search

SpiderLabs / owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
https://modsecurity.org/crs
Apache License 2.0
2.45k stars 727 forks source link

utils/upgrade.py not included in V3.2/master #1547

Closed erniewarren closed 5 years ago

erniewarren commented 5 years ago

Type of Issue

Bug fix - Missing file? From /etc/nginx/modsec/owasp-modsecurity-crs/INSTALL upgrade.py is still referenced...

Installing From Git

Github is the preferred way to download and install CRS. Doing so
insures that you have the most recent version of the rules. We
encourage you to create scripts that will automatically download
updates at regular intervals so that you may be protected against
the latest threats that CRS adds protection for.

The script util/upgrade.py is an example for script. You can use
it as follows:

```
./util/upgrade.py --crs

Include utils/upgrade.py in V3.2 Master

Description

owasp-modsecurity-crs utils/upgrade.py not included in V3.2/master. It is included in V3.0/master Has this been deprecated? Or is there another way now to update the CRS?

Your Environment

Listing of installed util directory /etc/nginx/modsec/owasp-modsecurity-crs/util

[root@ip-10-216-20-80 owasp-modsecurity-crs]# cd util [root@ip-10-216-20-80 util]# ls -al total 24 drwxr-xr-x 13 root root 319 Sep 11 07:40 . drwxr-xr-x 7 root root 283 Sep 11 07:42 .. drwxr-xr-x 3 root root 35 Sep 11 07:40 av-scanning drwxr-xr-x 2 root root 29 Sep 11 07:40 browser-tools drwxr-xr-x 2 root root 60 Sep 11 07:40 crs2-renumbering drwxr-xr-x 2 root root 4096 Sep 11 07:40 docker drwxr-xr-x 2 root root 20 Sep 11 07:40 geo-location drwxr-xr-x 2 root root 97 Sep 11 07:40 honeypot-sensor -rw-r--r-- 1 root root 30 Sep 11 07:40 id-range drwxr-xr-x 2 root root 53 Sep 11 07:40 integration drwxr-xr-x 2 root root 21 Sep 11 07:40 join-multiline-rules -rw-r--r-- 1 root root 341 Sep 11 07:40 README drwxr-xr-x 2 root root 4096 Sep 11 07:40 regexp-assemble drwxr-xr-x 4 root root 177 Sep 11 07:40 regression-tests -rw-r--r-- 1 root root 2884 Sep 11 07:40 send-payload-pls.sh -rwxr-xr-x 1 root root 3381 Sep 11 07:40 verify.rb drwxr-xr-x 2 root root 52 Sep 11 07:40 virtual-patching

no upgrade.py in the utils listing.

Confirmation

[ ] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

csanders-git commented 5 years ago

This was removed as 2.x CRS is not as common anymore

erniewarren commented 5 years ago

Is upgrade.py only used for 2.x CRS. Is there an equivalent for Version 3.x CRS for updating the rulesets. If so where is it located?

lifeforms commented 5 years ago

Thank you for bringing this documentation issue to our attention. I have fixed it.

The upgrade utility was retired since we no longer recommend to clone from Github (unless you want to develop on the CRS) but download the releases instead. To upgrade the CRS, you can simply delete your old rule files and download a new release from https://coreruleset.org/installation/ into the same directory.

erniewarren commented 5 years ago

Thanks very much for your clarification. You have answered my questions.

On Wed, 18 Sep 2019 01:02 Walter Hop notifications@github.com wrote:

Closed #1547 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1547.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1547?email_source=notifications&email_token=ANFMC7U7ASFEVYFN23N37NLQKDWQNA5CNFSM4IWBAYUKYY3PNVWWK3TUL52HS4DFWZEXG43VMVCXMZLOORHG65DJMZUWGYLUNFXW5KTDN5WW2ZLOORPWSZGOTVPPAXQ#event-2640244830, or mute the thread https://github.com/notifications/unsubscribe-auth/ANFMC7QJXID54VZN3NVZKMDQKDWQNANCNFSM4IWBAYUA .