Skip to content

fix(agent): remove ModSecurity, raise HTTP/2 and HTTP/3 upload buffers #423

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
runleveldev merged 1 commit into from
Jul 24, 2026
Merged

fix(agent): remove ModSecurity, raise HTTP/2 and HTTP/3 upload buffers #423

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions agent/.fpm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@
--depends nodejs
--depends nginx
--depends libnginx-mod-stream
--depends libnginx-mod-http-modsecurity
--depends modsecurity-crs
--depends ssl-cert
--depends dnsmasq
--deb-no-default-config-files
Expand Down
16 changes: 11 additions & 5 deletions agent/templates/nginx.conf.ejs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,17 @@ http {
proxy_cache_path /var/cache/nginx/auth_cache levels=1:2 keys_zone=auth_cache:1m
max_size=10m inactive=5m;

modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity_includes.conf;
modsecurity_transaction_id "$request_id";
<%_ /*
Upload throughput over HTTP/2 and HTTP/3. The small defaults (64k body
preread / h3 stream buffer, 256k per-worker h2 recv buffer) cap how much
request body a client may send before waiting on flow control, which
throttles large uploads through the proxy. The recv buffer is shared per
worker, so it is sized at several prereads to keep concurrent uploads
from starving each other.
*/ -%>
http2_body_preread_size 4m;
http2_recv_buffer_size 16m;
http3_stream_buffer_size 4m;

<%_ /* Modern TLS configuration */ -%>
ssl_protocols TLSv1.2 TLSv1.3;
Expand All @@ -68,15 +76,13 @@ http {
Internal error page server on a unix socket. Named locations proxy here
with proxy_method GET so that NGINX's static file module will serve the
HTML regardless of the original request method (POST, PUT, etc.).
ModSecurity is disabled to prevent re-evaluation of the original request.
*/ -%>
upstream error_pages {
server unix:/run/nginx-error-pages.sock;
}

server {
listen unix:/run/nginx-error-pages.sock;
modsecurity off;
ssi on;

root /opt/opensource-server/error-pages;
Expand Down
19 changes: 8 additions & 11 deletions error-pages/403.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>403 — Request Blocked</title>
<title>403 — Access Denied</title>
<style>
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

Expand Down Expand Up @@ -150,10 +150,9 @@
<body>
<div class="container">
<div class="status-code">403</div>
<h1>Request Blocked</h1>
<h1>Access Denied</h1>
<p>
Your request was blocked by the web application firewall (WAF).
The request matched an OWASP Core Rule Set security rule.
You do not have permission to access this resource.
</p>
<div class="request-id">
<div class="label">Request ID</div>
Expand All @@ -162,16 +161,14 @@ <h1>Request Blocked</h1>
<div class="info">
<strong>Think this is a mistake?</strong>
Provide the request ID above to your server administrator.
The specific rule that triggered the block can be found in the
server audit log using this ID.
The request can be traced in the server logs using this ID.
</div>
Comment on lines 161 to 165
<div class="examples">
<h2>Common triggers</h2>
<h2>Common causes</h2>
<ul>
<li>SQL-like syntax in query parameters or form data</li>
<li>HTML or script tags in user input</li>
<li>Unusual HTTP headers or request methods</li>
<li>Path traversal patterns in the URL</li>
<li>Your account is not authorized for this application</li>
<li>You are signed in with the wrong account or group</li>
<li>The resource restricts access by policy</li>
</ul>
</div>
</div>
Expand Down
20 changes: 2 additions & 18 deletions images/agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,30 +5,14 @@ FROM nodejs
# opensource-* packages automatically
COPY images/opensource-server.sources /etc/apt/sources.list.d/opensource-server.sources

# Install the agent package (and its dependencies: nginx with stream +
# ModSecurity modules, dnsmasq, ...) built by the builder image.
# Install the agent package (and its dependencies: nginx with the stream
# module, dnsmasq, ...) built by the builder image.
RUN --mount=from=builder,source=/dist,target=/dist \
apt-get update && \
apt-get install -y /dist/opensource-agent_*.deb && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*

# configure nginx ModSecurity defaults
RUN sed -i \
-e 's!^#\(include /usr/share/modsecurity-crs/owasp-crs.load\)$!\1!' \
/etc/nginx/modsecurity_includes.conf \
&& sed -i -e 's/IncludeOptional/Include/' /usr/share/modsecurity-crs/owasp-crs.load \
&& sed -i -e 's/^SecRuleEngine .*$/SecRuleEngine DetectionOnly/' /etc/nginx/modsecurity.conf

# Logrotate overrides for NGINX and ModSecurity to work around a logrotate
# repoen bug at https://github.com/owasp-modsecurity/ModSecurity-nginx/issues/351
COPY ./images/agent/nginx.logrotate /etc/logrotate.d/nginx

# Apply custom ModSecurity configurations. See the blame on that file for
# details on what's been changed from stock.
COPY ./images/agent/crs-setup.conf /etc/modsecurity/crs/crs-setup.conf
COPY ./images/agent/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

# Configure DNSMasq to only get its config from our agent
RUN sed -i \
-e 's/^CONFIG_DIR=\(.*\)$/#CONFIG_DIR=\1/' \
Expand Down
86 changes: 0 additions & 86 deletions images/agent/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
View file
Open in desktop

This file was deleted.

Loading
Loading