using ModSec 3 with nginx rev proxy

[danfbach]

I will preface this with saying that to my knowledge, this problem started after upgrading to AlmaLinux 8 and/or enabling the nginx reverse proxy.

Feeling that modsec 2 was not working, I followed the modsec 3 guide, found here: https://blog.cpanel.com/how-to-install-and-configure-modsecurity-in-cpanel/

I have two cpanel installations running on AlmaLinux 8, on current cpanel 110.0.5, both with modsec not functioning.

I've been using an obvious sql injection example to test. I can't put it here because your WAF catches it. lol

cpanel 1: I have a dotnet web application, nginx reverse proxies for - I can put the obvious sql injection into the search bar and it is processed by nginx and my webapp as normal. It is processed as a GET request, so this should be exceptionally easy to catch. Nothing in the hit list log on WHM.
I also have a hidden, legacy php application, also using nginx rev proxy, and it doesn't catch it either.

cpanel 2: I have a two newer php applications using nginx rev proxy. Nothing in the hit list log on WHM.

Before I "elevated" to AlmaLinux from CentOS7, i would routinely get notifications of ModSec violations, and the CSF would block the offending IP addresses, many times a day. Now, I get nothing.

I have tried switching from mod_ruid2 to mod_suexec, as this was mentioned as a possible workaround for similar issues, but doing so has not changed anything.

Is the nginx reverse proxy just not supported here? Or is there something else that I need to configure?

Thanks,
Dan

 

[cPRex]

Hey there! The first thing I would try would be switching back to ModSecurity 2 and seeing if that catches the test. If so, could you make a ticket with the exact test you're doing so we can file a case with our developers? ModSecurity 3 in cPanel is still Experimental, so it's completely possible there are issues.

 

[danfbach]

Hey cPRex,

The whole reason that I switched to ModSecurity 3 was because 2 wasn't catching anything either.
My Hit lists were empty and I was not getting any notifications, as I previously was.
This came up as I was reviewing /var/log/nginx/access_log one day on an unrelated matter and noticed TONS of obviously malicious requests. I blocked the IP address (and about 10 more they used thereafter) but ModSecurity should have easily caught them...this was not a sophisticated attack.
I will try reverting one of my servers to version 2, just to be thorough and let you know the results...

 

[cPRex]

That's interesting - if anything, we've had more people report the opposite issue, where hits increased after the proxy setup: https://support.cpanel.net/hc/en-us...in-ModSecurity-hits-after-installing-ea-nginx

 

[danfbach]

Okay. So, I reverted to ModSecurity2, first leaving mod_suexec enabled. Works.
Then I switched to mod_ruid2. Also working.
So, it's working on the reverse proxy for the dotnet app and php apps, as I expected it would.

I am wondering if when I elevated the servers to Alma, the elevate script just didn't reinstall `ea-modsec2-rules-owasp-crs-3.3.4-1.1.6.cpanel`...unfortunately, I have no way of determining if that is the case or not, since i upgraded them several months ago now. Anyway, thanks for the suggestions, glad it's working again now. Already have several hundred entries in the hit lists lol

 

[cPRex]

I'm also glad it's working! If you run into something similar again and keep track of the steps, I'd be happy to check it out on my end.