doc

seb4itik/byow/README.md

@@ -105,18 +105,19 @@ Fonctionnalités déjà implémentées:
 - Collecte des logs via OVH LDP
 - Whitelist
 - Static files et FastCGI pour PHP (NON, par design !)
+- Authorizations (NON, par design !)
 - Rate limit (non distribué)
 - CORS
 
 Urgemment:
 
 - Connexion à consul, ACL consul
-- Active backend checks
-- Faire fonctionner le filtre dict2str via la collection Ansible
 
 Fonctionnalités à ajouter:
 
+- option "api: true" for activating API default settings
 - Rate limiting distribué
+- Antivirus
 - Antibot par:
   - Cookie
   - Captcha
@@ -133,17 +134,24 @@ Fonctionnalités à ajouter:
   - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents)
 - Client cache
 - Proxy cache
+- Random WAF signatures
 - Compression Brotli
 - Reverse scan
 - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules)
 - Gestion des sessions
 - Bad behavior (via Caddy events ?)
 - Authentification
+  - cf. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+  - avec vérification force du mot de passe (cf. CdC Essor)
+  - avec test mot de passe moins un caractère
+  - avec test mot de passe comprommis
 - Anti DDoS
 - Greylist
+- HTML Sanitization
 - HTML injection
 - Metrics (Elasticsearch + Metabase)
 - Crowdsec
+- Stream support
 - Caddy as internal CA
 - https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list 
 
@@ -156,6 +164,18 @@ Fonctionnalités à ajouter:
 - [Documentation AWOSP CRS](https://coreruleset.org/docs/)
 - https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)
 
+- (1) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
+- (2) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
+
 
 ### Installation d'Ansible avec pipx
 

seb4itik/byow/roles/caddy/templates/coraza.conf

@@ -1,4 +1,5 @@
 # -- Rule engine initialization ----------------------------------------------
+# See: https://coraza.io/docs/seclang/directives/
 
 # Enable Coraza, attaching it to every transaction. Use detection
 # only to start with, because that minimises the chances of post-installation

seb4itik/byow/roles/caddy/vars/main.yml

@@ -278,7 +278,7 @@ caddy_global_sites_defaults:
 
   # steffenbusch/caddy-bot-barrier
   bot_barrier: false
-  bot_barrier_secret: null     # Required
+  bot_barrier_secret: null    # Required
   bot_barrier_complexity: 18
   bot_barrier_valid_for: "60m"