forked from bunkerity/bunkerweb
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix CVE-2021-20205 and examples update
- Loading branch information
1 parent
1a7abab
commit a98dae1
Showing
34 changed files
with
268 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
|
|
||
| mywww: | ||
| image: bunkerity/bunkerized-nginx | ||
| restart: always | ||
| ports: | ||
| - 80:8080 | ||
| - 443:8443 | ||
| volumes: | ||
| - ./drupal-files:/www:ro | ||
| - ./letsencrypt:/etc/letsencrypt | ||
| #- ./server-confs:/server-confs:ro # custom confs at server context for permalinks | ||
| - ./modsec-crs-confs:/modsec-crs-confs:ro # custom Core Rule Set confs to add Drupal exclusions | ||
| environment: | ||
| - SERVER_NAME=www.website.com # replace with your domain | ||
| - AUTO_LETS_ENCRYPT=yes | ||
| - REDIRECT_HTTP_TO_HTTPS=yes | ||
| - DISABLE_DEFAULT_SERVER=yes | ||
| - MAX_CLIENT_SIZE=50m | ||
| - USE_CLIENT_CACHE=yes | ||
| - USE_GZIP=yes | ||
| - USE_BROTLI=yes | ||
| - REMOTE_PHP=mydrupal | ||
| - REMOTE_PHP_PATH=/var/www/html | ||
|
|
||
| mydrupal: | ||
| image: drupal:fpm-alpine | ||
| restart: always | ||
| volumes: | ||
| - ./drupal-files:/var/www/html | ||
|
|
||
| mydb: | ||
| image: mariadb | ||
| restart: always | ||
| volumes: | ||
| - ./db-data:/var/lib/mysql | ||
| environment: | ||
| - MYSQL_ROOT_PASSWORD=db-root-pwd # replace with a stronger password | ||
| - MYSQL_DATABASE=drupaldb | ||
| - MYSQL_USER=user | ||
| - MYSQL_PASSWORD=db-user-pwd # replace with a stronger password |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| SecAction \ | ||
| "id:900130,\ | ||
| phase:1,\ | ||
| nolog,\ | ||
| pass,\ | ||
| t:none,\ | ||
| setvar:tx.crs_exclusions_drupal=1" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
|
|
||
| myreverse: | ||
| image: bunkerity/bunkerized-nginx | ||
| restart: always | ||
| ports: | ||
| - 80:8080 | ||
| - 443:8443 | ||
| volumes: | ||
| - ./letsencrypt:/etc/letsencrypt | ||
| #- ./modsec-crs-confs:/modsec-crs-confs:ro # fix FP with CRS | ||
| environment: | ||
| - SERVER_NAME=www.website.com # replace with your domain | ||
| - SERVE_FILES=no | ||
| - DISABLE_DEFAULT_SERVER=yes | ||
| - REDIRECT_HTTP_TO_HTTPS=yes | ||
| - AUTO_LETS_ENCRYPT=yes | ||
| - USE_PROXY_CACHE=yes | ||
| - USE_CLIENT_CACHE=yes | ||
| - USE_GZIP=yes | ||
| - USE_BROTLI=yes | ||
| - USE_REVERSE_PROXY=yes | ||
| - REVERSE_PROXY_URL=/ | ||
| - REVERSE_PROXY_HOST=http://myghost:2368/ | ||
|
|
||
| myghost: | ||
| image: ghost:alpine | ||
| volumes: | ||
| - ./data-ghost:/ | ||
| environment: | ||
| - url=https://www.website.com # replace with your domain |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| SecAction \ | ||
| "id:900220,\ | ||
| phase:1,\ | ||
| nolog,\ | ||
| pass,\ | ||
| t:none,\ | ||
| setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain| |application/x-git-upload-pack-request| |application/x-git-receive-pack-request|'" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
|
|
||
| myreverse: | ||
| image: bunkerity/bunkerized-nginx | ||
| restart: always | ||
| ports: | ||
| - 80:8080 | ||
| - 443:8443 | ||
| volumes: | ||
| - ./letsencrypt:/etc/letsencrypt | ||
| - ./modsec-crs-confs:/modsec-crs-confs:ro # fix FP with CRS | ||
| environment: | ||
| - SERVER_NAME=www.website.com # replace with your domain | ||
| - SERVE_FILES=no | ||
| - DISABLE_DEFAULT_SERVER=yes | ||
| - REDIRECT_HTTP_TO_HTTPS=yes | ||
| - AUTO_LETS_ENCRYPT=yes | ||
| - USE_PROXY_CACHE=yes | ||
| - USE_CLIENT_CACHE=yes | ||
| - USE_GZIP=yes | ||
| - USE_BROTLI=yes | ||
| - USE_REVERSE_PROXY=yes | ||
| - REVERSE_PROXY_URL=/ | ||
| - REVERSE_PROXY_HOST=http://mygogs:3000/ | ||
|
|
||
| mygogs: | ||
| image: gogs/gogs | ||
| volumes: | ||
| - ./data-gogs:/data |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| SecAction \ | ||
| "id:900220,\ | ||
| phase:1,\ | ||
| nolog,\ | ||
| pass,\ | ||
| t:none,\ | ||
| setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain| |application/x-git-upload-pack-request| |application/x-git-receive-pack-request|'" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
|
|
||
| mywww: | ||
| image: bunkerity/bunkerized-nginx | ||
| restart: always | ||
| ports: | ||
| - 80:8080 | ||
| - 443:8443 | ||
| volumes: | ||
| - ./joomla-files:/www:ro | ||
| - ./letsencrypt:/etc/letsencrypt | ||
| environment: | ||
| - SERVER_NAME=www.website.com # replace with your domain | ||
| - AUTO_LETS_ENCRYPT=yes | ||
| - REDIRECT_HTTP_TO_HTTPS=yes | ||
| - DISABLE_DEFAULT_SERVER=yes | ||
| - MAX_CLIENT_SIZE=50m | ||
| - USE_CLIENT_CACHE=yes | ||
| - USE_GZIP=yes | ||
| - USE_BROTLI=yes | ||
| - REMOTE_PHP=myjoomla | ||
| - REMOTE_PHP_PATH=/var/www/html | ||
|
|
||
| myjoomla: | ||
| image: joomla:fpm-alpine | ||
| restart: always | ||
| volumes: | ||
| - ./joomla-files:/var/www/html | ||
| environment: | ||
| - JOOMLA_DB_HOST=mydb | ||
| - JOOMLA_DB_NAME=joomladb | ||
| - JOOMLA_DB_USER=user | ||
| - JOOMLA_DB_PASSWORD=db-user-pwd # replace with a stronger password (must match MYSQL_PASSWORD) | ||
|
|
||
| mydb: | ||
| image: mariadb | ||
| restart: always | ||
| volumes: | ||
| - ./db-data:/var/lib/mysql | ||
| environment: | ||
| - MYSQL_ROOT_PASSWORD=db-root-pwd # replace with a stronger password | ||
| - MYSQL_DATABASE=joomladb | ||
| - MYSQL_USER=user | ||
| - MYSQL_PASSWORD=db-user-pwd # replace with a stronger password (must match JOOMLA_DB_PASSWORD) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 change: 1 addition & 0 deletions
1
examples/multisite-custom-server-confs/modsec-confs/nc.website.com/nextcloud.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,2 @@ | ||
| SecRuleRemoveById 921110 | ||
| SecRule REQUEST_FILENAME "@contains /remote.php/webdav" "id:1,ctl:ruleRemoveByTag=OWASP_CRS" |
3 changes: 3 additions & 0 deletions
3
examples/multisite-custom-server-confs/modsec-confs/wp.website.com/wordpress.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,4 @@ | ||
| SecRule REQUEST_FILENAME "/wp-admin/admin-ajax.php" "id:1,ctl:ruleRemoveByTag=attack-xss,ctl:ruleRemoveByTag=attack-rce" | ||
| SecRule REQUEST_FILENAME "/wp-admin/options.php" "id:2,ctl:ruleRemoveByTag=attack-xss" | ||
| SecRule REQUEST_FILENAME "^/wp-json/yoast" "id:3,ctl:ruleRemoveById=930120" | ||
| SecRuleRemoveById 953120 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,2 @@ | ||
| SecRuleRemoveById 921110 | ||
| SecRule REQUEST_FILENAME "@contains /remote.php/webdav" "id:1,ctl:ruleRemoveByTag=OWASP_CRS" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
|
|
||
| myreverse: | ||
| image: bunkerity/bunkerized-nginx | ||
| restart: always | ||
| ports: | ||
| - 80:8080 | ||
| - 443:8443 | ||
| volumes: | ||
| - ./letsencrypt:/etc/letsencrypt | ||
| environment: | ||
| - SERVER_NAME=www.website.com # replace with your domain | ||
| - SERVE_FILES=no | ||
| - DISABLE_DEFAULT_SERVER=yes | ||
| - REDIRECT_HTTP_TO_HTTPS=yes | ||
| - AUTO_LETS_ENCRYPT=yes | ||
| - USE_PROXY_CACHE=yes | ||
| - USE_CLIENT_CACHE=yes | ||
| - USE_GZIP=yes | ||
| - USE_BROTLI=yes | ||
| - USE_REVERSE_PROXY=yes | ||
| - REVERSE_PROXY_URL=/ | ||
| - REVERSE_PROXY_HOST=http://myredmine:3000/ | ||
|
|
||
| redmine: | ||
| image: redmine | ||
| restart: always | ||
| volumes: | ||
| - ./redmine-data:/usr/src/redmine/files | ||
| environment: | ||
| - REDMINE_DB_MYSQL=mydb | ||
| - REDMINE_DB_DATABASE=redminedb | ||
| - REDMINE_DB_USERNAME=user | ||
| - REDMINE_DB_PASSWORD=db-user-pwd # replace with a stronger password (must match MYSQL_PASSWORD) | ||
|
|
||
| mydb: | ||
| image: mariadb | ||
| restart: always | ||
| volumes: | ||
| - ./db-data:/var/lib/mysql | ||
| environment: | ||
| - MYSQL_ROOT_PASSWORD=db-root-pwd # replace with a stronger password | ||
| - MYSQL_DATABASE=redminedb | ||
| - MYSQL_USER=user | ||
| - MYSQL_PASSWORD=db-user-pwd # replace with a stronger password (must match REDMINE_DB_PASSWORD) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.