The parameter for installing the Nemesida WAF license key. When using Nemesida WAF Community Edition, use the default parameter value nwaf_license_key none.

nwaf_sys_proxy

The parameter defines the proxy server address for accessing to external resources (license key verification, getting signatures, etc.).

Example:

nwaf_sys_proxy http://proxy.example.com:3128;

It is allowed to use authentication parameters when using a proxy server.

Example:

nwaf_sys_proxy http://<user>:<password>@proxy.example.com:3128;

nwaf_api_proxy

The parameter defines the proxy server address for accessing the Nemesida WAF API.

Example:

nwaf_api_proxy http://proxy.example.com:3128;

It is allowed to use authentication parameters when using a proxy server.

Example:

nwaf_api_proxy http://<user>:<password>@proxy.example.com:3128;

nwaf_api_conf

The address of the Nemesida WAF API server for sending information about detected anomalies.

host – the parameter defines the address of the Nemesida WAF API server for sending information about attacks, the results of the Nemesida WAF Scanner and Nemesida AI. With the host=none option, data will not be transmitted to the Nemesida WAF API.

nwaf_host_enable

Activates the Nemesida WAF request analysis mechanism for the virtual host. With the parameter nwaf_host_enable *;, the analysis will be performed for all virtual hosts.

Example of using a single value:

nwaf_host_enable *;

nwaf_host_enable example.com;

nwaf_host_enable *.example.com;

Example of using multiple values:

nwaf_host_enable example.com, a.example.com;

nwaf_host_enable example.com, *.example.com;

nwaf_limit

Sets the limit of blocked requests. If the allowed number of blocked requests is exceeded, as defined by the rate option, the IP address will be blocked for the time (in seconds) specified in block_time.

Example:

nwaf_limit rate=5r/m block_time=600;

To set the limit of blocked requests for a specific domain, you need to change the parameter to the form: nwaf_limit rate=... block_time=... domain=...;

Example:

nwaf_limit domain=example.com rate=5r/m block_time=600;

For the domain parameter, strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.

The conditions for triggering the option are selected based on the following order of priority of the values of the domain parameter from the highest to the lowest:

• example.com — activation of the domain option;
• .example.com — triggering the option for the example.com domain and its subdomains;
• *.example.com — the option is triggered only for subdomains of the example.com domain, excluding the main domain;
• * — the option is triggered for all domains.

If you set several options:

nwaf_limit domain=.example.com rate=5r/m block_time=600;
nwaf_limit domain=*.example.com rate=15r/m block_time=600;

then when requesting web.example.com to block an IP address, it will be enough to block 5 requests per minute, instead 15 because .example.com has a higher priority.

The following options are not allowed for the correct application of the option:

1. Using the option for the same domain with different values rate and block_time.

Example:

nwaf_limit domain=example.com rate=50r/m block_time=600;
nwaf_limit domain=example.com rate=15r/s block_time=1500;

2. Simultaneous addition of option values with and without the domain=* parameter.

Example:

nwaf_limit rate=5r/m block_time=600;
nwaf_limit domain=* rate=10r/s block_time=60;

nwaf_ip_wl

Deactivation of the request analysis mechanism by Nemesida WAF for a specific IP address or subnet.

Example:

nwaf_ip_wl x.x.x.x;

When using nwaf_ip_wl x.x.x.x domain=example.com ; the analysis mechanism will be deactivated only when accessing from a specific IP address to a specific virtual host.
For the domain option, strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.
IPv4/IPv6 addresses are allowed, including the use of CIDR (for example, x.x.x.x/24) and a range of IP addresses.

Example:

nwaf_ip_wl domain=example.com 127.0.0.1;
nwaf_ip_wl domain=example.com 192.168.61.0/24;
nwaf_ip_wl domain=example.com 192.168.61.1-192.168.61.255;

To reduce the number of false positives, it is recommended to specify the static IP address of users (administrators, content managers, editors) in the parameter nwaf_ip_wl. Requests that fall under the action of the parameter will not be blocked. Be extremely careful when using the parameter.

nwaf_host_wl

Deactivation of the request analysis mechanism by Nemesida WAF for a virtual host. With the parameter nwaf_host_wl *;, skipping will be performed for all virtual hosts.

Example of using a single value:

nwaf_host_wl *;

nwaf_host_wl example.com;

nwaf_host_wl *.example.com;

Example of using multiple values:

nwaf_host_wl example.com, a.example.com;

nwaf_host_wl example.com, *.example.com;

nwaf_url_wl

Deactivation of the request analysis mechanism using Nemesida WAF for the URL. With the parameter nwaf_url_wl *; deactivation will be performed when accessing any URL.

