# ---------------------------------------------------------------
# Core ModSecurity Rule Set ver.1.6.1
# Copyright (C) 2006-2007 Breach Security Inc. All rights reserved.
#
# The ModSecuirty Core Rule Set is distributed under GPL version 2
# Please see the enclosed LICENCE file for full details.
# ---------------------------------------------------------------

# Configuration customized for DTC

SecRuleEngine On

# TODO If you decide to enable output filtering make sure to
#      review the list of scanned MIME types. If pages of the types specified 
#      for outbound inspection are smaller than 512K in you application
#      (which is usually the case) you may reduce the SecResponseBodyLimit 
#      to protect from potential denial of service attacks.
#
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType (null) text/html text/plain text/xml
SecResponseBodyLimit 524288


# Initiate XML Processor in case of xml content-type
#
# TODO Uncomment this rule if you wish to parse
#      text/xml requests using the XML parser.  Note 
#      that this may cause considerable overhead in processing 
#      text/xml requests.
#SecRule REQUEST_HEADERS:Content-Type "text/xml" \
#"phase:1,pass,nolog,ctl:requestBodyProcessor=XML"

SecDefaultAction "phase:2,log,deny,status:406,t:lowercase,t:replaceNulls,t:compressWhitespace"

# Let's not reveale who we are
SecServerSignature "Apache/2.x.x"
SecComponentSignature "core ruleset/1.6.1 dtc patched"
SecUploadDir /tmp
SecUploadKeepFiles Off

# Inspect uploaded files.
#
# TODO If there is a danger of attack through uploaded files then it
#      is possible to configure an external script to inspect each file
#      before it is seen by the application. An example script is
#      included with ModSecurity (/util/modsec-clamscan.pl).
#
#      Inspecting uploaded files is especially important in a hosting,  
#      community or blogging environments where uploading files is permitted. 
#
# NOTE the t:none action is required in order not to process the files names 
#      passed to the script based on previously defined actions in a 
#      SecDefaultAction directive.
#
# SecRule FILES_TMPNAMES "@inspectFile /opt/apache/bin/inspect_script.pl" \
#       "t:none"

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"

# Log files structure
#
# You can select to log all events to a single log file (set SecAuditLogType to 
# "Serial") or to log each request to a separate file (set it to "Concurrent"). 
# The former is usually easier to use, but if full logging is required or if 
# the protected system supports a large transaction volume the later may
# be a better option.
#
# TODO Set the SecAuditLog (for "Serial" logging) or SecAuditLogStorageDir (for
#      "Concurrent" logging).
#
# TODO If you change from "Serial" to "Concurrent" uncomment the 
#      SecAuditLogStorageDir directive and make sure the direcory specified 
#      exists and has write permissions for the Apache user. 

SecAuditLogType Serial
SecAuditLog /var/log/apache2/security.log
# SecAuditLogStorageDir logs/modsec_audit

SecAuditLogParts "ABIFHKZ"
# LogFormat "%V %h %t %{UNIQUE_ID}e \"%r\" %>s %X | %I %O | %<{mod_security-time1}n %<{mod_security-time2}n %<{mod_security-time3}n %D" mperformance
# CustomLog logs/modsec_performance.log mperformance
SecArgumentSeparator "&" 
SecCookieFormat 0
SecRequestBodyInMemoryLimit 131072
SecDebugLog             /var/log/apache2/modsec_debug.log
SecDebugLogLevel        1

# Path where persistent data (e.g. IP address data, session data, etc) is to
# be stored. Must be writable by the web server user.
#
# TODO It is advisable to create a directory structure for ModSecurity such as
#      /var/log/msa and create sub directories for SecDataDir, SecTmpDir,
#      SecUploadDir, SecAuditLog and SecAuditLogStorageDir
#      underneath it and set the permission for read and write only by the
#      Apache user.

SecDataDir /tmp

# Configures the directory where temporary files will be created.
SecTmpDir /tmp
