itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity

doc

Browse Source
This commit is contained in:
Sébastien NAMECHE
2026-02-05 09:54:03 +03:00
parent 943423143d
commit df6f913d95
3 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
seb4itik/byow/README.md
View File

@@ -105,18 +105,19 @@ Fonctionnalités déjà implémentées:
- Collecte des logs via OVH LDP - Collecte des logs via OVH LDP
- Whitelist - Whitelist
- Static files et FastCGI pour PHP (NON, par design !) - Static files et FastCGI pour PHP (NON, par design !)
- Authorizations (NON, par design !)
- Rate limit (non distribué) - Rate limit (non distribué)
- CORS - CORS
Urgemment: Urgemment:
- Connexion à consul, ACL consul - Connexion à consul, ACL consul
- Active backend checks
- Faire fonctionner le filtre dict2str via la collection Ansible
Fonctionnalités à ajouter: Fonctionnalités à ajouter:
- option "api: true" for activating API default settings
- Rate limiting distribué - Rate limiting distribué
- Antivirus
- Antibot par: - Antibot par:
- Cookie - Cookie
- Captcha - Captcha
@@ -133,17 +134,24 @@ Fonctionnalités à ajouter:
- (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents) - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents)
- Client cache - Client cache
- Proxy cache - Proxy cache
- Random WAF signatures
- Compression Brotli - Compression Brotli
- Reverse scan - Reverse scan
- Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules) - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules)
- Gestion des sessions - Gestion des sessions
- Bad behavior (via Caddy events ?) - Bad behavior (via Caddy events ?)
- Authentification - Authentification
- cf. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
- avec vérification force du mot de passe (cf. CdC Essor)
- avec test mot de passe moins un caractère
- avec test mot de passe comprommis
- Anti DDoS - Anti DDoS
- Greylist - Greylist
- HTML Sanitization
- HTML injection - HTML injection
- Metrics (Elasticsearch + Metabase) - Metrics (Elasticsearch + Metabase)
- Crowdsec - Crowdsec
- Stream support
- Caddy as internal CA - Caddy as internal CA
- https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list - https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list
@@ -156,6 +164,18 @@ Fonctionnalités à ajouter:
- [Documentation AWOSP CRS](https://coreruleset.org/docs/) - [Documentation AWOSP CRS](https://coreruleset.org/docs/)
- https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x) - https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)
- (1) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
- (2) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
### Installation d'Ansible avec pipx ### Installation d'Ansible avec pipx

1
seb4itik/byow/roles/caddy/templates/coraza.conf
View File

@@ -1,4 +1,5 @@
# -- Rule engine initialization ---------------------------------------------- # -- Rule engine initialization ----------------------------------------------
# See: https://coraza.io/docs/seclang/directives/
# Enable Coraza, attaching it to every transaction. Use detection # Enable Coraza, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation # only to start with, because that minimises the chances of post-installation