search

coreruleset / dos-protection-plugin-modsecurity

Anti-automation rules plugin to detect denial of service attacks
Apache License 2.0
4 stars 2 forks source link

Collection timeout is missing #1

Open theseion opened 2 years ago

theseion commented 2 years ago

I think the following setting is missing from the plugin:

#
# -- [[ Collection timeout ]] --------------------------------------------------
#
# Set the SecCollectionTimeout directive from the ModSecurity default (1 hour)
# to a lower setting which is appropriate to most sites.
# This increases performance by cleaning out stale collection (block) entries.
#
# This value should be greater than or equal to:
# tx.reput_block_duration (see section "Blocking Based on IP Reputation") and
# tx.dos_block_timeout (see section "Anti-Automation / DoS Protection").
#
# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecCollectionTimeout

# Please keep this directive uncommented.
# Default: 600 (10 minutes)
SecCollectionTimeout 600
RedXanadu commented 2 years ago

@theseion Well spotted. I intentionally left this out as it is a directive that affects the whole ModSecurity install. I'm not sure how best to approach that, but I think it is potentially dangerous to have it quietly defined in a plugin file.

@dune73 What do you think about this in relation to plugin config files, generally? I was feeling conservative and didn't think that defining SecCollectionTimeout in a plugin file was a good idea, but maybe I'm being too cautious :)