Example of using a single value:

nwaf_url_wl *;

nwaf_url_wl example.com/login.php;

nwaf_url_wl *.example.com/login/*;

Example of using multiple values:

nwaf_url_wl example.com, *.example.com/login.php;

With the value example.com/login/* the occurrence of the URL will be taken, for example, example.com/login/aaaa or example.com/login/bbbbb.

If you need to use the * sign as a common character when writing a URL, then you need to escape it, for example, writing example.com/admin/uploads/abcd\\* will match example.com/uploads/abcd*.

nwaf_rfc_violation_wl

Deactivation of the request blocking mechanism by means of the Nemesida WAF for the URL in case of RFC violation.

Example:

nwaf_rfc_violation_wl *;
nwaf_rfc_violation_wl example.com;
nwaf_rfc_violation_wl example.com/login/*;
nwaf_rfc_violation_wl *.example.com/login/index.php;

With the parameter nwaf_rfc_violation_wl example.com/login/*; the occurrence of the URL will be taken, for example, example.com/login/aaaa or example.com/login/bbbbb.

With the parameter nwaf_rfc_violation_wl example.com; deactivation will be performed for all URL for virtual host example.com.

With the parameter nwaf_rfc_violation_wl *; deactivation will be performed for all virtual hosts.

nwaf_ip_lm

Configuring request processing for a specific IP address or subnet with fixation in the DBMS, but without actual blocking (monitoring mode).

Example:

nwaf_ip_lm x.x.x.x;

When using nwaf_ip_lm x.x.x.x domain=example.com ; the pass will be made only when accessing from a specific IP address to a specific domain.
For the domain option, strict matching and wildcard values are allowed: *, example.com, .example.com, *.example.com.
IPv4/IPv6 addresses are allowed, including the use of CIDR (for example, x.x.x.x/24) and a range of IP addresses.

Example:

nwaf_ip_lm domain=example.com 127.0.0.1;
nwaf_ip_lm domain=example.com 192.168.61.0/24;
nwaf_ip_lm domain=example.com 192.168.61.1-192.168.61.255;

nwaf_host_lm

Configuring request processing for a specific virtual host with a commit in the DBMS, but without actual blocking (monitoring mode). With the parameter nwaf_host_lm *;, skipping will be performed for all virtual hosts.

Example of using a single value:

nwaf_host_lm *;

nwaf_host_lm example.com;

nwaf_host_lm *.example.com;

Example of using multiple values:

nwaf_host_lm example.com, a.example.com;

nwaf_host_lm example.com, *.example.com;

nwaf_rfc_violation_lm

Configuring request processing for a specific virtual host with fixation in the DBMS, but without actual blocking (monitoring mode) in case of RFC violation.

Example:

nwaf_rfc_violation_lm *;
nwaf_rfc_violation_lm example.com;
nwaf_rfc_violation_lm example.com/login/*;
nwaf_rfc_violation_lm *.example.com/login/index.php;

With the parameter nwaf_rfc_violation_lm example.com/login/*; the occurrence of the URL will be taken, for example, example.com/login/aaaa or example.com/login/bbbbb.

With the parameter nwaf_rfc_violation_lm example.com; monitoring mode will be performed for all URL for virtual host example.com.

With the parameter nwaf_rfc_violation_lm *; monitoring mode will be performed for all virtual hosts.

nwaf_put_body_exclude

A parameter that excludes the signature method from analyzing the contents of the BODY zone for PUT requests. This option is useful when interacting with ownCloud web applications or similar ones that allow the client to upload a file to the server over the HTTP protocol.

Example of using a single value:

nwaf_put_body_exclude *;

nwaf_put_body_exclude example.com;

nwaf_put_body_exclude *.example.com;

Example of using multiple values:

nwaf_put_body_exclude example.com, a.example.com;

nwaf_put_body_exclude example.com, *.example.com;

nwaf_post_body_exclude

A parameter that excludes the signature method from analyzing the contents of the BODY zone for POST requests. This option is useful when interacting with ownCloud web applications or similar ones that allow the client to upload a file to the server over the HTTP protocol.

Example of using a single value:

nwaf_post_body_exclude *;

nwaf_post_body_exclude example.com;

nwaf_post_body_exclude *.example.com;

Example of using multiple values:

nwaf_post_body_exclude example.com, a.example.com;

nwaf_post_body_exclude example.com, *.example.com;

nwaf_body_exclude

A parameter that excludes the analysis of the BODY zone by the signature method. This option is useful if it is not possible to change the value of the client_body_buffer_size parameter in the /etc/nginx/nginx.conf file.

Example:

nwaf_body_exclude *;

nwaf_body_exclude example.com/uploads.php;

nwaf_body_exclude example.com/uploads/*;

With the value example.com/uploads/* the occurrence of the URL will be taken, for example, example.com/uploads/aaaa or example.com/uploads/bbbbb.

If you need to use the * sign as a common character when writing a URL, then you need to escape it, for example, writing example.com/admin/uploads/abcd\\* will match example.com/admin/uploads/abcd*.

With the value *, the exclusion of the BODY zone analysis will be applied to any address.

nwaf_body_bin_exclude

A parameter that excludes the analysis by the signature method of the binary contents of the BODY zone. This option is useful if it is not possible to change the value of the client_body_buffer_size parameter in the /etc/nginx/nginx.conf file.

Example:

nwaf_body_exclude *;

nwaf_body_exclude example.com/uploads.php;

nwaf_body_exclude example.com/uploads/*;

With the value example.com/uploads/* the occurrence of the URL will be taken, for example, example.com/uploads/aaaa or example.com/uploads/bbbbb.

If you need to use the * sign as a common character when writing a URL, then you need to escape it, for example, writing example.com/admin/uploads/abcd\\* will match example.com/admin/uploads/abcd*.

With the value *, the exclusion of the BODY zone analysis will be applied to any address.

nwaf_rmq

Configuring the interaction subsystem with RabbitMQ.

nwaf_log_mr_all

Activation of the parameter for recording information about all occurrences of blocking rules (attack signatures) in the Nginx error log. By default, the parameter is deactivated (commented out). When the parameter is deactivated, only the signature that led to blocking the request or to fixing the signature without subsequent blocking is recorded in the Nginx error log (in the LM mode).

With the parameter nwaf_log_mr_all domain=example.com ; the recorded occurrences will be recorded only for a specific domain.
For the domain option, strict matching and wildcard values are allowed: example.com, .example.com and *.example.com.

nwaf_check_bot_name

This parameter is used to identify search engine robots. Blocked requests that fall under the action of the parameter do not increase the value of the rate counter and cannot lead to blocking of the IP address. The first parameter value is defined in the User-Agent zone. The second parameter value defines the host name obtained by reverse IP address conversion. If the second value is not set, it is considered equal to the first.

Example:

nwaf_check_bot_name "example.com" "example.net";

nwaf_check_bot_name "example.com";

nwaf_check_bot_name "bingbot" "msn.com";

nwaf_check_bot_name "yandex.ru";

ID

The unique identifier for the rule. A range from 50000 to 99999 is available for creating your own rules. Required.

domain

Set the ownership of the rule to the domain. For the domain option it is allowed to use a wildcard value.

P/PX

Option defining the entry pattern (option P is used to denote a simple entry, option PX is a regular expression). Required.

SC

Setting the rule tag (Injection, XSS, UWA, Scanner, Evasion, Other or another) and the numerical value indicator (score from 1 to 12). Required.

Requests that fall within the scope of the rules with an indicator value of 12 are blocked without being sent to other analysis subsystems. More information is available in the corresponding section. Summation of digital indicators for decision-making is performed in each separate zone by identical tags.

Z

Zone application of the rule. To apply a signature to all zones, use the empty "Z:" parameter. Required.

To apply a signature to multiple zones, use the delimiter "Z:URL|BODY".

To disable IP address blocking due to the occurrence of a signature that has score = 12, use the value NoBan in the rule area ("Z:NoBan"). Entering a signature with such a zone does not reduce the nwaf_limit counter, meaning it does not block the IP address.

To clarify the zone, you can use additional options. For "Z:ARGS|$URL:/templates" the rule will work only in the ARGS zone with /templates parameter in URL.

For signatures in zone area, you can use the NoAPI value to disable sending a message to the Nemesida WAF API that falls under the action of the created signature. For all triggers of this signature, the message will not be sent to the Nemesida WAF API, but it will be blocked and written to the log file. This value is only used for signatures that have score = 12. For signatures with a different score, this value is ignored.

RL ID:50001 "P:select from" "SC:SQL:12" "Z:ARGS|URL|BODY|NoAPI";

For zone area you can use the LM value, which activates the LM mode for a request that falls under the action of the created signature. Each request that falls under the signature will not be blocked, but a corresponding message will be sent to the Nemesida WAF API about it, which is also recorded in the log file. The LM value is only used for signatures that have score = 12. For signatures with a different score, this value is ignored.

RL ID:50002 "P:select from" "SC:SQL:12" "Z:ARGS|URL|BODY|LM";